374 files changed, 47870 insertions, 8162 deletions

diff --git a/vendor/github.com/hashicorp/terraform/addrs/count_attr.go b/vendor/github.com/hashicorp/terraform/addrs/count_attr.go
new file mode 100644
index 0000000..90a5faf
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/count_attr.go
@@ -0,0 +1,12 @@
+package addrs
+
+// CountAttr is the address of an attribute of the "count" object in
+// the interpolation scope, like "count.index".
+type CountAttr struct {
+        referenceable
+        Name string
+}
+
+func (ca CountAttr) String() string {
+        return "count." + ca.Name
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/doc.go b/vendor/github.com/hashicorp/terraform/addrs/doc.go
new file mode 100644
index 0000000..4609331
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/doc.go
@@ -0,0 +1,17 @@
+// Package addrs contains types that represent "addresses", which are
+// references to specific objects within a Terraform configuration or
+// state.
+//
+// All addresses have string representations based on HCL traversal syntax
+// which should be used in the user-interface, and also in-memory
+// representations that can be used internally.
+//
+// For object types that exist within Terraform modules a pair of types is
+// used. The "local" part of the address is represented by a type, and then
+// an absolute path to that object in the context of its module is represented
+// by a type of the same name with an "Abs" prefix added, for "absolute".
+//
+// All types within this package should be treated as immutable, even if this
+// is not enforced by the Go compiler. It is always an implementation error
+// to modify an address object in-place after it is initially constructed.
+package addrs
diff --git a/vendor/github.com/hashicorp/terraform/addrs/input_variable.go b/vendor/github.com/hashicorp/terraform/addrs/input_variable.go
new file mode 100644
index 0000000..d2c046c
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/input_variable.go
@@ -0,0 +1,41 @@
+package addrs
+
+import (
+        "fmt"
+)
+
+// InputVariable is the address of an input variable.
+type InputVariable struct {
+        referenceable
+        Name string
+}
+
+func (v InputVariable) String() string {
+        return "var." + v.Name
+}
+
+// AbsInputVariableInstance is the address of an input variable within a
+// particular module instance.
+type AbsInputVariableInstance struct {
+        Module   ModuleInstance
+        Variable InputVariable
+}
+
+// InputVariable returns the absolute address of the input variable of the
+// given name inside the receiving module instance.
+func (m ModuleInstance) InputVariable(name string) AbsInputVariableInstance {
+        return AbsInputVariableInstance{
+                Module: m,
+                Variable: InputVariable{
+                        Name: name,
+                },
+        }
+}
+
+func (v AbsInputVariableInstance) String() string {
+        if len(v.Module) == 0 {
+                return v.String()
+        }
+
+        return fmt.Sprintf("%s.%s", v.Module.String(), v.Variable.String())
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/instance_key.go b/vendor/github.com/hashicorp/terraform/addrs/instance_key.go
new file mode 100644
index 0000000..cef8b27
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/instance_key.go
@@ -0,0 +1,123 @@
+package addrs
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+// InstanceKey represents the key of an instance within an object that
+// contains multiple instances due to using "count" or "for_each" arguments
+// in configuration.
+//
+// IntKey and StringKey are the two implementations of this type. No other
+// implementations are allowed. The single instance of an object that _isn't_
+// using "count" or "for_each" is represented by NoKey, which is a nil
+// InstanceKey.
+type InstanceKey interface {
+        instanceKeySigil()
+        String() string
+}
+
+// ParseInstanceKey returns the instance key corresponding to the given value,
+// which must be known and non-null.
+//
+// If an unknown or null value is provided then this function will panic. This
+// function is intended to deal with the values that would naturally be found
+// in a hcl.TraverseIndex, which (when parsed from source, at least) can never
+// contain unknown or null values.
+func ParseInstanceKey(key cty.Value) (InstanceKey, error) {
+        switch key.Type() {
+        case cty.String:
+                return StringKey(key.AsString()), nil
+        case cty.Number:
+                var idx int
+                err := gocty.FromCtyValue(key, &idx)
+                return IntKey(idx), err
+        default:
+                return NoKey, fmt.Errorf("either a string or an integer is required")
+        }
+}
+
+// NoKey represents the absense of an InstanceKey, for the single instance
+// of a configuration object that does not use "count" or "for_each" at all.
+var NoKey InstanceKey
+
+// IntKey is the InstanceKey representation representing integer indices, as
+// used when the "count" argument is specified or if for_each is used with
+// a sequence type.
+type IntKey int
+
+func (k IntKey) instanceKeySigil() {
+}
+
+func (k IntKey) String() string {
+        return fmt.Sprintf("[%d]", int(k))
+}
+
+// StringKey is the InstanceKey representation representing string indices, as
+// used when the "for_each" argument is specified with a map or object type.
+type StringKey string
+
+func (k StringKey) instanceKeySigil() {
+}
+
+func (k StringKey) String() string {
+        // FIXME: This isn't _quite_ right because Go's quoted string syntax is
+        // slightly different than HCL's, but we'll accept it for now.
+        return fmt.Sprintf("[%q]", string(k))
+}
+
+// InstanceKeyLess returns true if the first given instance key i should sort
+// before the second key j, and false otherwise.
+func InstanceKeyLess(i, j InstanceKey) bool {
+        iTy := instanceKeyType(i)
+        jTy := instanceKeyType(j)
+
+        switch {
+        case i == j:
+                return false
+        case i == NoKey:
+                return true
+        case j == NoKey:
+                return false
+        case iTy != jTy:
+                // The ordering here is arbitrary except that we want NoKeyType
+                // to sort before the others, so we'll just use the enum values
+                // of InstanceKeyType here (where NoKey is zero, sorting before
+                // any other).
+                return uint32(iTy) < uint32(jTy)
+        case iTy == IntKeyType:
+                return int(i.(IntKey)) < int(j.(IntKey))
+        case iTy == StringKeyType:
+                return string(i.(StringKey)) < string(j.(StringKey))
+        default:
+                // Shouldn't be possible to get down here in practice, since the
+                // above is exhaustive.
+                return false
+        }
+}
+
+func instanceKeyType(k InstanceKey) InstanceKeyType {
+        if _, ok := k.(StringKey); ok {
+                return StringKeyType
+        }
+        if _, ok := k.(IntKey); ok {
+                return IntKeyType
+        }
+        return NoKeyType
+}
+
+// InstanceKeyType represents the different types of instance key that are
+// supported. Usually it is sufficient to simply type-assert an InstanceKey
+// value to either IntKey or StringKey, but this type and its values can be
+// used to represent the types themselves, rather than specific values
+// of those types.
+type InstanceKeyType rune
+
+const (
+        NoKeyType     InstanceKeyType = 0
+        IntKeyType    InstanceKeyType = 'I'
+        StringKeyType InstanceKeyType = 'S'
+)
diff --git a/vendor/github.com/hashicorp/terraform/addrs/local_value.go b/vendor/github.com/hashicorp/terraform/addrs/local_value.go
new file mode 100644
index 0000000..61a07b9
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/local_value.go
@@ -0,0 +1,48 @@
+package addrs
+
+import (
+        "fmt"
+)
+
+// LocalValue is the address of a local value.
+type LocalValue struct {
+        referenceable
+        Name string
+}
+
+func (v LocalValue) String() string {
+        return "local." + v.Name
+}
+
+// Absolute converts the receiver into an absolute address within the given
+// module instance.
+func (v LocalValue) Absolute(m ModuleInstance) AbsLocalValue {
+        return AbsLocalValue{
+                Module:     m,
+                LocalValue: v,
+        }
+}
+
+// AbsLocalValue is the absolute address of a local value within a module instance.
+type AbsLocalValue struct {
+        Module     ModuleInstance
+        LocalValue LocalValue
+}
+
+// LocalValue returns the absolute address of a local value of the given
+// name within the receiving module instance.
+func (m ModuleInstance) LocalValue(name string) AbsLocalValue {
+        return AbsLocalValue{
+                Module: m,
+                LocalValue: LocalValue{
+                        Name: name,
+                },
+        }
+}
+
+func (v AbsLocalValue) String() string {
+        if len(v.Module) == 0 {
+                return v.LocalValue.String()
+        }
+        return fmt.Sprintf("%s.%s", v.Module.String(), v.LocalValue.String())
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/module.go b/vendor/github.com/hashicorp/terraform/addrs/module.go
new file mode 100644
index 0000000..6420c63
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/module.go
@@ -0,0 +1,75 @@
+package addrs
+
+import (
+        "strings"
+)
+
+// Module is an address for a module call within configuration. This is
+// the static counterpart of ModuleInstance, representing a traversal through
+// the static module call tree in configuration and does not take into account
+// the potentially-multiple instances of a module that might be created by
+// "count" and "for_each" arguments within those calls.
+//
+// This type should be used only in very specialized cases when working with
+// the static module call tree. Type ModuleInstance is appropriate in more cases.
+//
+// Although Module is a slice, it should be treated as immutable after creation.
+type Module []string
+
+// RootModule is the module address representing the root of the static module
+// call tree, which is also the zero value of Module.
+//
+// Note that this is not the root of the dynamic module tree, which is instead
+// represented by RootModuleInstance.
+var RootModule Module
+
+// IsRoot returns true if the receiver is the address of the root module,
+// or false otherwise.
+func (m Module) IsRoot() bool {
+        return len(m) == 0
+}
+
+func (m Module) String() string {
+        if len(m) == 0 {
+                return ""
+        }
+        return strings.Join([]string(m), ".")
+}
+
+// Child returns the address of a child call in the receiver, identified by the
+// given name.
+func (m Module) Child(name string) Module {
+        ret := make(Module, 0, len(m)+1)
+        ret = append(ret, m...)
+        return append(ret, name)
+}
+
+// Parent returns the address of the parent module of the receiver, or the
+// receiver itself if there is no parent (if it's the root module address).
+func (m Module) Parent() Module {
+        if len(m) == 0 {
+                return m
+        }
+        return m[:len(m)-1]
+}
+
+// Call returns the module call address that corresponds to the given module
+// instance, along with the address of the module that contains it.
+//
+// There is no call for the root module, so this method will panic if called
+// on the root module address.
+//
+// In practice, this just turns the last element of the receiver into a
+// ModuleCall and then returns a slice of the receiever that excludes that
+// last part. This is just a convenience for situations where a call address
+// is required, such as when dealing with *Reference and Referencable values.
+func (m Module) Call() (Module, ModuleCall) {
+        if len(m) == 0 {
+                panic("cannot produce ModuleCall for root module")
+        }
+
+        caller, callName := m[:len(m)-1], m[len(m)-1]
+        return caller, ModuleCall{
+                Name: callName,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/module_call.go b/vendor/github.com/hashicorp/terraform/addrs/module_call.go
new file mode 100644
index 0000000..09596cc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/module_call.go
@@ -0,0 +1,81 @@
+package addrs
+
+import (
+        "fmt"
+)
+
+// ModuleCall is the address of a call from the current module to a child
+// module.
+//
+// There is no "Abs" version of ModuleCall because an absolute module path
+// is represented by ModuleInstance.
+type ModuleCall struct {
+        referenceable
+        Name string
+}
+
+func (c ModuleCall) String() string {
+        return "module." + c.Name
+}
+
+// Instance returns the address of an instance of the receiver identified by
+// the given key.
+func (c ModuleCall) Instance(key InstanceKey) ModuleCallInstance {
+        return ModuleCallInstance{
+                Call: c,
+                Key:  key,
+        }
+}
+
+// ModuleCallInstance is the address of one instance of a module created from
+// a module call, which might create multiple instances using "count" or
+// "for_each" arguments.
+type ModuleCallInstance struct {
+        referenceable
+        Call ModuleCall
+        Key  InstanceKey
+}
+
+func (c ModuleCallInstance) String() string {
+        if c.Key == NoKey {
+                return c.Call.String()
+        }
+        return fmt.Sprintf("module.%s%s", c.Call.Name, c.Key)
+}
+
+// ModuleInstance returns the address of the module instance that corresponds
+// to the receiving call instance when resolved in the given calling module.
+// In other words, it returns the child module instance that the receving
+// call instance creates.
+func (c ModuleCallInstance) ModuleInstance(caller ModuleInstance) ModuleInstance {
+        return caller.Child(c.Call.Name, c.Key)
+}
+
+// Output returns the address of an output of the receiver identified by its
+// name.
+func (c ModuleCallInstance) Output(name string) ModuleCallOutput {
+        return ModuleCallOutput{
+                Call: c,
+                Name: name,
+        }
+}
+
+// ModuleCallOutput is the address of a particular named output produced by
+// an instance of a module call.
+type ModuleCallOutput struct {
+        referenceable
+        Call ModuleCallInstance
+        Name string
+}
+
+func (co ModuleCallOutput) String() string {
+        return fmt.Sprintf("%s.%s", co.Call.String(), co.Name)
+}
+
+// AbsOutputValue returns the absolute output value address that corresponds
+// to the receving module call output address, once resolved in the given
+// calling module.
+func (co ModuleCallOutput) AbsOutputValue(caller ModuleInstance) AbsOutputValue {
+        moduleAddr := co.Call.ModuleInstance(caller)
+        return moduleAddr.OutputValue(co.Name)
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/module_instance.go b/vendor/github.com/hashicorp/terraform/addrs/module_instance.go
new file mode 100644
index 0000000..67e73e5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/module_instance.go
@@ -0,0 +1,415 @@
+package addrs
+
+import (
+        "bytes"
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/gocty"
+
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// ModuleInstance is an address for a particular module instance within the
+// dynamic module tree. This is an extension of the static traversals
+// represented by type Module that deals with the possibility of a single
+// module call producing multiple instances via the "count" and "for_each"
+// arguments.
+//
+// Although ModuleInstance is a slice, it should be treated as immutable after
+// creation.
+type ModuleInstance []ModuleInstanceStep
+
+var (
+        _ Targetable = ModuleInstance(nil)
+)
+
+func ParseModuleInstance(traversal hcl.Traversal) (ModuleInstance, tfdiags.Diagnostics) {
+        mi, remain, diags := parseModuleInstancePrefix(traversal)
+        if len(remain) != 0 {
+                if len(remain) == len(traversal) {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid module instance address",
+                                Detail:   "A module instance address must begin with \"module.\".",
+                                Subject:  remain.SourceRange().Ptr(),
+                        })
+                } else {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid module instance address",
+                                Detail:   "The module instance address is followed by additional invalid content.",
+                                Subject:  remain.SourceRange().Ptr(),
+                        })
+                }
+        }
+        return mi, diags
+}
+
+// ParseModuleInstanceStr is a helper wrapper around ParseModuleInstance
+// that takes a string and parses it with the HCL native syntax traversal parser
+// before interpreting it.
+//
+// This should be used only in specialized situations since it will cause the
+// created references to not have any meaningful source location information.
+// If a reference string is coming from a source that should be identified in
+// error messages then the caller should instead parse it directly using a
+// suitable function from the HCL API and pass the traversal itself to
+// ParseProviderConfigCompact.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// then the returned address is invalid.
+func ParseModuleInstanceStr(str string) (ModuleInstance, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return nil, diags
+        }
+
+        addr, addrDiags := ParseModuleInstance(traversal)
+        diags = diags.Append(addrDiags)
+        return addr, diags
+}
+
+func parseModuleInstancePrefix(traversal hcl.Traversal) (ModuleInstance, hcl.Traversal, tfdiags.Diagnostics) {
+        remain := traversal
+        var mi ModuleInstance
+        var diags tfdiags.Diagnostics
+
+        for len(remain) > 0 {
+                var next string
+                switch tt := remain[0].(type) {
+                case hcl.TraverseRoot:
+                        next = tt.Name
+                case hcl.TraverseAttr:
+                        next = tt.Name
+                default:
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid address operator",
+                                Detail:   "Module address prefix must be followed by dot and then a name.",
+                                Subject:  remain[0].SourceRange().Ptr(),
+                        })
+                        break
+                }
+
+                if next != "module" {
+                        break
+                }
+
+                kwRange := remain[0].SourceRange()
+                remain = remain[1:]
+                // If we have the prefix "module" then we should be followed by an
+                // module call name, as an attribute, and then optionally an index step
+                // giving the instance key.
+                if len(remain) == 0 {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid address operator",
+                                Detail:   "Prefix \"module.\" must be followed by a module name.",
+                                Subject:  &kwRange,
+                        })
+                        break
+                }
+
+                var moduleName string
+                switch tt := remain[0].(type) {
+                case hcl.TraverseAttr:
+                        moduleName = tt.Name
+                default:
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid address operator",
+                                Detail:   "Prefix \"module.\" must be followed by a module name.",
+                                Subject:  remain[0].SourceRange().Ptr(),
+                        })
+                        break
+                }
+                remain = remain[1:]
+                step := ModuleInstanceStep{
+                        Name: moduleName,
+                }
+
+                if len(remain) > 0 {
+                        if idx, ok := remain[0].(hcl.TraverseIndex); ok {
+                                remain = remain[1:]
+
+                                switch idx.Key.Type() {
+                                case cty.String:
+                                        step.InstanceKey = StringKey(idx.Key.AsString())
+                                case cty.Number:
+                                        var idxInt int
+                                        err := gocty.FromCtyValue(idx.Key, &idxInt)
+                                        if err == nil {
+                                                step.InstanceKey = IntKey(idxInt)
+                                        } else {
+                                                diags = diags.Append(&hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Invalid address operator",
+                                                        Detail:   fmt.Sprintf("Invalid module index: %s.", err),
+                                                        Subject:  idx.SourceRange().Ptr(),
+                                                })
+                                        }
+                                default:
+                                        // Should never happen, because no other types are allowed in traversal indices.
+                                        diags = diags.Append(&hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Invalid address operator",
+                                                Detail:   "Invalid module key: must be either a string or an integer.",
+                                                Subject:  idx.SourceRange().Ptr(),
+                                        })
+                                }
+                        }
+                }
+
+                mi = append(mi, step)
+        }
+
+        var retRemain hcl.Traversal
+        if len(remain) > 0 {
+                retRemain = make(hcl.Traversal, len(remain))
+                copy(retRemain, remain)
+                // The first element here might be either a TraverseRoot or a
+                // TraverseAttr, depending on whether we had a module address on the
+                // front. To make life easier for callers, we'll normalize to always
+                // start with a TraverseRoot.
+                if tt, ok := retRemain[0].(hcl.TraverseAttr); ok {
+                        retRemain[0] = hcl.TraverseRoot{
+                                Name:     tt.Name,
+                                SrcRange: tt.SrcRange,
+                        }
+                }
+        }
+
+        return mi, retRemain, diags
+}
+
+// UnkeyedInstanceShim is a shim method for converting a Module address to the
+// equivalent ModuleInstance address that assumes that no modules have
+// keyed instances.
+//
+// This is a temporary allowance for the fact that Terraform does not presently
+// support "count" and "for_each" on modules, and thus graph building code that
+// derives graph nodes from configuration must just assume unkeyed modules
+// in order to construct the graph. At a later time when "count" and "for_each"
+// support is added for modules, all callers of this method will need to be
+// reworked to allow for keyed module instances.
+func (m Module) UnkeyedInstanceShim() ModuleInstance {
+        path := make(ModuleInstance, len(m))
+        for i, name := range m {
+                path[i] = ModuleInstanceStep{Name: name}
+        }
+        return path
+}
+
+// ModuleInstanceStep is a single traversal step through the dynamic module
+// tree. It is used only as part of ModuleInstance.
+type ModuleInstanceStep struct {
+        Name        string
+        InstanceKey InstanceKey
+}
+
+// RootModuleInstance is the module instance address representing the root
+// module, which is also the zero value of ModuleInstance.
+var RootModuleInstance ModuleInstance
+
+// IsRoot returns true if the receiver is the address of the root module instance,
+// or false otherwise.
+func (m ModuleInstance) IsRoot() bool {
+        return len(m) == 0
+}
+
+// Child returns the address of a child module instance of the receiver,
+// identified by the given name and key.
+func (m ModuleInstance) Child(name string, key InstanceKey) ModuleInstance {
+        ret := make(ModuleInstance, 0, len(m)+1)
+        ret = append(ret, m...)
+        return append(ret, ModuleInstanceStep{
+                Name:        name,
+                InstanceKey: key,
+        })
+}
+
+// Parent returns the address of the parent module instance of the receiver, or
+// the receiver itself if there is no parent (if it's the root module address).
+func (m ModuleInstance) Parent() ModuleInstance {
+        if len(m) == 0 {
+                return m
+        }
+        return m[:len(m)-1]
+}
+
+// String returns a string representation of the receiver, in the format used
+// within e.g. user-provided resource addresses.
+//
+// The address of the root module has the empty string as its representation.
+func (m ModuleInstance) String() string {
+        var buf bytes.Buffer
+        sep := ""
+        for _, step := range m {
+                buf.WriteString(sep)
+                buf.WriteString("module.")
+                buf.WriteString(step.Name)
+                if step.InstanceKey != NoKey {
+                        buf.WriteString(step.InstanceKey.String())
+                }
+                sep = "."
+        }
+        return buf.String()
+}
+
+// Equal returns true if the receiver and the given other value
+// contains the exact same parts.
+func (m ModuleInstance) Equal(o ModuleInstance) bool {
+        return m.String() == o.String()
+}
+
+// Less returns true if the receiver should sort before the given other value
+// in a sorted list of addresses.
+func (m ModuleInstance) Less(o ModuleInstance) bool {
+        if len(m) != len(o) {
+                // Shorter path sorts first.
+                return len(m) < len(o)
+        }
+
+        for i := range m {
+                mS, oS := m[i], o[i]
+                switch {
+                case mS.Name != oS.Name:
+                        return mS.Name < oS.Name
+                case mS.InstanceKey != oS.InstanceKey:
+                        return InstanceKeyLess(mS.InstanceKey, oS.InstanceKey)
+                }
+        }
+
+        return false
+}
+
+// Ancestors returns a slice containing the receiver and all of its ancestor
+// module instances, all the way up to (and including) the root module.
+// The result is ordered by depth, with the root module always first.
+//
+// Since the result always includes the root module, a caller may choose to
+// ignore it by slicing the result with [1:].
+func (m ModuleInstance) Ancestors() []ModuleInstance {
+        ret := make([]ModuleInstance, 0, len(m)+1)
+        for i := 0; i <= len(m); i++ {
+                ret = append(ret, m[:i])
+        }
+        return ret
+}
+
+// IsAncestor returns true if the receiver is an ancestor of the given
+// other value.
+func (m ModuleInstance) IsAncestor(o ModuleInstance) bool {
+        // Longer or equal sized paths means the receiver cannot
+        // be an ancestor of the given module insatnce.
+        if len(m) >= len(o) {
+                return false
+        }
+
+        for i, ms := range m {
+                if ms.Name != o[i].Name {
+                        return false
+                }
+                if ms.InstanceKey != NoKey && ms.InstanceKey != o[i].InstanceKey {
+                        return false
+                }
+        }
+
+        return true
+}
+
+// Call returns the module call address that corresponds to the given module
+// instance, along with the address of the module instance that contains it.
+//
+// There is no call for the root module, so this method will panic if called
+// on the root module address.
+//
+// A single module call can produce potentially many module instances, so the
+// result discards any instance key that might be present on the last step
+// of the instance. To retain this, use CallInstance instead.
+//
+// In practice, this just turns the last element of the receiver into a
+// ModuleCall and then returns a slice of the receiever that excludes that
+// last part. This is just a convenience for situations where a call address
+// is required, such as when dealing with *Reference and Referencable values.
+func (m ModuleInstance) Call() (ModuleInstance, ModuleCall) {
+        if len(m) == 0 {
+                panic("cannot produce ModuleCall for root module")
+        }
+
+        inst, lastStep := m[:len(m)-1], m[len(m)-1]
+        return inst, ModuleCall{
+                Name: lastStep.Name,
+        }
+}
+
+// CallInstance returns the module call instance address that corresponds to
+// the given module instance, along with the address of the module instance
+// that contains it.
+//
+// There is no call for the root module, so this method will panic if called
+// on the root module address.
+//
+// In practice, this just turns the last element of the receiver into a
+// ModuleCallInstance and then returns a slice of the receiever that excludes
+// that last part. This is just a convenience for situations where a call\
+// address is required, such as when dealing with *Reference and Referencable
+// values.
+func (m ModuleInstance) CallInstance() (ModuleInstance, ModuleCallInstance) {
+        if len(m) == 0 {
+                panic("cannot produce ModuleCallInstance for root module")
+        }
+
+        inst, lastStep := m[:len(m)-1], m[len(m)-1]
+        return inst, ModuleCallInstance{
+                Call: ModuleCall{
+                        Name: lastStep.Name,
+                },
+                Key: lastStep.InstanceKey,
+        }
+}
+
+// TargetContains implements Targetable by returning true if the given other
+// address either matches the receiver, is a sub-module-instance of the
+// receiver, or is a targetable absolute address within a module that
+// is contained within the reciever.
+func (m ModuleInstance) TargetContains(other Targetable) bool {
+        switch to := other.(type) {
+
+        case ModuleInstance:
+                if len(to) < len(m) {
+                        // Can't be contained if the path is shorter
+                        return false
+                }
+                // Other is contained if its steps match for the length of our own path.
+                for i, ourStep := range m {
+                        otherStep := to[i]
+                        if ourStep != otherStep {
+                                return false
+                        }
+                }
+                // If we fall out here then the prefixed matched, so it's contained.
+                return true
+
+        case AbsResource:
+                return m.TargetContains(to.Module)
+
+        case AbsResourceInstance:
+                return m.TargetContains(to.Module)
+
+        default:
+                return false
+        }
+}
+
+func (m ModuleInstance) targetableSigil() {
+        // ModuleInstance is targetable
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/output_value.go b/vendor/github.com/hashicorp/terraform/addrs/output_value.go
new file mode 100644
index 0000000..bcd923a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/output_value.go
@@ -0,0 +1,75 @@
+package addrs
+
+import (
+        "fmt"
+)
+
+// OutputValue is the address of an output value, in the context of the module
+// that is defining it.
+//
+// This is related to but separate from ModuleCallOutput, which represents
+// a module output from the perspective of its parent module. Since output
+// values cannot be represented from the module where they are defined,
+// OutputValue is not Referenceable, while ModuleCallOutput is.
+type OutputValue struct {
+        Name string
+}
+
+func (v OutputValue) String() string {
+        return "output." + v.Name
+}
+
+// Absolute converts the receiver into an absolute address within the given
+// module instance.
+func (v OutputValue) Absolute(m ModuleInstance) AbsOutputValue {
+        return AbsOutputValue{
+                Module:      m,
+                OutputValue: v,
+        }
+}
+
+// AbsOutputValue is the absolute address of an output value within a module instance.
+//
+// This represents an output globally within the namespace of a particular
+// configuration. It is related to but separate from ModuleCallOutput, which
+// represents a module output from the perspective of its parent module.
+type AbsOutputValue struct {
+        Module      ModuleInstance
+        OutputValue OutputValue
+}
+
+// OutputValue returns the absolute address of an output value of the given
+// name within the receiving module instance.
+func (m ModuleInstance) OutputValue(name string) AbsOutputValue {
+        return AbsOutputValue{
+                Module: m,
+                OutputValue: OutputValue{
+                        Name: name,
+                },
+        }
+}
+
+func (v AbsOutputValue) String() string {
+        if v.Module.IsRoot() {
+                return v.OutputValue.String()
+        }
+        return fmt.Sprintf("%s.%s", v.Module.String(), v.OutputValue.String())
+}
+
+// ModuleCallOutput converts an AbsModuleOutput into a ModuleCallOutput,
+// returning also the module instance that the ModuleCallOutput is relative
+// to.
+//
+// The root module does not have a call, and so this method cannot be used
+// with outputs in the root module, and will panic in that case.
+func (v AbsOutputValue) ModuleCallOutput() (ModuleInstance, ModuleCallOutput) {
+        if v.Module.IsRoot() {
+                panic("ReferenceFromCall used with root module output")
+        }
+
+        caller, call := v.Module.CallInstance()
+        return caller, ModuleCallOutput{
+                Call: call,
+                Name: v.OutputValue.Name,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/parse_ref.go b/vendor/github.com/hashicorp/terraform/addrs/parse_ref.go
new file mode 100644
index 0000000..84fe8a0
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/parse_ref.go
@@ -0,0 +1,338 @@
+package addrs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// Reference describes a reference to an address with source location
+// information.
+type Reference struct {
+        Subject     Referenceable
+        SourceRange tfdiags.SourceRange
+        Remaining   hcl.Traversal
+}
+
+// ParseRef attempts to extract a referencable address from the prefix of the
+// given traversal, which must be an absolute traversal or this function
+// will panic.
+//
+// If no error diagnostics are returned, the returned reference includes the
+// address that was extracted, the source range it was extracted from, and any
+// remaining relative traversal that was not consumed as part of the
+// reference.
+//
+// If error diagnostics are returned then the Reference value is invalid and
+// must not be used.
+func ParseRef(traversal hcl.Traversal) (*Reference, tfdiags.Diagnostics) {
+        ref, diags := parseRef(traversal)
+
+        // Normalize a little to make life easier for callers.
+        if ref != nil {
+                if len(ref.Remaining) == 0 {
+                        ref.Remaining = nil
+                }
+        }
+
+        return ref, diags
+}
+
+// ParseRefStr is a helper wrapper around ParseRef that takes a string
+// and parses it with the HCL native syntax traversal parser before
+// interpreting it.
+//
+// This should be used only in specialized situations since it will cause the
+// created references to not have any meaningful source location information.
+// If a reference string is coming from a source that should be identified in
+// error messages then the caller should instead parse it directly using a
+// suitable function from the HCL API and pass the traversal itself to
+// ParseRef.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// the returned reference may be nil or incomplete.
+func ParseRefStr(str string) (*Reference, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return nil, diags
+        }
+
+        ref, targetDiags := ParseRef(traversal)
+        diags = diags.Append(targetDiags)
+        return ref, diags
+}
+
+func parseRef(traversal hcl.Traversal) (*Reference, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        root := traversal.RootName()
+        rootRange := traversal[0].SourceRange()
+
+        switch root {
+
+        case "count":
+                name, rng, remain, diags := parseSingleAttrRef(traversal)
+                return &Reference{
+                        Subject:     CountAttr{Name: name},
+                        SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                        Remaining:   remain,
+                }, diags
+
+        case "data":
+                if len(traversal) < 3 {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid reference",
+                                Detail:   `The "data" object must be followed by two attribute names: the data source type and the resource name.`,
+                                Subject:  traversal.SourceRange().Ptr(),
+                        })
+                        return nil, diags
+                }
+                remain := traversal[1:] // trim off "data" so we can use our shared resource reference parser
+                return parseResourceRef(DataResourceMode, rootRange, remain)
+
+        case "local":
+                name, rng, remain, diags := parseSingleAttrRef(traversal)
+                return &Reference{
+                        Subject:     LocalValue{Name: name},
+                        SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                        Remaining:   remain,
+                }, diags
+
+        case "module":
+                callName, callRange, remain, diags := parseSingleAttrRef(traversal)
+                if diags.HasErrors() {
+                        return nil, diags
+                }
+
+                // A traversal starting with "module" can either be a reference to
+                // an entire module instance or to a single output from a module
+                // instance, depending on what we find after this introducer.
+
+                callInstance := ModuleCallInstance{
+                        Call: ModuleCall{
+                                Name: callName,
+                        },
+                        Key: NoKey,
+                }
+
+                if len(remain) == 0 {
+                        // Reference to an entire module instance. Might alternatively
+                        // be a reference to a collection of instances of a particular
+                        // module, but the caller will need to deal with that ambiguity
+                        // since we don't have enough context here.
+                        return &Reference{
+                                Subject:     callInstance,
+                                SourceRange: tfdiags.SourceRangeFromHCL(callRange),
+                                Remaining:   remain,
+                        }, diags
+                }
+
+                if idxTrav, ok := remain[0].(hcl.TraverseIndex); ok {
+                        var err error
+                        callInstance.Key, err = ParseInstanceKey(idxTrav.Key)
+                        if err != nil {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid index key",
+                                        Detail:   fmt.Sprintf("Invalid index for module instance: %s.", err),
+                                        Subject:  &idxTrav.SrcRange,
+                                })
+                                return nil, diags
+                        }
+                        remain = remain[1:]
+
+                        if len(remain) == 0 {
+                                // Also a reference to an entire module instance, but we have a key
+                                // now.
+                                return &Reference{
+                                        Subject:     callInstance,
+                                        SourceRange: tfdiags.SourceRangeFromHCL(hcl.RangeBetween(callRange, idxTrav.SrcRange)),
+                                        Remaining:   remain,
+                                }, diags
+                        }
+                }
+
+                if attrTrav, ok := remain[0].(hcl.TraverseAttr); ok {
+                        remain = remain[1:]
+                        return &Reference{
+                                Subject: ModuleCallOutput{
+                                        Name: attrTrav.Name,
+                                        Call: callInstance,
+                                },
+                                SourceRange: tfdiags.SourceRangeFromHCL(hcl.RangeBetween(callRange, attrTrav.SrcRange)),
+                                Remaining:   remain,
+                        }, diags
+                }
+
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid reference",
+                        Detail:   "Module instance objects do not support this operation.",
+                        Subject:  remain[0].SourceRange().Ptr(),
+                })
+                return nil, diags
+
+        case "path":
+                name, rng, remain, diags := parseSingleAttrRef(traversal)
+                return &Reference{
+                        Subject:     PathAttr{Name: name},
+                        SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                        Remaining:   remain,
+                }, diags
+
+        case "self":
+                return &Reference{
+                        Subject:     Self,
+                        SourceRange: tfdiags.SourceRangeFromHCL(rootRange),
+                        Remaining:   traversal[1:],
+                }, diags
+
+        case "terraform":
+                name, rng, remain, diags := parseSingleAttrRef(traversal)
+                return &Reference{
+                        Subject:     TerraformAttr{Name: name},
+                        SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                        Remaining:   remain,
+                }, diags
+
+        case "var":
+                name, rng, remain, diags := parseSingleAttrRef(traversal)
+                return &Reference{
+                        Subject:     InputVariable{Name: name},
+                        SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                        Remaining:   remain,
+                }, diags
+
+        default:
+                return parseResourceRef(ManagedResourceMode, rootRange, traversal)
+        }
+}
+
+func parseResourceRef(mode ResourceMode, startRange hcl.Range, traversal hcl.Traversal) (*Reference, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        if len(traversal) < 2 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid reference",
+                        Detail:   `A reference to a resource type must be followed by at least one attribute access, specifying the resource name.`,
+                        Subject:  hcl.RangeBetween(traversal[0].SourceRange(), traversal[len(traversal)-1].SourceRange()).Ptr(),
+                })
+                return nil, diags
+        }
