24 files changed, 357 insertions, 103 deletions

diff --git a/vendor/github.com/hashicorp/terraform/terraform/diff.go b/vendor/github.com/hashicorp/terraform/terraform/diff.go
index 7a6ef3d..323462f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/diff.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/diff.go
@@ -13,7 +13,6 @@ import (
         "sync"
 
         "github.com/hashicorp/terraform/addrs"
-        "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/config/hcl2shim"
         "github.com/hashicorp/terraform/configs/configschema"
         "github.com/zclconf/go-cty/cty"
@@ -665,7 +664,7 @@ func (d *InstanceDiff) applySingleAttrDiff(path []string, attrs map[string]strin
         old, exists := attrs[currentKey]
 
         if diff != nil && diff.NewComputed {
-                result[attr] = config.UnknownVariableValue
+                result[attr] = hcl2shim.UnknownVariableValue
                 return result, nil
         }
 
@@ -673,7 +672,7 @@ func (d *InstanceDiff) applySingleAttrDiff(path []string, attrs map[string]strin
         // This only applied to top-level "id" fields.
         if attr == "id" && len(path) == 1 {
                 if old == "" {
-                        result[attr] = config.UnknownVariableValue
+                        result[attr] = hcl2shim.UnknownVariableValue
                 } else {
                         result[attr] = old
                 }
@@ -704,8 +703,8 @@ func (d *InstanceDiff) applySingleAttrDiff(path []string, attrs map[string]strin
         // check for missmatched diff values
         if exists &&
                 old != diff.Old &&
-                old != config.UnknownVariableValue &&
-                diff.Old != config.UnknownVariableValue {
+                old != hcl2shim.UnknownVariableValue &&
+                diff.Old != hcl2shim.UnknownVariableValue {
                 return result, fmt.Errorf("diff apply conflict for %s: diff expects %q, but prior value has %q", attr, diff.Old, old)
         }
 
@@ -723,7 +722,7 @@ func (d *InstanceDiff) applySingleAttrDiff(path []string, attrs map[string]strin
         }
 
         if attrSchema.Computed && diff.NewComputed {
-                result[attr] = config.UnknownVariableValue
+                result[attr] = hcl2shim.UnknownVariableValue
                 return result, nil
         }
 
@@ -756,7 +755,7 @@ func (d *InstanceDiff) applyCollectionDiff(path []string, attrs map[string]strin
                         }
 
                         if diff.NewComputed {
-                                result[k[len(prefix):]] = config.UnknownVariableValue
+                                result[k[len(prefix):]] = hcl2shim.UnknownVariableValue
                                 return result, nil
                         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go b/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go
index 09313f7..422f372 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go
@@ -61,7 +61,8 @@ func (n *EvalApply) Eval(ctx EvalContext) (interface{}, error) {
         configVal := cty.NullVal(cty.DynamicPseudoType)
         if n.Config != nil {
                 var configDiags tfdiags.Diagnostics
-                keyData := EvalDataForInstanceKey(n.Addr.Key)
+                forEach, _ := evaluateResourceForEachExpression(n.Config.ForEach, ctx)
+                keyData := EvalDataForInstanceKey(n.Addr.Key, forEach)
                 configVal, _, configDiags = ctx.EvaluateBlock(n.Config.Config, schema, nil, keyData)
                 diags = diags.Append(configDiags)
                 if configDiags.HasErrors() {
@@ -548,7 +549,8 @@ func (n *EvalApplyProvisioners) apply(ctx EvalContext, provs []*configs.Provisio
                 provisioner := ctx.Provisioner(prov.Type)
                 schema := ctx.ProvisionerSchema(prov.Type)
 
-                keyData := EvalDataForInstanceKey(instanceAddr.Key)
+                // TODO the for_each val is not added here, which might causes issues with provisioners
+                keyData := EvalDataForInstanceKey(instanceAddr.Key, nil)
 
                 // Evaluate the main provisioner configuration.
                 config, _, configDiags := ctx.EvaluateBlock(prov.Config, schema, instanceAddr, keyData)
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go b/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
index b7acfb0..695b5fe 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
@@ -4,7 +4,6 @@ import (
         "bytes"
         "fmt"
         "log"
-        "reflect"
         "strings"
 
         "github.com/hashicorp/hcl2/hcl"
@@ -134,7 +133,8 @@ func (n *EvalDiff) Eval(ctx EvalContext) (interface{}, error) {
                 // Should be caught during validation, so we don't bother with a pretty error here
                 return nil, fmt.Errorf("provider does not support resource type %q", n.Addr.Resource.Type)
         }
-        keyData := EvalDataForInstanceKey(n.Addr.Key)
+        forEach, _ := evaluateResourceForEachExpression(n.Config.ForEach, ctx)
+        keyData := EvalDataForInstanceKey(n.Addr.Key, forEach)
         configVal, _, configDiags := ctx.EvaluateBlock(config.Config, schema, nil, keyData)
         diags = diags.Append(configDiags)
         if configDiags.HasErrors() {
@@ -174,6 +174,20 @@ func (n *EvalDiff) Eval(ctx EvalContext) (interface{}, error) {
                 }
         }
 
