28 files changed, 4348 insertions, 0 deletions

diff --git a/vendor/github.com/hashicorp/terraform/states/doc.go b/vendor/github.com/hashicorp/terraform/states/doc.go
new file mode 100644
index 0000000..7dd74ac
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/doc.go
@@ -0,0 +1,3 @@
+// Package states contains the types that are used to represent Terraform
+// states.
+package states
diff --git a/vendor/github.com/hashicorp/terraform/states/eachmode_string.go b/vendor/github.com/hashicorp/terraform/states/eachmode_string.go
new file mode 100644
index 0000000..0dc7349
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/eachmode_string.go
@@ -0,0 +1,35 @@
+// Code generated by "stringer -type EachMode"; DO NOT EDIT.
+
+package states
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[NoEach-0]
+        _ = x[EachList-76]
+        _ = x[EachMap-77]
+}
+
+const (
+        _EachMode_name_0 = "NoEach"
+        _EachMode_name_1 = "EachListEachMap"
+)
+
+var (
+        _EachMode_index_1 = [...]uint8{0, 8, 15}
+)
+
+func (i EachMode) String() string {
+        switch {
+        case i == 0:
+                return _EachMode_name_0
+        case 76 <= i && i <= 77:
+                i -= 76
+                return _EachMode_name_1[_EachMode_index_1[i]:_EachMode_index_1[i+1]]
+        default:
+                return "EachMode(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/instance_generation.go b/vendor/github.com/hashicorp/terraform/states/instance_generation.go
new file mode 100644
index 0000000..617ad4e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/instance_generation.go
@@ -0,0 +1,24 @@
+package states
+
+// Generation is used to represent multiple objects in a succession of objects
+// represented by a single resource instance address. A resource instance can
+// have multiple generations over its lifetime due to object replacement
+// (when a change can't be applied without destroying and re-creating), and
+// multiple generations can exist at the same time when create_before_destroy
+// is used.
+//
+// A Generation value can either be the value of the variable "CurrentGen" or
+// a value of type DeposedKey. Generation values can be compared for equality
+// using "==" and used as map keys. The zero value of Generation (nil) is not
+// a valid generation and must not be used.
+type Generation interface {
+        generation()
+}
+
+// CurrentGen is the Generation representing the currently-active object for
+// a resource instance.
+var CurrentGen Generation
+
+type currentGen struct{}
+
+func (g currentGen) generation() {}
diff --git a/vendor/github.com/hashicorp/terraform/states/instance_object.go b/vendor/github.com/hashicorp/terraform/states/instance_object.go
new file mode 100644
index 0000000..1374c59
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/instance_object.go
@@ -0,0 +1,120 @@
+package states
+
+import (
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// ResourceInstanceObject is the local representation of a specific remote
+// object associated with a resource instance. In practice not all remote
+// objects are actually remote in the sense of being accessed over the network,
+// but this is the most common case.
+//
+// It is not valid to mutate a ResourceInstanceObject once it has been created.
+// Instead, create a new object and replace the existing one.
+type ResourceInstanceObject struct {
+        // Value is the object-typed value representing the remote object within
+        // Terraform.
+        Value cty.Value
+
+        // Private is an opaque value set by the provider when this object was
+        // last created or updated. Terraform Core does not use this value in
+        // any way and it is not exposed anywhere in the user interface, so
+        // a provider can use it for retaining any necessary private state.
+        Private []byte
+
+        // Status represents the "readiness" of the object as of the last time
+        // it was updated.
+        Status ObjectStatus
+
+        // Dependencies is a set of other addresses in the same module which
+        // this instance depended on when the given attributes were evaluated.
+        // This is used to construct the dependency relationships for an object
+        // whose configuration is no longer available, such as if it has been
+        // removed from configuration altogether, or is now deposed.
+        Dependencies []addrs.Referenceable
+}
+
+// ObjectStatus represents the status of a RemoteObject.
+type ObjectStatus rune
+
+//go:generate stringer -type ObjectStatus
+
+const (
+        // ObjectReady is an object status for an object that is ready to use.
+        ObjectReady ObjectStatus = 'R'
+
+        // ObjectTainted is an object status representing an object that is in
+        // an unrecoverable bad state due to a partial failure during a create,
+        // update, or delete operation. Since it cannot be moved into the
+        // ObjectRead state, a tainted object must be replaced.
+        ObjectTainted ObjectStatus = 'T'
+
+        // ObjectPlanned is a special object status used only for the transient
+        // placeholder objects we place into state during the refresh and plan
+        // walks to stand in for objects that will be created during apply.
+        //
+        // Any object of this status must have a corresponding change recorded
+        // in the current plan, whose value must then be used in preference to
+        // the value stored in state when evaluating expressions. A planned
+        // object stored in state will be incomplete if any of its attributes are
+        // not yet known, and the plan must be consulted in order to "see" those
+        // unknown values, because the state is not able to represent them.
+        ObjectPlanned ObjectStatus = 'P'
+)
+
+// Encode marshals the value within the receiver to produce a
+// ResourceInstanceObjectSrc ready to be written to a state file.
+//
+// The given type must be the implied type of the resource type schema, and
+// the given value must conform to it. It is important to pass the schema
+// type and not the object's own type so that dynamically-typed attributes
+// will be stored correctly. The caller must also provide the version number
+// of the schema that the given type was derived from, which will be recorded
+// in the source object so it can be used to detect when schema migration is
+// required on read.
+//
+// The returned object may share internal references with the receiver and
+// so the caller must not mutate the receiver any further once once this
+// method is called.
+func (o *ResourceInstanceObject) Encode(ty cty.Type, schemaVersion uint64) (*ResourceInstanceObjectSrc, error) {
+        // Our state serialization can't represent unknown values, so we convert
+        // them to nulls here. This is lossy, but nobody should be writing unknown
+        // values here and expecting to get them out again later.
+        //
+        // We get unknown values here while we're building out a "planned state"
+        // during the plan phase, but the value stored in the plan takes precedence
+        // for expression evaluation. The apply step should never produce unknown
+        // values, but if it does it's the responsibility of the caller to detect
+        // and raise an error about that.
+        val := cty.UnknownAsNull(o.Value)
+
+        src, err := ctyjson.Marshal(val, ty)
+        if err != nil {
+                return nil, err
+        }
+
+        return &ResourceInstanceObjectSrc{
+                SchemaVersion: schemaVersion,
+                AttrsJSON:     src,
+                Private:       o.Private,
+                Status:        o.Status,
+                Dependencies:  o.Dependencies,
+        }, nil
+}
+
+// AsTainted returns a deep copy of the receiver with the status updated to
+// ObjectTainted.
+func (o *ResourceInstanceObject) AsTainted() *ResourceInstanceObject {
+        if o == nil {
+                // A nil object can't be tainted, but we'll allow this anyway to
+                // avoid a crash, since we presumably intend to eventually record
+                // the object has having been deleted anyway.
+                return nil
+        }
+        ret := o.DeepCopy()
+        ret.Status = ObjectTainted
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/instance_object_src.go b/vendor/github.com/hashicorp/terraform/states/instance_object_src.go
new file mode 100644
index 0000000..6cb3c27
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/instance_object_src.go
@@ -0,0 +1,113 @@
+package states
+
+import (
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+)
+
+// ResourceInstanceObjectSrc is a not-fully-decoded version of
+// ResourceInstanceObject. Decoding of it can be completed by first handling
+// any schema migration steps to get to the latest schema version and then
+// calling method Decode with the implied type of the latest schema.
+type ResourceInstanceObjectSrc struct {
+        // SchemaVersion is the resource-type-specific schema version number that
+        // was current when either AttrsJSON or AttrsFlat was encoded. Migration
+        // steps are required if this is less than the current version number
+        // reported by the corresponding provider.
+        SchemaVersion uint64
+
+        // AttrsJSON is a JSON-encoded representation of the object attributes,
+        // encoding the value (of the object type implied by the associated resource
+        // type schema) that represents this remote object in Terraform Language
+        // expressions, and is compared with configuration when producing a diff.
+        //
+        // This is retained in JSON format here because it may require preprocessing
+        // before decoding if, for example, the stored attributes are for an older
+        // schema version which the provider must upgrade before use. If the
+        // version is current, it is valid to simply decode this using the
+        // type implied by the current schema, without the need for the provider
+        // to perform an upgrade first.
+        //
+        // When writing a ResourceInstanceObject into the state, AttrsJSON should
+        // always be conformant to the current schema version and the current
+        // schema version should be recorded in the SchemaVersion field.
+        AttrsJSON []byte
+
+        // AttrsFlat is a legacy form of attributes used in older state file
+        // formats, and in the new state format for objects that haven't yet been
+        // upgraded. This attribute is mutually exclusive with Attrs: for any
+        // ResourceInstanceObject, only one of these attributes may be populated
+        // and the other must be nil.
+        //
+        // An instance object with this field populated should be upgraded to use
+        // Attrs at the earliest opportunity, since this legacy flatmap-based
+        // format will be phased out over time. AttrsFlat should not be used when
+        // writing new or updated objects to state; instead, callers must follow
+        // the recommendations in the AttrsJSON documentation above.
+        AttrsFlat map[string]string
+
+        // These fields all correspond to the fields of the same name on
+        // ResourceInstanceObject.
+        Private      []byte
+        Status       ObjectStatus
+        Dependencies []addrs.Referenceable
+}
+
+// Decode unmarshals the raw representation of the object attributes. Pass the
+// implied type of the corresponding resource type schema for correct operation.
+//
+// Before calling Decode, the caller must check that the SchemaVersion field
+// exactly equals the version number of the schema whose implied type is being
+// passed, or else the result is undefined.
+//
+// The returned object may share internal references with the receiver and
+// so the caller must not mutate the receiver any further once once this
+// method is called.
+func (os *ResourceInstanceObjectSrc) Decode(ty cty.Type) (*ResourceInstanceObject, error) {
+        var val cty.Value
+        var err error
+        if os.AttrsFlat != nil {
+                // Legacy mode. We'll do our best to unpick this from the flatmap.
+                val, err = hcl2shim.HCL2ValueFromFlatmap(os.AttrsFlat, ty)
+                if err != nil {
+                        return nil, err
+                }
+        } else {
+                val, err = ctyjson.Unmarshal(os.AttrsJSON, ty)
+                if err != nil {
+                        return nil, err
+                }
+        }
+
+        return &ResourceInstanceObject{
+                Value:        val,
+                Status:       os.Status,
+                Dependencies: os.Dependencies,
+                Private:      os.Private,
+        }, nil
+}
+
+// CompleteUpgrade creates a new ResourceInstanceObjectSrc by copying the
+// metadata from the receiver and writing in the given new schema version
+// and attribute value that are presumed to have resulted from upgrading
+// from an older schema version.
+func (os *ResourceInstanceObjectSrc) CompleteUpgrade(newAttrs cty.Value, newType cty.Type, newSchemaVersion uint64) (*ResourceInstanceObjectSrc, error) {
+        new := os.DeepCopy()
+        new.AttrsFlat = nil // We always use JSON after an upgrade, even if the source used flatmap
+
+        // This is the same principle as ResourceInstanceObject.Encode, but
+        // avoiding a decode/re-encode cycle because we don't have type info
+        // available for the "old" attributes.
+        newAttrs = cty.UnknownAsNull(newAttrs)
+        src, err := ctyjson.Marshal(newAttrs, newType)
+        if err != nil {
+                return nil, err
+        }
+
+        new.AttrsJSON = src
+        new.SchemaVersion = newSchemaVersion
+        return new, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/module.go b/vendor/github.com/hashicorp/terraform/states/module.go
new file mode 100644
index 0000000..d89e787
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/module.go
@@ -0,0 +1,285 @@
+package states
+
+import (
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Module is a container for the states of objects within a particular module.
+type Module struct {
+        Addr addrs.ModuleInstance
+
+        // Resources contains the state for each resource. The keys in this map are
+        // an implementation detail and must not be used by outside callers.
+        Resources map[string]*Resource
+
+        // OutputValues contains the state for each output value. The keys in this
+        // map are output value names.
+        OutputValues map[string]*OutputValue
+
+        // LocalValues contains the value for each named output value. The keys
+        // in this map are local value names.
+        LocalValues map[string]cty.Value
+}
+
+// NewModule constructs an empty module state for the given module address.
+func NewModule(addr addrs.ModuleInstance) *Module {
+        return &Module{
+                Addr:         addr,
+                Resources:    map[string]*Resource{},
+                OutputValues: map[string]*OutputValue{},
+                LocalValues:  map[string]cty.Value{},
+        }
+}
+
+// Resource returns the state for the resource with the given address within
+// the receiving module state, or nil if the requested resource is not tracked
+// in the state.
+func (ms *Module) Resource(addr addrs.Resource) *Resource {
+        return ms.Resources[addr.String()]
+}
+
+// ResourceInstance returns the state for the resource instance with the given
+// address within the receiving module state, or nil if the requested instance
+// is not tracked in the state.
+func (ms *Module) ResourceInstance(addr addrs.ResourceInstance) *ResourceInstance {
+        rs := ms.Resource(addr.Resource)
+        if rs == nil {
+                return nil
+        }
+        return rs.Instance(addr.Key)
+}
+
+// SetResourceMeta updates the resource-level metadata for the resource
+// with the given address, creating the resource state for it if it doesn't
+// already exist.
+func (ms *Module) SetResourceMeta(addr addrs.Resource, eachMode EachMode, provider addrs.AbsProviderConfig) {
+        rs := ms.Resource(addr)
+        if rs == nil {
+                rs = &Resource{
+                        Addr:      addr,
+                        Instances: map[addrs.InstanceKey]*ResourceInstance{},
+                }
+                ms.Resources[addr.String()] = rs
+        }
+
+        rs.EachMode = eachMode
+        rs.ProviderConfig = provider
+}
+
+// RemoveResource removes the entire state for the given resource, taking with
+// it any instances associated with the resource. This should generally be
+// called only for resource objects whose instances have all been destroyed.
+func (ms *Module) RemoveResource(addr addrs.Resource) {
+        delete(ms.Resources, addr.String())
+}
+
+// SetResourceInstanceCurrent saves the given instance object as the current
+// generation of the resource instance with the given address, simulataneously
+// updating the recorded provider configuration address, dependencies, and
+// resource EachMode.
+//
+// Any existing current instance object for the given resource is overwritten.
+// Set obj to nil to remove the primary generation object altogether. If there
+// are no deposed objects then the instance will be removed altogether.
+//
+// The provider address and "each mode" are resource-wide settings and so they
+// are updated for all other instances of the same resource as a side-effect of
+// this call.
+func (ms *Module) SetResourceInstanceCurrent(addr addrs.ResourceInstance, obj *ResourceInstanceObjectSrc, provider addrs.AbsProviderConfig) {
+        ms.SetResourceMeta(addr.Resource, eachModeForInstanceKey(addr.Key), provider)
+
+        rs := ms.Resource(addr.Resource)
+        is := rs.EnsureInstance(addr.Key)
+
+        is.Current = obj
+
+        if !is.HasObjects() {
+                // If we have no objects at all then we'll clean up.
+                delete(rs.Instances, addr.Key)
+        }
+        if rs.EachMode == NoEach && len(rs.Instances) == 0 {
+                // Also clean up if we only expect to have one instance anyway
+                // and there are none. We leave the resource behind if an each mode
+                // is active because an empty list or map of instances is a valid state.
+                delete(ms.Resources, addr.Resource.String())
+        }
+}
+
+// SetResourceInstanceDeposed saves the given instance object as a deposed
+// generation of the resource instance with the given address and deposed key.
+//
+// Call this method only for pre-existing deposed objects that already have
+// a known DeposedKey. For example, this method is useful if reloading objects
+// that were persisted to a state file. To mark the current object as deposed,
+// use DeposeResourceInstanceObject instead.
+//
+// The resource that contains the given instance must already exist in the
+// state, or this method will panic. Use Resource to check first if its
+// presence is not already guaranteed.
+//
+// Any existing current instance object for the given resource and deposed key
+// is overwritten. Set obj to nil to remove the deposed object altogether. If
+// the instance is left with no objects after this operation then it will
+// be removed from its containing resource altogether.
+func (ms *Module) SetResourceInstanceDeposed(addr addrs.ResourceInstance, key DeposedKey, obj *ResourceInstanceObjectSrc, provider addrs.AbsProviderConfig) {
+        ms.SetResourceMeta(addr.Resource, eachModeForInstanceKey(addr.Key), provider)
+
+        rs := ms.Resource(addr.Resource)
+        is := rs.EnsureInstance(addr.Key)
+        if obj != nil {
+                is.Deposed[key] = obj
+        } else {
+                delete(is.Deposed, key)
+        }
+
+        if !is.HasObjects() {
+                // If we have no objects at all then we'll clean up.
+                delete(rs.Instances, addr.Key)
+        }
+        if rs.EachMode == NoEach && len(rs.Instances) == 0 {
+                // Also clean up if we only expect to have one instance anyway
+                // and there are none. We leave the resource behind if an each mode
+                // is active because an empty list or map of instances is a valid state.
+                delete(ms.Resources, addr.Resource.String())
+        }
+}
+
+// ForgetResourceInstanceAll removes the record of all objects associated with
+// the specified resource instance, if present. If not present, this is a no-op.
+func (ms *Module) ForgetResourceInstanceAll(addr addrs.ResourceInstance) {
+        rs := ms.Resource(addr.Resource)
+        if rs == nil {
+                return
+        }
+        delete(rs.Instances, addr.Key)
+
+        if rs.EachMode == NoEach && len(rs.Instances) == 0 {
+                // Also clean up if we only expect to have one instance anyway
+                // and there are none. We leave the resource behind if an each mode
+                // is active because an empty list or map of instances is a valid state.
+                delete(ms.Resources, addr.Resource.String())
+        }
+}
+
+// ForgetResourceInstanceDeposed removes the record of the deposed object with
+// the given address and key, if present. If not present, this is a no-op.
+func (ms *Module) ForgetResourceInstanceDeposed(addr addrs.ResourceInstance, key DeposedKey) {
+        rs := ms.Resource(addr.Resource)
+        if rs == nil {
+                return
+        }
+        is := rs.Instance(addr.Key)
+        if is == nil {
+                return
+        }
+        delete(is.Deposed, key)
+
+        if !is.HasObjects() {
+                // If we have no objects at all then we'll clean up.