+
+        var typeName, name string
+        switch tt := traversal[0].(type) { // Could be either root or attr, depending on our resource mode
+        case hcl.TraverseRoot:
+                typeName = tt.Name
+        case hcl.TraverseAttr:
+                typeName = tt.Name
+        default:
+                // If it isn't a TraverseRoot then it must be a "data" reference.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid reference",
+                        Detail:   `The "data" object does not support this operation.`,
+                        Subject:  traversal[0].SourceRange().Ptr(),
+                })
+                return nil, diags
+        }
+
+        attrTrav, ok := traversal[1].(hcl.TraverseAttr)
+        if !ok {
+                var what string
+                switch mode {
+                case DataResourceMode:
+                        what = "data source"
+                default:
+                        what = "resource type"
+                }
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid reference",
+                        Detail:   fmt.Sprintf(`A reference to a %s must be followed by at least one attribute access, specifying the resource name.`, what),
+                        Subject:  traversal[1].SourceRange().Ptr(),
+                })
+                return nil, diags
+        }
+        name = attrTrav.Name
+        rng := hcl.RangeBetween(startRange, attrTrav.SrcRange)
+        remain := traversal[2:]
+
+        resourceAddr := Resource{
+                Mode: mode,
+                Type: typeName,
+                Name: name,
+        }
+        resourceInstAddr := ResourceInstance{
+                Resource: resourceAddr,
+                Key:      NoKey,
+        }
+
+        if len(remain) == 0 {
+                // This might actually be a reference to the collection of all instances
+                // of the resource, but we don't have enough context here to decide
+                // so we'll let the caller resolve that ambiguity.
+                return &Reference{
+                        Subject:     resourceInstAddr,
+                        SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                }, diags
+        }
+
+        if idxTrav, ok := remain[0].(hcl.TraverseIndex); ok {
+                var err error
+                resourceInstAddr.Key, err = ParseInstanceKey(idxTrav.Key)
+                if err != nil {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid index key",
+                                Detail:   fmt.Sprintf("Invalid index for resource instance: %s.", err),
+                                Subject:  &idxTrav.SrcRange,
+                        })
+                        return nil, diags
+                }
+                remain = remain[1:]
+                rng = hcl.RangeBetween(rng, idxTrav.SrcRange)
+        }
+
+        return &Reference{
+                Subject:     resourceInstAddr,
+                SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                Remaining:   remain,
+        }, diags
+}
+
+func parseSingleAttrRef(traversal hcl.Traversal) (string, hcl.Range, hcl.Traversal, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        root := traversal.RootName()
+        rootRange := traversal[0].SourceRange()
+
+        if len(traversal) < 2 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid reference",
+                        Detail:   fmt.Sprintf("The %q object cannot be accessed directly. Instead, access one of its attributes.", root),
+                        Subject:  &rootRange,
+                })
+                return "", hcl.Range{}, nil, diags
+        }
+        if attrTrav, ok := traversal[1].(hcl.TraverseAttr); ok {
+                return attrTrav.Name, hcl.RangeBetween(rootRange, attrTrav.SrcRange), traversal[2:], diags
+        }
+        diags = diags.Append(&hcl.Diagnostic{
+                Severity: hcl.DiagError,
+                Summary:  "Invalid reference",
+                Detail:   fmt.Sprintf("The %q object does not support this operation.", root),
+                Subject:  traversal[1].SourceRange().Ptr(),
+        })
+        return "", hcl.Range{}, nil, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/parse_target.go b/vendor/github.com/hashicorp/terraform/addrs/parse_target.go
new file mode 100644
index 0000000..057443a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/parse_target.go
@@ -0,0 +1,318 @@
+package addrs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// Target describes a targeted address with source location information.
+type Target struct {
+        Subject     Targetable
+        SourceRange tfdiags.SourceRange
+}
+
+// ParseTarget attempts to interpret the given traversal as a targetable
+// address. The given traversal must be absolute, or this function will
+// panic.
+//
+// If no error diagnostics are returned, the returned target includes the
+// address that was extracted and the source range it was extracted from.
+//
+// If error diagnostics are returned then the Target value is invalid and
+// must not be used.
+func ParseTarget(traversal hcl.Traversal) (*Target, tfdiags.Diagnostics) {
+        path, remain, diags := parseModuleInstancePrefix(traversal)
+        if diags.HasErrors() {
+                return nil, diags
+        }
+
+        rng := tfdiags.SourceRangeFromHCL(traversal.SourceRange())
+
+        if len(remain) == 0 {
+                return &Target{
+                        Subject:     path,
+                        SourceRange: rng,
+                }, diags
+        }
+
+        mode := ManagedResourceMode
+        if remain.RootName() == "data" {
+                mode = DataResourceMode
+                remain = remain[1:]
+        }
+
+        if len(remain) < 2 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "Resource specification must include a resource type and name.",
+                        Subject:  remain.SourceRange().Ptr(),
+                })
+                return nil, diags
+        }
+
+        var typeName, name string
+        switch tt := remain[0].(type) {
+        case hcl.TraverseRoot:
+                typeName = tt.Name
+        case hcl.TraverseAttr:
+                typeName = tt.Name
+        default:
+                switch mode {
+                case ManagedResourceMode:
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid address",
+                                Detail:   "A resource type name is required.",
+                                Subject:  remain[0].SourceRange().Ptr(),
+                        })
+                case DataResourceMode:
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid address",
+                                Detail:   "A data source name is required.",
+                                Subject:  remain[0].SourceRange().Ptr(),
+                        })
+                default:
+                        panic("unknown mode")
+                }
+                return nil, diags
+        }
+
+        switch tt := remain[1].(type) {
+        case hcl.TraverseAttr:
+                name = tt.Name
+        default:
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "A resource name is required.",
+                        Subject:  remain[1].SourceRange().Ptr(),
+                })
+                return nil, diags
+        }
+
+        var subject Targetable
+        remain = remain[2:]
+        switch len(remain) {
+        case 0:
+                subject = path.Resource(mode, typeName, name)
+        case 1:
+                if tt, ok := remain[0].(hcl.TraverseIndex); ok {
+                        key, err := ParseInstanceKey(tt.Key)
+                        if err != nil {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid address",
+                                        Detail:   fmt.Sprintf("Invalid resource instance key: %s.", err),
+                                        Subject:  remain[0].SourceRange().Ptr(),
+                                })
+                                return nil, diags
+                        }
+
+                        subject = path.ResourceInstance(mode, typeName, name, key)
+                } else {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid address",
+                                Detail:   "Resource instance key must be given in square brackets.",
+                                Subject:  remain[0].SourceRange().Ptr(),
+                        })
+                        return nil, diags
+                }
+        default:
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "Unexpected extra operators after address.",
+                        Subject:  remain[1].SourceRange().Ptr(),
+                })
+                return nil, diags
+        }
+
+        return &Target{
+                Subject:     subject,
+                SourceRange: rng,
+        }, diags
+}
+
+// ParseTargetStr is a helper wrapper around ParseTarget that takes a string
+// and parses it with the HCL native syntax traversal parser before
+// interpreting it.
+//
+// This should be used only in specialized situations since it will cause the
+// created references to not have any meaningful source location information.
+// If a target string is coming from a source that should be identified in
+// error messages then the caller should instead parse it directly using a
+// suitable function from the HCL API and pass the traversal itself to
+// ParseTarget.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// the returned target may be nil or incomplete.
+func ParseTargetStr(str string) (*Target, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return nil, diags
+        }
+
+        target, targetDiags := ParseTarget(traversal)
+        diags = diags.Append(targetDiags)
+        return target, diags
+}
+
+// ParseAbsResource attempts to interpret the given traversal as an absolute
+// resource address, using the same syntax as expected by ParseTarget.
+//
+// If no error diagnostics are returned, the returned target includes the
+// address that was extracted and the source range it was extracted from.
+//
+// If error diagnostics are returned then the AbsResource value is invalid and
+// must not be used.
+func ParseAbsResource(traversal hcl.Traversal) (AbsResource, tfdiags.Diagnostics) {
+        addr, diags := ParseTarget(traversal)
+        if diags.HasErrors() {
+                return AbsResource{}, diags
+        }
+
+        switch tt := addr.Subject.(type) {
+
+        case AbsResource:
+                return tt, diags
+
+        case AbsResourceInstance: // Catch likely user error with specialized message
+                // Assume that the last element of the traversal must be the index,
+                // since that's required for a valid resource instance address.
+                indexStep := traversal[len(traversal)-1]
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "A resource address is required. This instance key identifies a specific resource instance, which is not expected here.",
+                        Subject:  indexStep.SourceRange().Ptr(),
+                })
+                return AbsResource{}, diags
+
+        case ModuleInstance: // Catch likely user error with specialized message
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "A resource address is required here. The module path must be followed by a resource specification.",
+                        Subject:  traversal.SourceRange().Ptr(),
+                })
+                return AbsResource{}, diags
+
+        default: // Generic message for other address types
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "A resource address is required here.",
+                        Subject:  traversal.SourceRange().Ptr(),
+                })
+                return AbsResource{}, diags
+
+        }
+}
+
+// ParseAbsResourceStr is a helper wrapper around ParseAbsResource that takes a
+// string and parses it with the HCL native syntax traversal parser before
+// interpreting it.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// the returned address may be incomplete.
+//
+// Since this function has no context about the source of the given string,
+// any returned diagnostics will not have meaningful source location
+// information.
+func ParseAbsResourceStr(str string) (AbsResource, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return AbsResource{}, diags
+        }
+
+        addr, addrDiags := ParseAbsResource(traversal)
+        diags = diags.Append(addrDiags)
+        return addr, diags
+}
+
+// ParseAbsResourceInstance attempts to interpret the given traversal as an
+// absolute resource instance address, using the same syntax as expected by
+// ParseTarget.
+//
+// If no error diagnostics are returned, the returned target includes the
+// address that was extracted and the source range it was extracted from.
+//
+// If error diagnostics are returned then the AbsResource value is invalid and
+// must not be used.
+func ParseAbsResourceInstance(traversal hcl.Traversal) (AbsResourceInstance, tfdiags.Diagnostics) {
+        addr, diags := ParseTarget(traversal)
+        if diags.HasErrors() {
+                return AbsResourceInstance{}, diags
+        }
+
+        switch tt := addr.Subject.(type) {
+
+        case AbsResource:
+                return tt.Instance(NoKey), diags
+
+        case AbsResourceInstance:
+                return tt, diags
+
+        case ModuleInstance: // Catch likely user error with specialized message
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "A resource instance address is required here. The module path must be followed by a resource instance specification.",
+                        Subject:  traversal.SourceRange().Ptr(),
+                })
+                return AbsResourceInstance{}, diags
+
+        default: // Generic message for other address types
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "A resource address is required here.",
+                        Subject:  traversal.SourceRange().Ptr(),
+                })
+                return AbsResourceInstance{}, diags
+
+        }
+}
+
+// ParseAbsResourceInstanceStr is a helper wrapper around
+// ParseAbsResourceInstance that takes a string and parses it with the HCL
+// native syntax traversal parser before interpreting it.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// the returned address may be incomplete.
+//
+// Since this function has no context about the source of the given string,
+// any returned diagnostics will not have meaningful source location
+// information.
+func ParseAbsResourceInstanceStr(str string) (AbsResourceInstance, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return AbsResourceInstance{}, diags
+        }
+
+        addr, addrDiags := ParseAbsResourceInstance(traversal)
+        diags = diags.Append(addrDiags)
+        return addr, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/path_attr.go b/vendor/github.com/hashicorp/terraform/addrs/path_attr.go
new file mode 100644
index 0000000..cfc13f4
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/path_attr.go
@@ -0,0 +1,12 @@
+package addrs
+
+// PathAttr is the address of an attribute of the "path" object in
+// the interpolation scope, like "path.module".
+type PathAttr struct {
+        referenceable
+        Name string
+}
+
+func (pa PathAttr) String() string {
+        return "path." + pa.Name
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/provider_config.go b/vendor/github.com/hashicorp/terraform/addrs/provider_config.go
new file mode 100644
index 0000000..340dd19
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/provider_config.go
@@ -0,0 +1,297 @@
+package addrs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/tfdiags"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+)
+
+// ProviderConfig is the address of a provider configuration.
+type ProviderConfig struct {
+        Type string
+
+        // If not empty, Alias identifies which non-default (aliased) provider
+        // configuration this address refers to.
+        Alias string
+}
+
+// NewDefaultProviderConfig returns the address of the default (un-aliased)
+// configuration for the provider with the given type name.
+func NewDefaultProviderConfig(typeName string) ProviderConfig {
+        return ProviderConfig{
+                Type: typeName,
+        }
+}
+
+// ParseProviderConfigCompact parses the given absolute traversal as a relative
+// provider address in compact form. The following are examples of traversals
+// that can be successfully parsed as compact relative provider configuration
+// addresses:
+//
+//     aws
+//     aws.foo
+//
+// This function will panic if given a relative traversal.
+//
+// If the returned diagnostics contains errors then the result value is invalid
+// and must not be used.
+func ParseProviderConfigCompact(traversal hcl.Traversal) (ProviderConfig, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        ret := ProviderConfig{
+                Type: traversal.RootName(),
+        }
+
+        if len(traversal) < 2 {
+                // Just a type name, then.
+                return ret, diags
+        }
+
+        aliasStep := traversal[1]
+        switch ts := aliasStep.(type) {
+        case hcl.TraverseAttr:
+                ret.Alias = ts.Name
+                return ret, diags
+        default:
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid provider configuration address",
+                        Detail:   "The provider type name must either stand alone or be followed by an alias name separated with a dot.",
+                        Subject:  aliasStep.SourceRange().Ptr(),
+                })
+        }
+
+        if len(traversal) > 2 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid provider configuration address",
+                        Detail:   "Extraneous extra operators after provider configuration address.",
+                        Subject:  traversal[2:].SourceRange().Ptr(),
+                })
+        }
+
+        return ret, diags
+}
+
+// ParseProviderConfigCompactStr is a helper wrapper around ParseProviderConfigCompact
+// that takes a string and parses it with the HCL native syntax traversal parser
+// before interpreting it.
+//
+// This should be used only in specialized situations since it will cause the
+// created references to not have any meaningful source location information.
+// If a reference string is coming from a source that should be identified in
+// error messages then the caller should instead parse it directly using a
+// suitable function from the HCL API and pass the traversal itself to
+// ParseProviderConfigCompact.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// then the returned address is invalid.
+func ParseProviderConfigCompactStr(str string) (ProviderConfig, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return ProviderConfig{}, diags
+        }
+
+        addr, addrDiags := ParseProviderConfigCompact(traversal)
+        diags = diags.Append(addrDiags)
+        return addr, diags
+}
+
+// Absolute returns an AbsProviderConfig from the receiver and the given module
+// instance address.
+func (pc ProviderConfig) Absolute(module ModuleInstance) AbsProviderConfig {
+        return AbsProviderConfig{
+                Module:         module,
+                ProviderConfig: pc,
+        }
+}
+
+func (pc ProviderConfig) String() string {
+        if pc.Type == "" {
+                // Should never happen; always indicates a bug
+                return "provider.<invalid>"
+        }
+
+        if pc.Alias != "" {
+                return fmt.Sprintf("provider.%s.%s", pc.Type, pc.Alias)
+        }
+
+        return "provider." + pc.Type
+}
+
+// StringCompact is an alternative to String that returns the form that can
+// be parsed by ParseProviderConfigCompact, without the "provider." prefix.
+func (pc ProviderConfig) StringCompact() string {
+        if pc.Alias != "" {
+                return fmt.Sprintf("%s.%s", pc.Type, pc.Alias)
+        }
+        return pc.Type
+}
+
+// AbsProviderConfig is the absolute address of a provider configuration
+// within a particular module instance.
+type AbsProviderConfig struct {
+        Module         ModuleInstance
+        ProviderConfig ProviderConfig
+}
+
+// ParseAbsProviderConfig parses the given traversal as an absolute provider
+// address. The following are examples of traversals that can be successfully
+// parsed as absolute provider configuration addresses:
+//
+//     provider.aws
+//     provider.aws.foo
+//     module.bar.provider.aws
+//     module.bar.module.baz.provider.aws.foo
+//     module.foo[1].provider.aws.foo
+//
+// This type of address is used, for example, to record the relationships
+// between resources and provider configurations in the state structure.
+// This type of address is not generally used in the UI, except in error
+// messages that refer to provider configurations.
+func ParseAbsProviderConfig(traversal hcl.Traversal) (AbsProviderConfig, tfdiags.Diagnostics) {
+        modInst, remain, diags := parseModuleInstancePrefix(traversal)
+        ret := AbsProviderConfig{
+                Module: modInst,
+        }
+        if len(remain) < 2 || remain.RootName() != "provider" {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid provider configuration address",
+                        Detail:   "Provider address must begin with \"provider.\", followed by a provider type name.",
+                        Subject:  remain.SourceRange().Ptr(),
+                })
+                return ret, diags
+        }
+        if len(remain) > 3 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid provider configuration address",
+                        Detail:   "Extraneous operators after provider configuration alias.",
+                        Subject:  hcl.Traversal(remain[3:]).SourceRange().Ptr(),
+                })
+                return ret, diags
+        }
+
+        if tt, ok := remain[1].(hcl.TraverseAttr); ok {
+                ret.ProviderConfig.Type = tt.Name
+        } else {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid provider configuration address",
+                        Detail:   "The prefix \"provider.\" must be followed by a provider type name.",
+                        Subject:  remain[1].SourceRange().Ptr(),
+                })
+                return ret, diags
+        }
+
+        if len(remain) == 3 {
+                if tt, ok := remain[2].(hcl.TraverseAttr); ok {
+                        ret.ProviderConfig.Alias = tt.Name
+                } else {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid provider configuration address",
+                                Detail:   "Provider type name must be followed by a configuration alias name.",
+                                Subject:  remain[2].SourceRange().Ptr(),
+                        })
+                        return ret, diags
+                }
+        }
+
+        return ret, diags
+}
+
+// ParseAbsProviderConfigStr is a helper wrapper around ParseAbsProviderConfig
+// that takes a string and parses it with the HCL native syntax traversal parser
+// before interpreting it.
+//
+// This should be used only in specialized situations since it will cause the
+// created references to not have any meaningful source location information.
+// If a reference string is coming from a source that should be identified in
+// error messages then the caller should instead parse it directly using a
+// suitable function from the HCL API and pass the traversal itself to
+// ParseAbsProviderConfig.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// the returned address is invalid.
+func ParseAbsProviderConfigStr(str string) (AbsProviderConfig, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return AbsProviderConfig{}, diags
+        }
+
+        addr, addrDiags := ParseAbsProviderConfig(traversal)
+        diags = diags.Append(addrDiags)
+        return addr, diags
+}
+
+// ProviderConfigDefault returns the address of the default provider config
+// of the given type inside the recieving module instance.
+func (m ModuleInstance) ProviderConfigDefault(name string) AbsProviderConfig {
+        return AbsProviderConfig{
+                Module: m,
+                ProviderConfig: ProviderConfig{
+                        Type: name,
+                },
+        }
+}
+
+// ProviderConfigAliased returns the address of an aliased provider config
+// of with given type and alias inside the recieving module instance.
+func (m ModuleInstance) ProviderConfigAliased(name, alias string) AbsProviderConfig {
+        return AbsProviderConfig{
+                Module: m,
+                ProviderConfig: ProviderConfig{
+                        Type:  name,
+                        Alias: alias,
+                },
+        }
+}
+
+// Inherited returns an address that the receiving configuration address might
+// inherit from in a parent module. The second bool return value indicates if
+// such inheritance is possible, and thus whether the returned address is valid.
+//
+// Inheritance is possible only for default (un-aliased) providers in modules
+// other than the root module. Even if a valid address is returned, inheritence
+// may not be performed for other reasons, such as if the calling module
+// provided explicit provider configurations within the call for this module.
+// The ProviderTransformer graph transform in the main terraform module has
+// the authoritative logic for provider inheritance, and this method is here
+// mainly just for its benefit.
+func (pc AbsProviderConfig) Inherited() (AbsProviderConfig, bool) {
+        // Can't inherit if we're already in the root.
+        if len(pc.Module) == 0 {
+                return AbsProviderConfig{}, false
+        }
+
+        // Can't inherit if we have an alias.
+        if pc.ProviderConfig.Alias != "" {
+                return AbsProviderConfig{}, false
+        }
+
+        // Otherwise, we might inherit from a configuration with the same
+        // provider name in the parent module instance.
+        parentMod := pc.Module.Parent()
+        return pc.ProviderConfig.Absolute(parentMod), true
+}
+
+func (pc AbsProviderConfig) String() string {
+        if len(pc.Module) == 0 {
+                return pc.ProviderConfig.String()
+        }
+        return fmt.Sprintf("%s.%s", pc.Module.String(), pc.ProviderConfig.String())
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/referenceable.go b/vendor/github.com/hashicorp/terraform/addrs/referenceable.go
new file mode 100644
index 0000000..211083a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/referenceable.go
@@ -0,0 +1,20 @@
+package addrs
+
+// Referenceable is an interface implemented by all address types that can
+// appear as references in configuration language expressions.
+type Referenceable interface {
+        // All implementations of this interface must be covered by the type switch
+        // in lang.Scope.buildEvalContext.
+        referenceableSigil()
+
+        // String produces a string representation of the address that could be
+        // parsed as a HCL traversal and passed to ParseRef to produce an identical
+        // result.
+        String() string
+}
+
+type referenceable struct {
+}
+
+func (r referenceable) referenceableSigil() {
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/resource.go b/vendor/github.com/hashicorp/terraform/addrs/resource.go
new file mode 100644
index 0000000..2866770
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/resource.go
@@ -0,0 +1,270 @@
+package addrs
+
+import (
+        "fmt"
+        "strings"
+)
+
+// Resource is an address for a resource block within configuration, which
+// contains potentially-multiple resource instances if that configuration
+// block uses "count" or "for_each".
+type Resource struct {
+        referenceable
+        Mode ResourceMode
+        Type string
+        Name string
+}
+
+func (r Resource) String() string {
+        switch r.Mode {
+        case ManagedResourceMode:
+                return fmt.Sprintf("%s.%s", r.Type, r.Name)
+        case DataResourceMode:
+                return fmt.Sprintf("data.%s.%s", r.Type, r.Name)
+        default:
+                // Should never happen, but we'll return a string here rather than
+                // crashing just in case it does.
+                return fmt.Sprintf("<invalid>.%s.%s", r.Type, r.Name)
+        }
+}
+
+func (r Resource) Equal(o Resource) bool {
+        return r.String() == o.String()
+}
+
+// Instance produces the address for a specific instance of the receiver
+// that is idenfied by the given key.
+func (r Resource) Instance(key InstanceKey) ResourceInstance {
+        return ResourceInstance{
+                Resource: r,
+                Key:      key,
+        }
+}
+
+// Absolute returns an AbsResource from the receiver and the given module
+// instance address.
+func (r Resource) Absolute(module ModuleInstance) AbsResource {
+        return AbsResource{
+                Module:   module,
+                Resource: r,
+        }
+}
+
+// DefaultProviderConfig returns the address of the provider configuration
+// that should be used for the resource identified by the reciever if it
+// does not have a provider configuration address explicitly set in
+// configuration.
+//
+// This method is not able to verify that such a configuration exists, nor
+// represent the behavior of automatically inheriting certain provider
+// configurations from parent modules. It just does a static analysis of the
+// receiving address and returns an address to start from, relative to the
+// same module that contains the resource.
+func (r Resource) DefaultProviderConfig() ProviderConfig {
+        typeName := r.Type
+        if under := strings.Index(typeName, "_"); under != -1 {
+                typeName = typeName[:under]
+        }
+        return ProviderConfig{
+                Type: typeName,
+        }
+}
+
+// ResourceInstance is an address for a specific instance of a resource.
+// When a resource is defined in configuration with "count" or "for_each" it
+// produces zero or more instances, which can be addressed using this type.
+type ResourceInstance struct {
+        referenceable
+        Resource Resource
+        Key      InstanceKey
+}
+
+func (r ResourceInstance) ContainingResource() Resource {
+        return r.Resource
+}
+
+func (r ResourceInstance) String() string {
+        if r.Key == NoKey {
+                return r.Resource.String()
+        }
+        return r.Resource.String() + r.Key.String()
+}
+
+func (r ResourceInstance) Equal(o ResourceInstance) bool {
+        return r.String() == o.String()
+}
+
+// Absolute returns an AbsResourceInstance from the receiver and the given module
+// instance address.
+func (r ResourceInstance) Absolute(module ModuleInstance) AbsResourceInstance {
+        return AbsResourceInstance{
+                Module:   module,
+                Resource: r,
+        }
+}
+
+// AbsResource is an absolute address for a resource under a given module path.
+type AbsResource struct {
+        targetable
+        Module   ModuleInstance
+        Resource Resource
+}
+
+// Resource returns the address of a particular resource within the receiver.
+func (m ModuleInstance) Resource(mode ResourceMode, typeName string, name string) AbsResource {
+        return AbsResource{
+                Module: m,
+                Resource: Resource{
+                        Mode: mode,
+                        Type: typeName,
+                        Name: name,
+                },
+        }
+}
+
+// Instance produces the address for a specific instance of the receiver
+// that is idenfied by the given key.
+func (r AbsResource) Instance(key InstanceKey) AbsResourceInstance {
+        return AbsResourceInstance{
+                Module:   r.Module,
+                Resource: r.Resource.Instance(key),
+        }
+}
+
+// TargetContains implements Targetable by returning true if the given other
+// address is either equal to the receiver or is an instance of the
+// receiver.
+func (r AbsResource) TargetContains(other Targetable) bool {
+        switch to := other.(type) {
+
+        case AbsResource:
+                // We'll use our stringification as a cheat-ish way to test for equality.
+                return to.String() == r.String()
+
+        case AbsResourceInstance:
+                return r.TargetContains(to.ContainingResource())
+
+        default:
+                return false
+
+        }
+}
+
+func (r AbsResource) String() string {
+        if len(r.Module) == 0 {
+                return r.Resource.String()
+        }
+        return fmt.Sprintf("%s.%s", r.Module.String(), r.Resource.String())
+}
+
+func (r AbsResource) Equal(o AbsResource) bool {
+        return r.String() == o.String()
+}
+
+// AbsResourceInstance is an absolute address for a resource instance under a
+// given module path.
+type AbsResourceInstance struct {
+        targetable
+        Module   ModuleInstance
+        Resource ResourceInstance
+}
+
+// ResourceInstance returns the address of a particular resource instance within the receiver.
+func (m ModuleInstance) ResourceInstance(mode ResourceMode, typeName string, name string, key InstanceKey) AbsResourceInstance {
+        return AbsResourceInstance{
+                Module: m,
+                Resource: ResourceInstance{
+                        Resource: Resource{
+                                Mode: mode,
+                                Type: typeName,
+                                Name: name,
+                        },
+                        Key: key,
+                },
+        }
+}
+
+// ContainingResource returns the address of the resource that contains the
+// receving resource instance. In other words, it discards the key portion
+// of the address to produce an AbsResource value.
+func (r AbsResourceInstance) ContainingResource() AbsResource {
+        return AbsResource{
+                Module:   r.Module,
+                Resource: r.Resource.ContainingResource(),
+        }
+}
+
+// TargetContains implements Targetable by returning true if the given other
+// address is equal to the receiver.
+func (r AbsResourceInstance) TargetContains(other Targetable) bool {
+        switch to := other.(type) {
+
+        case AbsResourceInstance:
+                // We'll use our stringification as a cheat-ish way to test for equality.
+                return to.String() == r.String()
+
+        default:
+                return false
+
+        }
+}
+
+func (r AbsResourceInstance) String() string {
+        if len(r.Module) == 0 {
+                return r.Resource.String()
+        }
+        return fmt.Sprintf("%s.%s", r.Module.String(), r.Resource.String())
+}
+
+func (r AbsResourceInstance) Equal(o AbsResourceInstance) bool {
+        return r.String() == o.String()
+}
+
+// Less returns true if the receiver should sort before the given other value
+// in a sorted list of addresses.
+func (r AbsResourceInstance) Less(o AbsResourceInstance) bool {
+        switch {
+
+        case len(r.Module) != len(o.Module):
+                return len(r.Module) < len(o.Module)
+
+        case r.Module.String() != o.Module.String():
+                return r.Module.Less(o.Module)
+
+        case r.Resource.Resource.Mode != o.Resource.Resource.Mode:
+                return r.Resource.Resource.Mode == DataResourceMode
+
+        case r.Resource.Resource.Type != o.Resource.Resource.Type:
+                return r.Resource.Resource.Type < o.Resource.Resource.Type
+
+        case r.Resource.Resource.Name != o.Resource.Resource.Name:
+                return r.Resource.Resource.Name < o.Resource.Resource.Name
+
+        case r.Resource.Key != o.Resource.Key:
+                return InstanceKeyLess(r.Resource.Key, o.Resource.Key)
+
+        default:
+                return false
+
+        }
+}
+
+// ResourceMode defines which lifecycle applies to a given resource. Each
+// resource lifecycle has a slightly different address format.
+type ResourceMode rune
+
+//go:generate stringer -type ResourceMode
+
+const (
+        // InvalidResourceMode is the zero value of ResourceMode and is not
+        // a valid resource mode.
+        InvalidResourceMode ResourceMode = 0
+
+        // ManagedResourceMode indicates a managed resource, as defined by
+        // "resource" blocks in configuration.
+        ManagedResourceMode ResourceMode = 'M'
+
+        // DataResourceMode indicates a data resource, as defined by
+        // "data" blocks in configuration.
+        DataResourceMode ResourceMode = 'D'
+)
diff --git a/vendor/github.com/hashicorp/terraform/addrs/resource_phase.go b/vendor/github.com/hashicorp/terraform/addrs/resource_phase.go
new file mode 100644
index 0000000..9bdbdc4
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/resource_phase.go
@@ -0,0 +1,105 @@
+package addrs
+
+import "fmt"
+
+// ResourceInstancePhase is a special kind of reference used only internally
+// during graph building to represent resource instances that are in a
+// non-primary state.
+//
+// Graph nodes can declare themselves referenceable via an instance phase
+// or can declare that they reference an instance phase in order to accomodate
+// secondary graph nodes dealing with, for example, destroy actions.
+//
+// This special reference type cannot be accessed directly by end-users, and
+// should never be shown in the UI.
+type ResourceInstancePhase struct {
+        referenceable
+        ResourceInstance ResourceInstance
+        Phase            ResourceInstancePhaseType
+}
+
+var _ Referenceable = ResourceInstancePhase{}
+
+// Phase returns a special "phase address" for the receving instance. See the
+// documentation of ResourceInstancePhase for the limited situations where this
+// is intended to be used.
+func (r ResourceInstance) Phase(rpt ResourceInstancePhaseType) ResourceInstancePhase {
+        return ResourceInstancePhase{
+                ResourceInstance: r,
+                Phase:            rpt,
+        }
+}
+
+// ContainingResource returns an address for the same phase of the resource
+// that this instance belongs to.
+func (rp ResourceInstancePhase) ContainingResource() ResourcePhase {
+        return rp.ResourceInstance.Resource.Phase(rp.Phase)
+}
+
+func (rp ResourceInstancePhase) String() string {
+        // We use a different separator here than usual to ensure that we'll
+        // never conflict with any non-phased resource instance string. This
+        // is intentionally something that would fail parsing with ParseRef,
+        // because this special address type should never be exposed in the UI.
+        return fmt.Sprintf("%s#%s", rp.ResourceInstance, rp.Phase)
+}
+
+// ResourceInstancePhaseType is an enumeration used with ResourceInstancePhase.
+type ResourceInstancePhaseType string
+
+const (
+        // ResourceInstancePhaseDestroy represents the "destroy" phase of a
+        // resource instance.
+        ResourceInstancePhaseDestroy ResourceInstancePhaseType = "destroy"
+
+        // ResourceInstancePhaseDestroyCBD is similar to ResourceInstancePhaseDestroy
+        // but is used for resources that have "create_before_destroy" set, thus
+        // requiring a different dependency ordering.
+        ResourceInstancePhaseDestroyCBD ResourceInstancePhaseType = "destroy-cbd"
+)
+
+func (rpt ResourceInstancePhaseType) String() string {
+        return string(rpt)
+}
+
+// ResourcePhase is a special kind of reference used only internally
+// during graph building to represent resources that are in a
+// non-primary state.
+//
+// Graph nodes can declare themselves referenceable via a resource phase
+// or can declare that they reference a resource phase in order to accomodate
+// secondary graph nodes dealing with, for example, destroy actions.
+//
+// Since resources (as opposed to instances) aren't actually phased, this
+// address type is used only as an approximation during initial construction
+// of the resource-oriented plan graph, under the assumption that resource
+// instances with ResourceInstancePhase addresses will be created in dynamic
+// subgraphs during the graph walk.
+//
+// This special reference type cannot be accessed directly by end-users, and
+// should never be shown in the UI.
+type ResourcePhase struct {
+        referenceable
+        Resource Resource
+        Phase    ResourceInstancePhaseType
+}
+
+var _ Referenceable = ResourcePhase{}
+
+// Phase returns a special "phase address" for the receving instance. See the
+// documentation of ResourceInstancePhase for the limited situations where this
+// is intended to be used.
+func (r Resource) Phase(rpt ResourceInstancePhaseType) ResourcePhase {
+        return ResourcePhase{
+                Resource: r,
+                Phase:    rpt,
+        }
+}
+
+func (rp ResourcePhase) String() string {
+        // We use a different separator here than usual to ensure that we'll
+        // never conflict with any non-phased resource instance string. This
+        // is intentionally something that would fail parsing with ParseRef,
+        // because this special address type should never be exposed in the UI.
+        return fmt.Sprintf("%s#%s", rp.Resource, rp.Phase)
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/resourcemode_string.go b/vendor/github.com/hashicorp/terraform/addrs/resourcemode_string.go
new file mode 100644
index 0000000..0b5c33f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/resourcemode_string.go
@@ -0,0 +1,33 @@
+// Code generated by "stringer -type ResourceMode"; DO NOT EDIT.
+
+package addrs
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[InvalidResourceMode-0]
+        _ = x[ManagedResourceMode-77]
+        _ = x[DataResourceMode-68]
+}
+
+const (
+        _ResourceMode_name_0 = "InvalidResourceMode"
+        _ResourceMode_name_1 = "DataResourceMode"
+        _ResourceMode_name_2 = "ManagedResourceMode"
+)
+
+func (i ResourceMode) String() string {
+        switch {
+        case i == 0:
+                return _ResourceMode_name_0
+        case i == 68:
+                return _ResourceMode_name_1
+        case i == 77:
+                return _ResourceMode_name_2
+        default:
+                return "ResourceMode(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/self.go b/vendor/github.com/hashicorp/terraform/addrs/self.go
new file mode 100644
index 0000000..7f24eaf
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/self.go
@@ -0,0 +1,14 @@
+package addrs
+
+// Self is the address of the special object "self" that behaves as an alias
+// for a containing object currently in scope.
+const Self selfT = 0
+
+type selfT int
+
+func (s selfT) referenceableSigil() {
+}
+
+func (s selfT) String() string {
+        return "self"
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/targetable.go b/vendor/github.com/hashicorp/terraform/addrs/targetable.go
new file mode 100644
index 0000000..16819a5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/targetable.go
@@ -0,0 +1,26 @@
+package addrs
+
+// Targetable is an interface implemented by all address types that can be
+// used as "targets" for selecting sub-graphs of a graph.