+        log.Printf("[TRACE] Re-validating config for %q", n.Addr.Absolute(ctx.Path()))
+        // Allow the provider to validate the final set of values.
+        // The config was statically validated early on, but there may have been
+        // unknown values which the provider could not validate at the time.
+        validateResp := provider.ValidateResourceTypeConfig(
+                providers.ValidateResourceTypeConfigRequest{
+                        TypeName: n.Addr.Resource.Type,
+                        Config:   configVal,
+                },
+        )
+        if validateResp.Diagnostics.HasErrors() {
+                return nil, validateResp.Diagnostics.InConfigBody(config.Config).Err()
+        }
+
         // The provider gets an opportunity to customize the proposed new value,
         // which in turn produces the _planned_ new value.
         resp := provider.PlanResourceChange(providers.PlanResourceChangeRequest{
@@ -448,8 +462,9 @@ func (n *EvalDiff) Eval(ctx EvalContext) (interface{}, error) {
                         // must _also_ record the returned change in the active plan,
                         // which the expression evaluator will use in preference to this
                         // incomplete value recorded in the state.
-                        Status: states.ObjectPlanned,
-                        Value:  plannedNewVal,
+                        Status:  states.ObjectPlanned,
+                        Value:   plannedNewVal,
+                        Private: plannedPrivate,
                 }
         }
 
@@ -517,7 +532,7 @@ func processIgnoreChangesIndividual(prior, proposed cty.Value, ignoreChanges []h
                 // away any deeper values we already produced at that point.
                 var ignoreTraversal hcl.Traversal
                 for i, candidate := range ignoreChangesPath {
-                        if reflect.DeepEqual(path, candidate) {
+                        if path.Equals(candidate) {
                                 ignoreTraversal = ignoreChanges[i]
                         }
                 }
@@ -790,6 +805,7 @@ func (n *EvalDiffDestroy) Eval(ctx EvalContext) (interface{}, error) {
                         Before: state.Value,
                         After:  cty.NullVal(cty.DynamicPseudoType),
                 },
+                Private:      state.Private,
                 ProviderAddr: n.ProviderAddr,
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_for_each.go b/vendor/github.com/hashicorp/terraform/terraform/eval_for_each.go
new file mode 100644
index 0000000..b86bf37
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_for_each.go
@@ -0,0 +1,85 @@
+package terraform
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// evaluateResourceForEachExpression interprets a "for_each" argument on a resource.
+//
+// Returns a cty.Value map, and diagnostics if necessary. It will return nil if
+// the expression is nil, and is used to distinguish between an unset for_each and an
+// empty map
+func evaluateResourceForEachExpression(expr hcl.Expression, ctx EvalContext) (forEach map[string]cty.Value, diags tfdiags.Diagnostics) {
+        forEachMap, known, diags := evaluateResourceForEachExpressionKnown(expr, ctx)
+        if !known {
+                // Attach a diag as we do with count, with the same downsides
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid forEach argument",
+                        Detail:   `The "for_each" value depends on resource attributes that cannot be determined until apply, so Terraform cannot predict how many instances will be created. To work around this, use the -target argument to first apply only the resources that the for_each depends on.`,
+                })
+        }
+        return forEachMap, diags
+}
+
+// evaluateResourceForEachExpressionKnown is like evaluateResourceForEachExpression
+// except that it handles an unknown result by returning an empty map and
+// a known = false, rather than by reporting the unknown value as an error
+// diagnostic.
+func evaluateResourceForEachExpressionKnown(expr hcl.Expression, ctx EvalContext) (forEach map[string]cty.Value, known bool, diags tfdiags.Diagnostics) {
+        if expr == nil {
+                return nil, true, nil
+        }
+
+        forEachVal, forEachDiags := ctx.EvaluateExpr(expr, cty.DynamicPseudoType, nil)
+        diags = diags.Append(forEachDiags)
+        if diags.HasErrors() {
+                return nil, true, diags
+        }
+
+        switch {
+        case forEachVal.IsNull():
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid for_each argument",
+                        Detail:   `The given "for_each" argument value is unsuitable: the given "for_each" argument value is null. A map, or set of strings is allowed.`,
+                        Subject:  expr.Range().Ptr(),
+                })
+                return nil, true, diags
+        case !forEachVal.IsKnown():
+                return map[string]cty.Value{}, false, diags
+        }
+
+        if !forEachVal.CanIterateElements() || forEachVal.Type().IsListType() {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid for_each argument",
+                        Detail:   fmt.Sprintf(`The given "for_each" argument value is unsuitable: the "for_each" argument must be a map, or set of strings, and you have provided a value of type %s.`, forEachVal.Type().FriendlyName()),
+                        Subject:  expr.Range().Ptr(),
+                })
+                return nil, true, diags
+        }
+
+        if forEachVal.Type().IsSetType() {
+                if forEachVal.Type().ElementType() != cty.String {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid for_each set argument",
+                                Detail:   fmt.Sprintf(`The given "for_each" argument value is unsuitable: "for_each" supports maps and sets of strings, but you have provided a set containing type %s.`, forEachVal.Type().ElementType().FriendlyName()),
+                                Subject:  expr.Range().Ptr(),
+                        })
+                        return nil, true, diags
+                }
+        }
+
+        // If the map is empty ({}), return an empty map, because cty will return nil when representing {} AsValueMap
+        if forEachVal.LengthInt() == 0 {
+                return map[string]cty.Value{}, true, diags
+        }
+
+        return forEachVal.AsValueMap(), true, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_read_data.go b/vendor/github.com/hashicorp/terraform/terraform/eval_read_data.go
index 34f2d60..4999480 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_read_data.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_read_data.go
@@ -95,7 +95,8 @@ func (n *EvalReadData) Eval(ctx EvalContext) (interface{}, error) {
         objTy := schema.ImpliedType()
         priorVal := cty.NullVal(objTy) // for data resources, prior is always null because we start fresh every time
 