+                delete(rs.Instances, addr.Key)
+        }
+        if rs.EachMode == NoEach && len(rs.Instances) == 0 {
+                // Also clean up if we only expect to have one instance anyway
+                // and there are none. We leave the resource behind if an each mode
+                // is active because an empty list or map of instances is a valid state.
+                delete(ms.Resources, addr.Resource.String())
+        }
+}
+
+// deposeResourceInstanceObject is the real implementation of
+// SyncState.DeposeResourceInstanceObject.
+func (ms *Module) deposeResourceInstanceObject(addr addrs.ResourceInstance, forceKey DeposedKey) DeposedKey {
+        is := ms.ResourceInstance(addr)
+        if is == nil {
+                return NotDeposed
+        }
+        return is.deposeCurrentObject(forceKey)
+}
+
+// maybeRestoreResourceInstanceDeposed is the real implementation of
+// SyncState.MaybeRestoreResourceInstanceDeposed.
+func (ms *Module) maybeRestoreResourceInstanceDeposed(addr addrs.ResourceInstance, key DeposedKey) bool {
+        rs := ms.Resource(addr.Resource)
+        if rs == nil {
+                return false
+        }
+        is := rs.Instance(addr.Key)
+        if is == nil {
+                return false
+        }
+        if is.Current != nil {
+                return false
+        }
+        if len(is.Deposed) == 0 {
+                return false
+        }
+        is.Current = is.Deposed[key]
+        delete(is.Deposed, key)
+        return true
+}
+
+// SetOutputValue writes an output value into the state, overwriting any
+// existing value of the same name.
+func (ms *Module) SetOutputValue(name string, value cty.Value, sensitive bool) *OutputValue {
+        os := &OutputValue{
+                Value:     value,
+                Sensitive: sensitive,
+        }
+        ms.OutputValues[name] = os
+        return os
+}
+
+// RemoveOutputValue removes the output value of the given name from the state,
+// if it exists. This method is a no-op if there is no value of the given
+// name.
+func (ms *Module) RemoveOutputValue(name string) {
+        delete(ms.OutputValues, name)
+}
+
+// SetLocalValue writes a local value into the state, overwriting any
+// existing value of the same name.
+func (ms *Module) SetLocalValue(name string, value cty.Value) {
+        ms.LocalValues[name] = value
+}
+
+// RemoveLocalValue removes the local value of the given name from the state,
+// if it exists. This method is a no-op if there is no value of the given
+// name.
+func (ms *Module) RemoveLocalValue(name string) {
+        delete(ms.LocalValues, name)
+}
+
+// PruneResourceHusks is a specialized method that will remove any Resource
+// objects that do not contain any instances, even if they have an EachMode.
+//
+// You probably shouldn't call this! See the method of the same name on
+// type State for more information on what this is for and the rare situations
+// where it is safe to use.
+func (ms *Module) PruneResourceHusks() {
+        for _, rs := range ms.Resources {
+                if len(rs.Instances) == 0 {
+                        ms.RemoveResource(rs.Addr)
+                }
+        }
+}
+
+// empty returns true if the receving module state is contributing nothing
+// to the state. In other words, it returns true if the module could be
+// removed from the state altogether without changing the meaning of the state.
+//
+// In practice a module containing no objects is the same as a non-existent
+// module, and so we can opportunistically clean up once a module becomes
+// empty on the assumption that it will be re-added if needed later.
+func (ms *Module) empty() bool {
+        if ms == nil {
+                return true
+        }
+
+        // This must be updated to cover any new collections added to Module
+        // in future.
+        return (len(ms.Resources) == 0 &&
+                len(ms.OutputValues) == 0 &&
+                len(ms.LocalValues) == 0)
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/objectstatus_string.go b/vendor/github.com/hashicorp/terraform/states/objectstatus_string.go
new file mode 100644
index 0000000..96a6db2
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/objectstatus_string.go
@@ -0,0 +1,33 @@
+// Code generated by "stringer -type ObjectStatus"; DO NOT EDIT.
+
+package states
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[ObjectReady-82]
+        _ = x[ObjectTainted-84]
+        _ = x[ObjectPlanned-80]
+}
+
+const (
+        _ObjectStatus_name_0 = "ObjectPlanned"
+        _ObjectStatus_name_1 = "ObjectReady"
+        _ObjectStatus_name_2 = "ObjectTainted"
+)
+
+func (i ObjectStatus) String() string {
+        switch {
+        case i == 80:
+                return _ObjectStatus_name_0
+        case i == 82:
+                return _ObjectStatus_name_1
+        case i == 84:
+                return _ObjectStatus_name_2
+        default:
+                return "ObjectStatus(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/output_value.go b/vendor/github.com/hashicorp/terraform/states/output_value.go
new file mode 100644
index 0000000..d232b76
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/output_value.go
@@ -0,0 +1,14 @@
+package states
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// OutputValue represents the state of a particular output value.
+//
+// It is not valid to mutate an OutputValue object once it has been created.
+// Instead, create an entirely new OutputValue to replace the previous one.
+type OutputValue struct {
+        Value     cty.Value
+        Sensitive bool
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/resource.go b/vendor/github.com/hashicorp/terraform/states/resource.go
new file mode 100644
index 0000000..e2a2b85
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/resource.go
@@ -0,0 +1,239 @@
+package states
+
+import (
+        "fmt"
+        "math/rand"
+        "time"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Resource represents the state of a resource.
+type Resource struct {
+        // Addr is the module-relative address for the resource this state object
+        // belongs to.
+        Addr addrs.Resource
+
+        // EachMode is the multi-instance mode currently in use for this resource,
+        // or NoEach if this is a single-instance resource. This dictates what
+        // type of value is returned when accessing this resource via expressions
+        // in the Terraform language.
+        EachMode EachMode
+
+        // Instances contains the potentially-multiple instances associated with
+        // this resource. This map can contain a mixture of different key types,
+        // but only the ones of InstanceKeyType are considered current.
+        Instances map[addrs.InstanceKey]*ResourceInstance
+
+        // ProviderConfig is the absolute address for the provider configuration that
+        // most recently managed this resource. This is used to connect a resource
+        // with a provider configuration when the resource configuration block is
+        // not available, such as if it has been removed from configuration
+        // altogether.
+        ProviderConfig addrs.AbsProviderConfig
+}
+
+// Instance returns the state for the instance with the given key, or nil
+// if no such instance is tracked within the state.
+func (rs *Resource) Instance(key addrs.InstanceKey) *ResourceInstance {
+        return rs.Instances[key]
+}
+
+// EnsureInstance returns the state for the instance with the given key,
+// creating a new empty state for it if one doesn't already exist.
+//
+// Because this may create and save a new state, it is considered to be
+// a write operation.
+func (rs *Resource) EnsureInstance(key addrs.InstanceKey) *ResourceInstance {
+        ret := rs.Instance(key)
+        if ret == nil {
+                ret = NewResourceInstance()
+                rs.Instances[key] = ret
+        }
+        return ret
+}
+
+// ResourceInstance represents the state of a particular instance of a resource.
+type ResourceInstance struct {
+        // Current, if non-nil, is the remote object that is currently represented
+        // by the corresponding resource instance.
+        Current *ResourceInstanceObjectSrc
+
+        // Deposed, if len > 0, contains any remote objects that were previously
+        // represented by the corresponding resource instance but have been
+        // replaced and are pending destruction due to the create_before_destroy
+        // lifecycle mode.
+        Deposed map[DeposedKey]*ResourceInstanceObjectSrc
+}
+
+// NewResourceInstance constructs and returns a new ResourceInstance, ready to
+// use.
+func NewResourceInstance() *ResourceInstance {
+        return &ResourceInstance{
+                Deposed: map[DeposedKey]*ResourceInstanceObjectSrc{},
+        }
+}
+
+// HasCurrent returns true if this resource instance has a "current"-generation
+// object. Most instances do, but this can briefly be false during a
+// create-before-destroy replace operation when the current has been deposed
+// but its replacement has not yet been created.
+func (i *ResourceInstance) HasCurrent() bool {
+        return i != nil && i.Current != nil
+}
+
+// HasDeposed returns true if this resource instance has a deposed object
+// with the given key.
+func (i *ResourceInstance) HasDeposed(key DeposedKey) bool {
+        return i != nil && i.Deposed[key] != nil
+}
+
+// HasAnyDeposed returns true if this resource instance has one or more
+// deposed objects.
+func (i *ResourceInstance) HasAnyDeposed() bool {
+        return i != nil && len(i.Deposed) > 0
+}
+
+// HasObjects returns true if this resource has any objects at all, whether
+// current or deposed.
+func (i *ResourceInstance) HasObjects() bool {
+        return i.Current != nil || len(i.Deposed) != 0
+}
+
+// deposeCurrentObject is part of the real implementation of
+// SyncState.DeposeResourceInstanceObject. The exported method uses a lock
+// to ensure that we can safely allocate an unused deposed key without
+// collision.
+func (i *ResourceInstance) deposeCurrentObject(forceKey DeposedKey) DeposedKey {
+        if !i.HasCurrent() {
+                return NotDeposed
+        }
+
+        key := forceKey
+        if key == NotDeposed {
+                key = i.findUnusedDeposedKey()
+        } else {
+                if _, exists := i.Deposed[key]; exists {
+                        panic(fmt.Sprintf("forced key %s is already in use", forceKey))
+                }
+        }
+        i.Deposed[key] = i.Current
+        i.Current = nil
+        return key
+}
+
+// GetGeneration retrieves the object of the given generation from the
+// ResourceInstance, or returns nil if there is no such object.
+//
+// If the given generation is nil or invalid, this method will panic.
+func (i *ResourceInstance) GetGeneration(gen Generation) *ResourceInstanceObjectSrc {
+        if gen == CurrentGen {
+                return i.Current
+        }
+        if dk, ok := gen.(DeposedKey); ok {
+                return i.Deposed[dk]
+        }
+        if gen == nil {
+                panic(fmt.Sprintf("get with nil Generation"))
+        }
+        // Should never fall out here, since the above covers all possible
+        // Generation values.
+        panic(fmt.Sprintf("get invalid Generation %#v", gen))
+}
+
+// FindUnusedDeposedKey generates a unique DeposedKey that is guaranteed not to
+// already be in use for this instance at the time of the call.
+//
+// Note that the validity of this result may change if new deposed keys are
+// allocated before it is used. To avoid this risk, instead use the
+// DeposeResourceInstanceObject method on the SyncState wrapper type, which
+// allocates a key and uses it atomically.
+func (i *ResourceInstance) FindUnusedDeposedKey() DeposedKey {
+        return i.findUnusedDeposedKey()
+}
+
+// findUnusedDeposedKey generates a unique DeposedKey that is guaranteed not to
+// already be in use for this instance.
+func (i *ResourceInstance) findUnusedDeposedKey() DeposedKey {
+        for {
+                key := NewDeposedKey()
+                if _, exists := i.Deposed[key]; !exists {
+                        return key
+                }
+                // Spin until we find a unique one. This shouldn't take long, because
+                // we have a 32-bit keyspace and there's rarely more than one deposed
+                // instance.
+        }
+}
+
+// EachMode specifies the multi-instance mode for a resource.
+type EachMode rune
+
+const (
+        NoEach   EachMode = 0
+        EachList EachMode = 'L'
+        EachMap  EachMode = 'M'
+)
+
+//go:generate stringer -type EachMode
+
+func eachModeForInstanceKey(key addrs.InstanceKey) EachMode {
+        switch key.(type) {
+        case addrs.IntKey:
+                return EachList
+        case addrs.StringKey:
+                return EachMap
+        default:
+                if key == addrs.NoKey {
+                        return NoEach
+                }
+                panic(fmt.Sprintf("don't know an each mode for instance key %#v", key))
+        }
+}
+
+// DeposedKey is a 8-character hex string used to uniquely identify deposed
+// instance objects in the state.
+type DeposedKey string
+
+// NotDeposed is a special invalid value of DeposedKey that is used to represent
+// the absense of a deposed key. It must not be used as an actual deposed key.
+const NotDeposed = DeposedKey("")
+
+var deposedKeyRand = rand.New(rand.NewSource(time.Now().UnixNano()))
+
+// NewDeposedKey generates a pseudo-random deposed key. Because of the short
+// length of these keys, uniqueness is not a natural consequence and so the
+// caller should test to see if the generated key is already in use and generate
+// another if so, until a unique key is found.
+func NewDeposedKey() DeposedKey {
+        v := deposedKeyRand.Uint32()
+        return DeposedKey(fmt.Sprintf("%08x", v))
+}
+
+func (k DeposedKey) String() string {
+        return string(k)
+}
+
+func (k DeposedKey) GoString() string {
+        ks := string(k)
+        switch {
+        case ks == "":
+                return "states.NotDeposed"
+        default:
+                return fmt.Sprintf("states.DeposedKey(%s)", ks)
+        }
+}
+
+// Generation is a helper method to convert a DeposedKey into a Generation.
+// If the reciever is anything other than NotDeposed then the result is
+// just the same value as a Generation. If the receiver is NotDeposed then
+// the result is CurrentGen.
+func (k DeposedKey) Generation() Generation {
+        if k == NotDeposed {
+                return CurrentGen
+        }
+        return k
+}
+
+// generation is an implementation of Generation.
+func (k DeposedKey) generation() {}
diff --git a/vendor/github.com/hashicorp/terraform/states/state.go b/vendor/github.com/hashicorp/terraform/states/state.go
new file mode 100644
index 0000000..1f84235
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/state.go
@@ -0,0 +1,229 @@
+package states
+
+import (
+        "sort"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// State is the top-level type of a Terraform state.
+//
+// A state should be mutated only via its accessor methods, to ensure that
+// invariants are preserved.
+//
+// Access to State and the nested values within it is not concurrency-safe,
+// so when accessing a State object concurrently it is the caller's
+// responsibility to ensure that only one write is in progress at a time
+// and that reads only occur when no write is in progress. The most common
+// way to acheive this is to wrap the State in a SyncState and use the
+// higher-level atomic operations supported by that type.
+type State struct {
+        // Modules contains the state for each module. The keys in this map are
+        // an implementation detail and must not be used by outside callers.
+        Modules map[string]*Module
+}
+
+// NewState constructs a minimal empty state, containing an empty root module.
+func NewState() *State {
+        modules := map[string]*Module{}
+        modules[addrs.RootModuleInstance.String()] = NewModule(addrs.RootModuleInstance)
+        return &State{
+                Modules: modules,
+        }
+}
+
+// BuildState is a helper -- primarily intended for tests -- to build a state
+// using imperative code against the StateSync type while still acting as
+// an expression of type *State to assign into a containing struct.
+func BuildState(cb func(*SyncState)) *State {
+        s := NewState()
+        cb(s.SyncWrapper())
+        return s
+}
+
+// Empty returns true if there are no resources or populated output values
+// in the receiver. In other words, if this state could be safely replaced
+// with the return value of NewState and be functionally equivalent.
+func (s *State) Empty() bool {
+        if s == nil {
+                return true
+        }
+        for _, ms := range s.Modules {
+                if len(ms.Resources) != 0 {
+                        return false
+                }
+                if len(ms.OutputValues) != 0 {
+                        return false
+                }
+        }
+        return true
+}
+
+// Module returns the state for the module with the given address, or nil if
+// the requested module is not tracked in the state.
+func (s *State) Module(addr addrs.ModuleInstance) *Module {
+        if s == nil {
+                panic("State.Module on nil *State")
+        }
+        return s.Modules[addr.String()]
+}
+
+// RemoveModule removes the module with the given address from the state,
+// unless it is the root module. The root module cannot be deleted, and so
+// this method will panic if that is attempted.
+//
+// Removing a module implicitly discards all of the resources, outputs and
+// local values within it, and so this should usually be done only for empty
+// modules. For callers accessing the state through a SyncState wrapper, modules
+// are automatically pruned if they are empty after one of their contained
+// elements is removed.
+func (s *State) RemoveModule(addr addrs.ModuleInstance) {
+        if addr.IsRoot() {
+                panic("attempted to remove root module")
+        }
+
+        delete(s.Modules, addr.String())
+}
+
+// RootModule is a convenient alias for Module(addrs.RootModuleInstance).
+func (s *State) RootModule() *Module {
+        if s == nil {
+                panic("RootModule called on nil State")
+        }
+        return s.Modules[addrs.RootModuleInstance.String()]
+}
+
+// EnsureModule returns the state for the module with the given address,
+// creating and adding a new one if necessary.
+//
+// Since this might modify the state to add a new instance, it is considered
+// to be a write operation.
+func (s *State) EnsureModule(addr addrs.ModuleInstance) *Module {
+        ms := s.Module(addr)
+        if ms == nil {
+                ms = NewModule(addr)
+                s.Modules[addr.String()] = ms
+        }
+        return ms
+}
+
+// HasResources returns true if there is at least one resource (of any mode)
+// present in the receiving state.
+func (s *State) HasResources() bool {
+        if s == nil {
+                return false
+        }
+        for _, ms := range s.Modules {
+                if len(ms.Resources) > 0 {
+                        return true
+                }
+        }
+        return false
+}
+
+// Resource returns the state for the resource with the given address, or nil
+// if no such resource is tracked in the state.
+func (s *State) Resource(addr addrs.AbsResource) *Resource {
+        ms := s.Module(addr.Module)
+        if ms == nil {
+                return nil
+        }
+        return ms.Resource(addr.Resource)
+}
+
+// ResourceInstance returns the state for the resource instance with the given
+// address, or nil if no such resource is tracked in the state.
+func (s *State) ResourceInstance(addr addrs.AbsResourceInstance) *ResourceInstance {
+        if s == nil {
+                panic("State.ResourceInstance on nil *State")
+        }
+        ms := s.Module(addr.Module)
+        if ms == nil {
+                return nil
+        }
+        return ms.ResourceInstance(addr.Resource)
+}
+
+// OutputValue returns the state for the output value with the given address,
+// or nil if no such output value is tracked in the state.
+func (s *State) OutputValue(addr addrs.AbsOutputValue) *OutputValue {
+        ms := s.Module(addr.Module)
+        if ms == nil {
+                return nil
+        }
+        return ms.OutputValues[addr.OutputValue.Name]
+}
+
+// LocalValue returns the value of the named local value with the given address,
+// or cty.NilVal if no such value is tracked in the state.