+type Targetable interface {
+        targetableSigil()
+
+        // TargetContains returns true if the receiver is considered to contain
+        // the given other address. Containment, for the purpose of targeting,
+        // means that if a container address is targeted then all of the
+        // addresses within it are also implicitly targeted.
+        //
+        // A targetable address always contains at least itself.
+        TargetContains(other Targetable) bool
+
+        // String produces a string representation of the address that could be
+        // parsed as a HCL traversal and passed to ParseTarget to produce an
+        // identical result.
+        String() string
+}
+
+type targetable struct {
+}
+
+func (r targetable) targetableSigil() {
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/terraform_attr.go b/vendor/github.com/hashicorp/terraform/addrs/terraform_attr.go
new file mode 100644
index 0000000..a880182
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/terraform_attr.go
@@ -0,0 +1,12 @@
+package addrs
+
+// TerraformAttr is the address of an attribute of the "terraform" object in
+// the interpolation scope, like "terraform.workspace".
+type TerraformAttr struct {
+        referenceable
+        Name string
+}
+
+func (ta TerraformAttr) String() string {
+        return "terraform." + ta.Name
+}
diff --git a/vendor/github.com/hashicorp/terraform/command/format/diagnostic.go b/vendor/github.com/hashicorp/terraform/command/format/diagnostic.go
new file mode 100644
index 0000000..3dd9238
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/command/format/diagnostic.go
@@ -0,0 +1,295 @@
+package format
+
+import (
+        "bufio"
+        "bytes"
+        "fmt"
+        "sort"
+        "strings"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcled"
+        "github.com/hashicorp/hcl2/hclparse"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/mitchellh/colorstring"
+        wordwrap "github.com/mitchellh/go-wordwrap"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Diagnostic formats a single diagnostic message.
+//
+// The width argument specifies at what column the diagnostic messages will
+// be wrapped. If set to zero, messages will not be wrapped by this function
+// at all. Although the long-form text parts of the message are wrapped,
+// not all aspects of the message are guaranteed to fit within the specified
+// terminal width.
+func Diagnostic(diag tfdiags.Diagnostic, sources map[string][]byte, color *colorstring.Colorize, width int) string {
+        if diag == nil {
+                // No good reason to pass a nil diagnostic in here...
+                return ""
+        }
+
+        var buf bytes.Buffer
+
+        switch diag.Severity() {
+        case tfdiags.Error:
+                buf.WriteString(color.Color("\n[bold][red]Error: [reset]"))
+        case tfdiags.Warning:
+                buf.WriteString(color.Color("\n[bold][yellow]Warning: [reset]"))
+        default:
+                // Clear out any coloring that might be applied by Terraform's UI helper,
+                // so our result is not context-sensitive.
+                buf.WriteString(color.Color("\n[reset]"))
+        }
+
+        desc := diag.Description()
+        sourceRefs := diag.Source()
+
+        // We don't wrap the summary, since we expect it to be terse, and since
+        // this is where we put the text of a native Go error it may not always
+        // be pure text that lends itself well to word-wrapping.
+        fmt.Fprintf(&buf, color.Color("[bold]%s[reset]\n\n"), desc.Summary)
+
+        if sourceRefs.Subject != nil {
+                // We'll borrow HCL's range implementation here, because it has some
+                // handy features to help us produce a nice source code snippet.
+                highlightRange := sourceRefs.Subject.ToHCL()
+                snippetRange := highlightRange
+                if sourceRefs.Context != nil {
+                        snippetRange = sourceRefs.Context.ToHCL()
+                }
+
+                // Make sure the snippet includes the highlight. This should be true
+                // for any reasonable diagnostic, but we'll make sure.
+                snippetRange = hcl.RangeOver(snippetRange, highlightRange)
+                if snippetRange.Empty() {
+                        snippetRange.End.Byte++
+                        snippetRange.End.Column++
+                }
+                if highlightRange.Empty() {
+                        highlightRange.End.Byte++
+                        highlightRange.End.Column++
+                }
+
+                var src []byte
+                if sources != nil {
+                        src = sources[snippetRange.Filename]
+                }
+                if src == nil {
+                        // This should generally not happen, as long as sources are always
+                        // loaded through the main loader. We may load things in other
+                        // ways in weird cases, so we'll tolerate it at the expense of
+                        // a not-so-helpful error message.
+                        fmt.Fprintf(&buf, "  on %s line %d:\n  (source code not available)\n", highlightRange.Filename, highlightRange.Start.Line)
+                } else {
+                        file, offset := parseRange(src, highlightRange)
+
+                        headerRange := highlightRange
+
+                        contextStr := hcled.ContextString(file, offset-1)
+                        if contextStr != "" {
+                                contextStr = ", in " + contextStr
+                        }
+
+                        fmt.Fprintf(&buf, "  on %s line %d%s:\n", headerRange.Filename, headerRange.Start.Line, contextStr)
+
+                        // Config snippet rendering
+                        sc := hcl.NewRangeScanner(src, highlightRange.Filename, bufio.ScanLines)
+                        for sc.Scan() {
+                                lineRange := sc.Range()
+                                if !lineRange.Overlaps(snippetRange) {
+                                        continue
+                                }
+                                beforeRange, highlightedRange, afterRange := lineRange.PartitionAround(highlightRange)
+                                before := beforeRange.SliceBytes(src)
+                                highlighted := highlightedRange.SliceBytes(src)
+                                after := afterRange.SliceBytes(src)
+                                fmt.Fprintf(
+                                        &buf, color.Color("%4d: %s[underline]%s[reset]%s\n"),
+                                        lineRange.Start.Line,
+                                        before, highlighted, after,
+                                )
+                        }
+
+                }
+
+                if fromExpr := diag.FromExpr(); fromExpr != nil {
+                        // We may also be able to generate information about the dynamic
+                        // values of relevant variables at the point of evaluation, then.
+                        // This is particularly useful for expressions that get evaluated
+                        // multiple times with different values, such as blocks using
+                        // "count" and "for_each", or within "for" expressions.
+                        expr := fromExpr.Expression
+                        ctx := fromExpr.EvalContext
+                        vars := expr.Variables()
+                        stmts := make([]string, 0, len(vars))
+                        seen := make(map[string]struct{}, len(vars))
+                Traversals:
+                        for _, traversal := range vars {
+                                for len(traversal) > 1 {
+                                        val, diags := traversal.TraverseAbs(ctx)
+                                        if diags.HasErrors() {
+                                                // Skip anything that generates errors, since we probably
+                                                // already have the same error in our diagnostics set
+                                                // already.
+                                                traversal = traversal[:len(traversal)-1]
+                                                continue
+                                        }
+
+                                        traversalStr := traversalStr(traversal)
+                                        if _, exists := seen[traversalStr]; exists {
+                                                continue Traversals // don't show duplicates when the same variable is referenced multiple times
+                                        }
+                                        switch {
+                                        case !val.IsKnown():
+                                                // Can't say anything about this yet, then.
+                                                continue Traversals
+                                        case val.IsNull():
+                                                stmts = append(stmts, fmt.Sprintf(color.Color("[bold]%s[reset] is null"), traversalStr))
+                                        default:
+                                                stmts = append(stmts, fmt.Sprintf(color.Color("[bold]%s[reset] is %s"), traversalStr, compactValueStr(val)))
+                                        }
+                                        seen[traversalStr] = struct{}{}
+                                }
+                        }
+
+                        sort.Strings(stmts) // FIXME: Should maybe use a traversal-aware sort that can sort numeric indexes properly?
+
+                        if len(stmts) > 0 {
+                                fmt.Fprint(&buf, color.Color("    [dark_gray]|----------------[reset]\n"))
+                        }
+                        for _, stmt := range stmts {
+                                fmt.Fprintf(&buf, color.Color("    [dark_gray]|[reset] %s\n"), stmt)
+                        }
+                }
+
+                buf.WriteByte('\n')
+        }
+
+        if desc.Detail != "" {
+                detail := desc.Detail
+                if width != 0 {
+                        detail = wordwrap.WrapString(detail, uint(width))
+                }
+                fmt.Fprintf(&buf, "%s\n", detail)
+        }
+
+        return buf.String()
+}
+
+func parseRange(src []byte, rng hcl.Range) (*hcl.File, int) {
+        filename := rng.Filename
+        offset := rng.Start.Byte
+
+        // We need to re-parse here to get a *hcl.File we can interrogate. This
+        // is not awesome since we presumably already parsed the file earlier too,
+        // but this re-parsing is architecturally simpler than retaining all of
+        // the hcl.File objects and we only do this in the case of an error anyway
+        // so the overhead here is not a big problem.
+        parser := hclparse.NewParser()
+        var file *hcl.File
+        var diags hcl.Diagnostics
+        if strings.HasSuffix(filename, ".json") {
+                file, diags = parser.ParseJSON(src, filename)
+        } else {
+                file, diags = parser.ParseHCL(src, filename)
+        }
+        if diags.HasErrors() {
+                return file, offset
+        }
+
+        return file, offset
+}
+
+// traversalStr produces a representation of an HCL traversal that is compact,
+// resembles HCL native syntax, and is suitable for display in the UI.
+func traversalStr(traversal hcl.Traversal) string {
+        // This is a specialized subset of traversal rendering tailored to
+        // producing helpful contextual messages in diagnostics. It is not
+        // comprehensive nor intended to be used for other purposes.
+
+        var buf bytes.Buffer
+        for _, step := range traversal {
+                switch tStep := step.(type) {
+                case hcl.TraverseRoot:
+                        buf.WriteString(tStep.Name)
+                case hcl.TraverseAttr:
+                        buf.WriteByte('.')
+                        buf.WriteString(tStep.Name)
+                case hcl.TraverseIndex:
+                        buf.WriteByte('[')
+                        if keyTy := tStep.Key.Type(); keyTy.IsPrimitiveType() {
+                                buf.WriteString(compactValueStr(tStep.Key))
+                        } else {
+                                // We'll just use a placeholder for more complex values,
+                                // since otherwise our result could grow ridiculously long.
+                                buf.WriteString("...")
+                        }
+                        buf.WriteByte(']')
+                }
+        }
+        return buf.String()
+}
+
+// compactValueStr produces a compact, single-line summary of a given value
+// that is suitable for display in the UI.
+//
+// For primitives it returns a full representation, while for more complex
+// types it instead summarizes the type, size, etc to produce something
+// that is hopefully still somewhat useful but not as verbose as a rendering
+// of the entire data structure.
+func compactValueStr(val cty.Value) string {
+        // This is a specialized subset of value rendering tailored to producing
+        // helpful but concise messages in diagnostics. It is not comprehensive
+        // nor intended to be used for other purposes.
+
+        ty := val.Type()
+        switch {
+        case val.IsNull():
+                return "null"
+        case !val.IsKnown():
+                // Should never happen here because we should filter before we get
+                // in here, but we'll do something reasonable rather than panic.
+                return "(not yet known)"
+        case ty == cty.Bool:
+                if val.True() {
+                        return "true"
+                }
+                return "false"
+        case ty == cty.Number:
+                bf := val.AsBigFloat()
+                return bf.Text('g', 10)
+        case ty == cty.String:
+                // Go string syntax is not exactly the same as HCL native string syntax,
+                // but we'll accept the minor edge-cases where this is different here
+                // for now, just to get something reasonable here.
+                return fmt.Sprintf("%q", val.AsString())
+        case ty.IsCollectionType() || ty.IsTupleType():
+                l := val.LengthInt()
+                switch l {
+                case 0:
+                        return "empty " + ty.FriendlyName()
+                case 1:
+                        return ty.FriendlyName() + " with 1 element"
+                default:
+                        return fmt.Sprintf("%s with %d elements", ty.FriendlyName(), l)
+                }
+        case ty.IsObjectType():
+                atys := ty.AttributeTypes()
+                l := len(atys)
+                switch l {
+                case 0:
+                        return "object with no attributes"
+                case 1:
+                        var name string
+                        for k := range atys {
+                                name = k
+                        }
+                        return fmt.Sprintf("object with 1 attribute %q", name)
+                default:
+                        return fmt.Sprintf("object with %d attributes", l)
+                }
+        default:
+                return ty.FriendlyName()
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/command/format/diff.go b/vendor/github.com/hashicorp/terraform/command/format/diff.go
new file mode 100644
index 0000000..c726f0e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/command/format/diff.go
@@ -0,0 +1,1192 @@
+package format
+
+import (
+        "bufio"
+        "bytes"
+        "fmt"
+        "sort"
+        "strings"
+
+        "github.com/mitchellh/colorstring"
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/plans/objchange"
+        "github.com/hashicorp/terraform/states"
+)
+
+// ResourceChange returns a string representation of a change to a particular
+// resource, for inclusion in user-facing plan output.
+//
+// The resource schema must be provided along with the change so that the
+// formatted change can reflect the configuration structure for the associated
+// resource.
+//
+// If "color" is non-nil, it will be used to color the result. Otherwise,
+// no color codes will be included.
+func ResourceChange(
+        change *plans.ResourceInstanceChangeSrc,
+        tainted bool,
+        schema *configschema.Block,
+        color *colorstring.Colorize,
+) string {
+        addr := change.Addr
+        var buf bytes.Buffer
+
+        if color == nil {
+                color = &colorstring.Colorize{
+                        Colors:  colorstring.DefaultColors,
+                        Disable: true,
+                        Reset:   false,
+                }
+        }
+
+        dispAddr := addr.String()
+        if change.DeposedKey != states.NotDeposed {
+                dispAddr = fmt.Sprintf("%s (deposed object %s)", dispAddr, change.DeposedKey)
+        }
+
+        switch change.Action {
+        case plans.Create:
+                buf.WriteString(color.Color(fmt.Sprintf("[bold]  # %s[reset] will be created", dispAddr)))
+        case plans.Read:
+                buf.WriteString(color.Color(fmt.Sprintf("[bold]  # %s[reset] will be read during apply\n  # (config refers to values not yet known)", dispAddr)))
+        case plans.Update:
+                buf.WriteString(color.Color(fmt.Sprintf("[bold]  # %s[reset] will be updated in-place", dispAddr)))
+        case plans.CreateThenDelete, plans.DeleteThenCreate:
+                if tainted {
+                        buf.WriteString(color.Color(fmt.Sprintf("[bold]  # %s[reset] is tainted, so must be [bold][red]replaced", dispAddr)))
+                } else {
+                        buf.WriteString(color.Color(fmt.Sprintf("[bold]  # %s[reset] must be [bold][red]replaced", dispAddr)))
+                }
+        case plans.Delete:
+                buf.WriteString(color.Color(fmt.Sprintf("[bold]  # %s[reset] will be [bold][red]destroyed", dispAddr)))
+        default:
+                // should never happen, since the above is exhaustive
+                buf.WriteString(fmt.Sprintf("%s has an action the plan renderer doesn't support (this is a bug)", dispAddr))
+        }
+        buf.WriteString(color.Color("[reset]\n"))
+
+        switch change.Action {
+        case plans.Create:
+                buf.WriteString(color.Color("[green]  +[reset] "))
+        case plans.Read:
+                buf.WriteString(color.Color("[cyan] <=[reset] "))
+        case plans.Update:
+                buf.WriteString(color.Color("[yellow]  ~[reset] "))
+        case plans.DeleteThenCreate:
+                buf.WriteString(color.Color("[red]-[reset]/[green]+[reset] "))
+        case plans.CreateThenDelete:
+                buf.WriteString(color.Color("[green]+[reset]/[red]-[reset] "))
+        case plans.Delete:
+                buf.WriteString(color.Color("[red]  -[reset] "))
+        default:
+                buf.WriteString(color.Color("??? "))
+        }
+
+        switch addr.Resource.Resource.Mode {
+        case addrs.ManagedResourceMode:
+                buf.WriteString(fmt.Sprintf(
+                        "resource %q %q",
+                        addr.Resource.Resource.Type,
+                        addr.Resource.Resource.Name,
+                ))
+        case addrs.DataResourceMode:
+                buf.WriteString(fmt.Sprintf(
+                        "data %q %q ",
+                        addr.Resource.Resource.Type,
+                        addr.Resource.Resource.Name,
+                ))
+        default:
+                // should never happen, since the above is exhaustive
+                buf.WriteString(addr.String())
+        }
+
+        buf.WriteString(" {")
+
+        p := blockBodyDiffPrinter{
+                buf:             &buf,
+                color:           color,
+                action:          change.Action,
+                requiredReplace: change.RequiredReplace,
+        }
+
+        // Most commonly-used resources have nested blocks that result in us
+        // going at least three traversals deep while we recurse here, so we'll
+        // start with that much capacity and then grow as needed for deeper
+        // structures.
+        path := make(cty.Path, 0, 3)
+
+        changeV, err := change.Decode(schema.ImpliedType())
+        if err != nil {
+                // Should never happen in here, since we've already been through
+                // loads of layers of encode/decode of the planned changes before now.
+                panic(fmt.Sprintf("failed to decode plan for %s while rendering diff: %s", addr, err))
+        }
+
+        // We currently have an opt-out that permits the legacy SDK to return values
+        // that defy our usual conventions around handling of nesting blocks. To
+        // avoid the rendering code from needing to handle all of these, we'll
+        // normalize first.
+        // (Ideally we'd do this as part of the SDK opt-out implementation in core,
+        // but we've added it here for now to reduce risk of unexpected impacts
+        // on other code in core.)
+        changeV.Change.Before = objchange.NormalizeObjectFromLegacySDK(changeV.Change.Before, schema)
+        changeV.Change.After = objchange.NormalizeObjectFromLegacySDK(changeV.Change.After, schema)
+
+        bodyWritten := p.writeBlockBodyDiff(schema, changeV.Before, changeV.After, 6, path)
+        if bodyWritten {
+                buf.WriteString("\n")
+                buf.WriteString(strings.Repeat(" ", 4))
+        }
+        buf.WriteString("}\n")
+
+        return buf.String()
+}
+
+type blockBodyDiffPrinter struct {
+        buf             *bytes.Buffer
+        color           *colorstring.Colorize
+        action          plans.Action
+        requiredReplace cty.PathSet
+}
+
+const forcesNewResourceCaption = " [red]# forces replacement[reset]"
+
+// writeBlockBodyDiff writes attribute or block differences
+// and returns true if any differences were found and written
+func (p *blockBodyDiffPrinter) writeBlockBodyDiff(schema *configschema.Block, old, new cty.Value, indent int, path cty.Path) bool {
+        path = ctyEnsurePathCapacity(path, 1)
+
+        bodyWritten := false
+        blankBeforeBlocks := false
+        {
+                attrNames := make([]string, 0, len(schema.Attributes))
+                attrNameLen := 0
+                for name := range schema.Attributes {
+                        oldVal := ctyGetAttrMaybeNull(old, name)
+                        newVal := ctyGetAttrMaybeNull(new, name)
+                        if oldVal.IsNull() && newVal.IsNull() {
+                                // Skip attributes where both old and new values are null
+                                // (we do this early here so that we'll do our value alignment
+                                // based on the longest attribute name that has a change, rather
+                                // than the longest attribute name in the full set.)
+                                continue
+                        }
+
+                        attrNames = append(attrNames, name)
+                        if len(name) > attrNameLen {
+                                attrNameLen = len(name)
+                        }
+                }
+                sort.Strings(attrNames)
+                if len(attrNames) > 0 {
+                        blankBeforeBlocks = true
+                }
+
+                for _, name := range attrNames {
+                        attrS := schema.Attributes[name]
+                        oldVal := ctyGetAttrMaybeNull(old, name)
+                        newVal := ctyGetAttrMaybeNull(new, name)
+
+                        bodyWritten = true
+                        p.writeAttrDiff(name, attrS, oldVal, newVal, attrNameLen, indent, path)
+                }
+        }
+
+        {
+                blockTypeNames := make([]string, 0, len(schema.BlockTypes))
+                for name := range schema.BlockTypes {
+                        blockTypeNames = append(blockTypeNames, name)
+                }
+                sort.Strings(blockTypeNames)
+
+                for _, name := range blockTypeNames {
+                        blockS := schema.BlockTypes[name]
+                        oldVal := ctyGetAttrMaybeNull(old, name)
+                        newVal := ctyGetAttrMaybeNull(new, name)
+
+                        bodyWritten = true
+                        p.writeNestedBlockDiffs(name, blockS, oldVal, newVal, blankBeforeBlocks, indent, path)
+
+                        // Always include a blank for any subsequent block types.
+                        blankBeforeBlocks = true
+                }
+        }
+
+        return bodyWritten
+}
+
+func (p *blockBodyDiffPrinter) writeAttrDiff(name string, attrS *configschema.Attribute, old, new cty.Value, nameLen, indent int, path cty.Path) {
+        path = append(path, cty.GetAttrStep{Name: name})
+        p.buf.WriteString("\n")
+        p.buf.WriteString(strings.Repeat(" ", indent))
+        showJustNew := false
+        var action plans.Action
+        switch {
+        case old.IsNull():
+                action = plans.Create
+                showJustNew = true
+        case new.IsNull():
+                action = plans.Delete
+        case ctyEqualWithUnknown(old, new):
+                action = plans.NoOp
+                showJustNew = true
+        default:
+                action = plans.Update
+        }
+
+        p.writeActionSymbol(action)
+
+        p.buf.WriteString(p.color.Color("[bold]"))
+        p.buf.WriteString(name)
+        p.buf.WriteString(p.color.Color("[reset]"))
+        p.buf.WriteString(strings.Repeat(" ", nameLen-len(name)))
+        p.buf.WriteString(" = ")
+
+        if attrS.Sensitive {
+                p.buf.WriteString("(sensitive value)")
+        } else {
+                switch {
+                case showJustNew:
+                        p.writeValue(new, action, indent+2)
+                        if p.pathForcesNewResource(path) {
+                                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+                        }
+                default:
+                        // We show new even if it is null to emphasize the fact
+                        // that it is being unset, since otherwise it is easy to
+                        // misunderstand that the value is still set to the old value.
+                        p.writeValueDiff(old, new, indent+2, path)
+                }
+        }
+}
+
+func (p *blockBodyDiffPrinter) writeNestedBlockDiffs(name string, blockS *configschema.NestedBlock, old, new cty.Value, blankBefore bool, indent int, path cty.Path) {
+        path = append(path, cty.GetAttrStep{Name: name})
+        if old.IsNull() && new.IsNull() {
+                // Nothing to do if both old and new is null
+                return
+        }
+
+        // Where old/new are collections representing a nesting mode other than
+        // NestingSingle, we assume the collection value can never be unknown
+        // since we always produce the container for the nested objects, even if
+        // the objects within are computed.
+
+        switch blockS.Nesting {
+        case configschema.NestingSingle, configschema.NestingGroup:
+                var action plans.Action
+                eqV := new.Equals(old)
+                switch {
+                case old.IsNull():
+                        action = plans.Create
+                case new.IsNull():
+                        action = plans.Delete
+                case !new.IsWhollyKnown() || !old.IsWhollyKnown():
+                        // "old" should actually always be known due to our contract
+                        // that old values must never be unknown, but we'll allow it
+                        // anyway to be robust.
+                        action = plans.Update
+                case !eqV.IsKnown() || !eqV.True():
+                        action = plans.Update
+                }
+
+                if blankBefore {
+                        p.buf.WriteRune('\n')
+                }
+                p.writeNestedBlockDiff(name, nil, &blockS.Block, action, old, new, indent, path)
+        case configschema.NestingList:
+                // For the sake of handling nested blocks, we'll treat a null list
+                // the same as an empty list since the config language doesn't
+                // distinguish these anyway.
+                old = ctyNullBlockListAsEmpty(old)
+                new = ctyNullBlockListAsEmpty(new)
+
+                oldItems := ctyCollectionValues(old)
+                newItems := ctyCollectionValues(new)
+
+                // Here we intentionally preserve the index-based correspondance
+                // between old and new, rather than trying to detect insertions
+                // and removals in the list, because this more accurately reflects
+                // how Terraform Core and providers will understand the change,
+                // particularly when the nested block contains computed attributes
+                // that will themselves maintain correspondance by index.
+
+                // commonLen is number of elements that exist in both lists, which
+                // will be presented as updates (~). Any additional items in one
+                // of the lists will be presented as either creates (+) or deletes (-)
+                // depending on which list they belong to.
+                var commonLen int
+                switch {
+                case len(oldItems) < len(newItems):
+                        commonLen = len(oldItems)
+                default:
+                        commonLen = len(newItems)
+                }
+
+                if blankBefore && (len(oldItems) > 0 || len(newItems) > 0) {
+                        p.buf.WriteRune('\n')
+                }
+
+                for i := 0; i < commonLen; i++ {
+                        path := append(path, cty.IndexStep{Key: cty.NumberIntVal(int64(i))})
+                        oldItem := oldItems[i]
+                        newItem := newItems[i]
+                        action := plans.Update
+                        if oldItem.RawEquals(newItem) {
+                                action = plans.NoOp
+                        }
+                        p.writeNestedBlockDiff(name, nil, &blockS.Block, action, oldItem, newItem, indent, path)
+                }
+                for i := commonLen; i < len(oldItems); i++ {
+                        path := append(path, cty.IndexStep{Key: cty.NumberIntVal(int64(i))})
+                        oldItem := oldItems[i]
+                        newItem := cty.NullVal(oldItem.Type())
+                        p.writeNestedBlockDiff(name, nil, &blockS.Block, plans.Delete, oldItem, newItem, indent, path)
+                }
+                for i := commonLen; i < len(newItems); i++ {
+                        path := append(path, cty.IndexStep{Key: cty.NumberIntVal(int64(i))})
+                        newItem := newItems[i]
+                        oldItem := cty.NullVal(newItem.Type())
+                        p.writeNestedBlockDiff(name, nil, &blockS.Block, plans.Create, oldItem, newItem, indent, path)
+                }
+        case configschema.NestingSet:
+                // For the sake of handling nested blocks, we'll treat a null set
+                // the same as an empty set since the config language doesn't
+                // distinguish these anyway.
+                old = ctyNullBlockSetAsEmpty(old)
+                new = ctyNullBlockSetAsEmpty(new)
+
+                oldItems := ctyCollectionValues(old)
+                newItems := ctyCollectionValues(new)
+
+                if (len(oldItems) + len(newItems)) == 0 {
+                        // Nothing to do if both sets are empty
+                        return
+                }
+
+                allItems := make([]cty.Value, 0, len(oldItems)+len(newItems))
+                allItems = append(allItems, oldItems...)
+                allItems = append(allItems, newItems...)
+                all := cty.SetVal(allItems)
+
+                if blankBefore {
+                        p.buf.WriteRune('\n')
+                }
+
+                for it := all.ElementIterator(); it.Next(); {
+                        _, val := it.Element()
+                        var action plans.Action
+                        var oldValue, newValue cty.Value
+                        switch {
+                        case !val.IsKnown():
+                                action = plans.Update
+                                newValue = val
+                        case !old.HasElement(val).True():
+                                action = plans.Create
+                                oldValue = cty.NullVal(val.Type())
+                                newValue = val
+                        case !new.HasElement(val).True():
+                                action = plans.Delete
+                                oldValue = val
+                                newValue = cty.NullVal(val.Type())
+                        default:
+                                action = plans.NoOp
+                                oldValue = val
+                                newValue = val
+                        }
+                        path := append(path, cty.IndexStep{Key: val})
+                        p.writeNestedBlockDiff(name, nil, &blockS.Block, action, oldValue, newValue, indent, path)
+                }
+
+        case configschema.NestingMap:
+                // For the sake of handling nested blocks, we'll treat a null map
+                // the same as an empty map since the config language doesn't
+                // distinguish these anyway.
+                old = ctyNullBlockMapAsEmpty(old)
+                new = ctyNullBlockMapAsEmpty(new)
+
+                oldItems := old.AsValueMap()
+                newItems := new.AsValueMap()
+                if (len(oldItems) + len(newItems)) == 0 {
+                        // Nothing to do if both maps are empty
+                        return
+                }
+
+                allKeys := make(map[string]bool)
+                for k := range oldItems {
+                        allKeys[k] = true
+                }
+                for k := range newItems {
+                        allKeys[k] = true
+                }
+                allKeysOrder := make([]string, 0, len(allKeys))
+                for k := range allKeys {
+                        allKeysOrder = append(allKeysOrder, k)
+                }
+                sort.Strings(allKeysOrder)
+
+                if blankBefore {
+                        p.buf.WriteRune('\n')
+                }
+
+                for _, k := range allKeysOrder {
+                        var action plans.Action
+                        oldValue := oldItems[k]
+                        newValue := newItems[k]
+                        switch {
+                        case oldValue == cty.NilVal:
+                                oldValue = cty.NullVal(newValue.Type())
+                                action = plans.Create
+                        case newValue == cty.NilVal:
+                                newValue = cty.NullVal(oldValue.Type())
+                                action = plans.Delete
+                        case !newValue.RawEquals(oldValue):
+                                action = plans.Update
+                        default:
+                                action = plans.NoOp
+                        }
+
+                        path := append(path, cty.IndexStep{Key: cty.StringVal(k)})
+                        p.writeNestedBlockDiff(name, &k, &blockS.Block, action, oldValue, newValue, indent, path)
+                }
+        }
+}
+
+func (p *blockBodyDiffPrinter) writeNestedBlockDiff(name string, label *string, blockS *configschema.Block, action plans.Action, old, new cty.Value, indent int, path cty.Path) {
+        p.buf.WriteString("\n")
+        p.buf.WriteString(strings.Repeat(" ", indent))
+        p.writeActionSymbol(action)
+
+        if label != nil {
+                fmt.Fprintf(p.buf, "%s %q {", name, *label)
+        } else {
+                fmt.Fprintf(p.buf, "%s {", name)
+        }
+
+        if action != plans.NoOp && (p.pathForcesNewResource(path) || p.pathForcesNewResource(path[:len(path)-1])) {
+                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+        }
+
+        bodyWritten := p.writeBlockBodyDiff(blockS, old, new, indent+4, path)
+        if bodyWritten {
+                p.buf.WriteString("\n")
+                p.buf.WriteString(strings.Repeat(" ", indent+2))
+        }
+        p.buf.WriteString("}")
+}
+
+func (p *blockBodyDiffPrinter) writeValue(val cty.Value, action plans.Action, indent int) {
+        if !val.IsKnown() {
+                p.buf.WriteString("(known after apply)")
+                return
+        }
+        if val.IsNull() {
+                p.buf.WriteString(p.color.Color("[dark_gray]null[reset]"))
+                return
+        }
+
+        ty := val.Type()
+
+        switch {
+        case ty.IsPrimitiveType():
+                switch ty {
+                case cty.String:
+                        {
+                                // Special behavior for JSON strings containing array or object
+                                src := []byte(val.AsString())
+                                ty, err := ctyjson.ImpliedType(src)
+                                // check for the special case of "null", which decodes to nil,
+                                // and just allow it to be printed out directly
+                                if err == nil && !ty.IsPrimitiveType() && val.AsString() != "null" {
+                                        jv, err := ctyjson.Unmarshal(src, ty)
+                                        if err == nil {
+                                                p.buf.WriteString("jsonencode(")
+                                                if jv.LengthInt() == 0 {
+                                                        p.writeValue(jv, action, 0)
+                                                } else {
+                                                        p.buf.WriteByte('\n')
+                                                        p.buf.WriteString(strings.Repeat(" ", indent+4))
+                                                        p.writeValue(jv, action, indent+4)
+                                                        p.buf.WriteByte('\n')
+                                                        p.buf.WriteString(strings.Repeat(" ", indent))
+                                                }
+                                                p.buf.WriteByte(')')
+                                                break // don't *also* do the normal behavior below
+                                        }
+                                }
+                        }
+                        fmt.Fprintf(p.buf, "%q", val.AsString())
+                case cty.Bool:
+                        if val.True() {
+                                p.buf.WriteString("true")
+                        } else {
+                                p.buf.WriteString("false")
+                        }
+                case cty.Number:
+                        bf := val.AsBigFloat()
+                        p.buf.WriteString(bf.Text('f', -1))
+                default:
+                        // should never happen, since the above is exhaustive
+                        fmt.Fprintf(p.buf, "%#v", val)
+                }
+        case ty.IsListType() || ty.IsSetType() || ty.IsTupleType():
+                p.buf.WriteString("[")
+
+                it := val.ElementIterator()
+                for it.Next() {
+                        _, val := it.Element()
+
+                        p.buf.WriteString("\n")
+                        p.buf.WriteString(strings.Repeat(" ", indent+2))
+                        p.writeActionSymbol(action)
+                        p.writeValue(val, action, indent+4)
+                        p.buf.WriteString(",")
+                }
+
+                if val.LengthInt() > 0 {
+                        p.buf.WriteString("\n")
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                }
+                p.buf.WriteString("]")
+        case ty.IsMapType():
+                p.buf.WriteString("{")
+
+                keyLen := 0
+                for it := val.ElementIterator(); it.Next(); {
+                        key, _ := it.Element()
+                        if keyStr := key.AsString(); len(keyStr) > keyLen {
+                                keyLen = len(keyStr)
+                        }
+                }
+
+                for it := val.ElementIterator(); it.Next(); {
+                        key, val := it.Element()
+
+                        p.buf.WriteString("\n")
+                        p.buf.WriteString(strings.Repeat(" ", indent+2))
+                        p.writeActionSymbol(action)
+                        p.writeValue(key, action, indent+4)
+                        p.buf.WriteString(strings.Repeat(" ", keyLen-len(key.AsString())))
+                        p.buf.WriteString(" = ")
+                        p.writeValue(val, action, indent+4)
+                }
+
+                if val.LengthInt() > 0 {
+                        p.buf.WriteString("\n")
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                }
+                p.buf.WriteString("}")
+        case ty.IsObjectType():
+                p.buf.WriteString("{")
+
+                atys := ty.AttributeTypes()
+                attrNames := make([]string, 0, len(atys))
+                nameLen := 0
+                for attrName := range atys {
+                        attrNames = append(attrNames, attrName)
+                        if len(attrName) > nameLen {
+                                nameLen = len(attrName)
+                        }
+                }
+                sort.Strings(attrNames)
+
+                for _, attrName := range attrNames {
+                        val := val.GetAttr(attrName)
+
+                        p.buf.WriteString("\n")
+                        p.buf.WriteString(strings.Repeat(" ", indent+2))
+                        p.writeActionSymbol(action)
+                        p.buf.WriteString(attrName)
+                        p.buf.WriteString(strings.Repeat(" ", nameLen-len(attrName)))
+                        p.buf.WriteString(" = ")
+                        p.writeValue(val, action, indent+4)
+                }
+
+                if len(attrNames) > 0 {
+                        p.buf.WriteString("\n")
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                }
+                p.buf.WriteString("}")
+        }
+}
+
+func (p *blockBodyDiffPrinter) writeValueDiff(old, new cty.Value, indent int, path cty.Path) {
+        ty := old.Type()