-        keyData := EvalDataForInstanceKey(n.Addr.Key)
+        forEach, _ := evaluateResourceForEachExpression(n.Config.ForEach, ctx)
+        keyData := EvalDataForInstanceKey(n.Addr.Key, forEach)
 
         var configDiags tfdiags.Diagnostics
         configVal, _, configDiags = ctx.EvaluateBlock(config.Config, schema, nil, keyData)
@@ -179,6 +180,17 @@ func (n *EvalReadData) Eval(ctx EvalContext) (interface{}, error) {
                 )
         }
 
+        log.Printf("[TRACE] Re-validating config for %s", absAddr)
+        validateResp := provider.ValidateDataSourceConfig(
+                providers.ValidateDataSourceConfigRequest{
+                        TypeName: n.Addr.Resource.Type,
+                        Config:   configVal,
+                },
+        )
+        if validateResp.Diagnostics.HasErrors() {
+                return nil, validateResp.Diagnostics.InConfigBody(n.Config.Config).Err()
+        }
+
         // If we get down here then our configuration is complete and we're read
         // to actually call the provider to read the data.
         log.Printf("[TRACE] EvalReadData: %s configuration is complete, so reading from provider", absAddr)
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/eval_refresh.go
index 03bc948..4dfb5b4 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_refresh.go
@@ -55,6 +55,7 @@ func (n *EvalRefresh) Eval(ctx EvalContext) (interface{}, error) {
         req := providers.ReadResourceRequest{
                 TypeName:   n.Addr.Resource.Type,
                 PriorState: priorVal,
+                Private:    state.Private,
         }
 
         provider := *n.Provider
@@ -87,6 +88,7 @@ func (n *EvalRefresh) Eval(ctx EvalContext) (interface{}, error) {
 
         newState := state.DeepCopy()
         newState.Value = resp.NewState
+        newState.Private = resp.Private
 
         // Call post-refresh hook
         err = ctx.Hook(func(h Hook) (HookAction, error) {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_state.go b/vendor/github.com/hashicorp/terraform/terraform/eval_state.go
index d506ce3..b611113 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_state.go
@@ -424,15 +424,21 @@ func (n *EvalWriteResourceState) Eval(ctx EvalContext) (interface{}, error) {
                 return nil, diags.Err()
         }
 
-        // Currently we ony support NoEach and EachList, because for_each support
-        // is not fully wired up across Terraform. Once for_each support is added,
-        // we'll need to handle that here too, setting states.EachMap if the
-        // assigned expression is a map.
         eachMode := states.NoEach
         if count >= 0 { // -1 signals "count not set"
                 eachMode = states.EachList
         }
 
+        forEach, forEachDiags := evaluateResourceForEachExpression(n.Config.ForEach, ctx)
+        diags = diags.Append(forEachDiags)
+        if forEachDiags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        if forEach != nil {
+                eachMode = states.EachMap
+        }
+
         // This method takes care of all of the business logic of updating this
         // while ensuring that any existing instances are preserved, etc.
         state.SetResourceMeta(absAddr, eachMode, n.ProviderAddr)
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go b/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
index 0033e01..6b809a2 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
@@ -112,11 +112,12 @@ func (n *EvalValidateProvider) Eval(ctx EvalContext) (interface{}, error) {
 // the configuration of a provisioner belonging to a resource. The provisioner
 // config is expected to contain the merged connection configurations.
 type EvalValidateProvisioner struct {
-        ResourceAddr     addrs.Resource
-        Provisioner      *provisioners.Interface
-        Schema           **configschema.Block
-        Config           *configs.Provisioner
-        ResourceHasCount bool
+        ResourceAddr       addrs.Resource
+        Provisioner        *provisioners.Interface
+        Schema             **configschema.Block
+        Config             *configs.Provisioner
+        ResourceHasCount   bool
+        ResourceHasForEach bool
 }
 
 func (n *EvalValidateProvisioner) Eval(ctx EvalContext) (interface{}, error) {
@@ -198,6 +199,19 @@ func (n *EvalValidateProvisioner) evaluateBlock(ctx EvalContext, body hcl.Body,
                 // expected type since none of these elements are known at this
                 // point anyway.
                 selfAddr = n.ResourceAddr.Instance(addrs.IntKey(0))
+        } else if n.ResourceHasForEach {
+                // For a resource that has for_each, we allow each.value and each.key
+                // but don't know at this stage what it will return.
+                keyData = InstanceKeyEvalData{
+                        EachKey:   cty.UnknownVal(cty.String),
+                        EachValue: cty.DynamicVal,
+                }
+
+                // "self" can't point to an unknown key, but we'll force it to be
+                // key "" here, which should return an unknown value of the
+                // expected type since none of these elements are known at
+                // this point anyway.
+                selfAddr = n.ResourceAddr.Instance(addrs.StringKey(""))
         }
 
         return ctx.EvaluateBlock(body, schema, selfAddr, keyData)
@@ -370,10 +384,21 @@ func (n *EvalValidateResource) Eval(ctx EvalContext) (interface{}, error) {
                 diags = diags.Append(countDiags)
         }
 