+func (s *State) LocalValue(addr addrs.AbsLocalValue) cty.Value {
+        ms := s.Module(addr.Module)
+        if ms == nil {
+                return cty.NilVal
+        }
+        return ms.LocalValues[addr.LocalValue.Name]
+}
+
+// ProviderAddrs returns a list of all of the provider configuration addresses
+// referenced throughout the receiving state.
+//
+// The result is de-duplicated so that each distinct address appears only once.
+func (s *State) ProviderAddrs() []addrs.AbsProviderConfig {
+        if s == nil {
+                return nil
+        }
+
+        m := map[string]addrs.AbsProviderConfig{}
+        for _, ms := range s.Modules {
+                for _, rc := range ms.Resources {
+                        m[rc.ProviderConfig.String()] = rc.ProviderConfig
+                }
+        }
+        if len(m) == 0 {
+                return nil
+        }
+
+        // This is mainly just so we'll get stable results for testing purposes.
+        keys := make([]string, 0, len(m))
+        for k := range m {
+                keys = append(keys, k)
+        }
+        sort.Strings(keys)
+
+        ret := make([]addrs.AbsProviderConfig, len(keys))
+        for i, key := range keys {
+                ret[i] = m[key]
+        }
+
+        return ret
+}
+
+// PruneResourceHusks is a specialized method that will remove any Resource
+// objects that do not contain any instances, even if they have an EachMode.
+//
+// This should generally be used only after a "terraform destroy" operation,
+// to finalize the cleanup of the state. It is not correct to use this after
+// other operations because if a resource has "count = 0" or "for_each" over
+// an empty collection then we want to retain it in the state so that references
+// to it, particularly in "strange" contexts like "terraform console", can be
+// properly resolved.
+//
+// This method MUST NOT be called concurrently with other readers and writers
+// of the receiving state.
+func (s *State) PruneResourceHusks() {
+        for _, m := range s.Modules {
+                m.PruneResourceHusks()
+                if len(m.Resources) == 0 && !m.Addr.IsRoot() {
+                        s.RemoveModule(m.Addr)
+                }
+        }
+}
+
+// SyncWrapper returns a SyncState object wrapping the receiver.
+func (s *State) SyncWrapper() *SyncState {
+        return &SyncState{
+                state: s,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/state_deepcopy.go b/vendor/github.com/hashicorp/terraform/states/state_deepcopy.go
new file mode 100644
index 0000000..ea717d0
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/state_deepcopy.go
@@ -0,0 +1,218 @@
+package states
+
+import (
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Taking deep copies of states is an important operation because state is
+// otherwise a mutable data structure that is challenging to share across
+// many separate callers. It is important that the DeepCopy implementations
+// in this file comprehensively copy all parts of the state data structure
+// that could be mutated via pointers.
+
+// DeepCopy returns a new state that contains equivalent data to the reciever
+// but shares no backing memory in common.
+//
+// As with all methods on State, this method is not safe to use concurrently
+// with writing to any portion of the recieving data structure. It is the
+// caller's responsibility to ensure mutual exclusion for the duration of the
+// operation, but may then freely modify the receiver and the returned copy
+// independently once this method returns.
+func (s *State) DeepCopy() *State {
+        if s == nil {
+                return nil
+        }
+
+        modules := make(map[string]*Module, len(s.Modules))
+        for k, m := range s.Modules {
+                modules[k] = m.DeepCopy()
+        }
+        return &State{
+                Modules: modules,
+        }
+}
+
+// DeepCopy returns a new module state that contains equivalent data to the
+// receiver but shares no backing memory in common.
+//
+// As with all methods on Module, this method is not safe to use concurrently
+// with writing to any portion of the recieving data structure. It is the
+// caller's responsibility to ensure mutual exclusion for the duration of the
+// operation, but may then freely modify the receiver and the returned copy
+// independently once this method returns.
+func (ms *Module) DeepCopy() *Module {
+        if ms == nil {
+                return nil
+        }
+
+        resources := make(map[string]*Resource, len(ms.Resources))
+        for k, r := range ms.Resources {
+                resources[k] = r.DeepCopy()
+        }
+        outputValues := make(map[string]*OutputValue, len(ms.OutputValues))
+        for k, v := range ms.OutputValues {
+                outputValues[k] = v.DeepCopy()
+        }
+        localValues := make(map[string]cty.Value, len(ms.LocalValues))
+        for k, v := range ms.LocalValues {
+                // cty.Value is immutable, so we don't need to copy these.
+                localValues[k] = v
+        }
+
+        return &Module{
+                Addr:         ms.Addr, // technically mutable, but immutable by convention
+                Resources:    resources,
+                OutputValues: outputValues,
+                LocalValues:  localValues,
+        }
+}
+
+// DeepCopy returns a new resource state that contains equivalent data to the
+// receiver but shares no backing memory in common.
+//
+// As with all methods on Resource, this method is not safe to use concurrently
+// with writing to any portion of the recieving data structure. It is the
+// caller's responsibility to ensure mutual exclusion for the duration of the
+// operation, but may then freely modify the receiver and the returned copy
+// independently once this method returns.
+func (rs *Resource) DeepCopy() *Resource {
+        if rs == nil {
+                return nil
+        }
+
+        instances := make(map[addrs.InstanceKey]*ResourceInstance, len(rs.Instances))
+        for k, i := range rs.Instances {
+                instances[k] = i.DeepCopy()
+        }
+
+        return &Resource{
+                Addr:           rs.Addr,
+                EachMode:       rs.EachMode,
+                Instances:      instances,
+                ProviderConfig: rs.ProviderConfig, // technically mutable, but immutable by convention
+        }
+}
+
+// DeepCopy returns a new resource instance state that contains equivalent data
+// to the receiver but shares no backing memory in common.
+//
+// As with all methods on ResourceInstance, this method is not safe to use
+// concurrently with writing to any portion of the recieving data structure. It
+// is the caller's responsibility to ensure mutual exclusion for the duration
+// of the operation, but may then freely modify the receiver and the returned
+// copy independently once this method returns.
+func (is *ResourceInstance) DeepCopy() *ResourceInstance {
+        if is == nil {
+                return nil
+        }
+
+        deposed := make(map[DeposedKey]*ResourceInstanceObjectSrc, len(is.Deposed))
+        for k, obj := range is.Deposed {
+                deposed[k] = obj.DeepCopy()
+        }
+
+        return &ResourceInstance{
+                Current: is.Current.DeepCopy(),
+                Deposed: deposed,
+        }
+}
+
+// DeepCopy returns a new resource instance object that contains equivalent data
+// to the receiver but shares no backing memory in common.
+//
+// As with all methods on ResourceInstanceObjectSrc, this method is not safe to
+// use concurrently with writing to any portion of the recieving data structure.
+// It is the caller's responsibility to ensure mutual exclusion for the duration
+// of the operation, but may then freely modify the receiver and the returned
+// copy independently once this method returns.
+func (obj *ResourceInstanceObjectSrc) DeepCopy() *ResourceInstanceObjectSrc {
+        if obj == nil {
+                return nil
+        }
+
+        var attrsFlat map[string]string
+        if obj.AttrsFlat != nil {
+                attrsFlat = make(map[string]string, len(obj.AttrsFlat))
+                for k, v := range obj.AttrsFlat {
+                        attrsFlat[k] = v
+                }
+        }
+
+        var attrsJSON []byte
+        if obj.AttrsJSON != nil {
+                attrsJSON = make([]byte, len(obj.AttrsJSON))
+                copy(attrsJSON, obj.AttrsJSON)
+        }
+
+        var private []byte
+        if obj.Private != nil {
+                private := make([]byte, len(obj.Private))
+                copy(private, obj.Private)
+        }
+
+        // Some addrs.Referencable implementations are technically mutable, but
+        // we treat them as immutable by convention and so we don't deep-copy here.
+        dependencies := make([]addrs.Referenceable, len(obj.Dependencies))
+        copy(dependencies, obj.Dependencies)
+
+        return &ResourceInstanceObjectSrc{
+                Status:        obj.Status,
+                SchemaVersion: obj.SchemaVersion,
+                Private:       private,
+                AttrsFlat:     attrsFlat,
+                AttrsJSON:     attrsJSON,
+                Dependencies:  dependencies,
+        }
+}
+
+// DeepCopy returns a new resource instance object that contains equivalent data
+// to the receiver but shares no backing memory in common.
+//
+// As with all methods on ResourceInstanceObject, this method is not safe to use
+// concurrently with writing to any portion of the recieving data structure. It
+// is the caller's responsibility to ensure mutual exclusion for the duration
+// of the operation, but may then freely modify the receiver and the returned
+// copy independently once this method returns.
+func (obj *ResourceInstanceObject) DeepCopy() *ResourceInstanceObject {
+        if obj == nil {
+                return nil
+        }
+
+        var private []byte
+        if obj.Private != nil {
+                private := make([]byte, len(obj.Private))
+                copy(private, obj.Private)
+        }
+
+        // Some addrs.Referencable implementations are technically mutable, but
+        // we treat them as immutable by convention and so we don't deep-copy here.
+        dependencies := make([]addrs.Referenceable, len(obj.Dependencies))
+        copy(dependencies, obj.Dependencies)
+
+        return &ResourceInstanceObject{
+                Value:        obj.Value,
+                Status:       obj.Status,
+                Private:      private,
+                Dependencies: dependencies,
+        }
+}
+
+// DeepCopy returns a new output value state that contains equivalent data
+// to the receiver but shares no backing memory in common.
+//
+// As with all methods on OutputValue, this method is not safe to use
+// concurrently with writing to any portion of the recieving data structure. It
+// is the caller's responsibility to ensure mutual exclusion for the duration
+// of the operation, but may then freely modify the receiver and the returned
+// copy independently once this method returns.
+func (os *OutputValue) DeepCopy() *OutputValue {
+        if os == nil {
+                return nil
+        }
+
+        return &OutputValue{
+                Value:     os.Value,
+                Sensitive: os.Sensitive,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/state_equal.go b/vendor/github.com/hashicorp/terraform/states/state_equal.go
new file mode 100644
index 0000000..ea20967
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/state_equal.go
@@ -0,0 +1,18 @@
+package states
+
+import (
+        "reflect"
+)
+
+// Equal returns true if the receiver is functionally equivalent to other,
+// including any ephemeral portions of the state that would not be included
+// if the state were saved to files.
+//
+// To test only the persistent portions of two states for equality, instead
+// use statefile.StatesMarshalEqual.
+func (s *State) Equal(other *State) bool {
+        // For the moment this is sufficient, but we may need to do something
+        // more elaborate in future if we have any portions of state that require
+        // more sophisticated comparisons.
+        return reflect.DeepEqual(s, other)
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/state_string.go b/vendor/github.com/hashicorp/terraform/states/state_string.go
new file mode 100644
index 0000000..bca4581
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/state_string.go
@@ -0,0 +1,279 @@
+package states
+
+import (
+        "bufio"
+        "bytes"
+        "encoding/json"
+        "fmt"
+        "sort"
+        "strings"
+
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+)
+
+// String returns a rather-odd string representation of the entire state.
+//
+// This is intended to match the behavior of the older terraform.State.String
+// method that is used in lots of existing tests. It should not be used in
+// new tests: instead, use "cmp" to directly compare the state data structures
+// and print out a diff if they do not match.
+//
+// This method should never be used in non-test code, whether directly by call
+// or indirectly via a %s or %q verb in package fmt.
+func (s *State) String() string {
+        if s == nil {
+                return "<nil>"
+        }
+
+        // sort the modules by name for consistent output
+        modules := make([]string, 0, len(s.Modules))
+        for m := range s.Modules {
+                modules = append(modules, m)
+        }
+        sort.Strings(modules)
+
+        var buf bytes.Buffer
+        for _, name := range modules {
+                m := s.Modules[name]
+                mStr := m.testString()
+
+                // If we're the root module, we just write the output directly.
+                if m.Addr.IsRoot() {
+                        buf.WriteString(mStr + "\n")
+                        continue
+                }
+
+                // We need to build out a string that resembles the not-quite-standard
+                // format that terraform.State.String used to use, where there's a
+                // "module." prefix but then just a chain of all of the module names
+                // without any further "module." portions.
+                buf.WriteString("module")
+                for _, step := range m.Addr {
+                        buf.WriteByte('.')
+                        buf.WriteString(step.Name)
+                        if step.InstanceKey != addrs.NoKey {
+                                buf.WriteByte('[')
+                                buf.WriteString(step.InstanceKey.String())
+                                buf.WriteByte(']')
+                        }
+                }
+                buf.WriteString(":\n")
+
+                s := bufio.NewScanner(strings.NewReader(mStr))
+                for s.Scan() {
+                        text := s.Text()
+                        if text != "" {
+                                text = "  " + text
+                        }
+
+                        buf.WriteString(fmt.Sprintf("%s\n", text))
+                }
+        }
+
+        return strings.TrimSpace(buf.String())
+}
+
+// testString is used to produce part of the output of State.String. It should
+// never be used directly.
+func (m *Module) testString() string {
+        var buf bytes.Buffer
+
+        if len(m.Resources) == 0 {
+                buf.WriteString("<no state>")
+        }
+
+        // We use AbsResourceInstance here, even though everything belongs to
+        // the same module, just because we have a sorting behavior defined
+        // for those but not for just ResourceInstance.
+        addrsOrder := make([]addrs.AbsResourceInstance, 0, len(m.Resources))
+        for _, rs := range m.Resources {
+                for ik := range rs.Instances {
+                        addrsOrder = append(addrsOrder, rs.Addr.Instance(ik).Absolute(addrs.RootModuleInstance))
+                }
+        }
+
+        sort.Slice(addrsOrder, func(i, j int) bool {
+                return addrsOrder[i].Less(addrsOrder[j])
+        })
+
+        for _, fakeAbsAddr := range addrsOrder {
+                addr := fakeAbsAddr.Resource
+                rs := m.Resource(addr.ContainingResource())
+                is := m.ResourceInstance(addr)
+
+                // Here we need to fake up a legacy-style address as the old state
+                // types would've used, since that's what our tests against those
+                // old types expect. The significant difference is that instancekey
+                // is dot-separated rather than using index brackets.
+                k := addr.ContainingResource().String()
+                if addr.Key != addrs.NoKey {
+                        switch tk := addr.Key.(type) {
+                        case addrs.IntKey:
+                                k = fmt.Sprintf("%s.%d", k, tk)
+                        default:
+                                // No other key types existed for the legacy types, so we
+                                // can do whatever we want here. We'll just use our standard
+                                // syntax for these.
+                                k = k + tk.String()
+                        }
+                }
+
+                id := LegacyInstanceObjectID(is.Current)
+
+                taintStr := ""
+                if is.Current != nil && is.Current.Status == ObjectTainted {
+                        taintStr = " (tainted)"
+                }
+
+                deposedStr := ""
+                if len(is.Deposed) > 0 {
+                        deposedStr = fmt.Sprintf(" (%d deposed)", len(is.Deposed))
+                }
+
+                buf.WriteString(fmt.Sprintf("%s:%s%s\n", k, taintStr, deposedStr))
+                buf.WriteString(fmt.Sprintf("  ID = %s\n", id))
+                buf.WriteString(fmt.Sprintf("  provider = %s\n", rs.ProviderConfig.String()))
+
+                // Attributes were a flatmap before, but are not anymore. To preserve
+                // our old output as closely as possible we need to do a conversion
+                // to flatmap. Normally we'd want to do this with schema for
+                // accuracy, but for our purposes here it only needs to be approximate.
+                // This should produce an identical result for most cases, though
+                // in particular will differ in a few cases:
+                //  - The keys used for elements in a set will be different
+                //  - Values for attributes of type cty.DynamicPseudoType will be
+                //    misinterpreted (but these weren't possible in old world anyway)
+                var attributes map[string]string
+                if obj := is.Current; obj != nil {
+                        switch {
+                        case obj.AttrsFlat != nil:
+                                // Easy (but increasingly unlikely) case: the state hasn't
+                                // actually been upgraded to the new form yet.
+                                attributes = obj.AttrsFlat
+                        case obj.AttrsJSON != nil:
+                                ty, err := ctyjson.ImpliedType(obj.AttrsJSON)
+                                if err == nil {
+                                        val, err := ctyjson.Unmarshal(obj.AttrsJSON, ty)
+                                        if err == nil {
+                                                attributes = hcl2shim.FlatmapValueFromHCL2(val)
+                                        }
+                                }
+                        }
+                }
+                attrKeys := make([]string, 0, len(attributes))
+                for ak, val := range attributes {
+                        if ak == "id" {
+                                continue
+                        }
+
+                        // don't show empty containers in the output
+                        if val == "0" && (strings.HasSuffix(ak, ".#") || strings.HasSuffix(ak, ".%")) {
+                                continue
+                        }
+
+                        attrKeys = append(attrKeys, ak)
+                }
+
+                sort.Strings(attrKeys)
+
+                for _, ak := range attrKeys {
+                        av := attributes[ak]
+                        buf.WriteString(fmt.Sprintf("  %s = %s\n", ak, av))
+                }
+
+                // CAUTION: Since deposed keys are now random strings instead of
+                // incrementing integers, this result will not be deterministic
+                // if there is more than one deposed object.
+                i := 1
+                for _, t := range is.Deposed {
+                        id := LegacyInstanceObjectID(t)
+                        taintStr := ""
+                        if t.Status == ObjectTainted {
+                                taintStr = " (tainted)"
+                        }
+                        buf.WriteString(fmt.Sprintf("  Deposed ID %d = %s%s\n", i, id, taintStr))
+                        i++
+                }
+
+                if obj := is.Current; obj != nil && len(obj.Dependencies) > 0 {
+                        buf.WriteString(fmt.Sprintf("\n  Dependencies:\n"))
+                        for _, dep := range obj.Dependencies {
+                                buf.WriteString(fmt.Sprintf("    %s\n", dep.String()))
+                        }
+                }
+        }
+
+        if len(m.OutputValues) > 0 {
+                buf.WriteString("\nOutputs:\n\n")
+
+                ks := make([]string, 0, len(m.OutputValues))
+                for k := range m.OutputValues {
+                        ks = append(ks, k)
+                }
+                sort.Strings(ks)
+
+                for _, k := range ks {
+                        v := m.OutputValues[k]
+                        lv := hcl2shim.ConfigValueFromHCL2(v.Value)
+                        switch vTyped := lv.(type) {
+                        case string:
+                                buf.WriteString(fmt.Sprintf("%s = %s\n", k, vTyped))
+                        case []interface{}:
+                                buf.WriteString(fmt.Sprintf("%s = %s\n", k, vTyped))
+                        case map[string]interface{}:
+                                var mapKeys []string
+                                for key := range vTyped {
+                                        mapKeys = append(mapKeys, key)
+                                }
+                                sort.Strings(mapKeys)
+
+                                var mapBuf bytes.Buffer
+                                mapBuf.WriteString("{")
+                                for _, key := range mapKeys {
+                                        mapBuf.WriteString(fmt.Sprintf("%s:%s ", key, vTyped[key]))
+                                }
+                                mapBuf.WriteString("}")
+
+                                buf.WriteString(fmt.Sprintf("%s = %s\n", k, mapBuf.String()))
+                        default:
+                                buf.WriteString(fmt.Sprintf("%s = %#v\n", k, lv))
+                        }
+                }
+        }
+
+        return buf.String()
+}
+
+// LegacyInstanceObjectID is a helper for extracting an object id value from
+// an instance object in a way that approximates how we used to do this
+// for the old state types. ID is no longer first-class, so this is preserved
+// only for compatibility with old tests that include the id as part of their
+// expected value.