+        typesEqual := ctyTypesEqual(ty, new.Type())
+
+        // We have some specialized diff implementations for certain complex
+        // values where it's useful to see a visualization of the diff of
+        // the nested elements rather than just showing the entire old and
+        // new values verbatim.
+        // However, these specialized implementations can apply only if both
+        // values are known and non-null.
+        if old.IsKnown() && new.IsKnown() && !old.IsNull() && !new.IsNull() && typesEqual {
+                switch {
+                case ty == cty.String:
+                        // We have special behavior for both multi-line strings in general
+                        // and for strings that can parse as JSON. For the JSON handling
+                        // to apply, both old and new must be valid JSON.
+                        // For single-line strings that don't parse as JSON we just fall
+                        // out of this switch block and do the default old -> new rendering.
+                        oldS := old.AsString()
+                        newS := new.AsString()
+
+                        {
+                                // Special behavior for JSON strings containing object or
+                                // list values.
+                                oldBytes := []byte(oldS)
+                                newBytes := []byte(newS)
+                                oldType, oldErr := ctyjson.ImpliedType(oldBytes)
+                                newType, newErr := ctyjson.ImpliedType(newBytes)
+                                if oldErr == nil && newErr == nil && !(oldType.IsPrimitiveType() && newType.IsPrimitiveType()) {
+                                        oldJV, oldErr := ctyjson.Unmarshal(oldBytes, oldType)
+                                        newJV, newErr := ctyjson.Unmarshal(newBytes, newType)
+                                        if oldErr == nil && newErr == nil {
+                                                if !oldJV.RawEquals(newJV) { // two JSON values may differ only in insignificant whitespace
+                                                        p.buf.WriteString("jsonencode(")
+                                                        p.buf.WriteByte('\n')
+                                                        p.buf.WriteString(strings.Repeat(" ", indent+2))
+                                                        p.writeActionSymbol(plans.Update)
+                                                        p.writeValueDiff(oldJV, newJV, indent+4, path)
+                                                        p.buf.WriteByte('\n')
+                                                        p.buf.WriteString(strings.Repeat(" ", indent))
+                                                        p.buf.WriteByte(')')
+                                                } else {
+                                                        // if they differ only in insigificant whitespace
+                                                        // then we'll note that but still expand out the
+                                                        // effective value.
+                                                        if p.pathForcesNewResource(path) {
+                                                                p.buf.WriteString(p.color.Color("jsonencode( [red]# whitespace changes force replacement[reset]"))
+                                                        } else {
+                                                                p.buf.WriteString(p.color.Color("jsonencode( [dim]# whitespace changes[reset]"))
+                                                        }
+                                                        p.buf.WriteByte('\n')
+                                                        p.buf.WriteString(strings.Repeat(" ", indent+4))
+                                                        p.writeValue(oldJV, plans.NoOp, indent+4)
+                                                        p.buf.WriteByte('\n')
+                                                        p.buf.WriteString(strings.Repeat(" ", indent))
+                                                        p.buf.WriteByte(')')
+                                                }
+                                                return
+                                        }
+                                }
+                        }
+
+                        if strings.Index(oldS, "\n") < 0 && strings.Index(newS, "\n") < 0 {
+                                break
+                        }
+
+                        p.buf.WriteString("<<~EOT")
+                        if p.pathForcesNewResource(path) {
+                                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+                        }
+                        p.buf.WriteString("\n")
+
+                        var oldLines, newLines []cty.Value
+                        {
+                                r := strings.NewReader(oldS)
+                                sc := bufio.NewScanner(r)
+                                for sc.Scan() {
+                                        oldLines = append(oldLines, cty.StringVal(sc.Text()))
+                                }
+                        }
+                        {
+                                r := strings.NewReader(newS)
+                                sc := bufio.NewScanner(r)
+                                for sc.Scan() {
+                                        newLines = append(newLines, cty.StringVal(sc.Text()))
+                                }
+                        }
+
+                        diffLines := ctySequenceDiff(oldLines, newLines)
+                        for _, diffLine := range diffLines {
+                                p.buf.WriteString(strings.Repeat(" ", indent+2))
+                                p.writeActionSymbol(diffLine.Action)
+
+                                switch diffLine.Action {
+                                case plans.NoOp, plans.Delete:
+                                        p.buf.WriteString(diffLine.Before.AsString())
+                                case plans.Create:
+                                        p.buf.WriteString(diffLine.After.AsString())
+                                default:
+                                        // Should never happen since the above covers all
+                                        // actions that ctySequenceDiff can return for strings
+                                        p.buf.WriteString(diffLine.After.AsString())
+
+                                }
+                                p.buf.WriteString("\n")
+                        }
+
+                        p.buf.WriteString(strings.Repeat(" ", indent)) // +4 here because there's no symbol
+                        p.buf.WriteString("EOT")
+
+                        return
+
+                case ty.IsSetType():
+                        p.buf.WriteString("[")
+                        if p.pathForcesNewResource(path) {
+                                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+                        }
+                        p.buf.WriteString("\n")
+
+                        var addedVals, removedVals, allVals []cty.Value
+                        for it := old.ElementIterator(); it.Next(); {
+                                _, val := it.Element()
+                                allVals = append(allVals, val)
+                                if new.HasElement(val).False() {
+                                        removedVals = append(removedVals, val)
+                                }
+                        }
+                        for it := new.ElementIterator(); it.Next(); {
+                                _, val := it.Element()
+                                allVals = append(allVals, val)
+                                if val.IsKnown() && old.HasElement(val).False() {
+                                        addedVals = append(addedVals, val)
+                                }
+                        }
+
+                        var all, added, removed cty.Value
+                        if len(allVals) > 0 {
+                                all = cty.SetVal(allVals)
+                        } else {
+                                all = cty.SetValEmpty(ty.ElementType())
+                        }
+                        if len(addedVals) > 0 {
+                                added = cty.SetVal(addedVals)
+                        } else {
+                                added = cty.SetValEmpty(ty.ElementType())
+                        }
+                        if len(removedVals) > 0 {
+                                removed = cty.SetVal(removedVals)
+                        } else {
+                                removed = cty.SetValEmpty(ty.ElementType())
+                        }
+
+                        for it := all.ElementIterator(); it.Next(); {
+                                _, val := it.Element()
+
+                                p.buf.WriteString(strings.Repeat(" ", indent+2))
+
+                                var action plans.Action
+                                switch {
+                                case !val.IsKnown():
+                                        action = plans.Update
+                                case added.HasElement(val).True():
+                                        action = plans.Create
+                                case removed.HasElement(val).True():
+                                        action = plans.Delete
+                                default:
+                                        action = plans.NoOp
+                                }
+
+                                p.writeActionSymbol(action)
+                                p.writeValue(val, action, indent+4)
+                                p.buf.WriteString(",\n")
+                        }
+
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                        p.buf.WriteString("]")
+                        return
+                case ty.IsListType() || ty.IsTupleType():
+                        p.buf.WriteString("[")
+                        if p.pathForcesNewResource(path) {
+                                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+                        }
+                        p.buf.WriteString("\n")
+
+                        elemDiffs := ctySequenceDiff(old.AsValueSlice(), new.AsValueSlice())
+                        for _, elemDiff := range elemDiffs {
+                                p.buf.WriteString(strings.Repeat(" ", indent+2))
+                                p.writeActionSymbol(elemDiff.Action)
+                                switch elemDiff.Action {
+                                case plans.NoOp, plans.Delete:
+                                        p.writeValue(elemDiff.Before, elemDiff.Action, indent+4)
+                                case plans.Update:
+                                        p.writeValueDiff(elemDiff.Before, elemDiff.After, indent+4, path)
+                                case plans.Create:
+                                        p.writeValue(elemDiff.After, elemDiff.Action, indent+4)
+                                default:
+                                        // Should never happen since the above covers all
+                                        // actions that ctySequenceDiff can return.
+                                        p.writeValue(elemDiff.After, elemDiff.Action, indent+4)
+                                }
+
+                                p.buf.WriteString(",\n")
+                        }
+
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                        p.buf.WriteString("]")
+                        return
+
+                case ty.IsMapType():
+                        p.buf.WriteString("{")
+                        if p.pathForcesNewResource(path) {
+                                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+                        }
+                        p.buf.WriteString("\n")
+
+                        var allKeys []string
+                        keyLen := 0
+                        for it := old.ElementIterator(); it.Next(); {
+                                k, _ := it.Element()
+                                keyStr := k.AsString()
+                                allKeys = append(allKeys, keyStr)
+                                if len(keyStr) > keyLen {
+                                        keyLen = len(keyStr)
+                                }
+                        }
+                        for it := new.ElementIterator(); it.Next(); {
+                                k, _ := it.Element()
+                                keyStr := k.AsString()
+                                allKeys = append(allKeys, keyStr)
+                                if len(keyStr) > keyLen {
+                                        keyLen = len(keyStr)
+                                }
+                        }
+
+                        sort.Strings(allKeys)
+
+                        lastK := ""
+                        for i, k := range allKeys {
+                                if i > 0 && lastK == k {
+                                        continue // skip duplicates (list is sorted)
+                                }
+                                lastK = k
+
+                                p.buf.WriteString(strings.Repeat(" ", indent+2))
+                                kV := cty.StringVal(k)
+                                var action plans.Action
+                                if old.HasIndex(kV).False() {
+                                        action = plans.Create
+                                } else if new.HasIndex(kV).False() {
+                                        action = plans.Delete
+                                } else if eqV := old.Index(kV).Equals(new.Index(kV)); eqV.IsKnown() && eqV.True() {
+                                        action = plans.NoOp
+                                } else {
+                                        action = plans.Update
+                                }
+
+                                path := append(path, cty.IndexStep{Key: kV})
+
+                                p.writeActionSymbol(action)
+                                p.writeValue(kV, action, indent+4)
+                                p.buf.WriteString(strings.Repeat(" ", keyLen-len(k)))
+                                p.buf.WriteString(" = ")
+                                switch action {
+                                case plans.Create, plans.NoOp:
+                                        v := new.Index(kV)
+                                        p.writeValue(v, action, indent+4)
+                                case plans.Delete:
+                                        oldV := old.Index(kV)
+                                        newV := cty.NullVal(oldV.Type())
+                                        p.writeValueDiff(oldV, newV, indent+4, path)
+                                default:
+                                        oldV := old.Index(kV)
+                                        newV := new.Index(kV)
+                                        p.writeValueDiff(oldV, newV, indent+4, path)
+                                }
+
+                                p.buf.WriteByte('\n')
+                        }
+
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                        p.buf.WriteString("}")
+                        return
+                case ty.IsObjectType():
+                        p.buf.WriteString("{")
+                        p.buf.WriteString("\n")
+
+                        forcesNewResource := p.pathForcesNewResource(path)
+
+                        var allKeys []string
+                        keyLen := 0
+                        for it := old.ElementIterator(); it.Next(); {
+                                k, _ := it.Element()
+                                keyStr := k.AsString()
+                                allKeys = append(allKeys, keyStr)
+                                if len(keyStr) > keyLen {
+                                        keyLen = len(keyStr)
+                                }
+                        }
+                        for it := new.ElementIterator(); it.Next(); {
+                                k, _ := it.Element()
+                                keyStr := k.AsString()
+                                allKeys = append(allKeys, keyStr)
+                                if len(keyStr) > keyLen {
+                                        keyLen = len(keyStr)
+                                }
+                        }
+
+                        sort.Strings(allKeys)
+
+                        lastK := ""
+                        for i, k := range allKeys {
+                                if i > 0 && lastK == k {
+                                        continue // skip duplicates (list is sorted)
+                                }
+                                lastK = k
+
+                                p.buf.WriteString(strings.Repeat(" ", indent+2))
+                                kV := k
+                                var action plans.Action
+                                if !old.Type().HasAttribute(kV) {
+                                        action = plans.Create
+                                } else if !new.Type().HasAttribute(kV) {
+                                        action = plans.Delete
+                                } else if eqV := old.GetAttr(kV).Equals(new.GetAttr(kV)); eqV.IsKnown() && eqV.True() {
+                                        action = plans.NoOp
+                                } else {
+                                        action = plans.Update
+                                }
+
+                                path := append(path, cty.GetAttrStep{Name: kV})
+
+                                p.writeActionSymbol(action)
+                                p.buf.WriteString(k)
+                                p.buf.WriteString(strings.Repeat(" ", keyLen-len(k)))
+                                p.buf.WriteString(" = ")
+
+                                switch action {
+                                case plans.Create, plans.NoOp:
+                                        v := new.GetAttr(kV)
+                                        p.writeValue(v, action, indent+4)
+                                case plans.Delete:
+                                        oldV := old.GetAttr(kV)
+                                        newV := cty.NullVal(oldV.Type())
+                                        p.writeValueDiff(oldV, newV, indent+4, path)
+                                default:
+                                        oldV := old.GetAttr(kV)
+                                        newV := new.GetAttr(kV)
+                                        p.writeValueDiff(oldV, newV, indent+4, path)
+                                }
+
+                                p.buf.WriteString("\n")
+                        }
+
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                        p.buf.WriteString("}")
+
+                        if forcesNewResource {
+                                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+                        }
+                        return
+                }
+        }
+
+        // In all other cases, we just show the new and old values as-is
+        p.writeValue(old, plans.Delete, indent)
+        if new.IsNull() {
+                p.buf.WriteString(p.color.Color(" [dark_gray]->[reset] "))
+        } else {
+                p.buf.WriteString(p.color.Color(" [yellow]->[reset] "))
+        }
+
+        p.writeValue(new, plans.Create, indent)
+        if p.pathForcesNewResource(path) {
+                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+        }
+}
+
+// writeActionSymbol writes a symbol to represent the given action, followed
+// by a space.
+//
+// It only supports the actions that can be represented with a single character:
+// Create, Delete, Update and NoAction.
+func (p *blockBodyDiffPrinter) writeActionSymbol(action plans.Action) {
+        switch action {
+        case plans.Create:
+                p.buf.WriteString(p.color.Color("[green]+[reset] "))
+        case plans.Delete:
+                p.buf.WriteString(p.color.Color("[red]-[reset] "))
+        case plans.Update:
+                p.buf.WriteString(p.color.Color("[yellow]~[reset] "))
+        case plans.NoOp:
+                p.buf.WriteString("  ")
+        default:
+                // Should never happen
+                p.buf.WriteString(p.color.Color("? "))
+        }
+}
+
+func (p *blockBodyDiffPrinter) pathForcesNewResource(path cty.Path) bool {
+        if !p.action.IsReplace() {
+                // "requiredReplace" only applies when the instance is being replaced
+                return false
+        }
+        return p.requiredReplace.Has(path)
+}
+
+func ctyEmptyString(value cty.Value) bool {
+        if !value.IsNull() && value.IsKnown() {
+                valueType := value.Type()
+                if valueType == cty.String && value.AsString() == "" {
+                        return true
+                }
+        }
+        return false
+}
+
+func ctyGetAttrMaybeNull(val cty.Value, name string) cty.Value {
+        attrType := val.Type().AttributeType(name)
+
+        if val.IsNull() {
+                return cty.NullVal(attrType)
+        }
+
+        // We treat "" as null here
+        // as existing SDK doesn't support null yet.
+        // This allows us to avoid spurious diffs
+        // until we introduce null to the SDK.
+        attrValue := val.GetAttr(name)
+        if ctyEmptyString(attrValue) {
+                return cty.NullVal(attrType)
+        }
+
+        return attrValue
+}
+
+func ctyCollectionValues(val cty.Value) []cty.Value {
+        if !val.IsKnown() || val.IsNull() {
+                return nil
+        }
+
+        ret := make([]cty.Value, 0, val.LengthInt())
+        for it := val.ElementIterator(); it.Next(); {
+                _, value := it.Element()
+                ret = append(ret, value)
+        }
+        return ret
+}
+
+// ctySequenceDiff returns differences between given sequences of cty.Value(s)
+// in the form of Create, Delete, or Update actions (for objects).
+func ctySequenceDiff(old, new []cty.Value) []*plans.Change {
+        var ret []*plans.Change
+        lcs := objchange.LongestCommonSubsequence(old, new)
+        var oldI, newI, lcsI int
+        for oldI < len(old) || newI < len(new) || lcsI < len(lcs) {
+                for oldI < len(old) && (lcsI >= len(lcs) || !old[oldI].RawEquals(lcs[lcsI])) {
+                        isObjectDiff := old[oldI].Type().IsObjectType() && (newI >= len(new) || new[newI].Type().IsObjectType())
+                        if isObjectDiff && newI < len(new) {
+                                ret = append(ret, &plans.Change{
+                                        Action: plans.Update,
+                                        Before: old[oldI],
+                                        After:  new[newI],
+                                })
+                                oldI++
+                                newI++ // we also consume the next "new" in this case
+                                continue
+                        }
+
+                        ret = append(ret, &plans.Change{
+                                Action: plans.Delete,
+                                Before: old[oldI],
+                                After:  cty.NullVal(old[oldI].Type()),
+                        })
+                        oldI++
+                }
+                for newI < len(new) && (lcsI >= len(lcs) || !new[newI].RawEquals(lcs[lcsI])) {
+                        ret = append(ret, &plans.Change{
+                                Action: plans.Create,
+                                Before: cty.NullVal(new[newI].Type()),
+                                After:  new[newI],
+                        })
+                        newI++
+                }
+                if lcsI < len(lcs) {
+                        ret = append(ret, &plans.Change{
+                                Action: plans.NoOp,
+                                Before: lcs[lcsI],
+                                After:  lcs[lcsI],
+                        })
+
+                        // All of our indexes advance together now, since the line
+                        // is common to all three sequences.
+                        lcsI++
+                        oldI++
+                        newI++
+                }
+        }
+        return ret
+}
+
+func ctyEqualWithUnknown(old, new cty.Value) bool {
+        if !old.IsWhollyKnown() || !new.IsWhollyKnown() {
+                return false
+        }
+        return old.Equals(new).True()
+}
+
+// ctyTypesEqual checks equality of two types more loosely
+// by avoiding checks of object/tuple elements
+// as we render differences on element-by-element basis anyway
+func ctyTypesEqual(oldT, newT cty.Type) bool {
+        if oldT.IsObjectType() && newT.IsObjectType() {
+                return true
+        }
+        if oldT.IsTupleType() && newT.IsTupleType() {
+                return true
+        }
+        return oldT.Equals(newT)
+}
+
+func ctyEnsurePathCapacity(path cty.Path, minExtra int) cty.Path {
+        if cap(path)-len(path) >= minExtra {
+                return path
+        }
+        newCap := cap(path) * 2
+        if newCap < (len(path) + minExtra) {
+                newCap = len(path) + minExtra
+        }
+        newPath := make(cty.Path, len(path), newCap)
+        copy(newPath, path)
+        return newPath
+}
+
+// ctyNullBlockListAsEmpty either returns the given value verbatim if it is non-nil
+// or returns an empty value of a suitable type to serve as a placeholder for it.
+//
+// In particular, this function handles the special situation where a "list" is
+// actually represented as a tuple type where nested blocks contain
+// dynamically-typed values.
+func ctyNullBlockListAsEmpty(in cty.Value) cty.Value {
+        if !in.IsNull() {
+                return in
+        }
+        if ty := in.Type(); ty.IsListType() {
+                return cty.ListValEmpty(ty.ElementType())
+        }
+        return cty.EmptyTupleVal // must need a tuple, then
+}
+
+// ctyNullBlockMapAsEmpty either returns the given value verbatim if it is non-nil
+// or returns an empty value of a suitable type to serve as a placeholder for it.
+//
+// In particular, this function handles the special situation where a "map" is
+// actually represented as an object type where nested blocks contain
+// dynamically-typed values.
+func ctyNullBlockMapAsEmpty(in cty.Value) cty.Value {
+        if !in.IsNull() {
+                return in
+        }
+        if ty := in.Type(); ty.IsMapType() {
+                return cty.MapValEmpty(ty.ElementType())
+        }
+        return cty.EmptyObjectVal // must need an object, then
+}
+
+// ctyNullBlockSetAsEmpty either returns the given value verbatim if it is non-nil
+// or returns an empty value of a suitable type to serve as a placeholder for it.
+func ctyNullBlockSetAsEmpty(in cty.Value) cty.Value {
+        if !in.IsNull() {
+                return in
+        }
+        // Dynamically-typed attributes are not supported inside blocks backed by
+        // sets, so our result here is always a set.
+        return cty.SetValEmpty(in.Type().ElementType())
+}
diff --git a/vendor/github.com/hashicorp/terraform/command/format/format.go b/vendor/github.com/hashicorp/terraform/command/format/format.go
new file mode 100644
index 0000000..aa8d7de
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/command/format/format.go
@@ -0,0 +1,8 @@
+// Package format contains helpers for formatting various Terraform
+// structures for human-readabout output.
+//
+// This package is used by the official Terraform CLI in formatting any
+// output and is exported to encourage non-official frontends to mimic the
+// output formatting as much as possible so that text formats of Terraform
+// structures have a consistent look and feel.
+package format
diff --git a/vendor/github.com/hashicorp/terraform/command/format/object_id.go b/vendor/github.com/hashicorp/terraform/command/format/object_id.go
new file mode 100644
index 0000000..85ebbfe
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/command/format/object_id.go
@@ -0,0 +1,123 @@
+package format
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// ObjectValueID takes a value that is assumed to be an object representation
+// of some resource instance object and attempts to heuristically find an
+// attribute of it that is likely to be a unique identifier in the remote
+// system that it belongs to which will be useful to the user.
+//
+// If such an attribute is found, its name and string value intended for
+// display are returned. Both returned strings are empty if no such attribute
+// exists, in which case the caller should assume that the resource instance
+// address within the Terraform configuration is the best available identifier.
+//
+// This is only a best-effort sort of thing, relying on naming conventions in
+// our resource type schemas. The result is not guaranteed to be unique, but
+// should generally be suitable for display to an end-user anyway.
+//
+// This function will panic if the given value is not of an object type.
+func ObjectValueID(obj cty.Value) (k, v string) {
+        if obj.IsNull() || !obj.IsKnown() {
+                return "", ""
+        }
+
+        atys := obj.Type().AttributeTypes()
+
+        switch {
+
+        case atys["id"] == cty.String:
+                v := obj.GetAttr("id")
+                if v.IsKnown() && !v.IsNull() {
+                        return "id", v.AsString()
+                }
+
+        case atys["name"] == cty.String:
+                // "name" isn't always globally unique, but if there isn't also an
+                // "id" then it _often_ is, in practice.
+                v := obj.GetAttr("name")
+                if v.IsKnown() && !v.IsNull() {
+                        return "name", v.AsString()
+                }
+        }
+
+        return "", ""
+}
+
+// ObjectValueName takes a value that is assumed to be an object representation
+// of some resource instance object and attempts to heuristically find an
+// attribute of it that is likely to be a human-friendly name in the remote
+// system that it belongs to which will be useful to the user.
+//
+// If such an attribute is found, its name and string value intended for
+// display are returned. Both returned strings are empty if no such attribute
+// exists, in which case the caller should assume that the resource instance
+// address within the Terraform configuration is the best available identifier.
+//
+// This is only a best-effort sort of thing, relying on naming conventions in
+// our resource type schemas. The result is not guaranteed to be unique, but
+// should generally be suitable for display to an end-user anyway.
+//
+// Callers that use both ObjectValueName and ObjectValueID at the same time
+// should be prepared to get the same attribute key and value from both in
+// some cases, since there is overlap betweek the id-extraction and
+// name-extraction heuristics.
+//
+// This function will panic if the given value is not of an object type.
+func ObjectValueName(obj cty.Value) (k, v string) {
+        if obj.IsNull() || !obj.IsKnown() {
+                return "", ""
+        }
+
+        atys := obj.Type().AttributeTypes()
+
+        switch {
+
+        case atys["name"] == cty.String:
+                v := obj.GetAttr("name")
+                if v.IsKnown() && !v.IsNull() {
+                        return "name", v.AsString()
+                }
+
+        case atys["tags"].IsMapType() && atys["tags"].ElementType() == cty.String:
+                tags := obj.GetAttr("tags")
+                if tags.IsNull() || !tags.IsWhollyKnown() {
+                        break
+                }
+
+                switch {
+                case tags.HasIndex(cty.StringVal("name")).RawEquals(cty.True):
+                        v := tags.Index(cty.StringVal("name"))
+                        if v.IsKnown() && !v.IsNull() {
+                                return "tags.name", v.AsString()
+                        }
+                case tags.HasIndex(cty.StringVal("Name")).RawEquals(cty.True):
+                        // AWS-style naming convention
+                        v := tags.Index(cty.StringVal("Name"))
+                        if v.IsKnown() && !v.IsNull() {
+                                return "tags.Name", v.AsString()
+                        }
+                }
+        }
+
+        return "", ""
+}
+
+// ObjectValueIDOrName is a convenience wrapper around both ObjectValueID
+// and ObjectValueName (in that preference order) to try to extract some sort
+// of human-friendly descriptive string value for an object as additional
+// context about an object when it is being displayed in a compact way (where
+// not all of the attributes are visible.)
+//
+// Just as with the two functions it wraps, it is a best-effort and may return
+// two empty strings if no suitable attribute can be found for a given object.
+func ObjectValueIDOrName(obj cty.Value) (k, v string) {
+        k, v = ObjectValueID(obj)
+        if k != "" {
+                return
+        }
+        k, v = ObjectValueName(obj)
+        return
+}
diff --git a/vendor/github.com/hashicorp/terraform/command/format/plan.go b/vendor/github.com/hashicorp/terraform/command/format/plan.go
new file mode 100644
index 0000000..098653f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/command/format/plan.go
@@ -0,0 +1,302 @@
+package format
+
+import (
+        "bytes"
+        "fmt"
+        "log"
+        "sort"
+        "strings"
+
+        "github.com/mitchellh/colorstring"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/terraform"
+)
+
+// Plan is a representation of a plan optimized for display to
+// an end-user, as opposed to terraform.Plan which is for internal use.
+//
+// DisplayPlan excludes implementation details that may otherwise appear
+// in the main plan, such as destroy actions on data sources (which are
+// there only to clean up the state).
+type Plan struct {
+        Resources []*InstanceDiff
+}
+
+// InstanceDiff is a representation of an instance diff optimized
+// for display, in conjunction with DisplayPlan.
+type InstanceDiff struct {
+        Addr   *terraform.ResourceAddress
+        Action plans.Action
+
+        // Attributes describes changes to the attributes of the instance.
+        //
+        // For destroy diffs this is always nil.
+        Attributes []*AttributeDiff
+
+        Tainted bool
+        Deposed bool
+}
+
+// AttributeDiff is a representation of an attribute diff optimized
+// for display, in conjunction with DisplayInstanceDiff.
+type AttributeDiff struct {
+        // Path is a dot-delimited traversal through possibly many levels of list and map structure,
+        // intended for display purposes only.
+        Path string
+
+        Action plans.Action
+
+        OldValue string
+        NewValue string
+
+        NewComputed bool
+        Sensitive   bool
+        ForcesNew   bool
+}
+
+// PlanStats gives summary counts for a Plan.
+type PlanStats struct {
+        ToAdd, ToChange, ToDestroy int
+}
+
+// NewPlan produces a display-oriented Plan from a terraform.Plan.
+func NewPlan(changes *plans.Changes) *Plan {
+        log.Printf("[TRACE] NewPlan for %#v", changes)
+        ret := &Plan{}
+        if changes == nil {
+                // Nothing to do!
+                return ret
+        }
+
+        for _, rc := range changes.Resources {
+                addr := rc.Addr
+                log.Printf("[TRACE] NewPlan found %s (%s)", addr, rc.Action)
+                dataSource := addr.Resource.Resource.Mode == addrs.DataResourceMode
+
+                // We create "delete" actions for data resources so we can clean
+                // up their entries in state, but this is an implementation detail
+                // that users shouldn't see.
+                if dataSource && rc.Action == plans.Delete {
+                        continue
+                }
+
+                // For now we'll shim this to work with our old types.
+                // TODO: Update for the new plan types, ideally also switching over to
+                // a structural diff renderer instead of a flat renderer.
+                did := &InstanceDiff{
+                        Addr:   terraform.NewLegacyResourceInstanceAddress(addr),
+                        Action: rc.Action,
+                }
+
+                if rc.DeposedKey != states.NotDeposed {
+                        did.Deposed = true
+                }
+
+                // Since this is just a temporary stub implementation on the way
+                // to us replacing this with the structural diff renderer, we currently
+                // don't include any attributes here.
+                // FIXME: Implement the structural diff renderer to replace this
+                // codepath altogether.
+
+                ret.Resources = append(ret.Resources, did)
+        }
+
+        // Sort the instance diffs by their addresses for display.
+        sort.Slice(ret.Resources, func(i, j int) bool {
+                iAddr := ret.Resources[i].Addr
+                jAddr := ret.Resources[j].Addr
+                return iAddr.Less(jAddr)
+        })
+
+        return ret
+}
+
+// Format produces and returns a text representation of the receiving plan
+// intended for display in a terminal.
+//
+// If color is not nil, it is used to colorize the output.
+func (p *Plan) Format(color *colorstring.Colorize) string {
+        if p.Empty() {
+                return "This plan does nothing."
+        }
+
+        if color == nil {
+                color = &colorstring.Colorize{
+                        Colors: colorstring.DefaultColors,
+                        Reset:  false,
+                }
+        }
+
+        // Find the longest path length of all the paths that are changing,
+        // so we can align them all.
+        keyLen := 0
+        for _, r := range p.Resources {
+                for _, attr := range r.Attributes {
+                        key := attr.Path
+
+                        if len(key) > keyLen {
+                                keyLen = len(key)
+                        }
+                }
+        }
+
+        buf := new(bytes.Buffer)
+        for _, r := range p.Resources {
+                formatPlanInstanceDiff(buf, r, keyLen, color)
+        }
+
+        return strings.TrimSpace(buf.String())
+}
+
+// Stats returns statistics about the plan
+func (p *Plan) Stats() PlanStats {
+        var ret PlanStats
+        for _, r := range p.Resources {
+                switch r.Action {
+                case plans.Create:
+                        ret.ToAdd++
+                case plans.Update:
+                        ret.ToChange++
+                case plans.DeleteThenCreate, plans.CreateThenDelete:
+                        ret.ToAdd++
+                        ret.ToDestroy++
+                case plans.Delete:
+                        ret.ToDestroy++
+                }
+        }
+        return ret
+}
+
+// ActionCounts returns the number of diffs for each action type
+func (p *Plan) ActionCounts() map[plans.Action]int {
+        ret := map[plans.Action]int{}
+        for _, r := range p.Resources {
+                ret[r.Action]++
+        }
+        return ret
+}
+
+// Empty returns true if there is at least one resource diff in the receiving plan.
+func (p *Plan) Empty() bool {
+        return len(p.Resources) == 0
+}
+
+// DiffActionSymbol returns a string that, once passed through a
+// colorstring.Colorize, will produce a result that can be written
+// to a terminal to produce a symbol made of three printable
+// characters, possibly interspersed with VT100 color codes.
+func DiffActionSymbol(action plans.Action) string {
+        switch action {
+        case plans.DeleteThenCreate:
+                return "[red]-[reset]/[green]+[reset]"
+        case plans.CreateThenDelete:
+                return "[green]+[reset]/[red]-[reset]"
+        case plans.Create:
+                return "  [green]+[reset]"
+        case plans.Delete:
+                return "  [red]-[reset]"
+        case plans.Read:
+                return " [cyan]<=[reset]"
+        case plans.Update:
+                return "  [yellow]~[reset]"
+        default:
+                return "  ?"
+        }
+}
+
+// formatPlanInstanceDiff writes the text representation of the given instance diff
+// to the given buffer, using the given colorizer.
+func formatPlanInstanceDiff(buf *bytes.Buffer, r *InstanceDiff, keyLen int, colorizer *colorstring.Colorize) {
+        addrStr := r.Addr.String()
+
+        // Determine the color for the text (green for adding, yellow
+        // for change, red for delete), and symbol, and output the
+        // resource header.
+        color := "yellow"
+        symbol := DiffActionSymbol(r.Action)
+        oldValues := true
+        switch r.Action {
+        case plans.DeleteThenCreate, plans.CreateThenDelete:
+                color = "yellow"
+        case plans.Create:
+                color = "green"
+                oldValues = false
+        case plans.Delete:
+                color = "red"
+        case plans.Read:
+                color = "cyan"
+                oldValues = false
+        }
+
+        var extraStr string
+        if r.Tainted {
+                extraStr = extraStr + " (tainted)"
+        }
+        if r.Deposed {
+                extraStr = extraStr + " (deposed)"
+        }
+        if r.Action.IsReplace() {
+                extraStr = extraStr + colorizer.Color(" [red][bold](new resource required)")
+        }
+
+        buf.WriteString(
+                colorizer.Color(fmt.Sprintf(
+                        "[%s]%s [%s]%s%s\n",
+                        color, symbol, color, addrStr, extraStr,
+                )),
+        )
+
+        for _, attr := range r.Attributes {
+
+                v := attr.NewValue
+                var dispV string
+                switch {
+                case v == "" && attr.NewComputed:
+                        dispV = "<computed>"
+                case attr.Sensitive:
+                        dispV = "<sensitive>"
+                default:
+                        dispV = fmt.Sprintf("%q", v)
+                }
+
+                updateMsg := ""
+                switch {
+                case attr.ForcesNew && r.Action.IsReplace():
+                        updateMsg = colorizer.Color(" [red](forces new resource)")
+                case attr.Sensitive && oldValues:
+                        updateMsg = colorizer.Color(" [yellow](attribute changed)")
+                }
+
+                if oldValues {
+                        u := attr.OldValue
+                        var dispU string
