1 files changed, 21 insertions, 5 deletions

diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go b/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
index b7acfb0..695b5fe 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
@@ -4,7 +4,6 @@ import (
         "bytes"
         "fmt"
         "log"
-        "reflect"
         "strings"
 
         "github.com/hashicorp/hcl2/hcl"
@@ -134,7 +133,8 @@ func (n *EvalDiff) Eval(ctx EvalContext) (interface{}, error) {
                 // Should be caught during validation, so we don't bother with a pretty error here
                 return nil, fmt.Errorf("provider does not support resource type %q", n.Addr.Resource.Type)
         }
-        keyData := EvalDataForInstanceKey(n.Addr.Key)
+        forEach, _ := evaluateResourceForEachExpression(n.Config.ForEach, ctx)
+        keyData := EvalDataForInstanceKey(n.Addr.Key, forEach)
         configVal, _, configDiags := ctx.EvaluateBlock(config.Config, schema, nil, keyData)
         diags = diags.Append(configDiags)
         if configDiags.HasErrors() {
@@ -174,6 +174,20 @@ func (n *EvalDiff) Eval(ctx EvalContext) (interface{}, error) {
                 }
         }
 
+        log.Printf("[TRACE] Re-validating config for %q", n.Addr.Absolute(ctx.Path()))
+        // Allow the provider to validate the final set of values.
+        // The config was statically validated early on, but there may have been
+        // unknown values which the provider could not validate at the time.
+        validateResp := provider.ValidateResourceTypeConfig(
+                providers.ValidateResourceTypeConfigRequest{
+                        TypeName: n.Addr.Resource.Type,
+                        Config:   configVal,
+                },
+        )
+        if validateResp.Diagnostics.HasErrors() {
+                return nil, validateResp.Diagnostics.InConfigBody(config.Config).Err()
+        }
+
         // The provider gets an opportunity to customize the proposed new value,
         // which in turn produces the _planned_ new value.
         resp := provider.PlanResourceChange(providers.PlanResourceChangeRequest{
@@ -448,8 +462,9 @@ func (n *EvalDiff) Eval(ctx EvalContext) (interface{}, error) {
                         // must _also_ record the returned change in the active plan,
                         // which the expression evaluator will use in preference to this
                         // incomplete value recorded in the state.
-                        Status: states.ObjectPlanned,
-                        Value:  plannedNewVal,
+                        Status:  states.ObjectPlanned,
+                        Value:   plannedNewVal,
+                        Private: plannedPrivate,
                 }
         }
 
@@ -517,7 +532,7 @@ func processIgnoreChangesIndividual(prior, proposed cty.Value, ignoreChanges []h
                 // away any deeper values we already produced at that point.
                 var ignoreTraversal hcl.Traversal
                 for i, candidate := range ignoreChangesPath {
-                        if reflect.DeepEqual(path, candidate) {
+                        if path.Equals(candidate) {
                                 ignoreTraversal = ignoreChanges[i]
                         }
                 }
@@ -790,6 +805,7 @@ func (n *EvalDiffDestroy) Eval(ctx EvalContext) (interface{}, error) {
                         Before: state.Value,
                         After:  cty.NullVal(cty.DynamicPseudoType),
                 },
+                Private:      state.Private,
                 ProviderAddr: n.ProviderAddr,
         }