+        if n.Config.ForEach != nil {
+                keyData = InstanceKeyEvalData{
+                        EachKey:   cty.UnknownVal(cty.String),
+                        EachValue: cty.UnknownVal(cty.DynamicPseudoType),
+                }
+
+                // Evaluate the for_each expression here so we can expose the diagnostics
+                forEachDiags := n.validateForEach(ctx, n.Config.ForEach)
+                diags = diags.Append(forEachDiags)
+        }
+
         for _, traversal := range n.Config.DependsOn {
                 ref, refDiags := addrs.ParseRef(traversal)
                 diags = diags.Append(refDiags)
-                if len(ref.Remaining) != 0 {
+                if !refDiags.HasErrors() && len(ref.Remaining) != 0 {
                         diags = diags.Append(&hcl.Diagnostic{
                                 Severity: hcl.DiagError,
                                 Summary:  "Invalid depends_on reference",
@@ -542,3 +567,18 @@ func (n *EvalValidateResource) validateCount(ctx EvalContext, expr hcl.Expressio
 
         return diags
 }
+
+func (n *EvalValidateResource) validateForEach(ctx EvalContext, expr hcl.Expression) (diags tfdiags.Diagnostics) {
+        _, known, forEachDiags := evaluateResourceForEachExpressionKnown(expr, ctx)
+        // If the value isn't known then that's the best we can do for now, but
+        // we'll check more thoroughly during the plan walk
+        if !known {
+                return diags
+        }
+
+        if forEachDiags.HasErrors() {
+                diags = diags.Append(forEachDiags)
+        }
+
+        return diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_variable.go b/vendor/github.com/hashicorp/terraform/terraform/eval_variable.go
index 68adf76..ea46973 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_variable.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_variable.go
@@ -12,6 +12,7 @@ import (
         "github.com/hashicorp/terraform/addrs"
 
         "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
         "github.com/hashicorp/terraform/config/module"
         "github.com/zclconf/go-cty/cty"
         "github.com/zclconf/go-cty/cty/convert"
@@ -60,7 +61,7 @@ func (n *EvalTypeCheckVariable) Eval(ctx EvalContext) (interface{}, error) {
                         continue
                 }
 
-                if proposedValue == config.UnknownVariableValue {
+                if proposedValue == hcl2shim.UnknownVariableValue {
                         continue
                 }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/evaluate.go b/vendor/github.com/hashicorp/terraform/terraform/evaluate.go
index ab65d47..9bb6009 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/evaluate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/evaluate.go
@@ -120,20 +120,24 @@ type InstanceKeyEvalData struct {
 
 // EvalDataForInstanceKey constructs a suitable InstanceKeyEvalData for
 // evaluating in a context that has the given instance key.
-func EvalDataForInstanceKey(key addrs.InstanceKey) InstanceKeyEvalData {
-        // At the moment we don't actually implement for_each, so we only
-        // ever populate CountIndex.
-        // (When we implement for_each later we may need to reorganize this some,
-        // so that we can resolve the ambiguity that an int key may either be
-        // a count.index or an each.key where for_each is over a list.)
-
+func EvalDataForInstanceKey(key addrs.InstanceKey, forEachMap map[string]cty.Value) InstanceKeyEvalData {
         var countIdx cty.Value
+        var eachKey cty.Value
+        var eachVal cty.Value
+
         if intKey, ok := key.(addrs.IntKey); ok {
                 countIdx = cty.NumberIntVal(int64(intKey))
         }
 
+        if stringKey, ok := key.(addrs.StringKey); ok {
+                eachKey = cty.StringVal(string(stringKey))
+                eachVal = forEachMap[string(stringKey)]
+        }
+
         return InstanceKeyEvalData{
                 CountIndex: countIdx,
+                EachKey:    eachKey,
+                EachValue:  eachVal,
         }
 }
 
@@ -173,6 +177,37 @@ func (d *evaluationStateData) GetCountAttr(addr addrs.CountAttr, rng tfdiags.Sou
         }
 }
 
+func (d *evaluationStateData) GetForEachAttr(addr addrs.ForEachAttr, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        var returnVal cty.Value
+        switch addr.Name {
+
+        case "key":
+                returnVal = d.InstanceKeyData.EachKey
+        case "value":
+                returnVal = d.InstanceKeyData.EachValue
+        default:
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid "each" attribute`,
+                        Detail:   fmt.Sprintf(`The "each" object does not have an attribute named %q. The supported attributes are each.key and each.value, the current key and value pair of the "for_each" attribute set.`, addr.Name),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        if returnVal == cty.NilVal {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to "each" in context without for_each`,
+                        Detail:   fmt.Sprintf(`The "each" object can be used only in "resource" blocks, and only when the "for_each" argument is set.`),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.UnknownVal(cty.DynamicPseudoType), diags
+        }
+        return returnVal, diags
+}
+
 func (d *evaluationStateData) GetInputVariable(addr addrs.InputVariable, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
         var diags tfdiags.Diagnostics
 
@@ -569,7 +604,7 @@ func (d *evaluationStateData) GetResourceInstance(addr addrs.ResourceInstance, r
                 }
         case states.EachMap:
                 multi = key == addrs.NoKey
-                if _, ok := addr.Key.(addrs.IntKey); !multi && !ok {
+                if _, ok := addr.Key.(addrs.StringKey); !multi && !ok {
                         diags = diags.Append(&hcl.Diagnostic{
                                 Severity: hcl.DiagError,
                                 Summary:  "Invalid resource index",
@@ -696,7 +731,7 @@ func (d *evaluationStateData) getResourceInstancesAll(addr addrs.Resource, rng t
                         ty := schema.ImpliedType()
                         key := addrs.IntKey(i)
                         is, exists := rs.Instances[key]
-                        if exists {
+                        if exists && is.Current != nil {
                                 instAddr := addr.Instance(key).Absolute(d.ModulePath)
 