+                        switch {
+                        case attr.Sensitive:
+                                dispU = "<sensitive>"
+                        default:
+                                dispU = fmt.Sprintf("%q", u)
+                        }
+                        buf.WriteString(fmt.Sprintf(
+                                "      %s:%s %s => %s%s\n",
+                                attr.Path,
+                                strings.Repeat(" ", keyLen-len(attr.Path)),
+                                dispU, dispV,
+                                updateMsg,
+                        ))
+                } else {
+                        buf.WriteString(fmt.Sprintf(
+                                "      %s:%s %s%s\n",
+                                attr.Path,
+                                strings.Repeat(" ", keyLen-len(attr.Path)),
+                                dispV,
+                                updateMsg,
+                        ))
+                }
+        }
+
+        // Write the reset color so we don't bleed color into later text
+        buf.WriteString(colorizer.Color("[reset]\n"))
+}
diff --git a/vendor/github.com/hashicorp/terraform/command/format/state.go b/vendor/github.com/hashicorp/terraform/command/format/state.go
new file mode 100644
index 0000000..f411ef9
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/command/format/state.go
@@ -0,0 +1,286 @@
+package format
+
+import (
+        "bytes"
+        "fmt"
+        "sort"
+        "strings"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/terraform"
+        "github.com/mitchellh/colorstring"
+)
+
+// StateOpts are the options for formatting a state.
+type StateOpts struct {
+        // State is the state to format. This is required.
+        State *states.State
+
+        // Schemas are used to decode attributes. This is required.
+        Schemas *terraform.Schemas
+
+        // Color is the colorizer. This is optional.
+        Color *colorstring.Colorize
+}
+
+// State takes a state and returns a string
+func State(opts *StateOpts) string {
+        if opts.Color == nil {
+                panic("colorize not given")
+        }
+
+        if opts.Schemas == nil {
+                panic("schemas not given")
+        }
+
+        s := opts.State
+        if len(s.Modules) == 0 {
+                return "The state file is empty. No resources are represented."
+        }
+
+        buf := bytes.NewBufferString("[reset]")
+        p := blockBodyDiffPrinter{
+                buf:    buf,
+                color:  opts.Color,
+                action: plans.NoOp,
+        }
+
+        // Format all the modules
+        for _, m := range s.Modules {
+                formatStateModule(p, m, opts.Schemas)
+        }
+
+        // Write the outputs for the root module
+        m := s.RootModule()
+
+        if m.OutputValues != nil {
+                if len(m.OutputValues) > 0 {
+                        p.buf.WriteString("Outputs:\n\n")
+                }
+
+                // Sort the outputs
+                ks := make([]string, 0, len(m.OutputValues))
+                for k := range m.OutputValues {
+                        ks = append(ks, k)
+                }
+                sort.Strings(ks)
+
+                // Output each output k/v pair
+                for _, k := range ks {
+                        v := m.OutputValues[k]
+                        p.buf.WriteString(fmt.Sprintf("%s = ", k))
+                        p.writeValue(v.Value, plans.NoOp, 0)
+                        p.buf.WriteString("\n\n")
+                }
+        }
+
+        return opts.Color.Color(strings.TrimSpace(p.buf.String()))
+
+}
+
+func formatStateModule(p blockBodyDiffPrinter, m *states.Module, schemas *terraform.Schemas) {
+        // First get the names of all the resources so we can show them
+        // in alphabetical order.
+        names := make([]string, 0, len(m.Resources))
+        for name := range m.Resources {
+                names = append(names, name)
+        }
+        sort.Strings(names)
+
+        // Go through each resource and begin building up the output.
+        for _, key := range names {
+                for k, v := range m.Resources[key].Instances {
+                        addr := m.Resources[key].Addr
+
+                        taintStr := ""
+                        if v.Current.Status == 'T' {
+                                taintStr = "(tainted)"
+                        }
+                        p.buf.WriteString(fmt.Sprintf("# %s: %s\n", addr.Absolute(m.Addr).Instance(k), taintStr))
+
+                        var schema *configschema.Block
+                        provider := m.Resources[key].ProviderConfig.ProviderConfig.StringCompact()
+                        if _, exists := schemas.Providers[provider]; !exists {
+                                // This should never happen in normal use because we should've
+                                // loaded all of the schemas and checked things prior to this
+                                // point. We can't return errors here, but since this is UI code
+                                // we will try to do _something_ reasonable.
+                                p.buf.WriteString(fmt.Sprintf("# missing schema for provider %q\n\n", provider))
+                                continue
+                        }
+
+                        switch addr.Mode {
+                        case addrs.ManagedResourceMode:
+                                schema, _ = schemas.ResourceTypeConfig(
+                                        provider,
+                                        addr.Mode,
+                                        addr.Type,
+                                )
+                                if schema == nil {
+                                        p.buf.WriteString(fmt.Sprintf(
+                                                "# missing schema for provider %q resource type %s\n\n", provider, addr.Type))
+                                        continue
+                                }
+
+                                p.buf.WriteString(fmt.Sprintf(
+                                        "resource %q %q {",
+                                        addr.Type,
+                                        addr.Name,
+                                ))
+                        case addrs.DataResourceMode:
+                                schema, _ = schemas.ResourceTypeConfig(
+                                        provider,
+                                        addr.Mode,
+                                        addr.Type,
+                                )
+                                if schema == nil {
+                                        p.buf.WriteString(fmt.Sprintf(
+                                                "# missing schema for provider %q data source %s\n\n", provider, addr.Type))
+                                        continue
+                                }
+
+                                p.buf.WriteString(fmt.Sprintf(
+                                        "data %q %q {",
+                                        addr.Type,
+                                        addr.Name,
+                                ))
+                        default:
+                                // should never happen, since the above is exhaustive
+                                p.buf.WriteString(addr.String())
+                        }
+
+                        val, err := v.Current.Decode(schema.ImpliedType())
+                        if err != nil {
+                                fmt.Println(err.Error())
+                                break
+                        }
+
+                        path := make(cty.Path, 0, 3)
+                        bodyWritten := p.writeBlockBodyDiff(schema, val.Value, val.Value, 2, path)
+                        if bodyWritten {
+                                p.buf.WriteString("\n")
+                        }
+
+                        p.buf.WriteString("}\n\n")
+                }
+        }
+        p.buf.WriteString("[reset]\n")
+}
+
+func formatNestedList(indent string, outputList []interface{}) string {
+        outputBuf := new(bytes.Buffer)
+        outputBuf.WriteString(fmt.Sprintf("%s[", indent))
+
+        lastIdx := len(outputList) - 1
+
+        for i, value := range outputList {
+                outputBuf.WriteString(fmt.Sprintf("\n%s%s%s", indent, "    ", value))
+                if i != lastIdx {
+                        outputBuf.WriteString(",")
+                }
+        }
+
+        outputBuf.WriteString(fmt.Sprintf("\n%s]", indent))
+        return strings.TrimPrefix(outputBuf.String(), "\n")
+}
+
+func formatListOutput(indent, outputName string, outputList []interface{}) string {
+        keyIndent := ""
+
+        outputBuf := new(bytes.Buffer)
+
+        if outputName != "" {
+                outputBuf.WriteString(fmt.Sprintf("%s%s = [", indent, outputName))
+                keyIndent = "    "
+        }
+
+        lastIdx := len(outputList) - 1
+
+        for i, value := range outputList {
+                switch typedValue := value.(type) {
+                case string:
+                        outputBuf.WriteString(fmt.Sprintf("\n%s%s%s", indent, keyIndent, value))
+                case []interface{}:
+                        outputBuf.WriteString(fmt.Sprintf("\n%s%s", indent,
+                                formatNestedList(indent+keyIndent, typedValue)))
+                case map[string]interface{}:
+                        outputBuf.WriteString(fmt.Sprintf("\n%s%s", indent,
+                                formatNestedMap(indent+keyIndent, typedValue)))
+                }
+
+                if lastIdx != i {
+                        outputBuf.WriteString(",")
+                }
+        }
+
+        if outputName != "" {
+                if len(outputList) > 0 {
+                        outputBuf.WriteString(fmt.Sprintf("\n%s]", indent))
+                } else {
+                        outputBuf.WriteString("]")
+                }
+        }
+
+        return strings.TrimPrefix(outputBuf.String(), "\n")
+}
+
+func formatNestedMap(indent string, outputMap map[string]interface{}) string {
+        ks := make([]string, 0, len(outputMap))
+        for k, _ := range outputMap {
+                ks = append(ks, k)
+        }
+        sort.Strings(ks)
+
+        outputBuf := new(bytes.Buffer)
+        outputBuf.WriteString(fmt.Sprintf("%s{", indent))
+
+        lastIdx := len(outputMap) - 1
+        for i, k := range ks {
+                v := outputMap[k]
+                outputBuf.WriteString(fmt.Sprintf("\n%s%s = %v", indent+"    ", k, v))
+
+                if lastIdx != i {
+                        outputBuf.WriteString(",")
+                }
+        }
+
+        outputBuf.WriteString(fmt.Sprintf("\n%s}", indent))
+
+        return strings.TrimPrefix(outputBuf.String(), "\n")
+}
+
+func formatMapOutput(indent, outputName string, outputMap map[string]interface{}) string {
+        ks := make([]string, 0, len(outputMap))
+        for k, _ := range outputMap {
+                ks = append(ks, k)
+        }
+        sort.Strings(ks)
+
+        keyIndent := ""
+
+        outputBuf := new(bytes.Buffer)
+        if outputName != "" {
+                outputBuf.WriteString(fmt.Sprintf("%s%s = {", indent, outputName))
+                keyIndent = "  "
+        }
+
+        for _, k := range ks {
+                v := outputMap[k]
+                outputBuf.WriteString(fmt.Sprintf("\n%s%s%s = %v", indent, keyIndent, k, v))
+        }
+
+        if outputName != "" {
+                if len(outputMap) > 0 {
+                        outputBuf.WriteString(fmt.Sprintf("\n%s}", indent))
+                } else {
+                        outputBuf.WriteString("}")
+                }
+        }
+
+        return strings.TrimPrefix(outputBuf.String(), "\n")
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/decoder_spec.go b/vendor/github.com/hashicorp/terraform/config/configschema/decoder_spec.go
deleted file mode 100644
index 2b1b0ca..0000000
--- a/vendor/github.com/hashicorp/terraform/config/configschema/decoder_spec.go
+++ /dev/null
@@ -1,97 +0,0 @@
-package configschema
-
-import (
-        "github.com/hashicorp/hcl2/hcldec"
-        "github.com/zclconf/go-cty/cty"
-)
-
-var mapLabelNames = []string{"key"}
-
-// DecoderSpec returns a hcldec.Spec that can be used to decode a HCL Body
-// using the facilities in the hcldec package.
-//
-// The returned specification is guaranteed to return a value of the same type
-// returned by method ImpliedType, but it may contain null or unknown values if
-// any of the block attributes are defined as optional and/or computed
-// respectively.
-func (b *Block) DecoderSpec() hcldec.Spec {
-        ret := hcldec.ObjectSpec{}
-        if b == nil {
-                return ret
-        }
-
-        for name, attrS := range b.Attributes {
-                switch {
-                case attrS.Computed && attrS.Optional:
-                        // In this special case we use an unknown value as a default
-                        // to get the intended behavior that the result is computed
-                        // unless it has been explicitly set in config.
-                        ret[name] = &hcldec.DefaultSpec{
-                                Primary: &hcldec.AttrSpec{
-                                        Name: name,
-                                        Type: attrS.Type,
-                                },
-                                Default: &hcldec.LiteralSpec{
-                                        Value: cty.UnknownVal(attrS.Type),
-                                },
-                        }
-                case attrS.Computed:
-                        ret[name] = &hcldec.LiteralSpec{
-                                Value: cty.UnknownVal(attrS.Type),
-                        }
-                default:
-                        ret[name] = &hcldec.AttrSpec{
-                                Name:     name,
-                                Type:     attrS.Type,
-                                Required: attrS.Required,
-                        }
-                }
-        }
-
-        for name, blockS := range b.BlockTypes {
-                if _, exists := ret[name]; exists {
-                        // This indicates an invalid schema, since it's not valid to
-                        // define both an attribute and a block type of the same name.
-                        // However, we don't raise this here since it's checked by
-                        // InternalValidate.
-                        continue
-                }
-
-                childSpec := blockS.Block.DecoderSpec()
-
-                switch blockS.Nesting {
-                case NestingSingle:
-                        ret[name] = &hcldec.BlockSpec{
-                                TypeName: name,
-                                Nested:   childSpec,
-                                Required: blockS.MinItems == 1 && blockS.MaxItems >= 1,
-                        }
-                case NestingList:
-                        ret[name] = &hcldec.BlockListSpec{
-                                TypeName: name,
-                                Nested:   childSpec,
-                                MinItems: blockS.MinItems,
-                                MaxItems: blockS.MaxItems,
-                        }
-                case NestingSet:
-                        ret[name] = &hcldec.BlockSetSpec{
-                                TypeName: name,
-                                Nested:   childSpec,
-                                MinItems: blockS.MinItems,
-                                MaxItems: blockS.MaxItems,
-                        }
-                case NestingMap:
-                        ret[name] = &hcldec.BlockMapSpec{
-                                TypeName:   name,
-                                Nested:     childSpec,
-                                LabelNames: mapLabelNames,
-                        }
-                default:
-                        // Invalid nesting type is just ignored. It's checked by
-                        // InternalValidate.
-                        continue
-                }
-        }
-
-        return ret
-}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/implied_type.go b/vendor/github.com/hashicorp/terraform/config/configschema/implied_type.go
deleted file mode 100644
index 67324eb..0000000
--- a/vendor/github.com/hashicorp/terraform/config/configschema/implied_type.go
+++ /dev/null
@@ -1,21 +0,0 @@
-package configschema
-
-import (
-        "github.com/hashicorp/hcl2/hcldec"
-        "github.com/zclconf/go-cty/cty"
-)
-
-// ImpliedType returns the cty.Type that would result from decoding a
-// configuration block using the receiving block schema.
-//
-// ImpliedType always returns a result, even if the given schema is
-// inconsistent. Code that creates configschema.Block objects should be
-// tested using the InternalValidate method to detect any inconsistencies
-// that would cause this method to fall back on defaults and assumptions.
-func (b *Block) ImpliedType() cty.Type {
-        if b == nil {
-                return cty.EmptyObject
-        }
-
-        return hcldec.ImpliedType(b.DecoderSpec())
-}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/nestingmode_string.go b/vendor/github.com/hashicorp/terraform/config/configschema/nestingmode_string.go
deleted file mode 100644
index 6cb9313..0000000
--- a/vendor/github.com/hashicorp/terraform/config/configschema/nestingmode_string.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// Code generated by "stringer -type=NestingMode"; DO NOT EDIT.
-
-package configschema
-
-import "strconv"
-
-const _NestingMode_name = "nestingModeInvalidNestingSingleNestingListNestingSetNestingMap"
-
-var _NestingMode_index = [...]uint8{0, 18, 31, 42, 52, 62}
-
-func (i NestingMode) String() string {
-        if i < 0 || i >= NestingMode(len(_NestingMode_index)-1) {
-                return "NestingMode(" + strconv.FormatInt(int64(i), 10) + ")"
-        }
-        return _NestingMode_name[_NestingMode_index[i]:_NestingMode_index[i+1]]
-}
diff --git a/vendor/github.com/hashicorp/terraform/config/hcl2shim/flatmap.go b/vendor/github.com/hashicorp/terraform/config/hcl2shim/flatmap.go
new file mode 100644
index 0000000..bb4228d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/hcl2shim/flatmap.go
@@ -0,0 +1,424 @@
+package hcl2shim
+
+import (
+        "fmt"
+        "strconv"
+        "strings"
+
+        "github.com/zclconf/go-cty/cty/convert"
+
+        "github.com/zclconf/go-cty/cty"
+)
+
+// FlatmapValueFromHCL2 converts a value from HCL2 (really, from the cty dynamic
+// types library that HCL2 uses) to a map compatible with what would be
+// produced by the "flatmap" package.
+//
+// The type of the given value informs the structure of the resulting map.
+// The value must be of an object type or this function will panic.
+//
+// Flatmap values can only represent maps when they are of primitive types,
+// so the given value must not have any maps of complex types or the result
+// is undefined.
+func FlatmapValueFromHCL2(v cty.Value) map[string]string {
+        if v.IsNull() {
+                return nil
+        }
+
+        if !v.Type().IsObjectType() {
+                panic(fmt.Sprintf("HCL2ValueFromFlatmap called on %#v", v.Type()))
+        }
+
+        m := make(map[string]string)
+        flatmapValueFromHCL2Map(m, "", v)
+        return m
+}
+
+func flatmapValueFromHCL2Value(m map[string]string, key string, val cty.Value) {
+        ty := val.Type()
+        switch {
+        case ty.IsPrimitiveType() || ty == cty.DynamicPseudoType:
+                flatmapValueFromHCL2Primitive(m, key, val)
+        case ty.IsObjectType() || ty.IsMapType():
+                flatmapValueFromHCL2Map(m, key+".", val)
+        case ty.IsTupleType() || ty.IsListType() || ty.IsSetType():
+                flatmapValueFromHCL2Seq(m, key+".", val)
+        default:
+                panic(fmt.Sprintf("cannot encode %s to flatmap", ty.FriendlyName()))
+        }
+}
+
+func flatmapValueFromHCL2Primitive(m map[string]string, key string, val cty.Value) {
+        if !val.IsKnown() {
+                m[key] = UnknownVariableValue
+                return
+        }
+        if val.IsNull() {
+                // Omit entirely
+                return
+        }
+
+        var err error
+        val, err = convert.Convert(val, cty.String)
+        if err != nil {
+                // Should not be possible, since all primitive types can convert to string.
+                panic(fmt.Sprintf("invalid primitive encoding to flatmap: %s", err))
+        }
+        m[key] = val.AsString()
+}
+
+func flatmapValueFromHCL2Map(m map[string]string, prefix string, val cty.Value) {
+        if val.IsNull() {
+                // Omit entirely
+                return
+        }
+        if !val.IsKnown() {
+                switch {
+                case val.Type().IsObjectType():
+                        // Whole objects can't be unknown in flatmap, so instead we'll
+                        // just write all of the attribute values out as unknown.
+                        for name, aty := range val.Type().AttributeTypes() {
+                                flatmapValueFromHCL2Value(m, prefix+name, cty.UnknownVal(aty))
+                        }
+                default:
+                        m[prefix+"%"] = UnknownVariableValue
+                }
+                return
+        }
+
+        len := 0
+        for it := val.ElementIterator(); it.Next(); {
+                ak, av := it.Element()
+                name := ak.AsString()
+                flatmapValueFromHCL2Value(m, prefix+name, av)
+                len++
+        }
+        if !val.Type().IsObjectType() { // objects don't have an explicit count included, since their attribute count is fixed
+                m[prefix+"%"] = strconv.Itoa(len)
+        }
+}
+
+func flatmapValueFromHCL2Seq(m map[string]string, prefix string, val cty.Value) {
+        if val.IsNull() {
+                // Omit entirely
+                return
+        }
+        if !val.IsKnown() {
+                m[prefix+"#"] = UnknownVariableValue
+                return
+        }
+
+        // For sets this won't actually generate exactly what helper/schema would've
+        // generated, because we don't have access to the set key function it
+        // would've used. However, in practice it doesn't actually matter what the
+        // keys are as long as they are unique, so we'll just generate sequential
+        // indexes for them as if it were a list.
+        //
+        // An important implication of this, however, is that the set ordering will
+        // not be consistent across mutations and so different keys may be assigned
+        // to the same value when round-tripping. Since this shim is intended to
+        // be short-lived and not used for round-tripping, we accept this.
+        i := 0
+        for it := val.ElementIterator(); it.Next(); {
+                _, av := it.Element()
+                key := prefix + strconv.Itoa(i)
+                flatmapValueFromHCL2Value(m, key, av)
+                i++
+        }
+        m[prefix+"#"] = strconv.Itoa(i)
+}
+
+// HCL2ValueFromFlatmap converts a map compatible with what would be produced
+// by the "flatmap" package to a HCL2 (really, the cty dynamic types library
+// that HCL2 uses) object type.
+//
+// The intended result type must be provided in order to guide how the
+// map contents are decoded. This must be an object type or this function
+// will panic.
+//
+// Flatmap values can only represent maps when they are of primitive types,
+// so the given type must not have any maps of complex types or the result
+// is undefined.
+//
+// The result may contain null values if the given map does not contain keys
+// for all of the different key paths implied by the given type.
+func HCL2ValueFromFlatmap(m map[string]string, ty cty.Type) (cty.Value, error) {
+        if m == nil {
+                return cty.NullVal(ty), nil
+        }
+        if !ty.IsObjectType() {
+                panic(fmt.Sprintf("HCL2ValueFromFlatmap called on %#v", ty))
+        }
+
+        return hcl2ValueFromFlatmapObject(m, "", ty.AttributeTypes())
+}
+
+func hcl2ValueFromFlatmapValue(m map[string]string, key string, ty cty.Type) (cty.Value, error) {
+        var val cty.Value
+        var err error
+        switch {
+        case ty.IsPrimitiveType():
+                val, err = hcl2ValueFromFlatmapPrimitive(m, key, ty)
+        case ty.IsObjectType():
+                val, err = hcl2ValueFromFlatmapObject(m, key+".", ty.AttributeTypes())
+        case ty.IsTupleType():
+                val, err = hcl2ValueFromFlatmapTuple(m, key+".", ty.TupleElementTypes())
+        case ty.IsMapType():
+                val, err = hcl2ValueFromFlatmapMap(m, key+".", ty)
+        case ty.IsListType():
+                val, err = hcl2ValueFromFlatmapList(m, key+".", ty)
+        case ty.IsSetType():
+                val, err = hcl2ValueFromFlatmapSet(m, key+".", ty)
+        default:
+                err = fmt.Errorf("cannot decode %s from flatmap", ty.FriendlyName())
+        }
+
+        if err != nil {
+                return cty.DynamicVal, err
+        }
+        return val, nil
+}
+
+func hcl2ValueFromFlatmapPrimitive(m map[string]string, key string, ty cty.Type) (cty.Value, error) {
+        rawVal, exists := m[key]
+        if !exists {
+                return cty.NullVal(ty), nil
+        }
+        if rawVal == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        var err error
+        val := cty.StringVal(rawVal)
+        val, err = convert.Convert(val, ty)
+        if err != nil {
+                // This should never happen for _valid_ input, but flatmap data might
+                // be tampered with by the user and become invalid.
+                return cty.DynamicVal, fmt.Errorf("invalid value for %q in state: %s", key, err)
+        }
+
+        return val, nil
+}
+
+func hcl2ValueFromFlatmapObject(m map[string]string, prefix string, atys map[string]cty.Type) (cty.Value, error) {
+        vals := make(map[string]cty.Value)
+        for name, aty := range atys {
+                val, err := hcl2ValueFromFlatmapValue(m, prefix+name, aty)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+                vals[name] = val
+        }
+        return cty.ObjectVal(vals), nil
+}
+
+func hcl2ValueFromFlatmapTuple(m map[string]string, prefix string, etys []cty.Type) (cty.Value, error) {
+        var vals []cty.Value
+
+        // if the container is unknown, there is no count string
+        listName := strings.TrimRight(prefix, ".")
+        if m[listName] == UnknownVariableValue {
+                return cty.UnknownVal(cty.Tuple(etys)), nil
+        }
+
+        countStr, exists := m[prefix+"#"]
+        if !exists {
+                return cty.NullVal(cty.Tuple(etys)), nil
+        }
+        if countStr == UnknownVariableValue {
+                return cty.UnknownVal(cty.Tuple(etys)), nil
+        }
+
+        count, err := strconv.Atoi(countStr)
+        if err != nil {
+                return cty.DynamicVal, fmt.Errorf("invalid count value for %q in state: %s", prefix, err)
+        }
+        if count != len(etys) {
+                return cty.DynamicVal, fmt.Errorf("wrong number of values for %q in state: got %d, but need %d", prefix, count, len(etys))
+        }
+
+        vals = make([]cty.Value, len(etys))
+        for i, ety := range etys {
+                key := prefix + strconv.Itoa(i)
+                val, err := hcl2ValueFromFlatmapValue(m, key, ety)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+                vals[i] = val
+        }
+        return cty.TupleVal(vals), nil
+}
+
+func hcl2ValueFromFlatmapMap(m map[string]string, prefix string, ty cty.Type) (cty.Value, error) {
+        vals := make(map[string]cty.Value)
+        ety := ty.ElementType()
+
+        // if the container is unknown, there is no count string
+        listName := strings.TrimRight(prefix, ".")
+        if m[listName] == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        // We actually don't really care about the "count" of a map for our
+        // purposes here, but we do need to check if it _exists_ in order to
+        // recognize the difference between null (not set at all) and empty.
+        if strCount, exists := m[prefix+"%"]; !exists {
+                return cty.NullVal(ty), nil
+        } else if strCount == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        for fullKey := range m {
+                if !strings.HasPrefix(fullKey, prefix) {
+                        continue
+                }
+
+                // The flatmap format doesn't allow us to distinguish between keys
+                // that contain periods and nested objects, so by convention a
+                // map is only ever of primitive type in flatmap, and we just assume
+                // that the remainder of the raw key (dots and all) is the key we
+                // want in the result value.
+                key := fullKey[len(prefix):]
+                if key == "%" {
+                        // Ignore the "count" key
+                        continue
+                }
+
+                val, err := hcl2ValueFromFlatmapValue(m, fullKey, ety)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+                vals[key] = val
+        }
+
+        if len(vals) == 0 {
+                return cty.MapValEmpty(ety), nil
+        }
+        return cty.MapVal(vals), nil
+}
+
+func hcl2ValueFromFlatmapList(m map[string]string, prefix string, ty cty.Type) (cty.Value, error) {
+        var vals []cty.Value
+
+        // if the container is unknown, there is no count string
+        listName := strings.TrimRight(prefix, ".")
+        if m[listName] == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        countStr, exists := m[prefix+"#"]
+        if !exists {
+                return cty.NullVal(ty), nil
+        }
+        if countStr == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        count, err := strconv.Atoi(countStr)
+        if err != nil {
+                return cty.DynamicVal, fmt.Errorf("invalid count value for %q in state: %s", prefix, err)
+        }
+
+        ety := ty.ElementType()
+        if count == 0 {
+                return cty.ListValEmpty(ety), nil
+        }
+
+        vals = make([]cty.Value, count)
+        for i := 0; i < count; i++ {
+                key := prefix + strconv.Itoa(i)
+                val, err := hcl2ValueFromFlatmapValue(m, key, ety)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+                vals[i] = val
+        }
+
+        return cty.ListVal(vals), nil
+}
+
+func hcl2ValueFromFlatmapSet(m map[string]string, prefix string, ty cty.Type) (cty.Value, error) {
+        var vals []cty.Value
+        ety := ty.ElementType()
+
+        // if the container is unknown, there is no count string
+        listName := strings.TrimRight(prefix, ".")
+        if m[listName] == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        strCount, exists := m[prefix+"#"]
+        if !exists {
+                return cty.NullVal(ty), nil
+        } else if strCount == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        // Keep track of keys we've seen, se we don't add the same set value
+        // multiple times. The cty.Set will normally de-duplicate values, but we may
+        // have unknown values that would not show as equivalent.
+        seen := map[string]bool{}
+
+        for fullKey := range m {
+                if !strings.HasPrefix(fullKey, prefix) {
+                        continue
+                }
+                subKey := fullKey[len(prefix):]
+                if subKey == "#" {
+                        // Ignore the "count" key
+                        continue
+                }
+                key := fullKey
+                if dot := strings.IndexByte(subKey, '.'); dot != -1 {
+                        key = fullKey[:dot+len(prefix)]
+                }
+
+                if seen[key] {
+                        continue
+                }
+
+                seen[key] = true
+
+                // The flatmap format doesn't allow us to distinguish between keys
+                // that contain periods and nested objects, so by convention a
+                // map is only ever of primitive type in flatmap, and we just assume
+                // that the remainder of the raw key (dots and all) is the key we
+                // want in the result value.
+
+                val, err := hcl2ValueFromFlatmapValue(m, key, ety)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+                vals = append(vals, val)
+        }
+
+        if len(vals) == 0 && strCount == "1" {
+                // An empty set wouldn't be represented in the flatmap, so this must be
+                // a single empty object since the count is actually 1.
+                // Add an appropriately typed null value to the set.
+                var val cty.Value
+                switch {
+                case ety.IsMapType():
+                        val = cty.MapValEmpty(ety)
+                case ety.IsListType():
+                        val = cty.ListValEmpty(ety)
+                case ety.IsSetType():
+                        val = cty.SetValEmpty(ety)
+                case ety.IsObjectType():
+                        // TODO: cty.ObjectValEmpty
+                        objectMap := map[string]cty.Value{}
+                        for attr, ty := range ety.AttributeTypes() {
+                                objectMap[attr] = cty.NullVal(ty)
+                        }
+                        val = cty.ObjectVal(objectMap)
+                default:
+                        val = cty.NullVal(ety)
+                }
+                vals = append(vals, val)
+
+        } else if len(vals) == 0 {
+                return cty.SetValEmpty(ety), nil
+        }
+
+        return cty.SetVal(vals), nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/hcl2shim/paths.go b/vendor/github.com/hashicorp/terraform/config/hcl2shim/paths.go
new file mode 100644
index 0000000..3403c02
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/hcl2shim/paths.go
@@ -0,0 +1,276 @@
+package hcl2shim
+
+import (
+        "fmt"
+        "reflect"
+        "strconv"
+        "strings"
+
+        "github.com/zclconf/go-cty/cty"
+)
+
+// RequiresReplace takes a list of flatmapped paths from a
+// InstanceDiff.Attributes along with the corresponding cty.Type, and returns
+// the list of the cty.Paths that are flagged as causing the resource
+// replacement (RequiresNew).
+// This will filter out redundant paths, paths that refer to flatmapped indexes
+// (e.g. "#", "%"), and will return any changes within a set as the path to the
+// set itself.
+func RequiresReplace(attrs []string, ty cty.Type) ([]cty.Path, error) {
+        var paths []cty.Path
+
+        for _, attr := range attrs {
+                p, err := requiresReplacePath(attr, ty)
+                if err != nil {
+                        return nil, err
+                }
+
+                paths = append(paths, p)
+        }
+
+        // now trim off any trailing paths that aren't GetAttrSteps, since only an
+        // attribute itself can require replacement
+        paths = trimPaths(paths)
+
+        // There may be redundant paths due to set elements or index attributes
+        // Do some ugly n^2 filtering, but these are always fairly small sets.
+        for i := 0; i < len(paths)-1; i++ {
+                for j := i + 1; j < len(paths); j++ {
+                        if reflect.DeepEqual(paths[i], paths[j]) {
+                                // swap the tail and slice it off
+                                paths[j], paths[len(paths)-1] = paths[len(paths)-1], paths[j]
+                                paths = paths[:len(paths)-1]
+                                j--
+                        }
+                }
+        }
+
+        return paths, nil
+}
+
+// trimPaths removes any trailing steps that aren't of type GetAttrSet, since
+// only an attribute itself can require replacement
+func trimPaths(paths []cty.Path) []cty.Path {
+        var trimmed []cty.Path
+        for _, path := range paths {
+                path = trimPath(path)
+                if len(path) > 0 {
+                        trimmed = append(trimmed, path)
+                }
+        }
+        return trimmed
+}
+
+func trimPath(path cty.Path) cty.Path {
+        for len(path) > 0 {
+                _, isGetAttr := path[len(path)-1].(cty.GetAttrStep)
+                if isGetAttr {
+                        break
+                }
+                path = path[:len(path)-1]
+        }
+        return path
+}
+
+// requiresReplacePath takes a key from a flatmap along with the cty.Type
+// describing the structure, and returns the cty.Path that would be used to
+// reference the nested value in the data structure.
+// This is used specifically to record the RequiresReplace attributes from a
+// ResourceInstanceDiff.
+func requiresReplacePath(k string, ty cty.Type) (cty.Path, error) {
+        if k == "" {
+                return nil, nil
+        }
+        if !ty.IsObjectType() {
+                panic(fmt.Sprintf("requires replace path on non-object type: %#v", ty))
+        }
+
+        path, err := pathFromFlatmapKeyObject(k, ty.AttributeTypes())
+        if err != nil {
+                return path, fmt.Errorf("[%s] %s", k, err)
+        }
+        return path, nil
+}
+
+func pathSplit(p string) (string, string) {
+        parts := strings.SplitN(p, ".", 2)
+        head := parts[0]
+        rest := ""
+        if len(parts) > 1 {
+                rest = parts[1]
+        }
+        return head, rest
+}
+
+func pathFromFlatmapKeyObject(key string, atys map[string]cty.Type) (cty.Path, error) {
+        k, rest := pathSplit(key)
+
+        path := cty.Path{cty.GetAttrStep{Name: k}}
+
+        ty, ok := atys[k]
+        if !ok {
+                return path, fmt.Errorf("attribute %q not found", k)
+        }
+
+        if rest == "" {
+                return path, nil
+        }
+
+        p, err := pathFromFlatmapKeyValue(rest, ty)
+        if err != nil {
+                return path, err
+        }
+
+        return append(path, p...), nil
+}
+
+func pathFromFlatmapKeyValue(key string, ty cty.Type) (cty.Path, error) {
+        var path cty.Path
+        var err error
+
+        switch {
+        case ty.IsPrimitiveType():
+                err = fmt.Errorf("invalid step %q with type %#v", key, ty)
+        case ty.IsObjectType():
+                path, err = pathFromFlatmapKeyObject(key, ty.AttributeTypes())
+        case ty.IsTupleType():
+                path, err = pathFromFlatmapKeyTuple(key, ty.TupleElementTypes())
+        case ty.IsMapType():
+                path, err = pathFromFlatmapKeyMap(key, ty)
+        case ty.IsListType():
+                path, err = pathFromFlatmapKeyList(key, ty)
+        case ty.IsSetType():
+                path, err = pathFromFlatmapKeySet(key, ty)
+        default:
+                err = fmt.Errorf("unrecognized type: %s", ty.FriendlyName())
+        }
+
+        if err != nil {
+                return path, err
+        }
+
+        return path, nil
+}
+
+func pathFromFlatmapKeyTuple(key string, etys []cty.Type) (cty.Path, error) {
+        var path cty.Path
+        var err error
+
+        k, rest := pathSplit(key)
+
+        // we don't need to convert the index keys to paths
+        if k == "#" {
+                return path, nil
+        }
+
+        idx, err := strconv.Atoi(k)
+        if err != nil {
+                return path, err
+        }
+
+        path = cty.Path{cty.IndexStep{Key: cty.NumberIntVal(int64(idx))}}
+
+        if idx >= len(etys) {
+                return path, fmt.Errorf("index %s out of range in %#v", key, etys)
+        }
+
+        if rest == "" {
+                return path, nil
+        }
+
+        ty := etys[idx]
+
+        p, err := pathFromFlatmapKeyValue(rest, ty.ElementType())
+        if err != nil {
+                return path, err
+        }
+
+        return append(path, p...), nil
+}
+
+func pathFromFlatmapKeyMap(key string, ty cty.Type) (cty.Path, error) {
+        var path cty.Path
+        var err error
+
+        k, rest := key, ""
+        if !ty.ElementType().IsPrimitiveType() {
+                k, rest = pathSplit(key)
+        }
+
+        // we don't need to convert the index keys to paths
+        if k == "%" {
+                return path, nil
+        }
+
+        path = cty.Path{cty.IndexStep{Key: cty.StringVal(k)}}
+
+        if rest == "" {
+                return path, nil
+        }
+
+        p, err := pathFromFlatmapKeyValue(rest, ty.ElementType())
+        if err != nil {
+                return path, err
+        }
+
+        return append(path, p...), nil
+}
+
+func pathFromFlatmapKeyList(key string, ty cty.Type) (cty.Path, error) {
+        var path cty.Path
+        var err error
+
+        k, rest := pathSplit(key)
+
+        // we don't need to convert the index keys to paths
+        if key == "#" {
+                return path, nil
+        }
+
+        idx, err := strconv.Atoi(k)
+        if err != nil {
+                return path, err
+        }
+
+        path = cty.Path{cty.IndexStep{Key: cty.NumberIntVal(int64(idx))}}
+
+        if rest == "" {
+                return path, nil
+        }
+
+        p, err := pathFromFlatmapKeyValue(rest, ty.ElementType())
+        if err != nil {
+                return path, err
+        }
+
+        return append(path, p...), nil
+}
+
+func pathFromFlatmapKeySet(key string, ty cty.Type) (cty.Path, error) {
+        // once we hit a set, we can't return consistent paths, so just mark the
+        // set as a whole changed.
+        return nil, nil
+}
+
+// FlatmapKeyFromPath returns the flatmap equivalent of the given cty.Path for
+// use in generating legacy style diffs.
+func FlatmapKeyFromPath(path cty.Path) string {
+        var parts []string
+
+        for _, step := range path {
+                switch step := step.(type) {
+                case cty.GetAttrStep:
+                        parts = append(parts, step.Name)
+                case cty.IndexStep:
+                        switch ty := step.Key.Type(); {
+                        case ty == cty.String:
+                                parts = append(parts, step.Key.AsString())
+                        case ty == cty.Number:
+                                i, _ := step.Key.AsBigFloat().Int64()
+                                parts = append(parts, strconv.Itoa(int(i)))
+                        }
+                }
+        }
+
+        return strings.Join(parts, ".")
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/hcl2shim/values.go b/vendor/github.com/hashicorp/terraform/config/hcl2shim/values.go
index 0b697a5..daeb0b8 100644
--- a/vendor/github.com/hashicorp/terraform/config/hcl2shim/values.go
+++ b/vendor/github.com/hashicorp/terraform/config/hcl2shim/values.go
@@ -6,6 +6,8 @@ import (
 