+func LegacyInstanceObjectID(obj *ResourceInstanceObjectSrc) string {
+        if obj == nil {
+                return "<not created>"
+        }
+
+        if obj.AttrsJSON != nil {
+                type WithID struct {
+                        ID string `json:"id"`
+                }
+                var withID WithID
+                err := json.Unmarshal(obj.AttrsJSON, &withID)
+                if err == nil {
+                        return withID.ID
+                }
+        } else if obj.AttrsFlat != nil {
+                if flatID, exists := obj.AttrsFlat["id"]; exists {
+                        return flatID
+                }
+        }
+
+        // For resource types created after we removed id as special there may
+        // not actually be one at all. This is okay because older tests won't
+        // encounter this, and new tests shouldn't be using ids.
+        return "<none>"
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/diagnostics.go b/vendor/github.com/hashicorp/terraform/states/statefile/diagnostics.go
new file mode 100644
index 0000000..a6d88ec
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/diagnostics.go
@@ -0,0 +1,62 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+const invalidFormat = "Invalid state file format"
+
+// jsonUnmarshalDiags is a helper that translates errors returned from
+// json.Unmarshal into hopefully-more-helpful diagnostics messages.
+func jsonUnmarshalDiags(err error) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+        if err == nil {
+                return diags
+        }
+
+        switch tErr := err.(type) {
+        case *json.SyntaxError:
+                // We've usually already successfully parsed a source file as JSON at
+                // least once before we'd use jsonUnmarshalDiags with it (to sniff
+                // the version number) so this particular error should not appear much
+                // in practice.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        invalidFormat,
+                        fmt.Sprintf("The state file could not be parsed as JSON: syntax error at byte offset %d.", tErr.Offset),
+                ))
+        case *json.UnmarshalTypeError:
+                // This is likely to be the most common area, describing a
+                // non-conformance between the file and the expected file format
+                // at a semantic level.
+                if tErr.Field != "" {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                invalidFormat,
+                                fmt.Sprintf("The state file field %q has invalid value %s", tErr.Field, tErr.Value),
+                        ))
+                        break
+                } else {
+                        // Without a field name, we can't really say anything helpful.
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                invalidFormat,
+                                "The state file does not conform to the expected JSON data structure.",
+                        ))
+                }
+        default:
+                // Fallback for all other types of errors. This can happen only for
+                // custom UnmarshalJSON implementations, so should be encountered
+                // only rarely.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        invalidFormat,
+                        fmt.Sprintf("The state file does not conform to the expected JSON data structure: %s.", err.Error()),
+                ))
+        }
+
+        return diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/doc.go b/vendor/github.com/hashicorp/terraform/states/statefile/doc.go
new file mode 100644
index 0000000..625d0cf
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/doc.go
@@ -0,0 +1,3 @@
+// Package statefile deals with the file format used to serialize states for
+// persistent storage and then deserialize them into memory again later.
+package statefile
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/file.go b/vendor/github.com/hashicorp/terraform/states/statefile/file.go
new file mode 100644
index 0000000..6e20240
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/file.go
@@ -0,0 +1,62 @@
+package statefile
+
+import (
+        version "github.com/hashicorp/go-version"
+
+        "github.com/hashicorp/terraform/states"
+        tfversion "github.com/hashicorp/terraform/version"
+)
+
+// File is the in-memory representation of a state file. It includes the state
+// itself along with various metadata used to track changing state files for
+// the same configuration over time.
+type File struct {
+        // TerraformVersion is the version of Terraform that wrote this state file.
+        TerraformVersion *version.Version
+
+        // Serial is incremented on any operation that modifies
+        // the State file. It is used to detect potentially conflicting
+        // updates.
+        Serial uint64
+
+        // Lineage is set when a new, blank state file is created and then
+        // never updated. This allows us to determine whether the serials
+        // of two states can be meaningfully compared.
+        // Apart from the guarantee that collisions between two lineages
+        // are very unlikely, this value is opaque and external callers
+        // should only compare lineage strings byte-for-byte for equality.
+        Lineage string
+
+        // State is the actual state represented by this file.
+        State *states.State
+}
+
+func New(state *states.State, lineage string, serial uint64) *File {
+        // To make life easier on callers, we'll accept a nil state here and just
+        // allocate an empty one, which is required for this file to be successfully
+        // written out.
+        if state == nil {
+                state = states.NewState()
+        }
+
+        return &File{
+                TerraformVersion: tfversion.SemVer,
+                State:            state,
+                Lineage:          lineage,
+                Serial:           serial,
+        }
+}
+
+// DeepCopy is a convenience method to create a new File object whose state
+// is a deep copy of the receiver's, as implemented by states.State.DeepCopy.
+func (f *File) DeepCopy() *File {
+        if f == nil {
+                return nil
+        }
+        return &File{
+                TerraformVersion: f.TerraformVersion,
+                Serial:           f.Serial,
+                Lineage:          f.Lineage,
+                State:            f.State.DeepCopy(),
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/marshal_equal.go b/vendor/github.com/hashicorp/terraform/states/statefile/marshal_equal.go
new file mode 100644
index 0000000..4948b39
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/marshal_equal.go
@@ -0,0 +1,40 @@
+package statefile
+
+import (
+        "bytes"
+
+        "github.com/hashicorp/terraform/states"
+)
+
+// StatesMarshalEqual returns true if and only if the two given states have
+// an identical (byte-for-byte) statefile representation.
+//
+// This function compares only the portions of the state that are persisted
+// in state files, so for example it will not return false if the only
+// differences between the two states are local values or descendent module
+// outputs.
+func StatesMarshalEqual(a, b *states.State) bool {
+        var aBuf bytes.Buffer
+        var bBuf bytes.Buffer
+
+        // nil states are not valid states, and so they can never martial equal.
+        if a == nil || b == nil {
+                return false
+        }
+
+        // We write here some temporary files that have no header information
+        // populated, thus ensuring that we're only comparing the state itself
+        // and not any metadata.
+        err := Write(&File{State: a}, &aBuf)
+        if err != nil {
+                // Should never happen, because we're writing to an in-memory buffer
+                panic(err)
+        }
+        err = Write(&File{State: b}, &bBuf)
+        if err != nil {
+                // Should never happen, because we're writing to an in-memory buffer
+                panic(err)
+        }
+
+        return bytes.Equal(aBuf.Bytes(), bBuf.Bytes())
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/read.go b/vendor/github.com/hashicorp/terraform/states/statefile/read.go
new file mode 100644
index 0000000..d691c02
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/read.go
@@ -0,0 +1,209 @@
+package statefile
+
+import (
+        "encoding/json"
+        "errors"
+        "fmt"
+        "io"
+        "io/ioutil"
+        "os"
+
+        version "github.com/hashicorp/go-version"
+
+        "github.com/hashicorp/terraform/tfdiags"
+        tfversion "github.com/hashicorp/terraform/version"
+)
+
+// ErrNoState is returned by ReadState when the state file is empty.
+var ErrNoState = errors.New("no state")
+
+// Read reads a state from the given reader.
+//
+// Legacy state format versions 1 through 3 are supported, but the result will
+// contain object attributes in the deprecated "flatmap" format and so must
+// be upgraded by the caller before use.
+//
+// If the state file is empty, the special error value ErrNoState is returned.
+// Otherwise, the returned error might be a wrapper around tfdiags.Diagnostics
+// potentially describing multiple errors.
+func Read(r io.Reader) (*File, error) {
+        // Some callers provide us a "typed nil" *os.File here, which would
+        // cause us to panic below if we tried to use it.
+        if f, ok := r.(*os.File); ok && f == nil {
+                return nil, ErrNoState
+        }
+
+        var diags tfdiags.Diagnostics
+
+        // We actually just buffer the whole thing in memory, because states are
+        // generally not huge and we need to do be able to sniff for a version
+        // number before full parsing.
+        src, err := ioutil.ReadAll(r)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to read state file",
+                        fmt.Sprintf("The state file could not be read: %s", err),
+                ))
+                return nil, diags.Err()
+        }
+
+        if len(src) == 0 {
+                return nil, ErrNoState
+        }
+
+        state, diags := readState(src)
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        if state == nil {
+                // Should never happen
+                panic("readState returned nil state with no errors")
+        }
+
+        if state.TerraformVersion != nil && state.TerraformVersion.GreaterThan(tfversion.SemVer) {
+                return state, fmt.Errorf(
+                        "state snapshot was created by Terraform v%s, which is newer than current v%s; upgrade to Terraform v%s or greater to work with this state",
+                        state.TerraformVersion,
+                        tfversion.SemVer,
+                        state.TerraformVersion,
+                )
+        }
+
+        return state, diags.Err()
+}
+
+func readState(src []byte) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        if looksLikeVersion0(src) {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        unsupportedFormat,
+                        "The state is stored in a legacy binary format that is not supported since Terraform v0.7. To continue, first upgrade the state using Terraform 0.6.16 or earlier.",
+                ))
+                return nil, diags
+        }
+
+        version, versionDiags := sniffJSONStateVersion(src)
+        diags = diags.Append(versionDiags)
+        if versionDiags.HasErrors() {
+                return nil, diags
+        }
+
+        switch version {
+        case 0:
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        unsupportedFormat,
+                        "The state file uses JSON syntax but has a version number of zero. There was never a JSON-based state format zero, so this state file is invalid and cannot be processed.",
+                ))
+                return nil, diags
+        case 1:
+                return readStateV1(src)
+        case 2:
+                return readStateV2(src)
+        case 3:
+                return readStateV3(src)
+        case 4:
+                return readStateV4(src)
+        default:
+                thisVersion := tfversion.SemVer.String()
+                creatingVersion := sniffJSONStateTerraformVersion(src)
+                switch {
+                case creatingVersion != "":
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                unsupportedFormat,
+                                fmt.Sprintf("The state file uses format version %d, which is not supported by Terraform %s. This state file was created by Terraform %s.", version, thisVersion, creatingVersion),
+                        ))
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                unsupportedFormat,
+                                fmt.Sprintf("The state file uses format version %d, which is not supported by Terraform %s. This state file may have been created by a newer version of Terraform.", version, thisVersion),
+                        ))
+                }
+                return nil, diags
+        }
+}
+
+func sniffJSONStateVersion(src []byte) (uint64, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        type VersionSniff struct {
+                Version *uint64 `json:"version"`
+        }
+        var sniff VersionSniff
+        err := json.Unmarshal(src, &sniff)
+        if err != nil {
+                switch tErr := err.(type) {
+                case *json.SyntaxError:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                unsupportedFormat,
+                                fmt.Sprintf("The state file could not be parsed as JSON: syntax error at byte offset %d.", tErr.Offset),
+                        ))
+                case *json.UnmarshalTypeError:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                unsupportedFormat,
+                                fmt.Sprintf("The version in the state file is %s. A positive whole number is required.", tErr.Value),
+                        ))
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                unsupportedFormat,
+                                "The state file could not be parsed as JSON.",
+                        ))
+                }
+        }
+
+        if sniff.Version == nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        unsupportedFormat,
+                        "The state file does not have a \"version\" attribute, which is required to identify the format version.",
+                ))
+                return 0, diags
+        }
+
+        return *sniff.Version, diags
+}
+
+// sniffJSONStateTerraformVersion attempts to sniff the Terraform version
+// specification from the given state file source code. The result is either
+// a version string or an empty string if no version number could be extracted.
+//
+// This is a best-effort function intended to produce nicer error messages. It
+// should not be used for any real processing.
+func sniffJSONStateTerraformVersion(src []byte) string {
+        type VersionSniff struct {
+                Version string `json:"terraform_version"`
+        }
+        var sniff VersionSniff
+
+        err := json.Unmarshal(src, &sniff)
+        if err != nil {
+                return ""
+        }
+
+        // Attempt to parse the string as a version so we won't report garbage
+        // as a version number.
+        _, err = version.NewVersion(sniff.Version)
+        if err != nil {
+                return ""
+        }
+
+        return sniff.Version
+}
+
+// unsupportedFormat is a diagnostic summary message for when the state file
+// seems to not be a state file at all, or is not a supported version.
+//
+// Use invalidFormat instead for the subtly-different case of "this looks like
+// it's intended to be a state file but it's not structured correctly".
+const unsupportedFormat = "Unsupported state file format"
+
+const upgradeFailed = "State format upgrade failed"
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version0.go b/vendor/github.com/hashicorp/terraform/states/statefile/version0.go
new file mode 100644
index 0000000..9b53331
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version0.go
@@ -0,0 +1,23 @@
+package statefile
+
+// looksLikeVersion0 sniffs for the signature indicating a version 0 state
+// file.
+//
+// Version 0 was the number retroactively assigned to Terraform's initial
+// (unversioned) binary state file format, which was later superseded by the
+// version 1 format in JSON.
+//
+// Version 0 is no longer supported, so this is used only to detect it and
+// return a nice error to the user.
+func looksLikeVersion0(src []byte) bool {
+        // Version 0 files begin with the magic prefix "tfstate".
+        const magic = "tfstate"
+        if len(src) < len(magic) {
+                // Not even long enough to have the magic prefix
+                return false
+        }
+        if string(src[0:len(magic)]) == magic {
+                return true
+        }
+        return false
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version1.go b/vendor/github.com/hashicorp/terraform/states/statefile/version1.go
new file mode 100644
index 0000000..80d711b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version1.go
@@ -0,0 +1,174 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func readStateV1(src []byte) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV1 := &stateV1{}
+        err := json.Unmarshal(src, sV1)
+        if err != nil {
+                diags = diags.Append(jsonUnmarshalDiags(err))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV1(sV1)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+func prepareStateV1(sV1 *stateV1) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV2, err := upgradeStateV1ToV2(sV1)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        upgradeFailed,
+                        fmt.Sprintf("Error upgrading state file format from version 1 to version 2: %s.", err),
+                ))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV2(sV2)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+// stateV1 is a representation of the legacy JSON state format version 1.
+//
+// It is only used to read version 1 JSON files prior to upgrading them to
+// the current format.
+type stateV1 struct {
+        // Version is the protocol version. "1" for a StateV1.
+        Version int `json:"version"`
+
+        // Serial is incremented on any operation that modifies
+        // the State file. It is used to detect potentially conflicting
+        // updates.
+        Serial int64 `json:"serial"`
+
+        // Remote is used to track the metadata required to
+        // pull and push state files from a remote storage endpoint.
+        Remote *remoteStateV1 `json:"remote,omitempty"`
+
+        // Modules contains all the modules in a breadth-first order
+        Modules []*moduleStateV1 `json:"modules"`
+}
+
+type remoteStateV1 struct {
+        // Type controls the client we use for the remote state
+        Type string `json:"type"`
+
+        // Config is used to store arbitrary configuration that
+        // is type specific
+        Config map[string]string `json:"config"`
+}
+
+type moduleStateV1 struct {
+        // Path is the import path from the root module. Modules imports are
+        // always disjoint, so the path represents amodule tree
+        Path []string `json:"path"`
+
+        // Outputs declared by the module and maintained for each module
+        // even though only the root module technically needs to be kept.
+        // This allows operators to inspect values at the boundaries.
+        Outputs map[string]string `json:"outputs"`
+
+        // Resources is a mapping of the logically named resource to
+        // the state of the resource. Each resource may actually have
+        // N instances underneath, although a user only needs to think
+        // about the 1:1 case.
+        Resources map[string]*resourceStateV1 `json:"resources"`
+
+        // Dependencies are a list of things that this module relies on
+        // existing to remain intact. For example: an module may depend
+        // on a VPC ID given by an aws_vpc resource.
+        //
+        // Terraform uses this information to build valid destruction
+        // orders and to warn the user if they're destroying a module that
+        // another resource depends on.
+        //
+        // Things can be put into this list that may not be managed by
+        // Terraform. If Terraform doesn't find a matching ID in the
+        // overall state, then it assumes it isn't managed and doesn't
+        // worry about it.
+        Dependencies []string `json:"depends_on,omitempty"`
+}
+
+type resourceStateV1 struct {
+        // This is filled in and managed by Terraform, and is the resource
+        // type itself such as "mycloud_instance". If a resource provider sets
+        // this value, it won't be persisted.
+        Type string `json:"type"`
+
+        // Dependencies are a list of things that this resource relies on
+        // existing to remain intact. For example: an AWS instance might
+        // depend on a subnet (which itself might depend on a VPC, and so
+        // on).
+        //
+        // Terraform uses this information to build valid destruction
+        // orders and to warn the user if they're destroying a resource that
+        // another resource depends on.
+        //
+        // Things can be put into this list that may not be managed by
+        // Terraform. If Terraform doesn't find a matching ID in the
+        // overall state, then it assumes it isn't managed and doesn't
+        // worry about it.
+        Dependencies []string `json:"depends_on,omitempty"`
+
+        // Primary is the current active instance for this resource.
+        // It can be replaced but only after a successful creation.
+        // This is the instances on which providers will act.
+        Primary *instanceStateV1 `json:"primary"`
+
+        // Tainted is used to track any underlying instances that
+        // have been created but are in a bad or unknown state and
+        // need to be cleaned up subsequently.  In the
+        // standard case, there is only at most a single instance.
+        // However, in pathological cases, it is possible for the number
+        // of instances to accumulate.