                                 // Prefer pending value in plan if present. See getResourceInstanceSingle
diff --git a/vendor/github.com/hashicorp/terraform/terraform/interpolate.go b/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
index 26c1857..97bb1f6 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
@@ -11,16 +11,11 @@ import (
         "github.com/hashicorp/hil"
         "github.com/hashicorp/hil/ast"
         "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
         "github.com/hashicorp/terraform/config/module"
         "github.com/hashicorp/terraform/flatmap"
 )
 
-const (
-        // VarEnvPrefix is the prefix of variables that are read from
-        // the environment to set variables here.
-        VarEnvPrefix = "TF_VAR_"
-)
-
 // Interpolater is the structure responsible for determining the values
 // for interpolations such as `aws_instance.foo.bar`.
 type Interpolater struct {
@@ -71,7 +66,7 @@ func (i *Interpolater) valueCountVar(
 func unknownVariable() ast.Variable {
         return ast.Variable{
                 Type:  ast.TypeUnknown,
-                Value: config.UnknownVariableValue,
+                Value: hcl2shim.UnknownVariableValue,
         }
 }
 
@@ -659,7 +654,7 @@ func (i *Interpolater) interpolateComplexTypeAttribute(
                 // ".#" count field is marked as unknown to indicate "this whole list is
                 // unknown". We must honor that meaning here so computed references can be
                 // treated properly during the plan phase.
-                if lengthAttr == config.UnknownVariableValue {
+                if lengthAttr == hcl2shim.UnknownVariableValue {
                         return unknownVariable(), nil
                 }
 
@@ -675,7 +670,7 @@ func (i *Interpolater) interpolateComplexTypeAttribute(
                 // ".%" count field is marked as unknown to indicate "this whole list is
                 // unknown". We must honor that meaning here so computed references can be
                 // treated properly during the plan phase.
-                if lengthAttr == config.UnknownVariableValue {
+                if lengthAttr == hcl2shim.UnknownVariableValue {
                         return unknownVariable(), nil
                 }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go
index ab82163..dd92866 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go
@@ -38,6 +38,16 @@ func (n *NodeRefreshableDataResource) DynamicExpand(ctx EvalContext) (*Graph, er
                 return nil, nil
         }
 
+        forEachMap, forEachKnown, forEachDiags := evaluateResourceForEachExpressionKnown(n.Config.ForEach, ctx)
+        if forEachDiags.HasErrors() {
+                return nil, diags.Err()
+        }
+        if !forEachKnown {
+                // If the for_each isn't known yet, we'll skip refreshing and try expansion
+                // again during the plan walk.
+                return nil, nil
+        }
+
         // Next we need to potentially rename an instance address in the state
         // if we're transitioning whether "count" is set at all.
         fixResourceCountSetTransition(ctx, n.ResourceAddr(), count != -1)
@@ -77,6 +87,7 @@ func (n *NodeRefreshableDataResource) DynamicExpand(ctx EvalContext) (*Graph, er
                         Concrete: concreteResource,
                         Schema:   n.Schema,
                         Count:    count,
+                        ForEach:  forEachMap,
                         Addr:     n.ResourceAddr(),
                 },
 
@@ -85,6 +96,7 @@ func (n *NodeRefreshableDataResource) DynamicExpand(ctx EvalContext) (*Graph, er
                 &OrphanResourceCountTransformer{
                         Concrete: concreteResourceDestroyable,
                         Count:    count,
+                        ForEach:  forEachMap,
                         Addr:     n.ResourceAddr(),
                         State:    state,
                 },
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go
index 3a0570c..d147b42 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go
@@ -187,6 +187,8 @@ func (n *NodeAbstractResource) References() []*addrs.Reference {
 
                 refs, _ := lang.ReferencesInExpr(c.Count)
                 result = append(result, refs...)
+                refs, _ = lang.ReferencesInExpr(c.ForEach)
+                result = append(result, refs...)
                 refs, _ = lang.ReferencesInBlock(c.Config, n.Schema)
                 result = append(result, refs...)
                 if c.Managed != nil {
@@ -238,21 +240,31 @@ func (n *NodeAbstractResourceInstance) References() []*addrs.Reference {
                         // need to do a little work here to massage this to the form we now
                         // want.
                         var result []*addrs.Reference
-                        for _, addr := range s.Current.Dependencies {
-                                if addr == nil {
-                                        // Should never happen; indicates a bug in the state loader
-                                        panic(fmt.Sprintf("dependencies for current object on %s contains nil address", n.ResourceInstanceAddr()))
-                                }
 