         "github.com/hashicorp/hil/ast"
         "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/configs/configschema"
 )
 
 // UnknownVariableValue is a sentinel value that can be used
@@ -14,6 +16,108 @@ import (
 // unknown keys.
 const UnknownVariableValue = "74D93920-ED26-11E3-AC10-0800200C9A66"
 
+// ConfigValueFromHCL2Block is like ConfigValueFromHCL2 but it works only for
+// known object values and uses the provided block schema to perform some
+// additional normalization to better mimic the shape of value that the old
+// HCL1/HIL-based codepaths would've produced.
+//
+// In particular, it discards the collections that we use to represent nested
+// blocks (other than NestingSingle) if they are empty, which better mimics
+// the HCL1 behavior because HCL1 had no knowledge of the schema and so didn't
+// know that an unspecified block _could_ exist.
+//
+// The given object value must conform to the schema's implied type or this
+// function will panic or produce incorrect results.
+//
+// This is primarily useful for the final transition from new-style values to
+// terraform.ResourceConfig before calling to a legacy provider, since
+// helper/schema (the old provider SDK) is particularly sensitive to these
+// subtle differences within its validation code.
+func ConfigValueFromHCL2Block(v cty.Value, schema *configschema.Block) map[string]interface{} {
+        if v.IsNull() {
+                return nil
+        }
+        if !v.IsKnown() {
+                panic("ConfigValueFromHCL2Block used with unknown value")
+        }
+        if !v.Type().IsObjectType() {
+                panic(fmt.Sprintf("ConfigValueFromHCL2Block used with non-object value %#v", v))
+        }
+
+        atys := v.Type().AttributeTypes()
+        ret := make(map[string]interface{})
+
+        for name := range schema.Attributes {
+                if _, exists := atys[name]; !exists {
+                        continue
+                }
+
+                av := v.GetAttr(name)
+                if av.IsNull() {
+                        // Skip nulls altogether, to better mimic how HCL1 would behave
+                        continue
+                }
+                ret[name] = ConfigValueFromHCL2(av)
+        }
+
+        for name, blockS := range schema.BlockTypes {
+                if _, exists := atys[name]; !exists {
+                        continue
+                }
+                bv := v.GetAttr(name)
+                if !bv.IsKnown() {
+                        ret[name] = UnknownVariableValue
+                        continue
+                }
+                if bv.IsNull() {
+                        continue
+                }
+
+                switch blockS.Nesting {
+
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        ret[name] = ConfigValueFromHCL2Block(bv, &blockS.Block)
+
+                case configschema.NestingList, configschema.NestingSet:
+                        l := bv.LengthInt()
+                        if l == 0 {
+                                // skip empty collections to better mimic how HCL1 would behave
+                                continue
+                        }
+
+                        elems := make([]interface{}, 0, l)
+                        for it := bv.ElementIterator(); it.Next(); {
+                                _, ev := it.Element()
+                                if !ev.IsKnown() {
+                                        elems = append(elems, UnknownVariableValue)
+                                        continue
+                                }
+                                elems = append(elems, ConfigValueFromHCL2Block(ev, &blockS.Block))
+                        }
+                        ret[name] = elems
+
+                case configschema.NestingMap:
+                        if bv.LengthInt() == 0 {
+                                // skip empty collections to better mimic how HCL1 would behave
+                                continue
+                        }
+
+                        elems := make(map[string]interface{})
+                        for it := bv.ElementIterator(); it.Next(); {
+                                ek, ev := it.Element()
+                                if !ev.IsKnown() {
+                                        elems[ek.AsString()] = UnknownVariableValue
+                                        continue
+                                }
+                                elems[ek.AsString()] = ConfigValueFromHCL2Block(ev, &blockS.Block)
+                        }
+                        ret[name] = elems
+                }
+        }
+
+        return ret
+}
+
 // ConfigValueFromHCL2 converts a value from HCL2 (really, from the cty dynamic
 // types library that HCL2 uses) to a value type that matches what would've
 // been produced from the HCL-based interpolator for an equivalent structure.
@@ -73,7 +177,10 @@ func ConfigValueFromHCL2(v cty.Value) interface{} {
                 it := v.ElementIterator()
                 for it.Next() {
                         ek, ev := it.Element()
-                        l[ek.AsString()] = ConfigValueFromHCL2(ev)
+                        cv := ConfigValueFromHCL2(ev)
+                        if cv != nil {
+                                l[ek.AsString()] = cv
+                        }
                 }
                 return l
         }
diff --git a/vendor/github.com/hashicorp/terraform/config/hcl2shim/values_equiv.go b/vendor/github.com/hashicorp/terraform/config/hcl2shim/values_equiv.go
new file mode 100644
index 0000000..92f0213
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/hcl2shim/values_equiv.go
@@ -0,0 +1,214 @@
+package hcl2shim
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// ValuesSDKEquivalent returns true if both of the given values seem equivalent
+// as far as the legacy SDK diffing code would be concerned.
+//
+// Since SDK diffing is a fuzzy, inexact operation, this function is also
+// fuzzy and inexact. It will err on the side of returning false if it
+// encounters an ambiguous situation. Ambiguity is most common in the presence
+// of sets because in practice it is impossible to exactly correlate
+// nonequal-but-equivalent set elements because they have no identity separate
+// from their value.
+//
+// This must be used _only_ for comparing values for equivalence within the
+// SDK planning code. It is only meaningful to compare the "prior state"
+// provided by Terraform Core with the "planned new state" produced by the
+// legacy SDK code via shims. In particular it is not valid to use this
+// function with their the config value or the "proposed new state" value
+// because they contain only the subset of data that Terraform Core itself is
+// able to determine.
+func ValuesSDKEquivalent(a, b cty.Value) bool {
+        if a == cty.NilVal || b == cty.NilVal {
+                // We don't generally expect nils to appear, but we'll allow them
+                // for robustness since the data structures produced by legacy SDK code
+                // can sometimes be non-ideal.
+                return a == b // equivalent if they are _both_ nil
+        }
+        if a.RawEquals(b) {
+                // Easy case. We use RawEquals because we want two unknowns to be
+                // considered equal here, whereas "Equals" would return unknown.
+                return true
+        }
+        if !a.IsKnown() || !b.IsKnown() {
+                // Two unknown values are equivalent regardless of type. A known is
+                // never equivalent to an unknown.
+                return a.IsKnown() == b.IsKnown()
+        }
+        if aZero, bZero := valuesSDKEquivalentIsNullOrZero(a), valuesSDKEquivalentIsNullOrZero(b); aZero || bZero {
+                // Two null/zero values are equivalent regardless of type. A non-zero is
+                // never equivalent to a zero.
+                return aZero == bZero
+        }
+
+        // If we get down here then we are guaranteed that both a and b are known,
+        // non-null values.
+
+        aTy := a.Type()
+        bTy := b.Type()
+        switch {
+        case aTy.IsSetType() && bTy.IsSetType():
+                return valuesSDKEquivalentSets(a, b)
+        case aTy.IsListType() && bTy.IsListType():
+                return valuesSDKEquivalentSequences(a, b)
+        case aTy.IsTupleType() && bTy.IsTupleType():
+                return valuesSDKEquivalentSequences(a, b)
+        case aTy.IsMapType() && bTy.IsMapType():
+                return valuesSDKEquivalentMappings(a, b)
+        case aTy.IsObjectType() && bTy.IsObjectType():
+                return valuesSDKEquivalentMappings(a, b)
+        case aTy == cty.Number && bTy == cty.Number:
+                return valuesSDKEquivalentNumbers(a, b)
+        default:
+                // We've now covered all the interesting cases, so anything that falls
+                // down here cannot be equivalent.
+                return false
+        }
+}
+
+// valuesSDKEquivalentIsNullOrZero returns true if the given value is either
+// null or is the "zero value" (in the SDK/Go sense) for its type.
+func valuesSDKEquivalentIsNullOrZero(v cty.Value) bool {
+        if v == cty.NilVal {
+                return true
+        }
+
+        ty := v.Type()
+        switch {
+        case !v.IsKnown():
+                return false
+        case v.IsNull():
+                return true
+
+        // After this point, v is always known and non-null
+        case ty.IsListType() || ty.IsSetType() || ty.IsMapType() || ty.IsObjectType() || ty.IsTupleType():
+                return v.LengthInt() == 0
+        case ty == cty.String:
+                return v.RawEquals(cty.StringVal(""))
+        case ty == cty.Number:
+                return v.RawEquals(cty.Zero)
+        case ty == cty.Bool:
+                return v.RawEquals(cty.False)
+        default:
+                // The above is exhaustive, but for robustness we'll consider anything
+                // else to _not_ be zero unless it is null.
+                return false
+        }
+}
+
+// valuesSDKEquivalentSets returns true only if each of the elements in a can
+// be correlated with at least one equivalent element in b and vice-versa.
+// This is a fuzzy operation that prefers to signal non-equivalence if it cannot
+// be certain that all elements are accounted for.
+func valuesSDKEquivalentSets(a, b cty.Value) bool {
+        if aLen, bLen := a.LengthInt(), b.LengthInt(); aLen != bLen {
+                return false
+        }
+
+        // Our methodology here is a little tricky, to deal with the fact that
+        // it's impossible to directly correlate two non-equal set elements because
+        // they don't have identities separate from their values.
+        // The approach is to count the number of equivalent elements each element
+        // of a has in b and vice-versa, and then return true only if each element
+        // in both sets has at least one equivalent.
+        as := a.AsValueSlice()
+        bs := b.AsValueSlice()
+        aeqs := make([]bool, len(as))
+        beqs := make([]bool, len(bs))
+        for ai, av := range as {
+                for bi, bv := range bs {
+                        if ValuesSDKEquivalent(av, bv) {
+                                aeqs[ai] = true
+                                beqs[bi] = true
+                        }
+                }
+        }
+
+        for _, eq := range aeqs {
+                if !eq {
+                        return false
+                }
+        }
+        for _, eq := range beqs {
+                if !eq {
+                        return false
+                }
+        }
+        return true
+}
+
+// valuesSDKEquivalentSequences decides equivalence for two sequence values
+// (lists or tuples).
+func valuesSDKEquivalentSequences(a, b cty.Value) bool {
+        as := a.AsValueSlice()
+        bs := b.AsValueSlice()
+        if len(as) != len(bs) {
+                return false
+        }
+
+        for i := range as {
+                if !ValuesSDKEquivalent(as[i], bs[i]) {
+                        return false
+                }
+        }
+        return true
+}
+
+// valuesSDKEquivalentMappings decides equivalence for two mapping values
+// (maps or objects).
+func valuesSDKEquivalentMappings(a, b cty.Value) bool {
+        as := a.AsValueMap()
+        bs := b.AsValueMap()
+        if len(as) != len(bs) {
+                return false
+        }
+
+        for k, av := range as {
+                bv, ok := bs[k]
+                if !ok {
+                        return false
+                }
+                if !ValuesSDKEquivalent(av, bv) {
+                        return false
+                }
+        }
+        return true
+}
+
+// valuesSDKEquivalentNumbers decides equivalence for two number values based
+// on the fact that the SDK uses int and float64 representations while
+// cty (and thus Terraform Core) uses big.Float, and so we expect to lose
+// precision in the round-trip.
+//
+// This does _not_ attempt to allow for an epsilon difference that may be
+// caused by accumulated innacuracy in a float calculation, under the
+// expectation that providers generally do not actually do compuations on
+// floats and instead just pass string representations of them on verbatim
+// to remote APIs. A remote API _itself_ may introduce inaccuracy, but that's
+// a problem for the provider itself to deal with, based on its knowledge of
+// the remote system, e.g. using DiffSuppressFunc.
+func valuesSDKEquivalentNumbers(a, b cty.Value) bool {
+        if a.RawEquals(b) {
+                return true // easy
+        }
+
+        af := a.AsBigFloat()
+        bf := b.AsBigFloat()
+
+        if af.IsInt() != bf.IsInt() {
+                return false
+        }
+        if af.IsInt() && bf.IsInt() {
+                return false // a.RawEquals(b) test above is good enough for integers
+        }
+
+        // The SDK supports only int and float64, so if it's not an integer
+        // we know that only a float64-level of precision can possibly be
+        // significant.
+        af64, _ := af.Float64()
+        bf64, _ := bf.Float64()
+        return af64 == bf64
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go b/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go
index 421edb0..6a2050c 100644
--- a/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go
+++ b/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go
@@ -47,6 +47,20 @@ func stringSliceToVariableValue(values []string) []ast.Variable {
         return output
 }
 