+        Tainted []*instanceStateV1 `json:"tainted,omitempty"`
+
+        // Deposed is used in the mechanics of CreateBeforeDestroy: the existing
+        // Primary is Deposed to get it out of the way for the replacement Primary to
+        // be created by Apply. If the replacement Primary creates successfully, the
+        // Deposed instance is cleaned up. If there were problems creating the
+        // replacement, the instance remains in the Deposed list so it can be
+        // destroyed in a future run. Functionally, Deposed instances are very
+        // similar to Tainted instances in that Terraform is only tracking them in
+        // order to remember to destroy them.
+        Deposed []*instanceStateV1 `json:"deposed,omitempty"`
+
+        // Provider is used when a resource is connected to a provider with an alias.
+        // If this string is empty, the resource is connected to the default provider,
+        // e.g. "aws_instance" goes with the "aws" provider.
+        // If the resource block contained a "provider" key, that value will be set here.
+        Provider string `json:"provider,omitempty"`
+}
+
+type instanceStateV1 struct {
+        // A unique ID for this resource. This is opaque to Terraform
+        // and is only meant as a lookup mechanism for the providers.
+        ID string `json:"id"`
+
+        // Attributes are basic information about the resource. Any keys here
+        // are accessible in variable format within Terraform configurations:
+        // ${resourcetype.name.attribute}.
+        Attributes map[string]string `json:"attributes,omitempty"`
+
+        // Meta is a simple K/V map that is persisted to the State but otherwise
+        // ignored by Terraform core. It's meant to be used for accounting by
+        // external client code.
+        Meta map[string]string `json:"meta,omitempty"`
+}
+
+type ephemeralStateV1 struct {
+        // ConnInfo is used for the providers to export information which is
+        // used to connect to the resource for provisioning. For example,
+        // this could contain SSH or WinRM credentials.
+        ConnInfo map[string]string `json:"-"`
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version1_upgrade.go b/vendor/github.com/hashicorp/terraform/states/statefile/version1_upgrade.go
new file mode 100644
index 0000000..0b417e1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version1_upgrade.go
@@ -0,0 +1,172 @@
+package statefile
+
+import (
+        "fmt"
+        "log"
+
+        "github.com/mitchellh/copystructure"
+)
+
+// upgradeStateV1ToV2 is used to upgrade a V1 state representation
+// into a V2 state representation
+func upgradeStateV1ToV2(old *stateV1) (*stateV2, error) {
+        log.Printf("[TRACE] statefile.Read: upgrading format from v1 to v2")
+        if old == nil {
+                return nil, nil
+        }
+
+        remote, err := old.Remote.upgradeToV2()
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading State V1: %v", err)
+        }
+
+        modules := make([]*moduleStateV2, len(old.Modules))
+        for i, module := range old.Modules {
+                upgraded, err := module.upgradeToV2()
+                if err != nil {
+                        return nil, fmt.Errorf("Error upgrading State V1: %v", err)
+                }
+                modules[i] = upgraded
+        }
+        if len(modules) == 0 {
+                modules = nil
+        }
+
+        newState := &stateV2{
+                Version: 2,
+                Serial:  old.Serial,
+                Remote:  remote,
+                Modules: modules,
+        }
+
+        return newState, nil
+}
+
+func (old *remoteStateV1) upgradeToV2() (*remoteStateV2, error) {
+        if old == nil {
+                return nil, nil
+        }
+
+        config, err := copystructure.Copy(old.Config)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading RemoteState V1: %v", err)
+        }
+
+        return &remoteStateV2{
+                Type:   old.Type,
+                Config: config.(map[string]string),
+        }, nil
+}
+
+func (old *moduleStateV1) upgradeToV2() (*moduleStateV2, error) {
+        if old == nil {
+                return nil, nil
+        }
+
+        pathRaw, err := copystructure.Copy(old.Path)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading ModuleState V1: %v", err)
+        }
+        path, ok := pathRaw.([]string)
+        if !ok {
+                return nil, fmt.Errorf("Error upgrading ModuleState V1: path is not a list of strings")
+        }
+        if len(path) == 0 {
+                // We found some V1 states with a nil path. Assume root.
+                path = []string{"root"}
+        }
+
+        // Outputs needs upgrading to use the new structure
+        outputs := make(map[string]*outputStateV2)
+        for key, output := range old.Outputs {
+                outputs[key] = &outputStateV2{
+                        Type:      "string",
+                        Value:     output,
+                        Sensitive: false,
+                }
+        }
+
+        resources := make(map[string]*resourceStateV2)
+        for key, oldResource := range old.Resources {
+                upgraded, err := oldResource.upgradeToV2()
+                if err != nil {
+                        return nil, fmt.Errorf("Error upgrading ModuleState V1: %v", err)
+                }
+                resources[key] = upgraded
+        }
+
+        dependencies, err := copystructure.Copy(old.Dependencies)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading ModuleState V1: %v", err)
+        }
+
+        return &moduleStateV2{
+                Path:         path,
+                Outputs:      outputs,
+                Resources:    resources,
+                Dependencies: dependencies.([]string),
+        }, nil
+}
+
+func (old *resourceStateV1) upgradeToV2() (*resourceStateV2, error) {
+        if old == nil {
+                return nil, nil
+        }
+
+        dependencies, err := copystructure.Copy(old.Dependencies)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading ResourceState V1: %v", err)
+        }
+
+        primary, err := old.Primary.upgradeToV2()
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading ResourceState V1: %v", err)
+        }
+
+        deposed := make([]*instanceStateV2, len(old.Deposed))
+        for i, v := range old.Deposed {
+                upgraded, err := v.upgradeToV2()
+                if err != nil {
+                        return nil, fmt.Errorf("Error upgrading ResourceState V1: %v", err)
+                }
+                deposed[i] = upgraded
+        }
+        if len(deposed) == 0 {
+                deposed = nil
+        }
+
+        return &resourceStateV2{
+                Type:         old.Type,
+                Dependencies: dependencies.([]string),
+                Primary:      primary,
+                Deposed:      deposed,
+                Provider:     old.Provider,
+        }, nil
+}
+
+func (old *instanceStateV1) upgradeToV2() (*instanceStateV2, error) {
+        if old == nil {
+                return nil, nil
+        }
+
+        attributes, err := copystructure.Copy(old.Attributes)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading InstanceState V1: %v", err)
+        }
+
+        meta, err := copystructure.Copy(old.Meta)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading InstanceState V1: %v", err)
+        }
+
+        newMeta := make(map[string]interface{})
+        for k, v := range meta.(map[string]string) {
+                newMeta[k] = v
+        }
+
+        return &instanceStateV2{
+                ID:         old.ID,
+                Attributes: attributes.(map[string]string),
+                Meta:       newMeta,
+        }, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version2.go b/vendor/github.com/hashicorp/terraform/states/statefile/version2.go
new file mode 100644
index 0000000..6fe2ab8
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version2.go
@@ -0,0 +1,209 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+        "sync"
+
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func readStateV2(src []byte) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV2 := &stateV2{}
+        err := json.Unmarshal(src, sV2)
+        if err != nil {
+                diags = diags.Append(jsonUnmarshalDiags(err))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV2(sV2)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+func prepareStateV2(sV2 *stateV2) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV3, err := upgradeStateV2ToV3(sV2)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        upgradeFailed,
+                        fmt.Sprintf("Error upgrading state file format from version 2 to version 3: %s.", err),
+                ))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV3(sV3)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+// stateV2 is a representation of the legacy JSON state format version 2.
+//
+// It is only used to read version 2 JSON files prior to upgrading them to
+// the current format.
+type stateV2 struct {
+        // Version is the state file protocol version.
+        Version int `json:"version"`
+
+        // TFVersion is the version of Terraform that wrote this state.
+        TFVersion string `json:"terraform_version,omitempty"`
+
+        // Serial is incremented on any operation that modifies
+        // the State file. It is used to detect potentially conflicting
+        // updates.
+        Serial int64 `json:"serial"`
+
+        // Lineage is set when a new, blank state is created and then
+        // never updated. This allows us to determine whether the serials
+        // of two states can be meaningfully compared.
+        // Apart from the guarantee that collisions between two lineages
+        // are very unlikely, this value is opaque and external callers
+        // should only compare lineage strings byte-for-byte for equality.
+        Lineage string `json:"lineage"`
+
+        // Remote is used to track the metadata required to
+        // pull and push state files from a remote storage endpoint.
+        Remote *remoteStateV2 `json:"remote,omitempty"`
+
+        // Backend tracks the configuration for the backend in use with
+        // this state. This is used to track any changes in the backend
+        // configuration.
+        Backend *backendStateV2 `json:"backend,omitempty"`
+
+        // Modules contains all the modules in a breadth-first order
+        Modules []*moduleStateV2 `json:"modules"`
+}
+
+type remoteStateV2 struct {
+        // Type controls the client we use for the remote state
+        Type string `json:"type"`
+
+        // Config is used to store arbitrary configuration that
+        // is type specific
+        Config map[string]string `json:"config"`
+}
+
+type outputStateV2 struct {
+        // Sensitive describes whether the output is considered sensitive,
+        // which may lead to masking the value on screen in some cases.
+        Sensitive bool `json:"sensitive"`
+        // Type describes the structure of Value. Valid values are "string",
+        // "map" and "list"
+        Type string `json:"type"`
+        // Value contains the value of the output, in the structure described
+        // by the Type field.
+        Value interface{} `json:"value"`
+
+        mu sync.Mutex
+}
+
+type moduleStateV2 struct {
+        // Path is the import path from the root module. Modules imports are
+        // always disjoint, so the path represents amodule tree
+        Path []string `json:"path"`
+
+        // Locals are kept only transiently in-memory, because we can always
+        // re-compute them.
+        Locals map[string]interface{} `json:"-"`
+
+        // Outputs declared by the module and maintained for each module
+        // even though only the root module technically needs to be kept.
+        // This allows operators to inspect values at the boundaries.
+        Outputs map[string]*outputStateV2 `json:"outputs"`
+
+        // Resources is a mapping of the logically named resource to
+        // the state of the resource. Each resource may actually have
+        // N instances underneath, although a user only needs to think
+        // about the 1:1 case.
+        Resources map[string]*resourceStateV2 `json:"resources"`
+
+        // Dependencies are a list of things that this module relies on
+        // existing to remain intact. For example: an module may depend
+        // on a VPC ID given by an aws_vpc resource.
+        //
+        // Terraform uses this information to build valid destruction
+        // orders and to warn the user if they're destroying a module that
+        // another resource depends on.
+        //
+        // Things can be put into this list that may not be managed by
+        // Terraform. If Terraform doesn't find a matching ID in the
+        // overall state, then it assumes it isn't managed and doesn't
+        // worry about it.
+        Dependencies []string `json:"depends_on"`
+}
+
+type resourceStateV2 struct {
+        // This is filled in and managed by Terraform, and is the resource
+        // type itself such as "mycloud_instance". If a resource provider sets
+        // this value, it won't be persisted.
+        Type string `json:"type"`
+
+        // Dependencies are a list of things that this resource relies on
+        // existing to remain intact. For example: an AWS instance might
+        // depend on a subnet (which itself might depend on a VPC, and so
+        // on).
+        //
+        // Terraform uses this information to build valid destruction
+        // orders and to warn the user if they're destroying a resource that
+        // another resource depends on.
+        //
+        // Things can be put into this list that may not be managed by
+        // Terraform. If Terraform doesn't find a matching ID in the
+        // overall state, then it assumes it isn't managed and doesn't
+        // worry about it.
+        Dependencies []string `json:"depends_on"`
+
+        // Primary is the current active instance for this resource.
+        // It can be replaced but only after a successful creation.
+        // This is the instances on which providers will act.
+        Primary *instanceStateV2 `json:"primary"`
+
+        // Deposed is used in the mechanics of CreateBeforeDestroy: the existing
+        // Primary is Deposed to get it out of the way for the replacement Primary to
+        // be created by Apply. If the replacement Primary creates successfully, the
+        // Deposed instance is cleaned up.
+        //
+        // If there were problems creating the replacement Primary, the Deposed
+        // instance and the (now tainted) replacement Primary will be swapped so the
+        // tainted replacement will be cleaned up instead.
+        //
+        // An instance will remain in the Deposed list until it is successfully
+        // destroyed and purged.
+        Deposed []*instanceStateV2 `json:"deposed"`
+
+        // Provider is used when a resource is connected to a provider with an alias.
+        // If this string is empty, the resource is connected to the default provider,
+        // e.g. "aws_instance" goes with the "aws" provider.
+        // If the resource block contained a "provider" key, that value will be set here.
+        Provider string `json:"provider"`
+
+        mu sync.Mutex
+}
+
+type instanceStateV2 struct {
+        // A unique ID for this resource. This is opaque to Terraform
+        // and is only meant as a lookup mechanism for the providers.
+        ID string `json:"id"`
+
+        // Attributes are basic information about the resource. Any keys here
+        // are accessible in variable format within Terraform configurations:
+        // ${resourcetype.name.attribute}.
+        Attributes map[string]string `json:"attributes"`
+
+        // Meta is a simple K/V map that is persisted to the State but otherwise
+        // ignored by Terraform core. It's meant to be used for accounting by
+        // external client code. The value here must only contain Go primitives
+        // and collections.
+        Meta map[string]interface{} `json:"meta"`
+
+        // Tainted is used to mark a resource for recreation.
+        Tainted bool `json:"tainted"`
+}
+
+type backendStateV2 struct {
+        Type      string          `json:"type"`   // Backend type
+        ConfigRaw json.RawMessage `json:"config"` // Backend raw config
+        Hash      int             `json:"hash"`   // Hash of portion of configuration from config files
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version2_upgrade.go b/vendor/github.com/hashicorp/terraform/states/statefile/version2_upgrade.go
new file mode 100644
index 0000000..2d03c07
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version2_upgrade.go
@@ -0,0 +1,145 @@
+package statefile
+
+import (
+        "fmt"
+        "log"
+        "regexp"
+        "sort"
+        "strconv"
+        "strings"
+
+        "github.com/mitchellh/copystructure"
+)
+
+func upgradeStateV2ToV3(old *stateV2) (*stateV3, error) {
+        if old == nil {
+                return (*stateV3)(nil), nil
+        }
+
+        var new *stateV3
+        {
+                copy, err := copystructure.Config{Lock: true}.Copy(old)
+                if err != nil {
+                        panic(err)
+                }
+                newWrongType := copy.(*stateV2)
+                newRightType := (stateV3)(*newWrongType)
+                new = &newRightType
+        }
+
+        // Set the new version number
+        new.Version = 3
+
+        // Change the counts for things which look like maps to use the %
+        // syntax. Remove counts for empty collections - they will be added
+        // back in later.
+        for _, module := range new.Modules {
+                for _, resource := range module.Resources {
+                        // Upgrade Primary
+                        if resource.Primary != nil {
+                                upgradeAttributesV2ToV3(resource.Primary)
+                        }
+
+                        // Upgrade Deposed
+                        for _, deposed := range resource.Deposed {
+                                upgradeAttributesV2ToV3(deposed)
+                        }
+                }
+        }
+
+        return new, nil
+}
+
+func upgradeAttributesV2ToV3(instanceState *instanceStateV2) error {
+        collectionKeyRegexp := regexp.MustCompile(`^(.*\.)#$`)
+        collectionSubkeyRegexp := regexp.MustCompile(`^([^\.]+)\..*`)
+
+        // Identify the key prefix of anything which is a collection
+        var collectionKeyPrefixes []string
+        for key := range instanceState.Attributes {
+                if submatches := collectionKeyRegexp.FindAllStringSubmatch(key, -1); len(submatches) > 0 {
+                        collectionKeyPrefixes = append(collectionKeyPrefixes, submatches[0][1])
+                }
+        }
+        sort.Strings(collectionKeyPrefixes)
+
+        log.Printf("[STATE UPGRADE] Detected the following collections in state: %v", collectionKeyPrefixes)
+
+        // This could be rolled into fewer loops, but it is somewhat clearer this way, and will not
+        // run very often.
+        for _, prefix := range collectionKeyPrefixes {
+                // First get the actual keys that belong to this prefix
+                var potentialKeysMatching []string
+                for key := range instanceState.Attributes {
+                        if strings.HasPrefix(key, prefix) {
+                                potentialKeysMatching = append(potentialKeysMatching, strings.TrimPrefix(key, prefix))
+                        }
+                }
+                sort.Strings(potentialKeysMatching)
+
+                var actualKeysMatching []string
+                for _, key := range potentialKeysMatching {
+                        if submatches := collectionSubkeyRegexp.FindAllStringSubmatch(key, -1); len(submatches) > 0 {
+                                actualKeysMatching = append(actualKeysMatching, submatches[0][1])
+                        } else {
+                                if key != "#" {
+                                        actualKeysMatching = append(actualKeysMatching, key)
+                                }
+                        }
+                }
+                actualKeysMatching = uniqueSortedStrings(actualKeysMatching)
+
+                // Now inspect the keys in order to determine whether this is most likely to be
+                // a map, list or set. There is room for error here, so we log in each case. If
+                // there is no method of telling, we remove the key from the InstanceState in
+                // order that it will be recreated. Again, this could be rolled into fewer loops
+                // but we prefer clarity.
+
+                oldCountKey := fmt.Sprintf("%s#", prefix)
+
+                // First, detect "obvious" maps - which have non-numeric keys (mostly).
+                hasNonNumericKeys := false
+                for _, key := range actualKeysMatching {
+                        if _, err := strconv.Atoi(key); err != nil {
+                                hasNonNumericKeys = true
+                        }
+                }
+                if hasNonNumericKeys {
+                        newCountKey := fmt.Sprintf("%s%%", prefix)
+
+                        instanceState.Attributes[newCountKey] = instanceState.Attributes[oldCountKey]
+                        delete(instanceState.Attributes, oldCountKey)
+                        log.Printf("[STATE UPGRADE] Detected %s as a map. Replaced count = %s",
+                                strings.TrimSuffix(prefix, "."), instanceState.Attributes[newCountKey])
+                }
+
+                // Now detect empty collections and remove them from state.
+                if len(actualKeysMatching) == 0 {
+                        delete(instanceState.Attributes, oldCountKey)
+                        log.Printf("[STATE UPGRADE] Detected %s as an empty collection. Removed from state.",
+                                strings.TrimSuffix(prefix, "."))