-                                // This is a little weird: we need to manufacture an addrs.Reference
-                                // with a fake range here because the state isn't something we can
-                                // make source references into.
-                                result = append(result, &addrs.Reference{
-                                        Subject: addr,
-                                        SourceRange: tfdiags.SourceRange{
-                                                Filename: "(state file)",
-                                        },
-                                })
+                        // It is (apparently) possible for s.Current to be nil. This proved
+                        // difficult to reproduce, so we will fix the symptom here and hope
+                        // to find the root cause another time.
+                        //
+                        // https://github.com/hashicorp/terraform/issues/21407
+                        if s.Current == nil {
+                                log.Printf("[WARN] no current state found for %s", n.Name())
+                        } else {
+                                for _, addr := range s.Current.Dependencies {
+                                        if addr == nil {
+                                                // Should never happen; indicates a bug in the state loader
+                                                panic(fmt.Sprintf("dependencies for current object on %s contains nil address", n.ResourceInstanceAddr()))
+                                        }
+
+                                        // This is a little weird: we need to manufacture an addrs.Reference
+                                        // with a fake range here because the state isn't something we can
+                                        // make source references into.
+                                        result = append(result, &addrs.Reference{
+                                                Subject: addr,
+                                                SourceRange: tfdiags.SourceRange{
+                                                        Filename: "(state file)",
+                                                },
+                                        })
+                                }
                         }
                         return result
                 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply_instance.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply_instance.go
index dad7bfc..d795324 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply_instance.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply_instance.go
@@ -101,13 +101,6 @@ func (n *NodeApplyableResourceInstance) References() []*addrs.Reference {
 func (n *NodeApplyableResourceInstance) EvalTree() EvalNode {
         addr := n.ResourceInstanceAddr()
 
-        // State still uses legacy-style internal ids, so we need to shim to get
-        // a suitable key to use.
-        stateId := NewLegacyResourceInstanceAddress(addr).stateId()
-
-        // Determine the dependencies for the state.
-        stateDeps := n.StateReferences()
-
         if n.Config == nil {
                 // This should not be possible, but we've got here in at least one
                 // case as discussed in the following issue:
@@ -132,15 +125,15 @@ func (n *NodeApplyableResourceInstance) EvalTree() EvalNode {
         // Eval info is different depending on what kind of resource this is
         switch n.Config.Mode {
         case addrs.ManagedResourceMode:
-                return n.evalTreeManagedResource(addr, stateId, stateDeps)
+                return n.evalTreeManagedResource(addr)
         case addrs.DataResourceMode:
-                return n.evalTreeDataResource(addr, stateId, stateDeps)
+                return n.evalTreeDataResource(addr)
         default:
                 panic(fmt.Errorf("unsupported resource mode %s", n.Config.Mode))
         }
 }
 
-func (n *NodeApplyableResourceInstance) evalTreeDataResource(addr addrs.AbsResourceInstance, stateId string, stateDeps []addrs.Referenceable) EvalNode {
+func (n *NodeApplyableResourceInstance) evalTreeDataResource(addr addrs.AbsResourceInstance) EvalNode {
         var provider providers.Interface
         var providerSchema *ProviderSchema
         var change *plans.ResourceInstanceChange
@@ -206,7 +199,7 @@ func (n *NodeApplyableResourceInstance) evalTreeDataResource(addr addrs.AbsResou
         }
 }
 
-func (n *NodeApplyableResourceInstance) evalTreeManagedResource(addr addrs.AbsResourceInstance, stateId string, stateDeps []addrs.Referenceable) EvalNode {
+func (n *NodeApplyableResourceInstance) evalTreeManagedResource(addr addrs.AbsResourceInstance) EvalNode {
         // Declare a bunch of variables that are used for state during
         // evaluation. Most of this are written to by-address below.
         var provider providers.Interface
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go
index 633c1c4..ec4aa93 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go
@@ -77,6 +77,11 @@ func (n *NodePlannableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
                 return nil, diags.Err()
         }
 
+        forEachMap, forEachDiags := evaluateResourceForEachExpression(n.Config.ForEach, ctx)
+        if forEachDiags.HasErrors() {
+                return nil, diags.Err()
+        }
+
         // Next we need to potentially rename an instance address in the state
         // if we're transitioning whether "count" is set at all.
         fixResourceCountSetTransition(ctx, n.ResourceAddr(), count != -1)
@@ -119,18 +124,20 @@ func (n *NodePlannableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
 
         // Start creating the steps
         steps := []GraphTransformer{
-                // Expand the count.
+                // Expand the count or for_each (if present)
                 &ResourceCountTransformer{
                         Concrete: concreteResource,
                         Schema:   n.Schema,
                         Count:    count,
+                        ForEach:  forEachMap,
                         Addr:     n.ResourceAddr(),
                 },
 
-                // Add the count orphans
+                // Add the count/for_each orphans
                 &OrphanResourceCountTransformer{
                         Concrete: concreteResourceOrphan,
                         Count:    count,
+                        ForEach:  forEachMap,
                         Addr:     n.ResourceAddr(),
                         State:    state,
                 },
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go
index 75e0bcd..0f74bbe 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go
@@ -34,25 +34,18 @@ var (
 func (n *NodePlannableResourceInstance) EvalTree() EvalNode {
         addr := n.ResourceInstanceAddr()
 
-        // State still uses legacy-style internal ids, so we need to shim to get
-        // a suitable key to use.
-        stateId := NewLegacyResourceInstanceAddress(addr).stateId()
-
-        // Determine the dependencies for the state.
-        stateDeps := n.StateReferences()
-
         // Eval info is different depending on what kind of resource this is
         switch addr.Resource.Resource.Mode {
         case addrs.ManagedResourceMode:
-                return n.evalTreeManagedResource(addr, stateId, stateDeps)
+                return n.evalTreeManagedResource(addr)
         case addrs.DataResourceMode:
-                return n.evalTreeDataResource(addr, stateId, stateDeps)
+                return n.evalTreeDataResource(addr)
         default:
                 panic(fmt.Errorf("unsupported resource mode %s", n.Config.Mode))
         }
 }
 