+// listVariableSliceToVariableValue converts a list of lists into the value
+// required to be returned from interpolation functions which return TypeList.
+func listVariableSliceToVariableValue(values [][]ast.Variable) []ast.Variable {
+        output := make([]ast.Variable, len(values))
+
+        for index, value := range values {
+                output[index] = ast.Variable{
+                        Type:  ast.TypeList,
+                        Value: value,
+                }
+        }
+        return output
+}
+
 func listVariableValueToStringSlice(values []ast.Variable) ([]string, error) {
         output := make([]string, len(values))
         for index, value := range values {
@@ -61,74 +75,69 @@ func listVariableValueToStringSlice(values []ast.Variable) ([]string, error) {
 // Funcs is the mapping of built-in functions for configuration.
 func Funcs() map[string]ast.Function {
         return map[string]ast.Function{
-                "abs":              interpolationFuncAbs(),
-                "basename":         interpolationFuncBasename(),
-                "base64decode":     interpolationFuncBase64Decode(),
-                "base64encode":     interpolationFuncBase64Encode(),
-                "base64gzip":       interpolationFuncBase64Gzip(),
-                "base64sha256":     interpolationFuncBase64Sha256(),
-                "base64sha512":     interpolationFuncBase64Sha512(),
-                "bcrypt":           interpolationFuncBcrypt(),
-                "ceil":             interpolationFuncCeil(),
-                "chomp":            interpolationFuncChomp(),
-                "cidrhost":         interpolationFuncCidrHost(),
-                "cidrnetmask":      interpolationFuncCidrNetmask(),
-                "cidrsubnet":       interpolationFuncCidrSubnet(),
-                "coalesce":         interpolationFuncCoalesce(),
-                "coalescelist":     interpolationFuncCoalesceList(),
-                "compact":          interpolationFuncCompact(),
-                "concat":           interpolationFuncConcat(),
-                "contains":         interpolationFuncContains(),
-                "dirname":          interpolationFuncDirname(),
-                "distinct":         interpolationFuncDistinct(),
-                "element":          interpolationFuncElement(),
-                "chunklist":        interpolationFuncChunklist(),
-                "file":             interpolationFuncFile(),
-                "filebase64sha256": interpolationFuncMakeFileHash(interpolationFuncBase64Sha256()),
-                "filebase64sha512": interpolationFuncMakeFileHash(interpolationFuncBase64Sha512()),
-                "filemd5":          interpolationFuncMakeFileHash(interpolationFuncMd5()),
-                "filesha1":         interpolationFuncMakeFileHash(interpolationFuncSha1()),
-                "filesha256":       interpolationFuncMakeFileHash(interpolationFuncSha256()),
-                "filesha512":       interpolationFuncMakeFileHash(interpolationFuncSha512()),
-                "matchkeys":        interpolationFuncMatchKeys(),
-                "flatten":          interpolationFuncFlatten(),
-                "floor":            interpolationFuncFloor(),
-                "format":           interpolationFuncFormat(),
-                "formatlist":       interpolationFuncFormatList(),
-                "indent":           interpolationFuncIndent(),
-                "index":            interpolationFuncIndex(),
-                "join":             interpolationFuncJoin(),
-                "jsonencode":       interpolationFuncJSONEncode(),
-                "length":           interpolationFuncLength(),
-                "list":             interpolationFuncList(),
-                "log":              interpolationFuncLog(),
-                "lower":            interpolationFuncLower(),
-                "map":              interpolationFuncMap(),
-                "max":              interpolationFuncMax(),
-                "md5":              interpolationFuncMd5(),
-                "merge":            interpolationFuncMerge(),
-                "min":              interpolationFuncMin(),
-                "pathexpand":       interpolationFuncPathExpand(),
-                "pow":              interpolationFuncPow(),
-                "uuid":             interpolationFuncUUID(),
-                "replace":          interpolationFuncReplace(),
-                "rsadecrypt":       interpolationFuncRsaDecrypt(),
-                "sha1":             interpolationFuncSha1(),
-                "sha256":           interpolationFuncSha256(),
-                "sha512":           interpolationFuncSha512(),
-                "signum":           interpolationFuncSignum(),
-                "slice":            interpolationFuncSlice(),
-                "sort":             interpolationFuncSort(),
-                "split":            interpolationFuncSplit(),
-                "substr":           interpolationFuncSubstr(),
-                "timestamp":        interpolationFuncTimestamp(),
-                "timeadd":          interpolationFuncTimeAdd(),
-                "title":            interpolationFuncTitle(),
-                "transpose":        interpolationFuncTranspose(),
-                "trimspace":        interpolationFuncTrimSpace(),
-                "upper":            interpolationFuncUpper(),
-                "urlencode":        interpolationFuncURLEncode(),
-                "zipmap":           interpolationFuncZipMap(),
+                "abs":          interpolationFuncAbs(),
+                "basename":     interpolationFuncBasename(),
+                "base64decode": interpolationFuncBase64Decode(),
+                "base64encode": interpolationFuncBase64Encode(),
+                "base64gzip":   interpolationFuncBase64Gzip(),
+                "base64sha256": interpolationFuncBase64Sha256(),
+                "base64sha512": interpolationFuncBase64Sha512(),
+                "bcrypt":       interpolationFuncBcrypt(),
+                "ceil":         interpolationFuncCeil(),
+                "chomp":        interpolationFuncChomp(),
+                "cidrhost":     interpolationFuncCidrHost(),
+                "cidrnetmask":  interpolationFuncCidrNetmask(),
+                "cidrsubnet":   interpolationFuncCidrSubnet(),
+                "coalesce":     interpolationFuncCoalesce(),
+                "coalescelist": interpolationFuncCoalesceList(),
+                "compact":      interpolationFuncCompact(),
+                "concat":       interpolationFuncConcat(),
+                "contains":     interpolationFuncContains(),
+                "dirname":      interpolationFuncDirname(),
+                "distinct":     interpolationFuncDistinct(),
+                "element":      interpolationFuncElement(),
+                "chunklist":    interpolationFuncChunklist(),
+                "file":         interpolationFuncFile(),
+                "matchkeys":    interpolationFuncMatchKeys(),
+                "flatten":      interpolationFuncFlatten(),
+                "floor":        interpolationFuncFloor(),
+                "format":       interpolationFuncFormat(),
+                "formatlist":   interpolationFuncFormatList(),
+                "indent":       interpolationFuncIndent(),
+                "index":        interpolationFuncIndex(),
+                "join":         interpolationFuncJoin(),
+                "jsonencode":   interpolationFuncJSONEncode(),
+                "length":       interpolationFuncLength(),
+                "list":         interpolationFuncList(),
+                "log":          interpolationFuncLog(),
+                "lower":        interpolationFuncLower(),
+                "map":          interpolationFuncMap(),
+                "max":          interpolationFuncMax(),
+                "md5":          interpolationFuncMd5(),
+                "merge":        interpolationFuncMerge(),
+                "min":          interpolationFuncMin(),
+                "pathexpand":   interpolationFuncPathExpand(),
+                "pow":          interpolationFuncPow(),
+                "uuid":         interpolationFuncUUID(),
+                "replace":      interpolationFuncReplace(),
+                "reverse":      interpolationFuncReverse(),
+                "rsadecrypt":   interpolationFuncRsaDecrypt(),
+                "sha1":         interpolationFuncSha1(),
+                "sha256":       interpolationFuncSha256(),
+                "sha512":       interpolationFuncSha512(),
+                "signum":       interpolationFuncSignum(),
+                "slice":        interpolationFuncSlice(),
+                "sort":         interpolationFuncSort(),
+                "split":        interpolationFuncSplit(),
+                "substr":       interpolationFuncSubstr(),
+                "timestamp":    interpolationFuncTimestamp(),
+                "timeadd":      interpolationFuncTimeAdd(),
+                "title":        interpolationFuncTitle(),
+                "transpose":    interpolationFuncTranspose(),
+                "trimspace":    interpolationFuncTrimSpace(),
+                "upper":        interpolationFuncUpper(),
+                "urlencode":    interpolationFuncURLEncode(),
+                "zipmap":       interpolationFuncZipMap(),
         }
 }
 
@@ -947,6 +956,25 @@ func interpolationFuncReplace() ast.Function {
         }
 }
 
+// interpolationFuncReverse implements the "reverse" function that does list reversal
+func interpolationFuncReverse() ast.Function {
+        return ast.Function{
+                ArgTypes:   []ast.Type{ast.TypeList},
+                ReturnType: ast.TypeList,
+                Variadic:   false,
+                Callback: func(args []interface{}) (interface{}, error) {
+                        inputList := args[0].([]ast.Variable)
+
+                        reversedList := make([]ast.Variable, len(inputList))
+                        for idx := range inputList {
+                                reversedList[len(inputList)-1-idx] = inputList[idx]
+                        }
+
+                        return reversedList, nil
+                },
+        }
+}
+
 func interpolationFuncLength() ast.Function {
         return ast.Function{
                 ArgTypes:   []ast.Type{ast.TypeAny},
@@ -1731,24 +1759,3 @@ func interpolationFuncRsaDecrypt() ast.Function {
                 },
         }
 }
-
-// interpolationFuncMakeFileHash constructs a function that hashes the contents
-// of a file by combining the implementations of the file(...) function and
-// a given other function that is assumed to take a single string argument and
-// return a hash value.
-func interpolationFuncMakeFileHash(hashFunc ast.Function) ast.Function {
-        fileFunc := interpolationFuncFile()
-
-        return ast.Function{
-                ArgTypes:   []ast.Type{ast.TypeString},
-                ReturnType: ast.TypeString,
-                Callback: func(args []interface{}) (interface{}, error) {
-                        filename := args[0].(string)
-                        contents, err := fileFunc.Callback([]interface{}{filename})
-                        if err != nil {
-                                return nil, err
-                        }
-                        return hashFunc.Callback([]interface{}{contents})
-                },
-        }
-}
diff --git a/vendor/github.com/hashicorp/terraform/config/module/storage.go b/vendor/github.com/hashicorp/terraform/config/module/storage.go
index 58e3a10..7734cbc 100644
--- a/vendor/github.com/hashicorp/terraform/config/module/storage.go
+++ b/vendor/github.com/hashicorp/terraform/config/module/storage.go
@@ -7,7 +7,6 @@ import (
         "log"
         "os"
         "path/filepath"
-        "strings"
 
         getter "github.com/hashicorp/go-getter"
         "github.com/hashicorp/terraform/registry"
@@ -101,21 +100,6 @@ func (s Storage) loadManifest() (moduleManifest, error) {
         if err := json.Unmarshal(data, &manifest); err != nil {
                 return manifest, err
         }
-
-        for i, rec := range manifest.Modules {
-                // If the path was recorded before we changed to always using a
-                // slash as separator, we delete the record from the manifest so
-                // it can be discovered again and will be recorded using a slash.
-                if strings.Contains(rec.Dir, "\\") {
-                        manifest.Modules[i] = manifest.Modules[len(manifest.Modules)-1]
-                        manifest.Modules = manifest.Modules[:len(manifest.Modules)-1]
-                        continue
-                }
-
-                // Make sure we use the correct path separator.
-                rec.Dir = filepath.FromSlash(rec.Dir)
-        }
-
         return manifest, nil
 }
 
@@ -146,9 +130,6 @@ func (s Storage) recordModule(rec moduleRecord) error {
                 }
         }
 
-        // Make sure we always use a slash separator.
-        rec.Dir = filepath.ToSlash(rec.Dir)
-
         manifest.Modules = append(manifest.Modules, rec)
 
         js, err := json.Marshal(manifest)
@@ -331,7 +312,7 @@ func (s Storage) findRegistryModule(mSource, constraint string) (moduleRecord, e
         // we need to lookup available versions
         // Only on Get if it's not found, on unconditionally on Update
         if (s.Mode == GetModeGet && !found) || (s.Mode == GetModeUpdate) {
-                resp, err := s.registry.Versions(mod)
+                resp, err := s.registry.ModuleVersions(mod)
                 if err != nil {
                         return rec, err
                 }
@@ -351,7 +332,7 @@ func (s Storage) findRegistryModule(mSource, constraint string) (moduleRecord, e
 
                 rec.Version = match.Version
 
-                rec.url, err = s.registry.Location(mod, rec.Version)
+                rec.url, err = s.registry.ModuleLocation(mod, rec.Version)
                 if err != nil {
                         return rec, err
                 }
diff --git a/vendor/github.com/hashicorp/terraform/config/resource_mode_string.go b/vendor/github.com/hashicorp/terraform/config/resource_mode_string.go
index 8a55e06..0105278 100644
--- a/vendor/github.com/hashicorp/terraform/config/resource_mode_string.go
+++ b/vendor/github.com/hashicorp/terraform/config/resource_mode_string.go
@@ -4,6 +4,14 @@ package config
 
 import "strconv"
 
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[ManagedResourceMode-0]
+        _ = x[DataResourceMode-1]
+}
+
 const _ResourceMode_name = "ManagedResourceModeDataResourceMode"
 