+                }
+        }
+
+        return nil
+}
+
+// uniqueSortedStrings removes duplicates from a slice of strings and returns
+// a sorted slice of the unique strings.
+func uniqueSortedStrings(input []string) []string {
+        uniquemap := make(map[string]struct{})
+        for _, str := range input {
+                uniquemap[str] = struct{}{}
+        }
+
+        output := make([]string, len(uniquemap))
+
+        i := 0
+        for key := range uniquemap {
+                output[i] = key
+                i = i + 1
+        }
+
+        sort.Strings(output)
+        return output
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version3.go b/vendor/github.com/hashicorp/terraform/states/statefile/version3.go
new file mode 100644
index 0000000..ab6414b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version3.go
@@ -0,0 +1,50 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func readStateV3(src []byte) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV3 := &stateV3{}
+        err := json.Unmarshal(src, sV3)
+        if err != nil {
+                diags = diags.Append(jsonUnmarshalDiags(err))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV3(sV3)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+func prepareStateV3(sV3 *stateV3) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV4, err := upgradeStateV3ToV4(sV3)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        upgradeFailed,
+                        fmt.Sprintf("Error upgrading state file format from version 3 to version 4: %s.", err),
+                ))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV4(sV4)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+// stateV2 is a representation of the legacy JSON state format version 3.
+//
+// It is only used to read version 3 JSON files prior to upgrading them to
+// the current format.
+//
+// The differences between version 2 and version 3 are only in the data and
+// not in the structure, so stateV3 actually shares the same structs as
+// stateV2. Type stateV3 represents that the data within is formatted as
+// expected by the V3 format, rather than the V2 format.
+type stateV3 stateV2
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version3_upgrade.go b/vendor/github.com/hashicorp/terraform/states/statefile/version3_upgrade.go
new file mode 100644
index 0000000..2cbe8a5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version3_upgrade.go
@@ -0,0 +1,431 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+        "strconv"
+        "strings"
+
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func upgradeStateV3ToV4(old *stateV3) (*stateV4, error) {
+
+        if old.Serial < 0 {
+                // The new format is using uint64 here, which should be fine for any
+                // real state (we only used positive integers in practice) but we'll
+                // catch this explicitly here to avoid weird behavior if a state file
+                // has been tampered with in some way.
+                return nil, fmt.Errorf("state has serial less than zero, which is invalid")
+        }
+
+        new := &stateV4{
+                TerraformVersion: old.TFVersion,
+                Serial:           uint64(old.Serial),
+                Lineage:          old.Lineage,
+                RootOutputs:      map[string]outputStateV4{},
+                Resources:        []resourceStateV4{},
+        }
+
+        if new.TerraformVersion == "" {
+                // Older formats considered this to be optional, but now it's required
+                // and so we'll stub it out with something that's definitely older
+                // than the version that really created this state.
+                new.TerraformVersion = "0.0.0"
+        }
+
+        for _, msOld := range old.Modules {
+                if len(msOld.Path) < 1 || msOld.Path[0] != "root" {
+                        return nil, fmt.Errorf("state contains invalid module path %#v", msOld.Path)
+                }
+
+                // Convert legacy-style module address into our newer address type.
+                // Since these old formats are only generated by versions of Terraform
+                // that don't support count and for_each on modules, we can just assume
+                // all of the modules are unkeyed.
+                moduleAddr := make(addrs.ModuleInstance, len(msOld.Path)-1)
+                for i, name := range msOld.Path[1:] {
+                        moduleAddr[i] = addrs.ModuleInstanceStep{
+                                Name:        name,
+                                InstanceKey: addrs.NoKey,
+                        }
+                }
+
+                // In a v3 state file, a "resource state" is actually an instance
+                // state, so we need to fill in a missing level of heirarchy here
+                // by lazily creating resource states as we encounter them.
+                // We'll track them in here, keyed on the string representation of
+                // the resource address.
+                resourceStates := map[string]*resourceStateV4{}
+
+                for legacyAddr, rsOld := range msOld.Resources {
+                        instAddr, err := parseLegacyResourceAddress(legacyAddr)
+                        if err != nil {
+                                return nil, err
+                        }
+
+                        resAddr := instAddr.Resource
+                        rs, exists := resourceStates[resAddr.String()]
+                        if !exists {
+                                var modeStr string
+                                switch resAddr.Mode {
+                                case addrs.ManagedResourceMode:
+                                        modeStr = "managed"
+                                case addrs.DataResourceMode:
+                                        modeStr = "data"
+                                default:
+                                        return nil, fmt.Errorf("state contains resource %s with an unsupported resource mode", resAddr)
+                                }
+
+                                // In state versions prior to 4 we allowed each instance of a
+                                // resource to have its own provider configuration address,
+                                // which makes no real sense in practice because providers
+                                // are associated with resources in the configuration. We
+                                // elevate that to the resource level during this upgrade,
+                                // implicitly taking the provider address of the first instance
+                                // we encounter for each resource. While this is lossy in
+                                // theory, in practice there is no reason for these values to
+                                // differ between instances.
+                                var providerAddr addrs.AbsProviderConfig
+                                oldProviderAddr := rsOld.Provider
+                                if strings.Contains(oldProviderAddr, "provider.") {
+                                        // Smells like a new-style provider address, but we'll test it.
+                                        var diags tfdiags.Diagnostics
+                                        providerAddr, diags = addrs.ParseAbsProviderConfigStr(oldProviderAddr)
+                                        if diags.HasErrors() {
+                                                return nil, diags.Err()
+                                        }
+                                } else {
+                                        // Smells like an old-style module-local provider address,
+                                        // which we'll need to migrate. We'll assume it's referring
+                                        // to the same module the resource is in, which might be
+                                        // incorrect but it'll get fixed up next time any updates
+                                        // are made to an instance.
+                                        if oldProviderAddr != "" {
+                                                localAddr, diags := addrs.ParseProviderConfigCompactStr(oldProviderAddr)
+                                                if diags.HasErrors() {
+                                                        return nil, diags.Err()
+                                                }
+                                                providerAddr = localAddr.Absolute(moduleAddr)
+                                        } else {
+                                                providerAddr = resAddr.DefaultProviderConfig().Absolute(moduleAddr)
+                                        }
+                                }
+
+                                rs = &resourceStateV4{
+                                        Module:         moduleAddr.String(),
+                                        Mode:           modeStr,
+                                        Type:           resAddr.Type,
+                                        Name:           resAddr.Name,
+                                        Instances:      []instanceObjectStateV4{},
+                                        ProviderConfig: providerAddr.String(),
+                                }
+                                resourceStates[resAddr.String()] = rs
+                        }
+
+                        // Now we'll deal with the instance itself, which may either be
+                        // the first instance in a resource we just created or an additional
+                        // instance for a resource added on a prior loop.
+                        instKey := instAddr.Key
+                        if isOld := rsOld.Primary; isOld != nil {
+                                isNew, err := upgradeInstanceObjectV3ToV4(rsOld, isOld, instKey, states.NotDeposed)
+                                if err != nil {
+                                        return nil, fmt.Errorf("failed to migrate primary generation of %s: %s", instAddr, err)
+                                }
+                                rs.Instances = append(rs.Instances, *isNew)
+                        }
+                        for i, isOld := range rsOld.Deposed {
+                                // When we migrate old instances we'll use sequential deposed
+                                // keys just so that the upgrade result is deterministic. New
+                                // deposed keys allocated moving forward will be pseudorandomly
+                                // selected, but we check for collisions and so these
+                                // non-random ones won't hurt.
+                                deposedKey := states.DeposedKey(fmt.Sprintf("%08x", i+1))
+                                isNew, err := upgradeInstanceObjectV3ToV4(rsOld, isOld, instKey, deposedKey)
+                                if err != nil {
+                                        return nil, fmt.Errorf("failed to migrate deposed generation index %d of %s: %s", i, instAddr, err)
+                                }
+                                rs.Instances = append(rs.Instances, *isNew)
+                        }
+
+                        if instKey != addrs.NoKey && rs.EachMode == "" {
+                                rs.EachMode = "list"
+                        }
+                }
+
+                for _, rs := range resourceStates {
+                        new.Resources = append(new.Resources, *rs)
+                }
+
+                if len(msOld.Path) == 1 && msOld.Path[0] == "root" {
+                        // We'll migrate the outputs for this module too, then.
+                        for name, oldOS := range msOld.Outputs {
+                                newOS := outputStateV4{
+                                        Sensitive: oldOS.Sensitive,
+                                }
+
+                                valRaw := oldOS.Value
+                                valSrc, err := json.Marshal(valRaw)
+                                if err != nil {
+                                        // Should never happen, because this value came from JSON
+                                        // in the first place and so we're just round-tripping here.
+                                        return nil, fmt.Errorf("failed to serialize output %q value as JSON: %s", name, err)
+                                }
+
+                                // The "type" field in state V2 wasn't really that useful
+                                // since it was only able to capture string vs. list vs. map.
+                                // For this reason, during upgrade we'll just discard it
+                                // altogether and use cty's idea of the implied type of
+                                // turning our old value into JSON.
+                                ty, err := ctyjson.ImpliedType(valSrc)
+                                if err != nil {
+                                        // REALLY should never happen, because we literally just
+                                        // encoded this as JSON above!
+                                        return nil, fmt.Errorf("failed to parse output %q value from JSON: %s", name, err)
+                                }
+
+                                // ImpliedType tends to produce structural types, but since older
+                                // version of Terraform didn't support those a collection type
+                                // is probably what was intended, so we'll see if we can
+                                // interpret our value as one.
+                                ty = simplifyImpliedValueType(ty)
+
+                                tySrc, err := ctyjson.MarshalType(ty)
+                                if err != nil {
+                                        return nil, fmt.Errorf("failed to serialize output %q type as JSON: %s", name, err)
+                                }
+
+                                newOS.ValueRaw = json.RawMessage(valSrc)
+                                newOS.ValueTypeRaw = json.RawMessage(tySrc)
+
+                                new.RootOutputs[name] = newOS
+                        }
+                }
+        }
+
+        new.normalize()
+
+        return new, nil
+}
+
+func upgradeInstanceObjectV3ToV4(rsOld *resourceStateV2, isOld *instanceStateV2, instKey addrs.InstanceKey, deposedKey states.DeposedKey) (*instanceObjectStateV4, error) {
+
+        // Schema versions were, in prior formats, a private concern of the provider
+        // SDK, and not a first-class concept in the state format. Here we're
+        // sniffing for the pre-0.12 SDK's way of representing schema versions
+        // and promoting it to our first-class field if we find it. We'll ignore
+        // it if it doesn't look like what the SDK would've written. If this
+        // sniffing fails then we'll assume schema version 0.
+        var schemaVersion uint64
+        migratedSchemaVersion := false
+        if raw, exists := isOld.Meta["schema_version"]; exists {
+                switch tv := raw.(type) {
+                case string:
+                        v, err := strconv.ParseUint(tv, 10, 64)
+                        if err == nil {
+                                schemaVersion = v
+                                migratedSchemaVersion = true
+                        }
+                case int:
+                        schemaVersion = uint64(tv)
+                        migratedSchemaVersion = true
+                case float64:
+                        schemaVersion = uint64(tv)
+                        migratedSchemaVersion = true
+                }
+        }
+
+        private := map[string]interface{}{}
+        for k, v := range isOld.Meta {
+                if k == "schema_version" && migratedSchemaVersion {
+                        // We're gonna promote this into our first-class schema version field
+                        continue
+                }
+                private[k] = v
+        }
+        var privateJSON []byte
+        if len(private) != 0 {
+                var err error
+                privateJSON, err = json.Marshal(private)
+                if err != nil {
+                        // This shouldn't happen, because the Meta values all came from JSON
+                        // originally anyway.
+                        return nil, fmt.Errorf("cannot serialize private instance object data: %s", err)
+                }
+        }
+
+        var status string
+        if isOld.Tainted {
+                status = "tainted"
+        }
+
+        var instKeyRaw interface{}
+        switch tk := instKey.(type) {
+        case addrs.IntKey:
+                instKeyRaw = int(tk)
+        case addrs.StringKey:
+                instKeyRaw = string(tk)
+        default:
+                if instKeyRaw != nil {
+                        return nil, fmt.Errorf("insupported instance key: %#v", instKey)
+                }
+        }
+
+        var attributes map[string]string
+        if isOld.Attributes != nil {
+                attributes = make(map[string]string, len(isOld.Attributes))
+                for k, v := range isOld.Attributes {
+                        attributes[k] = v
+                }
+        }
+        if isOld.ID != "" {
+                // As a special case, if we don't already have an "id" attribute and
+                // yet there's a non-empty first-class ID on the old object then we'll
+                // create a synthetic id attribute to avoid losing that first-class id.
+                // In practice this generally arises only in tests where state literals
+                // are hand-written in a non-standard way; real code prior to 0.12
+                // would always force the first-class ID to be copied into the
+                // id attribute before storing.
+                if attributes == nil {
+                        attributes = make(map[string]string, len(isOld.Attributes))
+                }
+                if idVal := attributes["id"]; idVal == "" {
+                        attributes["id"] = isOld.ID
+                }
+        }
+
+        dependencies := make([]string, len(rsOld.Dependencies))
+        for i, v := range rsOld.Dependencies {
+                dependencies[i] = parseLegacyDependency(v)
+        }
+
+        return &instanceObjectStateV4{
+                IndexKey:       instKeyRaw,
+                Status:         status,
+                Deposed:        string(deposedKey),
+                AttributesFlat: attributes,
+                Dependencies:   dependencies,
+                SchemaVersion:  schemaVersion,
+                PrivateRaw:     privateJSON,
+        }, nil
+}
+
+// parseLegacyResourceAddress parses the different identifier format used
+// state formats before version 4, like "instance.name.0".
+func parseLegacyResourceAddress(s string) (addrs.ResourceInstance, error) {
+        var ret addrs.ResourceInstance
+
+        // Split based on ".". Every resource address should have at least two
+        // elements (type and name).
+        parts := strings.Split(s, ".")
+        if len(parts) < 2 || len(parts) > 4 {
+                return ret, fmt.Errorf("invalid internal resource address format: %s", s)
+        }
+
+        // Data resource if we have at least 3 parts and the first one is data
+        ret.Resource.Mode = addrs.ManagedResourceMode
+        if len(parts) > 2 && parts[0] == "data" {
+                ret.Resource.Mode = addrs.DataResourceMode
+                parts = parts[1:]
+        }
+
+        // If we're not a data resource and we have more than 3, then it is an error
+        if len(parts) > 3 && ret.Resource.Mode != addrs.DataResourceMode {
+                return ret, fmt.Errorf("invalid internal resource address format: %s", s)
+        }
+
+        // Build the parts of the resource address that are guaranteed to exist
+        ret.Resource.Type = parts[0]
+        ret.Resource.Name = parts[1]
+        ret.Key = addrs.NoKey
+
+        // If we have more parts, then we have an index. Parse that.
+        if len(parts) > 2 {
+                idx, err := strconv.ParseInt(parts[2], 0, 0)
+                if err != nil {
+                        return ret, fmt.Errorf("error parsing resource address %q: %s", s, err)
+                }
+
+                ret.Key = addrs.IntKey(idx)
+        }
+
+        return ret, nil
+}
+
+// simplifyImpliedValueType attempts to heuristically simplify a value type
+// derived from a legacy stored output value into something simpler that
+// is closer to what would've fitted into the pre-v0.12 value type system.
+func simplifyImpliedValueType(ty cty.Type) cty.Type {
+        switch {
+        case ty.IsTupleType():
+                // If all of the element types are the same then we'll make this
+                // a list instead. This is very likely to be true, since prior versions
+                // of Terraform did not officially support mixed-type collections.
+
+                if ty.Equals(cty.EmptyTuple) {
+                        // Don't know what the element type would be, then.
+                        return ty
+                }
+
+                etys := ty.TupleElementTypes()
+                ety := etys[0]
+                for _, other := range etys[1:] {
+                        if !other.Equals(ety) {
+                                // inconsistent types
+                                return ty
+                        }
+                }
+                ety = simplifyImpliedValueType(ety)
+                return cty.List(ety)
+
+        case ty.IsObjectType():
+                // If all of the attribute types are the same then we'll make this
+                // a map instead. This is very likely to be true, since prior versions
+                // of Terraform did not officially support mixed-type collections.
+
+                if ty.Equals(cty.EmptyObject) {
+                        // Don't know what the element type would be, then.
+                        return ty
+                }
+
+                atys := ty.AttributeTypes()
+                var ety cty.Type
+                for _, other := range atys {
+                        if ety == cty.NilType {
+                                ety = other
+                                continue
+                        }
+                        if !other.Equals(ety) {
+                                // inconsistent types
+                                return ty
+                        }
+                }
+                ety = simplifyImpliedValueType(ety)
+                return cty.Map(ety)
+
+        default:
+                // No other normalizations are possible
+                return ty
+        }
+}
+
+func parseLegacyDependency(s string) string {
+        parts := strings.Split(s, ".")