-func (n *NodePlannableResourceInstance) evalTreeDataResource(addr addrs.AbsResourceInstance, stateId string, stateDeps []addrs.Referenceable) EvalNode {
+func (n *NodePlannableResourceInstance) evalTreeDataResource(addr addrs.AbsResourceInstance) EvalNode {
         config := n.Config
         var provider providers.Interface
         var providerSchema *ProviderSchema
@@ -147,7 +140,7 @@ func (n *NodePlannableResourceInstance) evalTreeDataResource(addr addrs.AbsResou
         }
 }
 
-func (n *NodePlannableResourceInstance) evalTreeManagedResource(addr addrs.AbsResourceInstance, stateId string, stateDeps []addrs.Referenceable) EvalNode {
+func (n *NodePlannableResourceInstance) evalTreeManagedResource(addr addrs.AbsResourceInstance) EvalNode {
         config := n.Config
         var provider providers.Interface
         var providerSchema *ProviderSchema
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
index 9506023..9daeabf 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
@@ -39,6 +39,11 @@ func (n *NodeRefreshableManagedResource) DynamicExpand(ctx EvalContext) (*Graph,
                 return nil, diags.Err()
         }
 
+        forEachMap, forEachDiags := evaluateResourceForEachExpression(n.Config.ForEach, ctx)
+        if forEachDiags.HasErrors() {
+                return nil, diags.Err()
+        }
+
         // Next we need to potentially rename an instance address in the state
         // if we're transitioning whether "count" is set at all.
         fixResourceCountSetTransition(ctx, n.ResourceAddr(), count != -1)
@@ -66,6 +71,7 @@ func (n *NodeRefreshableManagedResource) DynamicExpand(ctx EvalContext) (*Graph,
                         Concrete: concreteResource,
                         Schema:   n.Schema,
                         Count:    count,
+                        ForEach:  forEachMap,
                         Addr:     n.ResourceAddr(),
                 },
 
@@ -74,6 +80,7 @@ func (n *NodeRefreshableManagedResource) DynamicExpand(ctx EvalContext) (*Graph,
                 &OrphanResourceCountTransformer{
                         Concrete: concreteResource,
                         Count:    count,
+                        ForEach:  forEachMap,
                         Addr:     n.ResourceAddr(),
                         State:    state,
                 },
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go
index 734ec9e..efa657b 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go
@@ -54,6 +54,7 @@ func (n *NodeValidatableResource) EvalTree() EvalNode {
 
         if managed := n.Config.Managed; managed != nil {
                 hasCount := n.Config.Count != nil
+                hasForEach := n.Config.ForEach != nil
 
                 // Validate all the provisioners
                 for _, p := range managed.Provisioners {
@@ -74,11 +75,12 @@ func (n *NodeValidatableResource) EvalTree() EvalNode {
                                         Schema: &provisionerSchema,
                                 },
                                 &EvalValidateProvisioner{
-                                        ResourceAddr:     addr.Resource,
-                                        Provisioner:      &provisioner,
-                                        Schema:           &provisionerSchema,
-                                        Config:           p,
-                                        ResourceHasCount: hasCount,
+                                        ResourceAddr:       addr.Resource,
+                                        Provisioner:        &provisioner,
+                                        Schema:             &provisionerSchema,
+                                        Config:             p,
+                                        ResourceHasCount:   hasCount,
+                                        ResourceHasForEach: hasForEach,
                                 },
                         )
                 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/provider_mock.go b/vendor/github.com/hashicorp/terraform/terraform/provider_mock.go
index 4ae346d..8eede48 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/provider_mock.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/provider_mock.go
@@ -8,7 +8,6 @@ import (
         "github.com/zclconf/go-cty/cty"
         ctyjson "github.com/zclconf/go-cty/cty/json"
 
-        "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/config/hcl2shim"
         "github.com/hashicorp/terraform/providers"
         "github.com/hashicorp/terraform/tfdiags"
@@ -391,7 +390,7 @@ func (p *MockProvider) ApplyResourceChange(r providers.ApplyResourceChangeReques
                         for k, new := range plannedMap {
                                 old := priorMap[k]
                                 newComputed := false
-                                if new == config.UnknownVariableValue {
+                                if new == hcl2shim.UnknownVariableValue {
                                         new = ""
                                         newComputed = true
                                 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_address.go b/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
index 156ecf5..5d8261a 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
@@ -365,6 +365,8 @@ func NewLegacyResourceInstanceAddress(addr addrs.AbsResourceInstance) *ResourceA
                 ret.Index = -1
         } else if ik, ok := addr.Resource.Key.(addrs.IntKey); ok {
                 ret.Index = int(ik)
+        } else if _, ok := addr.Resource.Key.(addrs.StringKey); ok {
+                ret.Index = -1
         } else {
                 panic(fmt.Errorf("cannot shim resource instance with key %#v to legacy ResourceAddress.Index", addr.Resource.Key))
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/state.go b/vendor/github.com/hashicorp/terraform/terraform/state.go
index 092b690..6280fb0 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/state.go
@@ -1201,7 +1201,7 @@ func (m *ModuleState) prune() {
         }
 
