1 files changed, 46 insertions, 6 deletions

diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go b/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
index 0033e01..6b809a2 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
@@ -112,11 +112,12 @@ func (n *EvalValidateProvider) Eval(ctx EvalContext) (interface{}, error) {
 // the configuration of a provisioner belonging to a resource. The provisioner
 // config is expected to contain the merged connection configurations.
 type EvalValidateProvisioner struct {
-        ResourceAddr     addrs.Resource
-        Provisioner      *provisioners.Interface
-        Schema           **configschema.Block
-        Config           *configs.Provisioner
-        ResourceHasCount bool
+        ResourceAddr       addrs.Resource
+        Provisioner        *provisioners.Interface
+        Schema             **configschema.Block
+        Config             *configs.Provisioner
+        ResourceHasCount   bool
+        ResourceHasForEach bool
 }
 
 func (n *EvalValidateProvisioner) Eval(ctx EvalContext) (interface{}, error) {
@@ -198,6 +199,19 @@ func (n *EvalValidateProvisioner) evaluateBlock(ctx EvalContext, body hcl.Body,
                 // expected type since none of these elements are known at this
                 // point anyway.
                 selfAddr = n.ResourceAddr.Instance(addrs.IntKey(0))
+        } else if n.ResourceHasForEach {
+                // For a resource that has for_each, we allow each.value and each.key
+                // but don't know at this stage what it will return.
+                keyData = InstanceKeyEvalData{
+                        EachKey:   cty.UnknownVal(cty.String),
+                        EachValue: cty.DynamicVal,
+                }
+
+                // "self" can't point to an unknown key, but we'll force it to be
+                // key "" here, which should return an unknown value of the
+                // expected type since none of these elements are known at
+                // this point anyway.
+                selfAddr = n.ResourceAddr.Instance(addrs.StringKey(""))
         }
 
         return ctx.EvaluateBlock(body, schema, selfAddr, keyData)
@@ -370,10 +384,21 @@ func (n *EvalValidateResource) Eval(ctx EvalContext) (interface{}, error) {
                 diags = diags.Append(countDiags)
         }
 
+        if n.Config.ForEach != nil {
+                keyData = InstanceKeyEvalData{
+                        EachKey:   cty.UnknownVal(cty.String),
+                        EachValue: cty.UnknownVal(cty.DynamicPseudoType),
+                }
+
+                // Evaluate the for_each expression here so we can expose the diagnostics
+                forEachDiags := n.validateForEach(ctx, n.Config.ForEach)
+                diags = diags.Append(forEachDiags)
+        }
+
         for _, traversal := range n.Config.DependsOn {
                 ref, refDiags := addrs.ParseRef(traversal)
                 diags = diags.Append(refDiags)
-                if len(ref.Remaining) != 0 {
+                if !refDiags.HasErrors() && len(ref.Remaining) != 0 {
                         diags = diags.Append(&hcl.Diagnostic{
                                 Severity: hcl.DiagError,
                                 Summary:  "Invalid depends_on reference",
@@ -542,3 +567,18 @@ func (n *EvalValidateResource) validateCount(ctx EvalContext, expr hcl.Expressio
 
         return diags
 }
+
+func (n *EvalValidateResource) validateForEach(ctx EvalContext, expr hcl.Expression) (diags tfdiags.Diagnostics) {
+        _, known, forEachDiags := evaluateResourceForEachExpressionKnown(expr, ctx)
+        // If the value isn't known then that's the best we can do for now, but
+        // we'll check more thoroughly during the plan walk
+        if !known {
+                return diags
+        }
+
+        if forEachDiags.HasErrors() {
+                diags = diags.Append(forEachDiags)
+        }
+
+        return diags
+}