+        ret := parts[0]
+        for _, part := range parts[1:] {
+                if part == "*" {
+                        break
+                }
+                if i, err := strconv.Atoi(part); err == nil {
+                        ret = ret + fmt.Sprintf("[%d]", i)
+                        break
+                }
+                ret = ret + "." + part
+        }
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version4.go b/vendor/github.com/hashicorp/terraform/states/statefile/version4.go
new file mode 100644
index 0000000..ee8b652
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version4.go
@@ -0,0 +1,604 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+        "io"
+        "sort"
+
+        version "github.com/hashicorp/go-version"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func readStateV4(src []byte) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV4 := &stateV4{}
+        err := json.Unmarshal(src, sV4)
+        if err != nil {
+                diags = diags.Append(jsonUnmarshalDiags(err))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV4(sV4)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+func prepareStateV4(sV4 *stateV4) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        var tfVersion *version.Version
+        if sV4.TerraformVersion != "" {
+                var err error
+                tfVersion, err = version.NewVersion(sV4.TerraformVersion)
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid Terraform version string",
+                                fmt.Sprintf("State file claims to have been written by Terraform version %q, which is not a valid version string.", sV4.TerraformVersion),
+                        ))
+                }
+        }
+
+        file := &File{
+                TerraformVersion: tfVersion,
+                Serial:           sV4.Serial,
+                Lineage:          sV4.Lineage,
+        }
+
+        state := states.NewState()
+
+        for _, rsV4 := range sV4.Resources {
+                rAddr := addrs.Resource{
+                        Type: rsV4.Type,
+                        Name: rsV4.Name,
+                }
+                switch rsV4.Mode {
+                case "managed":
+                        rAddr.Mode = addrs.ManagedResourceMode
+                case "data":
+                        rAddr.Mode = addrs.DataResourceMode
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid resource mode in state",
+                                fmt.Sprintf("State contains a resource with mode %q (%q %q) which is not supported.", rsV4.Mode, rAddr.Type, rAddr.Name),
+                        ))
+                        continue
+                }
+
+                moduleAddr := addrs.RootModuleInstance
+                if rsV4.Module != "" {
+                        var addrDiags tfdiags.Diagnostics
+                        moduleAddr, addrDiags = addrs.ParseModuleInstanceStr(rsV4.Module)
+                        diags = diags.Append(addrDiags)
+                        if addrDiags.HasErrors() {
+                                continue
+                        }
+                }
+
+                providerAddr, addrDiags := addrs.ParseAbsProviderConfigStr(rsV4.ProviderConfig)
+                diags.Append(addrDiags)
+                if addrDiags.HasErrors() {
+                        continue
+                }
+
+                var eachMode states.EachMode
+                switch rsV4.EachMode {
+                case "":
+                        eachMode = states.NoEach
+                case "list":
+                        eachMode = states.EachList
+                case "map":
+                        eachMode = states.EachMap
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid resource metadata in state",
+                                fmt.Sprintf("Resource %s has invalid \"each\" value %q in state.", rAddr.Absolute(moduleAddr), eachMode),
+                        ))
+                        continue
+                }
+
+                ms := state.EnsureModule(moduleAddr)
+
+                // Ensure the resource container object is present in the state.
+                ms.SetResourceMeta(rAddr, eachMode, providerAddr)
+
+                for _, isV4 := range rsV4.Instances {
+                        keyRaw := isV4.IndexKey
+                        var key addrs.InstanceKey
+                        switch tk := keyRaw.(type) {
+                        case int:
+                                key = addrs.IntKey(tk)
+                        case float64:
+                                // Since JSON only has one number type, reading from encoding/json
+                                // gives us a float64 here even if the number is whole.
+                                // float64 has a smaller integer range than int, but in practice
+                                // we rarely have more than a few tens of instances and so
+                                // it's unlikely that we'll exhaust the 52 bits in a float64.
+                                key = addrs.IntKey(int(tk))
+                        case string:
+                                key = addrs.StringKey(tk)
+                        default:
+                                if keyRaw != nil {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Invalid resource instance metadata in state",
+                                                fmt.Sprintf("Resource %s has an instance with the invalid instance key %#v.", rAddr.Absolute(moduleAddr), keyRaw),
+                                        ))
+                                        continue
+                                }
+                                key = addrs.NoKey
+                        }
+
+                        instAddr := rAddr.Instance(key)
+
+                        obj := &states.ResourceInstanceObjectSrc{
+                                SchemaVersion: isV4.SchemaVersion,
+                        }
+
+                        {
+                                // Instance attributes
+                                switch {
+                                case isV4.AttributesRaw != nil:
+                                        obj.AttrsJSON = isV4.AttributesRaw
+                                case isV4.AttributesFlat != nil:
+                                        obj.AttrsFlat = isV4.AttributesFlat
+                                default:
+                                        // This is odd, but we'll accept it and just treat the
+                                        // object has being empty. In practice this should arise
+                                        // only from the contrived sort of state objects we tend
+                                        // to hand-write inline in tests.
+                                        obj.AttrsJSON = []byte{'{', '}'}
+                                }
+                        }
+
+                        {
+                                // Status
+                                raw := isV4.Status
+                                switch raw {
+                                case "":
+                                        obj.Status = states.ObjectReady
+                                case "tainted":
+                                        obj.Status = states.ObjectTainted
+                                default:
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Invalid resource instance metadata in state",
+                                                fmt.Sprintf("Instance %s has invalid status %q.", instAddr.Absolute(moduleAddr), raw),
+                                        ))
+                                        continue
+                                }
+                        }
+
+                        if raw := isV4.PrivateRaw; len(raw) > 0 {
+                                obj.Private = raw
+                        }
+
+                        {
+                                depsRaw := isV4.Dependencies
+                                deps := make([]addrs.Referenceable, 0, len(depsRaw))
+                                for _, depRaw := range depsRaw {
+                                        ref, refDiags := addrs.ParseRefStr(depRaw)
+                                        diags = diags.Append(refDiags)
+                                        if refDiags.HasErrors() {
+                                                continue
+                                        }
+                                        if len(ref.Remaining) != 0 {
+                                                diags = diags.Append(tfdiags.Sourceless(
+                                                        tfdiags.Error,
+                                                        "Invalid resource instance metadata in state",
+                                                        fmt.Sprintf("Instance %s declares dependency on %q, which is not a reference to a dependable object.", instAddr.Absolute(moduleAddr), depRaw),
+                                                ))
+                                        }
+                                        if ref.Subject == nil {
+                                                // Should never happen
+                                                panic(fmt.Sprintf("parsing dependency %q for instance %s returned a nil address", depRaw, instAddr.Absolute(moduleAddr)))
+                                        }
+                                        deps = append(deps, ref.Subject)
+                                }
+                                obj.Dependencies = deps
+                        }
+
+                        switch {
+                        case isV4.Deposed != "":
+                                dk := states.DeposedKey(isV4.Deposed)
+                                if len(dk) != 8 {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Invalid resource instance metadata in state",
+                                                fmt.Sprintf("Instance %s has an object with deposed key %q, which is not correctly formatted.", instAddr.Absolute(moduleAddr), isV4.Deposed),
+                                        ))
+                                        continue
+                                }
+                                is := ms.ResourceInstance(instAddr)
+                                if is.HasDeposed(dk) {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Duplicate resource instance in state",
+                                                fmt.Sprintf("Instance %s deposed object %q appears multiple times in the state file.", instAddr.Absolute(moduleAddr), dk),
+                                        ))
+                                        continue
+                                }
+
+                                ms.SetResourceInstanceDeposed(instAddr, dk, obj, providerAddr)
+                        default:
+                                is := ms.ResourceInstance(instAddr)
+                                if is.HasCurrent() {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Duplicate resource instance in state",
+                                                fmt.Sprintf("Instance %s appears multiple times in the state file.", instAddr.Absolute(moduleAddr)),
+                                        ))
+                                        continue
+                                }
+
+                                ms.SetResourceInstanceCurrent(instAddr, obj, providerAddr)
+                        }
+                }
+
+                // We repeat this after creating the instances because
+                // SetResourceInstanceCurrent automatically resets this metadata based
+                // on the incoming objects. That behavior is useful when we're making
+                // piecemeal updates to the state during an apply, but when we're
+                // reading the state file we want to reflect its contents exactly.
+                ms.SetResourceMeta(rAddr, eachMode, providerAddr)
+        }
+
+        // The root module is special in that we persist its attributes and thus
+        // need to reload them now. (For descendent modules we just re-calculate
+        // them based on the latest configuration on each run.)
+        {
+                rootModule := state.RootModule()
+                for name, fos := range sV4.RootOutputs {
+                        os := &states.OutputValue{}
+                        os.Sensitive = fos.Sensitive
+
+                        ty, err := ctyjson.UnmarshalType([]byte(fos.ValueTypeRaw))
+                        if err != nil {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid output value type in state",
+                                        fmt.Sprintf("The state file has an invalid type specification for output %q: %s.", name, err),
+                                ))
+                                continue
+                        }
+
+                        val, err := ctyjson.Unmarshal([]byte(fos.ValueRaw), ty)
+                        if err != nil {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid output value saved in state",
+                                        fmt.Sprintf("The state file has an invalid value for output %q: %s.", name, err),
+                                ))
+                                continue
+                        }
+
+                        os.Value = val
+                        rootModule.OutputValues[name] = os
+                }
+        }
+
+        file.State = state
+        return file, diags
+}
+
+func writeStateV4(file *File, w io.Writer) tfdiags.Diagnostics {
+        // Here we'll convert back from the "File" representation to our
+        // stateV4 struct representation and write that.
+        //
+        // While we support legacy state formats for reading, we only support the
+        // latest for writing and so if a V5 is added in future then this function
+        // should be deleted and replaced with a writeStateV5, even though the
+        // read/prepare V4 functions above would stick around.
+
+        var diags tfdiags.Diagnostics
+        if file == nil || file.State == nil {
+                panic("attempt to write nil state to file")
+        }
+
+        var terraformVersion string
+        if file.TerraformVersion != nil {
+                terraformVersion = file.TerraformVersion.String()
+        }
+
+        sV4 := &stateV4{
+                TerraformVersion: terraformVersion,
+                Serial:           file.Serial,
+                Lineage:          file.Lineage,
+                RootOutputs:      map[string]outputStateV4{},
+                Resources:        []resourceStateV4{},
+        }
+
+        for name, os := range file.State.RootModule().OutputValues {
+                src, err := ctyjson.Marshal(os.Value, os.Value.Type())
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to serialize output value in state",
+                                fmt.Sprintf("An error occured while serializing output value %q: %s.", name, err),
+                        ))
+                        continue
+                }
+
+                typeSrc, err := ctyjson.MarshalType(os.Value.Type())
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to serialize output value in state",
+                                fmt.Sprintf("An error occured while serializing the type of output value %q: %s.", name, err),
+                        ))
+                        continue
+                }
+
+                sV4.RootOutputs[name] = outputStateV4{
+                        Sensitive:    os.Sensitive,
+                        ValueRaw:     json.RawMessage(src),
+                        ValueTypeRaw: json.RawMessage(typeSrc),
+                }
+        }
+
+        for _, ms := range file.State.Modules {
+                moduleAddr := ms.Addr
+                for _, rs := range ms.Resources {
+                        resourceAddr := rs.Addr
+
+                        var mode string
+                        switch resourceAddr.Mode {
+                        case addrs.ManagedResourceMode:
+                                mode = "managed"
+                        case addrs.DataResourceMode:
+                                mode = "data"
+                        default:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Failed to serialize resource in state",
+                                        fmt.Sprintf("Resource %s has mode %s, which cannot be serialized in state", resourceAddr.Absolute(moduleAddr), resourceAddr.Mode),
+                                ))
+                                continue
+                        }
+
+                        var eachMode string
+                        switch rs.EachMode {
+                        case states.NoEach:
+                                eachMode = ""
+                        case states.EachList:
+                                eachMode = "list"
+                        case states.EachMap:
+                                eachMode = "map"
+                        default:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Failed to serialize resource in state",
+                                        fmt.Sprintf("Resource %s has \"each\" mode %s, which cannot be serialized in state", resourceAddr.Absolute(moduleAddr), rs.EachMode),
+                                ))
+                                continue
+                        }
+
+                        sV4.Resources = append(sV4.Resources, resourceStateV4{
+                                Module:         moduleAddr.String(),
+                                Mode:           mode,
+                                Type:           resourceAddr.Type,
+                                Name:           resourceAddr.Name,
+                                EachMode:       eachMode,
+                                ProviderConfig: rs.ProviderConfig.String(),
+                                Instances:      []instanceObjectStateV4{},
+                        })
+                        rsV4 := &(sV4.Resources[len(sV4.Resources)-1])
+
+                        for key, is := range rs.Instances {
+                                if is.HasCurrent() {
+                                        var objDiags tfdiags.Diagnostics
+                                        rsV4.Instances, objDiags = appendInstanceObjectStateV4(
+                                                rs, is, key, is.Current, states.NotDeposed,
+                                                rsV4.Instances,
+                                        )
+                                        diags = diags.Append(objDiags)
+                                }
+                                for dk, obj := range is.Deposed {
+                                        var objDiags tfdiags.Diagnostics
+                                        rsV4.Instances, objDiags = appendInstanceObjectStateV4(
+                                                rs, is, key, obj, dk,
+                                                rsV4.Instances,
+                                        )
+                                        diags = diags.Append(objDiags)
+                                }
+                        }
+                }
+        }
+
+        sV4.normalize()
+
+        src, err := json.MarshalIndent(sV4, "", "  ")
+        if err != nil {
+                // Shouldn't happen if we do our conversion to *stateV4 correctly above.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to serialize state",
+                        fmt.Sprintf("An error occured while serializing the state to save it. This is a bug in Terraform and should be reported: %s.", err),
+                ))
+                return diags
+        }
+        src = append(src, '\n')
+
+        _, err = w.Write(src)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to write state",
+                        fmt.Sprintf("An error occured while writing the serialized state: %s.", err),
+                ))
+                return diags
+        }
+
+        return diags
+}
+
+func appendInstanceObjectStateV4(rs *states.Resource, is *states.ResourceInstance, key addrs.InstanceKey, obj *states.ResourceInstanceObjectSrc, deposed states.DeposedKey, isV4s []instanceObjectStateV4) ([]instanceObjectStateV4, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        var status string
+        switch obj.Status {
+        case states.ObjectReady:
+                status = ""
+        case states.ObjectTainted:
+                status = "tainted"
+        default:
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to serialize resource instance in state",
+                        fmt.Sprintf("Instance %s has status %s, which cannot be saved in state.", rs.Addr.Instance(key), obj.Status),
+                ))
+        }
+
+        var privateRaw []byte
+        if len(obj.Private) > 0 {
+                privateRaw = obj.Private
+        }
+
+        deps := make([]string, len(obj.Dependencies))
+        for i, depAddr := range obj.Dependencies {
+                deps[i] = depAddr.String()
+        }
+
+        var rawKey interface{}
+        switch tk := key.(type) {
+        case addrs.IntKey:
+                rawKey = int(tk)
+        case addrs.StringKey:
+                rawKey = string(tk)
+        default:
+                if key != addrs.NoKey {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to serialize resource instance in state",
+                                fmt.Sprintf("Instance %s has an unsupported instance key: %#v.", rs.Addr.Instance(key), key),
+                        ))
+                }
+        }
+
+        return append(isV4s, instanceObjectStateV4{
+                IndexKey:       rawKey,
+                Deposed:        string(deposed),
+                Status:         status,
+                SchemaVersion:  obj.SchemaVersion,
+                AttributesFlat: obj.AttrsFlat,
+                AttributesRaw:  obj.AttrsJSON,
+                PrivateRaw:     privateRaw,
+                Dependencies:   deps,
+        }), diags
+}
+
+type stateV4 struct {
+        Version          stateVersionV4           `json:"version"`
+        TerraformVersion string                   `json:"terraform_version"`
+        Serial           uint64                   `json:"serial"`
+        Lineage          string                   `json:"lineage"`
+        RootOutputs      map[string]outputStateV4 `json:"outputs"`
+        Resources        []resourceStateV4        `json:"resources"`
+}
+
+// normalize makes some in-place changes to normalize the way items are
+// stored to ensure that two functionally-equivalent states will be stored
+// identically.
+func (s *stateV4) normalize() {
+        sort.Stable(sortResourcesV4(s.Resources))
+        for _, rs := range s.Resources {
+                sort.Stable(sortInstancesV4(rs.Instances))
+        }
+}
+
+type outputStateV4 struct {
+        ValueRaw     json.RawMessage `json:"value"`
+        ValueTypeRaw json.RawMessage `json:"type"`
+        Sensitive    bool            `json:"sensitive,omitempty"`
+}
+
+type resourceStateV4 struct {
+        Module         string                  `json:"module,omitempty"`
+        Mode           string                  `json:"mode"`
+        Type           string                  `json:"type"`
+        Name           string                  `json:"name"`
+        EachMode       string                  `json:"each,omitempty"`
+        ProviderConfig string                  `json:"provider"`
+        Instances      []instanceObjectStateV4 `json:"instances"`
+}
+
+type instanceObjectStateV4 struct {
+        IndexKey interface{} `json:"index_key,omitempty"`
+        Status   string      `json:"status,omitempty"`
+        Deposed  string      `json:"deposed,omitempty"`
+
+        SchemaVersion  uint64            `json:"schema_version"`
+        AttributesRaw  json.RawMessage   `json:"attributes,omitempty"`
+        AttributesFlat map[string]string `json:"attributes_flat,omitempty"`
+
+        PrivateRaw []byte `json:"private,omitempty"`
+
+        Dependencies []string `json:"depends_on,omitempty"`
+}
+
+// stateVersionV4 is a weird special type we use to produce our hard-coded
+// "version": 4 in the JSON serialization.
+type stateVersionV4 struct{}
+
+func (sv stateVersionV4) MarshalJSON() ([]byte, error) {
+        return []byte{'4'}, nil
+}
+
+func (sv stateVersionV4) UnmarshalJSON([]byte) error {
+        // Nothing to do: we already know we're version 4
+        return nil
+}
+
+type sortResourcesV4 []resourceStateV4
+
+func (sr sortResourcesV4) Len() int      { return len(sr) }
+func (sr sortResourcesV4) Swap(i, j int) { sr[i], sr[j] = sr[j], sr[i] }
+func (sr sortResourcesV4) Less(i, j int) bool {
+        switch {
+        case sr[i].Mode != sr[j].Mode:
+                return sr[i].Mode < sr[j].Mode
+        case sr[i].Type != sr[j].Type:
+                return sr[i].Type < sr[j].Type
+        case sr[i].Name != sr[j].Name:
+                return sr[i].Name < sr[j].Name
+        default:
+                return false
+        }
+}
+
+type sortInstancesV4 []instanceObjectStateV4
+
+func (si sortInstancesV4) Len() int      { return len(si) }
+func (si sortInstancesV4) Swap(i, j int) { si[i], si[j] = si[j], si[i] }
+func (si sortInstancesV4) Less(i, j int) bool {
+        ki := si[i].IndexKey
+        kj := si[j].IndexKey
+        if ki != kj {
+                if (ki == nil) != (kj == nil) {
+                        return ki == nil
+                }
+                if kii, isInt := ki.(int); isInt {
+                        if kji, isInt := kj.(int); isInt {
+                                return kii < kji
+                        }
+                        return true
+                }
+                if kis, isStr := ki.(string); isStr {
+                        if kjs, isStr := kj.(string); isStr {
+                                return kis < kjs
+                        }
+                        return true
+                }
+        }
+        if si[i].Deposed != si[j].Deposed {
+                return si[i].Deposed < si[j].Deposed
+        }
+        return false
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/write.go b/vendor/github.com/hashicorp/terraform/states/statefile/write.go
new file mode 100644
index 0000000..548ba8a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/write.go
@@ -0,0 +1,17 @@
+package statefile
+
+import (
+        "io"
+
+        tfversion "github.com/hashicorp/terraform/version"
+)
+
+// Write writes the given state to the given writer in the current state
+// serialization format.