         for k, v := range m.Outputs {
-                if v.Value == config.UnknownVariableValue {
+                if v.Value == hcl2shim.UnknownVariableValue {
                         delete(m.Outputs, k)
                 }
         }
@@ -1827,7 +1827,7 @@ func (s *InstanceState) MergeDiff(d *InstanceDiff) *InstanceState {
                                 continue
                         }
                         if diff.NewComputed {
-                                result.Attributes[k] = config.UnknownVariableValue
+                                result.Attributes[k] = hcl2shim.UnknownVariableValue
                                 continue
                         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_count.go b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_count.go
index eec762e..4f323a7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_count.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_count.go
@@ -6,6 +6,7 @@ import (
         "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/dag"
         "github.com/hashicorp/terraform/states"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // OrphanResourceCountTransformer is a GraphTransformer that adds orphans
@@ -18,9 +19,10 @@ import (
 type OrphanResourceCountTransformer struct {
         Concrete ConcreteResourceInstanceNodeFunc
 
-        Count int               // Actual count of the resource, or -1 if count is not set at all
-        Addr  addrs.AbsResource // Addr of the resource to look for orphans
-        State *states.State     // Full global state
+        Count   int                  // Actual count of the resource, or -1 if count is not set at all
+        ForEach map[string]cty.Value // The ForEach map on the resource
+        Addr    addrs.AbsResource    // Addr of the resource to look for orphans
+        State   *states.State        // Full global state
 }
 
 func (t *OrphanResourceCountTransformer) Transform(g *Graph) error {
@@ -34,6 +36,10 @@ func (t *OrphanResourceCountTransformer) Transform(g *Graph) error {
                 haveKeys[key] = struct{}{}
         }
 
+        // if for_each is set, use that transformer
+        if t.ForEach != nil {
+                return t.transformForEach(haveKeys, g)
+        }
         if t.Count < 0 {
                 return t.transformNoCount(haveKeys, g)
         }
@@ -43,6 +49,25 @@ func (t *OrphanResourceCountTransformer) Transform(g *Graph) error {
         return t.transformCount(haveKeys, g)
 }
 
+func (t *OrphanResourceCountTransformer) transformForEach(haveKeys map[addrs.InstanceKey]struct{}, g *Graph) error {
+        for key := range haveKeys {
+                s, _ := key.(addrs.StringKey)
+                // If the key is present in our current for_each, carry on
+                if _, ok := t.ForEach[string(s)]; ok {
+                        continue
+                }
+
+                abstract := NewNodeAbstractResourceInstance(t.Addr.Instance(key))
+                var node dag.Vertex = abstract
+                if f := t.Concrete; f != nil {
+                        node = f(abstract)
+                }
+                log.Printf("[TRACE] OrphanResourceCount(non-zero): adding %s as %T", t.Addr, node)
+                g.Add(node)
+        }
+        return nil
+}
+
 func (t *OrphanResourceCountTransformer) transformCount(haveKeys map[addrs.InstanceKey]struct{}, g *Graph) error {
         // Due to the logic in Transform, we only get in here if our count is
         // at least one.
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go b/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go
index 1123790..c70a3c1 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go
@@ -4,6 +4,7 @@ import (
         "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/dag"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // ResourceCountTransformer is a GraphTransformer that expands the count
@@ -17,12 +18,13 @@ type ResourceCountTransformer struct {
         // Count is either the number of indexed instances to create, or -1 to
         // indicate that count is not set at all and thus a no-key instance should
         // be created.
-        Count int
-        Addr  addrs.AbsResource
+        Count   int
+        ForEach map[string]cty.Value
+        Addr    addrs.AbsResource
 }
 
 func (t *ResourceCountTransformer) Transform(g *Graph) error {
-        if t.Count < 0 {
+        if t.Count < 0 && t.ForEach == nil {
                 // Negative count indicates that count is not set at all.
                 addr := t.Addr.Instance(addrs.NoKey)
 
@@ -37,6 +39,19 @@ func (t *ResourceCountTransformer) Transform(g *Graph) error {
                 return nil
         }
 
+        // Add nodes related to the for_each expression
+        for key := range t.ForEach {
+                addr := t.Addr.Instance(addrs.StringKey(key))
+                abstract := NewNodeAbstractResourceInstance(addr)
+                abstract.Schema = t.Schema
+                var node dag.Vertex = abstract
+                if f := t.Concrete; f != nil {
+                        node = f(abstract)
+                }
+
+                g.Add(node)
+        }
+
         // For each count, build and add the node
         for i := 0; i < t.Count; i++ {
                 key := addrs.IntKey(i)
diff --git a/vendor/github.com/hashicorp/terraform/terraform/util.go b/vendor/github.com/hashicorp/terraform/terraform/util.go
index 752241a..5428cd5 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/util.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/util.go
@@ -2,8 +2,6 @@ package terraform
 
 import (
         "sort"
-
-        "github.com/hashicorp/terraform/config"
 )
 
 // Semaphore is a wrapper around a channel to provide
@@ -48,10 +46,6 @@ func (s Semaphore) Release() {
         }
 }
 
-func resourceProvider(resourceType, explicitProvider string) string {
-        return config.ResourceProviderFullName(resourceType, explicitProvider)
-}
-
 // strSliceContains checks if a given string is contained in a slice
 // When anybody asks why Go needs generics, here you go.
 func strSliceContains(haystack []string, needle string) bool {