+func Write(s *File, w io.Writer) error {
+        // Always record the current terraform version in the state.
+        s.TerraformVersion = tfversion.SemVer
+
+        diags := writeStateV4(s, w)
+        return diags.Err()
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/sync.go b/vendor/github.com/hashicorp/terraform/states/sync.go
new file mode 100644
index 0000000..a377446
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/sync.go
@@ -0,0 +1,537 @@
+package states
+
+import (
+        "log"
+        "sync"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// SyncState is a wrapper around State that provides concurrency-safe access to
+// various common operations that occur during a Terraform graph walk, or other
+// similar concurrent contexts.
+//
+// When a SyncState wrapper is in use, no concurrent direct access to the
+// underlying objects is permitted unless the caller first acquires an explicit
+// lock, using the Lock and Unlock methods. Most callers should _not_
+// explicitly lock, and should instead use the other methods of this type that
+// handle locking automatically.
+//
+// Since SyncState is able to safely consolidate multiple updates into a single
+// atomic operation, many of its methods are at a higher level than those
+// of the underlying types, and operate on the state as a whole rather than
+// on individual sub-structures of the state.
+//
+// SyncState can only protect against races within its own methods. It cannot
+// provide any guarantees about the order in which concurrent operations will
+// be processed, so callers may still need to employ higher-level techniques
+// for ensuring correct operation sequencing, such as building and walking
+// a dependency graph.
+type SyncState struct {
+        state *State
+        lock  sync.RWMutex
+}
+
+// Module returns a snapshot of the state of the module instance with the given
+// address, or nil if no such module is tracked.
+//
+// The return value is a pointer to a copy of the module state, which the
+// caller may then freely access and mutate. However, since the module state
+// tends to be a large data structure with many child objects, where possible
+// callers should prefer to use a more granular accessor to access a child
+// module directly, and thus reduce the amount of copying required.
+func (s *SyncState) Module(addr addrs.ModuleInstance) *Module {
+        s.lock.RLock()
+        ret := s.state.Module(addr).DeepCopy()
+        s.lock.RUnlock()
+        return ret
+}
+
+// RemoveModule removes the entire state for the given module, taking with
+// it any resources associated with the module. This should generally be
+// called only for modules whose resources have all been destroyed, but
+// that is not enforced by this method.
+func (s *SyncState) RemoveModule(addr addrs.ModuleInstance) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        s.state.RemoveModule(addr)
+}
+
+// OutputValue returns a snapshot of the state of the output value with the
+// given address, or nil if no such output value is tracked.
+//
+// The return value is a pointer to a copy of the output value state, which the
+// caller may then freely access and mutate.
+func (s *SyncState) OutputValue(addr addrs.AbsOutputValue) *OutputValue {
+        s.lock.RLock()
+        ret := s.state.OutputValue(addr).DeepCopy()
+        s.lock.RUnlock()
+        return ret
+}
+
+// SetOutputValue writes a given output value into the state, overwriting
+// any existing value of the same name.
+//
+// If the module containing the output is not yet tracked in state then it
+// be added as a side-effect.
+func (s *SyncState) SetOutputValue(addr addrs.AbsOutputValue, value cty.Value, sensitive bool) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.SetOutputValue(addr.OutputValue.Name, value, sensitive)
+}
+
+// RemoveOutputValue removes the stored value for the output value with the
+// given address.
+//
+// If this results in its containing module being empty, the module will be
+// pruned from the state as a side-effect.
+func (s *SyncState) RemoveOutputValue(addr addrs.AbsOutputValue) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return
+        }
+        ms.RemoveOutputValue(addr.OutputValue.Name)
+        s.maybePruneModule(addr.Module)
+}
+
+// LocalValue returns the current value associated with the given local value
+// address.
+func (s *SyncState) LocalValue(addr addrs.AbsLocalValue) cty.Value {
+        s.lock.RLock()
+        // cty.Value is immutable, so we don't need any extra copying here.
+        ret := s.state.LocalValue(addr)
+        s.lock.RUnlock()
+        return ret
+}
+
+// SetLocalValue writes a given output value into the state, overwriting
+// any existing value of the same name.
+//
+// If the module containing the local value is not yet tracked in state then it
+// will be added as a side-effect.
+func (s *SyncState) SetLocalValue(addr addrs.AbsLocalValue, value cty.Value) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.SetLocalValue(addr.LocalValue.Name, value)
+}
+
+// RemoveLocalValue removes the stored value for the local value with the
+// given address.
+//
+// If this results in its containing module being empty, the module will be
+// pruned from the state as a side-effect.
+func (s *SyncState) RemoveLocalValue(addr addrs.AbsLocalValue) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return
+        }
+        ms.RemoveLocalValue(addr.LocalValue.Name)
+        s.maybePruneModule(addr.Module)
+}
+
+// Resource returns a snapshot of the state of the resource with the given
+// address, or nil if no such resource is tracked.
+//
+// The return value is a pointer to a copy of the resource state, which the
+// caller may then freely access and mutate.
+func (s *SyncState) Resource(addr addrs.AbsResource) *Resource {
+        s.lock.RLock()
+        ret := s.state.Resource(addr).DeepCopy()
+        s.lock.RUnlock()
+        return ret
+}
+
+// ResourceInstance returns a snapshot of the state the resource instance with
+// the given address, or nil if no such instance is tracked.
+//
+// The return value is a pointer to a copy of the instance state, which the
+// caller may then freely access and mutate.
+func (s *SyncState) ResourceInstance(addr addrs.AbsResourceInstance) *ResourceInstance {
+        s.lock.RLock()
+        ret := s.state.ResourceInstance(addr).DeepCopy()
+        s.lock.RUnlock()
+        return ret
+}
+
+// ResourceInstanceObject returns a snapshot of the current instance object
+// of the given generation belonging to the instance with the given address,
+// or nil if no such object is tracked..
+//
+// The return value is a pointer to a copy of the object, which the caller may
+// then freely access and mutate.
+func (s *SyncState) ResourceInstanceObject(addr addrs.AbsResourceInstance, gen Generation) *ResourceInstanceObjectSrc {
+        s.lock.RLock()
+        defer s.lock.RUnlock()
+
+        inst := s.state.ResourceInstance(addr)
+        if inst == nil {
+                return nil
+        }
+        return inst.GetGeneration(gen).DeepCopy()
+}
+
+// SetResourceMeta updates the resource-level metadata for the resource at
+// the given address, creating the containing module state and resource state
+// as a side-effect if not already present.
+func (s *SyncState) SetResourceMeta(addr addrs.AbsResource, eachMode EachMode, provider addrs.AbsProviderConfig) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.SetResourceMeta(addr.Resource, eachMode, provider)
+}
+
+// RemoveResource removes the entire state for the given resource, taking with
+// it any instances associated with the resource. This should generally be
+// called only for resource objects whose instances have all been destroyed,
+// but that is not enforced by this method. (Use RemoveResourceIfEmpty instead
+// to safely check first.)
+func (s *SyncState) RemoveResource(addr addrs.AbsResource) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.RemoveResource(addr.Resource)
+        s.maybePruneModule(addr.Module)
+}
+
+// RemoveResourceIfEmpty is similar to RemoveResource but first checks to
+// make sure there are no instances or objects left in the resource.
+//
+// Returns true if the resource was removed, or false if remaining child
+// objects prevented its removal. Returns true also if the resource was
+// already absent, and thus no action needed to be taken.
+func (s *SyncState) RemoveResourceIfEmpty(addr addrs.AbsResource) bool {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return true // nothing to do
+        }
+        rs := ms.Resource(addr.Resource)
+        if rs == nil {
+                return true // nothing to do
+        }
+        if len(rs.Instances) != 0 {
+                // We don't check here for the possibility of instances that exist
+                // but don't have any objects because it's the responsibility of the
+                // instance-mutation methods to prune those away automatically.
+                return false
+        }
+        ms.RemoveResource(addr.Resource)
+        s.maybePruneModule(addr.Module)
+        return true
+}
+
+// MaybeFixUpResourceInstanceAddressForCount deals with the situation where a
+// resource has changed from having "count" set to not set, or vice-versa, and
+// so we need to rename the zeroth instance key to no key at all, or vice-versa.
+//
+// Set countEnabled to true if the resource has count set in its new
+// configuration, or false if it does not.
+//
+// The state is modified in-place if necessary, moving a resource instance
+// between the two addresses. The return value is true if a change was made,
+// and false otherwise.
+func (s *SyncState) MaybeFixUpResourceInstanceAddressForCount(addr addrs.AbsResource, countEnabled bool) bool {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return false
+        }
+
+        relAddr := addr.Resource
+        rs := ms.Resource(relAddr)
+        if rs == nil {
+                return false
+        }
+        huntKey := addrs.NoKey
+        replaceKey := addrs.InstanceKey(addrs.IntKey(0))
+        if !countEnabled {
+                huntKey, replaceKey = replaceKey, huntKey
+        }
+
+        is, exists := rs.Instances[huntKey]
+        if !exists {
+                return false
+        }
+
+        if _, exists := rs.Instances[replaceKey]; exists {
+                // If the replacement key also exists then we'll do nothing and keep both.
+                return false
+        }
+
+        // If we get here then we need to "rename" from hunt to replace
+        rs.Instances[replaceKey] = is
+        delete(rs.Instances, huntKey)
+        return true
+}
+
+// SetResourceInstanceCurrent saves the given instance object as the current
+// generation of the resource instance with the given address, simulataneously
+// updating the recorded provider configuration address, dependencies, and
+// resource EachMode.
+//
+// Any existing current instance object for the given resource is overwritten.
+// Set obj to nil to remove the primary generation object altogether. If there
+// are no deposed objects then the instance as a whole will be removed, which
+// may in turn also remove the containing module if it becomes empty.
+//
+// The caller must ensure that the given ResourceInstanceObject is not
+// concurrently mutated during this call, but may be freely used again once
+// this function returns.
+//
+// The provider address and "each mode" are resource-wide settings and so they
+// are updated for all other instances of the same resource as a side-effect of
+// this call.
+//
+// If the containing module for this resource or the resource itself are not
+// already tracked in state then they will be added as a side-effect.
+func (s *SyncState) SetResourceInstanceCurrent(addr addrs.AbsResourceInstance, obj *ResourceInstanceObjectSrc, provider addrs.AbsProviderConfig) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.SetResourceInstanceCurrent(addr.Resource, obj.DeepCopy(), provider)
+        s.maybePruneModule(addr.Module)
+}
+
+// SetResourceInstanceDeposed saves the given instance object as a deposed
+// generation of the resource instance with the given address and deposed key.
+//
+// Call this method only for pre-existing deposed objects that already have
+// a known DeposedKey. For example, this method is useful if reloading objects
+// that were persisted to a state file. To mark the current object as deposed,
+// use DeposeResourceInstanceObject instead.
+//
+// The caller must ensure that the given ResourceInstanceObject is not
+// concurrently mutated during this call, but may be freely used again once
+// this function returns.
+//
+// The resource that contains the given instance must already exist in the
+// state, or this method will panic. Use Resource to check first if its
+// presence is not already guaranteed.
+//
+// Any existing current instance object for the given resource and deposed key
+// is overwritten. Set obj to nil to remove the deposed object altogether. If
+// the instance is left with no objects after this operation then it will
+// be removed from its containing resource altogether.
+//
+// If the containing module for this resource or the resource itself are not
+// already tracked in state then they will be added as a side-effect.
+func (s *SyncState) SetResourceInstanceDeposed(addr addrs.AbsResourceInstance, key DeposedKey, obj *ResourceInstanceObjectSrc, provider addrs.AbsProviderConfig) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.SetResourceInstanceDeposed(addr.Resource, key, obj.DeepCopy(), provider)
+        s.maybePruneModule(addr.Module)
+}
+
+// DeposeResourceInstanceObject moves the current instance object for the
+// given resource instance address into the deposed set, leaving the instance
+// without a current object.
+//
+// The return value is the newly-allocated deposed key, or NotDeposed if the
+// given instance is already lacking a current object.
+//
+// If the containing module for this resource or the resource itself are not
+// already tracked in state then there cannot be a current object for the
+// given instance, and so NotDeposed will be returned without modifying the
+// state at all.
+func (s *SyncState) DeposeResourceInstanceObject(addr addrs.AbsResourceInstance) DeposedKey {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return NotDeposed
+        }
+
+        return ms.deposeResourceInstanceObject(addr.Resource, NotDeposed)
+}
+
+// DeposeResourceInstanceObjectForceKey is like DeposeResourceInstanceObject
+// but uses a pre-allocated key. It's the caller's responsibility to ensure
+// that there aren't any races to use a particular key; this method will panic
+// if the given key is already in use.
+func (s *SyncState) DeposeResourceInstanceObjectForceKey(addr addrs.AbsResourceInstance, forcedKey DeposedKey) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        if forcedKey == NotDeposed {
+                // Usage error: should use DeposeResourceInstanceObject in this case
+                panic("DeposeResourceInstanceObjectForceKey called without forced key")
+        }
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return // Nothing to do, since there can't be any current object either.
+        }
+
+        ms.deposeResourceInstanceObject(addr.Resource, forcedKey)
+}
+
+// ForgetResourceInstanceAll removes the record of all objects associated with
+// the specified resource instance, if present. If not present, this is a no-op.
+func (s *SyncState) ForgetResourceInstanceAll(addr addrs.AbsResourceInstance) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return
+        }
+        ms.ForgetResourceInstanceAll(addr.Resource)
+        s.maybePruneModule(addr.Module)
+}
+
+// ForgetResourceInstanceDeposed removes the record of the deposed object with
+// the given address and key, if present. If not present, this is a no-op.
+func (s *SyncState) ForgetResourceInstanceDeposed(addr addrs.AbsResourceInstance, key DeposedKey) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return
+        }
+        ms.ForgetResourceInstanceDeposed(addr.Resource, key)
+        s.maybePruneModule(addr.Module)
+}
+
+// MaybeRestoreResourceInstanceDeposed will restore the deposed object with the
+// given key on the specified resource as the current object for that instance
+// if and only if that would not cause us to forget an existing current
+// object for that instance.
+//
+// Returns true if the object was restored to current, or false if no change
+// was made at all.
+func (s *SyncState) MaybeRestoreResourceInstanceDeposed(addr addrs.AbsResourceInstance, key DeposedKey) bool {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        if key == NotDeposed {
+                panic("MaybeRestoreResourceInstanceDeposed called without DeposedKey")
+        }
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                // Nothing to do, since the specified deposed object cannot exist.
+                return false
+        }
+
+        return ms.maybeRestoreResourceInstanceDeposed(addr.Resource, key)
+}
+
+// RemovePlannedResourceInstanceObjects removes from the state any resource
+// instance objects that have the status ObjectPlanned, indiciating that they
+// are just transient placeholders created during planning.
+//
+// Note that this does not restore any "ready" or "tainted" object that might
+// have been present before the planned object was written. The only real use
+// for this method is in preparing the state created during a refresh walk,
+// where we run the planning step for certain instances just to create enough
+// information to allow correct expression evaluation within provider and
+// data resource blocks. Discarding planned instances in that case is okay
+// because the refresh phase only creates planned objects to stand in for
+// objects that don't exist yet, and thus the planned object must have been
+// absent before by definition.
+func (s *SyncState) RemovePlannedResourceInstanceObjects() {
+        // TODO: Merge together the refresh and plan phases into a single walk,
+        // so we can remove the need to create this "partial plan" during refresh
+        // that we then need to clean up before proceeding.
+
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        for _, ms := range s.state.Modules {
+                moduleAddr := ms.Addr
+
+                for _, rs := range ms.Resources {
+                        resAddr := rs.Addr
+
+                        for ik, is := range rs.Instances {
+                                instAddr := resAddr.Instance(ik)
+
+                                if is.Current != nil && is.Current.Status == ObjectPlanned {
+                                        // Setting the current instance to nil removes it from the
+                                        // state altogether if there are not also deposed instances.
+                                        ms.SetResourceInstanceCurrent(instAddr, nil, rs.ProviderConfig)
+                                }
+
+                                for dk, obj := range is.Deposed {
+                                        // Deposed objects should never be "planned", but we'll
+                                        // do this anyway for the sake of completeness.
+                                        if obj.Status == ObjectPlanned {
+                                                ms.ForgetResourceInstanceDeposed(instAddr, dk)
+                                        }
+                                }
+                        }
+                }
+
+                // We may have deleted some objects, which means that we may have
+                // left a module empty, and so we must prune to preserve the invariant
+                // that only the root module is allowed to be empty.
+                s.maybePruneModule(moduleAddr)
+        }
+}
+
+// Lock acquires an explicit lock on the state, allowing direct read and write
+// access to the returned state object. The caller must call Unlock once
+// access is no longer needed, and then immediately discard the state pointer
+// pointer.
+//
+// Most callers should not use this. Instead, use the concurrency-safe
+// accessors and mutators provided directly on SyncState.
+func (s *SyncState) Lock() *State {
+        s.lock.Lock()
+        return s.state
+}
+
+// Unlock releases a lock previously acquired by Lock, at which point the
+// caller must cease all use of the state pointer that was returned.
+//
+// Do not call this method except to end an explicit lock acquired by
+// Lock. If a caller calls Unlock without first holding the lock, behavior
+// is undefined.
+func (s *SyncState) Unlock() {
+        s.lock.Unlock()
+}
+
+// maybePruneModule will remove a module from the state altogether if it is
+// empty, unless it's the root module which must always be present.
+//
+// This helper method is not concurrency-safe on its own, so must only be
+// called while the caller is already holding the lock for writing.
+func (s *SyncState) maybePruneModule(addr addrs.ModuleInstance) {
+        if addr.IsRoot() {
+                // We never prune the root.
+                return
+        }
+
+        ms := s.state.Module(addr)
+        if ms == nil {
+                return
+        }
+
+        if ms.empty() {
+                log.Printf("[TRACE] states.SyncState: pruning %s because it is empty", addr)
+                s.state.RemoveModule(addr)
+        }
+}