 var _ResourceMode_index = [...]uint8{0, 19, 35}
diff --git a/vendor/github.com/hashicorp/terraform/configs/backend.go b/vendor/github.com/hashicorp/terraform/configs/backend.go
new file mode 100644
index 0000000..6df7ddd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/backend.go
@@ -0,0 +1,55 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Backend represents a "backend" block inside a "terraform" block in a module
+// or file.
+type Backend struct {
+        Type   string
+        Config hcl.Body
+
+        TypeRange hcl.Range
+        DeclRange hcl.Range
+}
+
+func decodeBackendBlock(block *hcl.Block) (*Backend, hcl.Diagnostics) {
+        return &Backend{
+                Type:      block.Labels[0],
+                TypeRange: block.LabelRanges[0],
+                Config:    block.Body,
+                DeclRange: block.DefRange,
+        }, nil
+}
+
+// Hash produces a hash value for the reciever that covers the type and the
+// portions of the config that conform to the given schema.
+//
+// If the config does not conform to the schema then the result is not
+// meaningful for comparison since it will be based on an incomplete result.
+//
+// As an exception, required attributes in the schema are treated as optional
+// for the purpose of hashing, so that an incomplete configuration can still
+// be hashed. Other errors, such as extraneous attributes, have no such special
+// case.
+func (b *Backend) Hash(schema *configschema.Block) int {
+        // Don't fail if required attributes are not set. Instead, we'll just
+        // hash them as nulls.
+        schema = schema.NoneRequired()
+        spec := schema.DecoderSpec()
+        val, _ := hcldec.Decode(b.Config, spec, nil)
+        if val == cty.NilVal {
+                val = cty.UnknownVal(schema.ImpliedType())
+        }
+
+        toHash := cty.TupleVal([]cty.Value{
+                cty.StringVal(b.Type),
+                val,
+        })
+
+        return toHash.Hash()
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/compat_shim.go b/vendor/github.com/hashicorp/terraform/configs/compat_shim.go
new file mode 100644
index 0000000..66037fc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/compat_shim.go
@@ -0,0 +1,116 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// -------------------------------------------------------------------------
+// Functions in this file are compatibility shims intended to ease conversion
+// from the old configuration loader. Any use of these functions that makes
+// a change should generate a deprecation warning explaining to the user how
+// to update their code for new patterns.
+//
+// Shims are particularly important for any patterns that have been widely
+// documented in books, tutorials, etc. Users will still be starting from
+// these examples and we want to help them adopt the latest patterns rather
+// than leave them stranded.
+// -------------------------------------------------------------------------
+
+// shimTraversalInString takes any arbitrary expression and checks if it is
+// a quoted string in the native syntax. If it _is_, then it is parsed as a
+// traversal and re-wrapped into a synthetic traversal expression and a
+// warning is generated. Otherwise, the given expression is just returned
+// verbatim.
+//
+// This function has no effect on expressions from the JSON syntax, since
+// traversals in strings are the required pattern in that syntax.
+//
+// If wantKeyword is set, the generated warning diagnostic will talk about
+// keywords rather than references. The behavior is otherwise unchanged, and
+// the caller remains responsible for checking that the result is indeed
+// a keyword, e.g. using hcl.ExprAsKeyword.
+func shimTraversalInString(expr hcl.Expression, wantKeyword bool) (hcl.Expression, hcl.Diagnostics) {
+        // ObjectConsKeyExpr is a special wrapper type used for keys on object
+        // constructors to deal with the fact that naked identifiers are normally
+        // handled as "bareword" strings rather than as variable references. Since
+        // we know we're interpreting as a traversal anyway (and thus it won't
+        // matter whether it's a string or an identifier) we can safely just unwrap
+        // here and then process whatever we find inside as normal.
+        if ocke, ok := expr.(*hclsyntax.ObjectConsKeyExpr); ok {
+                expr = ocke.Wrapped
+        }
+
+        if !exprIsNativeQuotedString(expr) {
+                return expr, nil
+        }
+
+        strVal, diags := expr.Value(nil)
+        if diags.HasErrors() || strVal.IsNull() || !strVal.IsKnown() {
+                // Since we're not even able to attempt a shim here, we'll discard
+                // the diagnostics we saw so far and let the caller's own error
+                // handling take care of reporting the invalid expression.
+                return expr, nil
+        }
+
+        // The position handling here isn't _quite_ right because it won't
+        // take into account any escape sequences in the literal string, but
+        // it should be close enough for any error reporting to make sense.
+        srcRange := expr.Range()
+        startPos := srcRange.Start // copy
+        startPos.Column++          // skip initial quote
+        startPos.Byte++            // skip initial quote
+
+        traversal, tDiags := hclsyntax.ParseTraversalAbs(
+                []byte(strVal.AsString()),
+                srcRange.Filename,
+                startPos,
+        )
+        diags = append(diags, tDiags...)
+
+        // For initial release our deprecation warnings are disabled to allow
+        // a period where modules can be compatible with both old and new
+        // conventions.
+        // FIXME: Re-enable these deprecation warnings in a release prior to
+        // Terraform 0.13 and then remove the shims altogether for 0.13.
+        /*
+                if wantKeyword {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagWarning,
+                                Summary:  "Quoted keywords are deprecated",
+                                Detail:   "In this context, keywords are expected literally rather than in quotes. Previous versions of Terraform required quotes, but that usage is now deprecated. Remove the quotes surrounding this keyword to silence this warning.",
+                                Subject:  &srcRange,
+                        })
+                } else {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagWarning,
+                                Summary:  "Quoted references are deprecated",
+                                Detail:   "In this context, references are expected literally rather than in quotes. Previous versions of Terraform required quotes, but that usage is now deprecated. Remove the quotes surrounding this reference to silence this warning.",
+                                Subject:  &srcRange,
+                        })
+                }
+        */
+
+        return &hclsyntax.ScopeTraversalExpr{
+                Traversal: traversal,
+                SrcRange:  srcRange,
+        }, diags
+}
+
+// shimIsIgnoreChangesStar returns true if the given expression seems to be
+// a string literal whose value is "*". This is used to support a legacy
+// form of ignore_changes = all .
+//
+// This function does not itself emit any diagnostics, so it's the caller's
+// responsibility to emit a warning diagnostic when this function returns true.
+func shimIsIgnoreChangesStar(expr hcl.Expression) bool {
+        val, valDiags := expr.Value(nil)
+        if valDiags.HasErrors() {
+                return false
+        }
+        if val.Type() != cty.String || val.IsNull() || !val.IsKnown() {
+                return false
+        }
+        return val.AsString() == "*"
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/config.go b/vendor/github.com/hashicorp/terraform/configs/config.go
new file mode 100644
index 0000000..8294312
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/config.go
@@ -0,0 +1,205 @@
+package configs
+
+import (
+        "sort"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// A Config is a node in the tree of modules within a configuration.
+//
+// The module tree is constructed by following ModuleCall instances recursively
+// through the root module transitively into descendent modules.
+//
+// A module tree described in *this* package represents the static tree
+// represented by configuration. During evaluation a static ModuleNode may
+// expand into zero or more module instances depending on the use of count and
+// for_each configuration attributes within each call.
+type Config struct {
+        // RootModule points to the Config for the root module within the same
+        // module tree as this module. If this module _is_ the root module then
+        // this is self-referential.
+        Root *Config
+
+        // ParentModule points to the Config for the module that directly calls
+        // this module. If this is the root module then this field is nil.
+        Parent *Config
+
+        // Path is a sequence of module logical names that traverse from the root
+        // module to this config. Path is empty for the root module.
+        //
+        // This should only be used to display paths to the end-user in rare cases
+        // where we are talking about the static module tree, before module calls
+        // have been resolved. In most cases, an addrs.ModuleInstance describing
+        // a node in the dynamic module tree is better, since it will then include
+        // any keys resulting from evaluating "count" and "for_each" arguments.
+        Path addrs.Module
+
+        // ChildModules points to the Config for each of the direct child modules
+        // called from this module. The keys in this map match the keys in
+        // Module.ModuleCalls.
+        Children map[string]*Config
+
+        // Module points to the object describing the configuration for the
+        // various elements (variables, resources, etc) defined by this module.
+        Module *Module
+
+        // CallRange is the source range for the header of the module block that
+        // requested this module.
+        //
+        // This field is meaningless for the root module, where its contents are undefined.
+        CallRange hcl.Range
+
+        // SourceAddr is the source address that the referenced module was requested
+        // from, as specified in configuration.
+        //
+        // This field is meaningless for the root module, where its contents are undefined.
+        SourceAddr string
+
+        // SourceAddrRange is the location in the configuration source where the
+        // SourceAddr value was set, for use in diagnostic messages.
+        //
+        // This field is meaningless for the root module, where its contents are undefined.
+        SourceAddrRange hcl.Range
+
+        // Version is the specific version that was selected for this module,
+        // based on version constraints given in configuration.
+        //
+        // This field is nil if the module was loaded from a non-registry source,
+        // since versions are not supported for other sources.
+        //
+        // This field is meaningless for the root module, where it will always
+        // be nil.
+        Version *version.Version
+}
+
+// NewEmptyConfig constructs a single-node configuration tree with an empty
+// root module. This is generally a pretty useless thing to do, so most callers
+// should instead use BuildConfig.
+func NewEmptyConfig() *Config {
+        ret := &Config{}
+        ret.Root = ret
+        ret.Children = make(map[string]*Config)
+        ret.Module = &Module{}
+        return ret
+}
+
+// Depth returns the number of "hops" the receiver is from the root of its
+// module tree, with the root module having a depth of zero.
+func (c *Config) Depth() int {
+        ret := 0
+        this := c
+        for this.Parent != nil {
+                ret++
+                this = this.Parent
+        }
+        return ret
+}
+
+// DeepEach calls the given function once for each module in the tree, starting
+// with the receiver.
+//
+// A parent is always called before its children and children of a particular
+// node are visited in lexicographic order by their names.
+func (c *Config) DeepEach(cb func(c *Config)) {
+        cb(c)
+
+        names := make([]string, 0, len(c.Children))
+        for name := range c.Children {
+                names = append(names, name)
+        }
+
+        for _, name := range names {
+                c.Children[name].DeepEach(cb)
+        }
+}
+
+// AllModules returns a slice of all the receiver and all of its descendent
+// nodes in the module tree, in the same order they would be visited by
+// DeepEach.
+func (c *Config) AllModules() []*Config {
+        var ret []*Config
+        c.DeepEach(func(c *Config) {
+                ret = append(ret, c)
+        })
+        return ret
+}
+
+// Descendent returns the descendent config that has the given path beneath
+// the receiver, or nil if there is no such module.
+//
+// The path traverses the static module tree, prior to any expansion to handle
+// count and for_each arguments.
+//
+// An empty path will just return the receiver, and is therefore pointless.
+func (c *Config) Descendent(path addrs.Module) *Config {
+        current := c
+        for _, name := range path {
+                current = current.Children[name]
+                if current == nil {
+                        return nil
+                }
+        }
+        return current
+}
+
+// DescendentForInstance is like Descendent except that it accepts a path
+// to a particular module instance in the dynamic module graph, returning
+// the node from the static module graph that corresponds to it.
+//
+// All instances created by a particular module call share the same
+// configuration, so the keys within the given path are disregarded.
+func (c *Config) DescendentForInstance(path addrs.ModuleInstance) *Config {
+        current := c
+        for _, step := range path {
+                current = current.Children[step.Name]
+                if current == nil {
+                        return nil
+                }
+        }
+        return current
+}
+
+// ProviderTypes returns the names of each distinct provider type referenced
+// in the receiving configuration.
+//
+// This is a helper for easily determining which provider types are required
+// to fully interpret the configuration, though it does not include version
+// information and so callers are expected to have already dealt with
+// provider version selection in an earlier step and have identified suitable
+// versions for each provider.
+func (c *Config) ProviderTypes() []string {
+        m := make(map[string]struct{})
+        c.gatherProviderTypes(m)
+
+        ret := make([]string, 0, len(m))
+        for k := range m {
+                ret = append(ret, k)
+        }
+        sort.Strings(ret)
+        return ret
+}
+func (c *Config) gatherProviderTypes(m map[string]struct{}) {
+        if c == nil {
+                return
+        }
+
+        for _, pc := range c.Module.ProviderConfigs {
+                m[pc.Name] = struct{}{}
+        }
+        for _, rc := range c.Module.ManagedResources {
+                providerAddr := rc.ProviderConfigAddr()
+                m[providerAddr.Type] = struct{}{}
+        }
+        for _, rc := range c.Module.DataResources {
+                providerAddr := rc.ProviderConfigAddr()
+                m[providerAddr.Type] = struct{}{}
+        }
+
+        // Must also visit our child modules, recursively.
+        for _, cc := range c.Children {
+                cc.gatherProviderTypes(m)
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/config_build.go b/vendor/github.com/hashicorp/terraform/configs/config_build.go
new file mode 100644
index 0000000..948b2c8
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/config_build.go
@@ -0,0 +1,179 @@
+package configs
+
+import (
+        "sort"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// BuildConfig constructs a Config from a root module by loading all of its
+// descendent modules via the given ModuleWalker.
+//
+// The result is a module tree that has so far only had basic module- and
+// file-level invariants validated. If the returned diagnostics contains errors,
+// the returned module tree may be incomplete but can still be used carefully
+// for static analysis.
+func BuildConfig(root *Module, walker ModuleWalker) (*Config, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        cfg := &Config{
+                Module: root,
+        }
+        cfg.Root = cfg // Root module is self-referential.
+        cfg.Children, diags = buildChildModules(cfg, walker)
+        return cfg, diags
+}
+
+func buildChildModules(parent *Config, walker ModuleWalker) (map[string]*Config, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        ret := map[string]*Config{}
+
+        calls := parent.Module.ModuleCalls
+
+        // We'll sort the calls by their local names so that they'll appear in a
+        // predictable order in any logging that's produced during the walk.
+        callNames := make([]string, 0, len(calls))
+        for k := range calls {
+                callNames = append(callNames, k)
+        }
+        sort.Strings(callNames)
+
+        for _, callName := range callNames {
+                call := calls[callName]
+                path := make([]string, len(parent.Path)+1)
+                copy(path, parent.Path)
+                path[len(path)-1] = call.Name
+
+                req := ModuleRequest{
+                        Name:              call.Name,
+                        Path:              path,
+                        SourceAddr:        call.SourceAddr,
+                        SourceAddrRange:   call.SourceAddrRange,
+                        VersionConstraint: call.Version,
+                        Parent:            parent,
+                        CallRange:         call.DeclRange,
+                }
+
+                mod, ver, modDiags := walker.LoadModule(&req)
+                diags = append(diags, modDiags...)
+                if mod == nil {
+                        // nil can be returned if the source address was invalid and so
+                        // nothing could be loaded whatsoever. LoadModule should've
+                        // returned at least one error diagnostic in that case.
+                        continue
+                }
+
+                child := &Config{
+                        Parent:          parent,
+                        Root:            parent.Root,
+                        Path:            path,
+                        Module:          mod,
+                        CallRange:       call.DeclRange,
+                        SourceAddr:      call.SourceAddr,
+                        SourceAddrRange: call.SourceAddrRange,
+                        Version:         ver,
+                }
+
+                child.Children, modDiags = buildChildModules(child, walker)
+
+                ret[call.Name] = child
+        }
+
+        return ret, diags
+}
+
+// A ModuleWalker knows how to find and load a child module given details about
+// the module to be loaded and a reference to its partially-loaded parent
+// Config.
+type ModuleWalker interface {
+        // LoadModule finds and loads a requested child module.
+        //
+        // If errors are detected during loading, implementations should return them
+        // in the diagnostics object. If the diagnostics object contains any errors
+        // then the caller will tolerate the returned module being nil or incomplete.
+        // If no errors are returned, it should be non-nil and complete.
+        //
+        // Full validation need not have been performed but an implementation should
+        // ensure that the basic file- and module-validations performed by the
+        // LoadConfigDir function (valid syntax, no namespace collisions, etc) have
+        // been performed before returning a module.
+        LoadModule(req *ModuleRequest) (*Module, *version.Version, hcl.Diagnostics)
+}
+
+// ModuleWalkerFunc is an implementation of ModuleWalker that directly wraps
+// a callback function, for more convenient use of that interface.
+type ModuleWalkerFunc func(req *ModuleRequest) (*Module, *version.Version, hcl.Diagnostics)
+
+// LoadModule implements ModuleWalker.
+func (f ModuleWalkerFunc) LoadModule(req *ModuleRequest) (*Module, *version.Version, hcl.Diagnostics) {
+        return f(req)
+}
+
+// ModuleRequest is used with the ModuleWalker interface to describe a child
+// module that must be loaded.
+type ModuleRequest struct {
+        // Name is the "logical name" of the module call within configuration.
+        // This is provided in case the name is used as part of a storage key
+        // for the module, but implementations must otherwise treat it as an
+        // opaque string. It is guaranteed to have already been validated as an
+        // HCL identifier and UTF-8 encoded.
+        Name string
+
+        // Path is a list of logical names that traverse from the root module to
+        // this module. This can be used, for example, to form a lookup key for
+        // each distinct module call in a configuration, allowing for multiple
+        // calls with the same name at different points in the tree.
+        Path addrs.Module
+
+        // SourceAddr is the source address string provided by the user in
+        // configuration.
+        SourceAddr string
+
+        // SourceAddrRange is the source range for the SourceAddr value as it
+        // was provided in configuration. This can and should be used to generate
+        // diagnostics about the source address having invalid syntax, referring
+        // to a non-existent object, etc.
+        SourceAddrRange hcl.Range
+
+        // VersionConstraint is the version constraint applied to the module in
+        // configuration. This data structure includes the source range for
+        // the constraint, which can and should be used to generate diagnostics
+        // about constraint-related issues, such as constraints that eliminate all
+        // available versions of a module whose source is otherwise valid.
+        VersionConstraint VersionConstraint
+
+        // Parent is the partially-constructed module tree node that the loaded
+        // module will be added to. Callers may refer to any field of this
+        // structure except Children, which is still under construction when
+        // ModuleRequest objects are created and thus has undefined content.
+        // The main reason this is provided is so that full module paths can
+        // be constructed for uniqueness.
+        Parent *Config
+
+        // CallRange is the source range for the header of the "module" block
+        // in configuration that prompted this request. This can be used as the
+        // subject of an error diagnostic that relates to the module call itself,
+        // rather than to either its source address or its version number.
+        CallRange hcl.Range
+}
+
+// DisabledModuleWalker is a ModuleWalker that doesn't support
+// child modules at all, and so will return an error if asked to load one.
+//
+// This is provided primarily for testing. There is no good reason to use this
+// in the main application.
+var DisabledModuleWalker ModuleWalker
+
+func init() {
+        DisabledModuleWalker = ModuleWalkerFunc(func(req *ModuleRequest) (*Module, *version.Version, hcl.Diagnostics) {
+                return nil, nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Child modules are not supported",
+                                Detail:   "Child module calls are not allowed in this context.",
+                                Subject:  &req.CallRange,
+                        },
+                }
+        })
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/copy_dir.go b/vendor/github.com/hashicorp/terraform/configs/configload/copy_dir.go
new file mode 100644
index 0000000..ebbeb3b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/copy_dir.go
@@ -0,0 +1,125 @@
+package configload
+
+import (
+        "io"
+        "os"
+        "path/filepath"
+        "strings"
+)
+
+// copyDir copies the src directory contents into dst. Both directories
+// should already exist.
+func copyDir(dst, src string) error {
+        src, err := filepath.EvalSymlinks(src)
+        if err != nil {
+                return err
+        }
+
+        walkFn := func(path string, info os.FileInfo, err error) error {
+                if err != nil {
+                        return err
+                }
+
+                if path == src {
+                        return nil
+                }
+
+                if strings.HasPrefix(filepath.Base(path), ".") {
+                        // Skip any dot files
+                        if info.IsDir() {
+                                return filepath.SkipDir
+                        } else {
+                                return nil
+                        }
+                }
+
+                // The "path" has the src prefixed to it. We need to join our
+                // destination with the path without the src on it.
+                dstPath := filepath.Join(dst, path[len(src):])
+
+                // we don't want to try and copy the same file over itself.
+                if eq, err := sameFile(path, dstPath); eq {
+                        return nil
+                } else if err != nil {
+                        return err
+                }
+
+                // If we have a directory, make that subdirectory, then continue
+                // the walk.
+                if info.IsDir() {
+                        if path == filepath.Join(src, dst) {
+                                // dst is in src; don't walk it.
+                                return nil
+                        }
+
+                        if err := os.MkdirAll(dstPath, 0755); err != nil {
+                                return err
+                        }
+
+                        return nil
+                }
+
+                // If the current path is a symlink, recreate the symlink relative to
+                // the dst directory
+                if info.Mode()&os.ModeSymlink == os.ModeSymlink {
+                        target, err := os.Readlink(path)
+                        if err != nil {
+                                return err
+                        }
+
+                        return os.Symlink(target, dstPath)
+                }
+
+                // If we have a file, copy the contents.
+                srcF, err := os.Open(path)
+                if err != nil {
+                        return err
+                }
+                defer srcF.Close()
+
+                dstF, err := os.Create(dstPath)
+                if err != nil {
+                        return err
+                }
+                defer dstF.Close()
+
+                if _, err := io.Copy(dstF, srcF); err != nil {
+                        return err
+                }
+
+                // Chmod it
+                return os.Chmod(dstPath, info.Mode())
+        }
+
+        return filepath.Walk(src, walkFn)
+}
+
+// sameFile tried to determine if to paths are the same file.
+// If the paths don't match, we lookup the inode on supported systems.
+func sameFile(a, b string) (bool, error) {
+        if a == b {
+                return true, nil
+        }
+
+        aIno, err := inode(a)
+        if err != nil {
+                if os.IsNotExist(err) {
+                        return false, nil
+                }
+                return false, err
+        }
+
+        bIno, err := inode(b)
+        if err != nil {
+                if os.IsNotExist(err) {
+                        return false, nil
+                }
+                return false, err
+        }
+
+        if aIno > 0 && aIno == bIno {
+                return true, nil
+        }
+
+        return false, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/doc.go b/vendor/github.com/hashicorp/terraform/configs/configload/doc.go
new file mode 100644
index 0000000..8b615f9
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/doc.go
@@ -0,0 +1,4 @@
+// Package configload knows how to install modules into the .terraform/modules
+// directory and to load modules from those installed locations. It is used
+// in conjunction with the LoadConfig function in the parent package.
+package configload
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/getter.go b/vendor/github.com/hashicorp/terraform/configs/configload/getter.go
new file mode 100644
index 0000000..4a3dace
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/getter.go
@@ -0,0 +1,150 @@
+package configload
+
+import (
+        "fmt"
+        "log"
+        "os"
+        "path/filepath"
+
+        cleanhttp "github.com/hashicorp/go-cleanhttp"
+        getter "github.com/hashicorp/go-getter"
+)
+
+// We configure our own go-getter detector and getter sets here, because
+// the set of sources we support is part of Terraform's documentation and
+// so we don't want any new sources introduced in go-getter to sneak in here
+// and work even though they aren't documented. This also insulates us from
+// any meddling that might be done by other go-getter callers linked into our
+// executable.
+
+var goGetterDetectors = []getter.Detector{
+        new(getter.GitHubDetector),
+        new(getter.BitBucketDetector),
+        new(getter.S3Detector),
+        new(getter.FileDetector),
+}
+
+var goGetterNoDetectors = []getter.Detector{}
+
+var goGetterDecompressors = map[string]getter.Decompressor{
+        "bz2": new(getter.Bzip2Decompressor),
+        "gz":  new(getter.GzipDecompressor),
+        "xz":  new(getter.XzDecompressor),
+        "zip": new(getter.ZipDecompressor),
+
+        "tar.bz2":  new(getter.TarBzip2Decompressor),
+        "tar.tbz2": new(getter.TarBzip2Decompressor),
+
+        "tar.gz": new(getter.TarGzipDecompressor),
+        "tgz":    new(getter.TarGzipDecompressor),
+
+        "tar.xz": new(getter.TarXzDecompressor),
+        "txz":    new(getter.TarXzDecompressor),
+}
+
+var goGetterGetters = map[string]getter.Getter{
+        "file":  new(getter.FileGetter),
+        "git":   new(getter.GitGetter),
+        "hg":    new(getter.HgGetter),
+        "s3":    new(getter.S3Getter),
+        "http":  getterHTTPGetter,
+        "https": getterHTTPGetter,
+}
+
+var getterHTTPClient = cleanhttp.DefaultClient()
+
+var getterHTTPGetter = &getter.HttpGetter{
+        Client: getterHTTPClient,
+        Netrc:  true,
+}
+
+// A reusingGetter is a helper for the module installer that remembers
+// the final resolved addresses of all of the sources it has already been
+// asked to install, and will copy from a prior installation directory if
+// it has the same resolved source address.
+//
+// The keys in a reusingGetter are resolved and trimmed source addresses
+// (with a scheme always present, and without any "subdir" component),
+// and the values are the paths where each source was previously installed.
+type reusingGetter map[string]string
+
+// getWithGoGetter retrieves the package referenced in the given address
+// into the installation path and then returns the full path to any subdir
+// indicated in the address.
+//
+// The errors returned by this function are those surfaced by the underlying
+// go-getter library, which have very inconsistent quality as
+// end-user-actionable error messages. At this time we do not have any
+// reasonable way to improve these error messages at this layer because
+// the underlying errors are not separatelyr recognizable.
+func (g reusingGetter) getWithGoGetter(instPath, addr string) (string, error) {
+        packageAddr, subDir := splitAddrSubdir(addr)
+
+        log.Printf("[DEBUG] will download %q to %s", packageAddr, instPath)
+
+        realAddr, err := getter.Detect(packageAddr, instPath, getter.Detectors)
+        if err != nil {
+                return "", err
+        }
+
+        var realSubDir string
+        realAddr, realSubDir = splitAddrSubdir(realAddr)
+        if realSubDir != "" {
+                subDir = filepath.Join(realSubDir, subDir)
+        }
+
+        if realAddr != packageAddr {
+                log.Printf("[TRACE] go-getter detectors rewrote %q to %q", packageAddr, realAddr)
+        }
+
+        if prevDir, exists := g[realAddr]; exists {
+                log.Printf("[TRACE] copying previous install %s to %s", prevDir, instPath)
+                err := os.Mkdir(instPath, os.ModePerm)
+                if err != nil {
+                        return "", fmt.Errorf("failed to create directory %s: %s", instPath, err)
+                }
+                err = copyDir(instPath, prevDir)
+                if err != nil {
+                        return "", fmt.Errorf("failed to copy from %s to %s: %s", prevDir, instPath, err)
+                }
+        } else {
+                log.Printf("[TRACE] fetching %q to %q", realAddr, instPath)
+                client := getter.Client{
+                        Src: realAddr,
+                        Dst: instPath,
+                        Pwd: instPath,
+
+                        Mode: getter.ClientModeDir,
+
+                        Detectors:     goGetterNoDetectors, // we already did detection above
+                        Decompressors: goGetterDecompressors,
+                        Getters:       goGetterGetters,
+                }
+                err = client.Get()
+                if err != nil {
+                        return "", err
+                }
+                // Remember where we installed this so we might reuse this directory
+                // on subsequent calls to avoid re-downloading.
+                g[realAddr] = instPath
+        }
+
+        // Our subDir string can contain wildcards until this point, so that
+        // e.g. a subDir of * can expand to one top-level directory in a .tar.gz
+        // archive. Now that we've expanded the archive successfully we must
+        // resolve that into a concrete path.
+        var finalDir string
+        if subDir != "" {
+                finalDir, err = getter.SubdirGlob(instPath, subDir)
+                log.Printf("[TRACE] expanded %q to %q", subDir, finalDir)
+                if err != nil {
+                        return "", err
+                }
+        } else {
+                finalDir = instPath
+        }
+
+        // If we got this far then we have apparently succeeded in downloading
+        // the requested object!
+        return filepath.Clean(finalDir), nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/inode.go b/vendor/github.com/hashicorp/terraform/configs/configload/inode.go
new file mode 100644
index 0000000..57df041
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/inode.go
@@ -0,0 +1,21 @@
+// +build linux darwin openbsd netbsd solaris dragonfly
+
+package configload
+
+import (
+        "fmt"
+        "os"
+        "syscall"
+)
+
+// lookup the inode of a file on posix systems
+func inode(path string) (uint64, error) {
+        stat, err := os.Stat(path)
+        if err != nil {
+                return 0, err
+        }
+        if st, ok := stat.Sys().(*syscall.Stat_t); ok {
+                return st.Ino, nil
+        }
+        return 0, fmt.Errorf("could not determine file inode")
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/inode_freebsd.go b/vendor/github.com/hashicorp/terraform/configs/configload/inode_freebsd.go
new file mode 100644
index 0000000..4dc28ea
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/inode_freebsd.go
@@ -0,0 +1,21 @@
+// +build freebsd
+
+package configload
+
+import (
+        "fmt"
+        "os"
+        "syscall"
+)
+
+// lookup the inode of a file on posix systems
+func inode(path string) (uint64, error) {
+        stat, err := os.Stat(path)
+        if err != nil {
+                return 0, err
+        }
+        if st, ok := stat.Sys().(*syscall.Stat_t); ok {
+                return uint64(st.Ino), nil
+        }
+        return 0, fmt.Errorf("could not determine file inode")
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/inode_windows.go b/vendor/github.com/hashicorp/terraform/configs/configload/inode_windows.go
new file mode 100644
index 0000000..0d22e67
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/inode_windows.go
@@ -0,0 +1,8 @@
+// +build windows
+
+package configload
+
+// no syscall.Stat_t on windows, return 0 for inodes
+func inode(path string) (uint64, error) {
+        return 0, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/loader.go b/vendor/github.com/hashicorp/terraform/configs/configload/loader.go
new file mode 100644
index 0000000..416b48f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/loader.go
@@ -0,0 +1,150 @@
+package configload
+
+import (
+        "fmt"
+        "path/filepath"
+
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/registry"
+        "github.com/hashicorp/terraform/svchost/disco"
+        "github.com/spf13/afero"
+)
+
+// A Loader instance is the main entry-point for loading configurations via
+// this package.
+//
+// It extends the general config-loading functionality in the parent package
+// "configs" to support installation of modules from remote sources and
+// loading full configurations using modules that were previously installed.
+type Loader struct {
+        // parser is used to read configuration
+        parser *configs.Parser
+
+        // modules is used to install and locate descendent modules that are
+        // referenced (directly or indirectly) from the root module.
+        modules moduleMgr
+}
+
+// Config is used with NewLoader to specify configuration arguments for the
+// loader.
+type Config struct {
+        // ModulesDir is a path to a directory where descendent modules are
+        // (or should be) installed. (This is usually the
+        // .terraform/modules directory, in the common case where this package
+        // is being loaded from the main Terraform CLI package.)
+        ModulesDir string
+
+        // Services is the service discovery client to use when locating remote
+        // module registry endpoints. If this is nil then registry sources are
+        // not supported, which should be true only in specialized circumstances
+        // such as in tests.
+        Services *disco.Disco
+}
+
+// NewLoader creates and returns a loader that reads configuration from the
+// real OS filesystem.
+//
+// The loader has some internal state about the modules that are currently
+// installed, which is read from disk as part of this function. If that
+// manifest cannot be read then an error will be returned.
+func NewLoader(config *Config) (*Loader, error) {
+        fs := afero.NewOsFs()
+        parser := configs.NewParser(fs)
+        reg := registry.NewClient(config.Services, nil)
+
+        ret := &Loader{
+                parser: parser,
+                modules: moduleMgr{
+                        FS:         afero.Afero{Fs: fs},
+                        CanInstall: true,
+                        Dir:        config.ModulesDir,
+                        Services:   config.Services,
+                        Registry:   reg,
+                },
+        }
+
+        err := ret.modules.readModuleManifestSnapshot()
+        if err != nil {
+                return nil, fmt.Errorf("failed to read module manifest: %s", err)
+        }
+
+        return ret, nil
+}
+
+// ModulesDir returns the path to the directory where the loader will look for
+// the local cache of remote module packages.
+func (l *Loader) ModulesDir() string {
+        return l.modules.Dir
+}
+
+// RefreshModules updates the in-memory cache of the module manifest from the
+// module manifest file on disk. This is not necessary in normal use because
+// module installation and configuration loading are separate steps, but it
+// can be useful in tests where module installation is done as a part of
+// configuration loading by a helper function.
+//
+// Call this function after any module installation where an existing loader
+// is already alive and may be used again later.
+//
+// An error is returned if the manifest file cannot be read.
+func (l *Loader) RefreshModules() error {
+        if l == nil {
+                // Nothing to do, then.
+                return nil
+        }
+        return l.modules.readModuleManifestSnapshot()
+}
+
+// Parser returns the underlying parser for this loader.
+//
+// This is useful for loading other sorts of files than the module directories
+// that a loader deals with, since then they will share the source code cache
+// for this loader and can thus be shown as snippets in diagnostic messages.
+func (l *Loader) Parser() *configs.Parser {
+        return l.parser
+}
+
+// Sources returns the source code cache for the underlying parser of this
+// loader. This is a shorthand for l.Parser().Sources().
+func (l *Loader) Sources() map[string][]byte {
+        return l.parser.Sources()
+}
+
+// IsConfigDir returns true if and only if the given directory contains at
+// least one Terraform configuration file. This is a wrapper around calling
+// the same method name on the loader's parser.
+func (l *Loader) IsConfigDir(path string) bool {
+        return l.parser.IsConfigDir(path)
+}
+
+// ImportSources writes into the receiver's source code the given source
+// code buffers.
+//
+// This is useful in the situation where an ancillary loader is created for
+// some reason (e.g. loading config from a plan file) but the cached source
+// code from that loader must be imported into the "main" loader in order
+// to return source code snapshots in diagnostic messages.
+//
+//     loader.ImportSources(otherLoader.Sources())
+func (l *Loader) ImportSources(sources map[string][]byte) {
+        p := l.Parser()
+        for name, src := range sources {
+                p.ForceFileSource(name, src)
+        }
+}
+
+// ImportSourcesFromSnapshot writes into the receiver's source code the
+// source files from the given snapshot.
+//
+// This is similar to ImportSources but knows how to unpack and flatten a
+// snapshot data structure to get the corresponding flat source file map.
+func (l *Loader) ImportSourcesFromSnapshot(snap *Snapshot) {
+        p := l.Parser()
+        for _, m := range snap.Modules {
+                baseDir := m.Dir
+                for fn, src := range m.Files {
+                        fullPath := filepath.Join(baseDir, fn)
+                        p.ForceFileSource(fullPath, src)
+                }
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/loader_load.go b/vendor/github.com/hashicorp/terraform/configs/configload/loader_load.go
new file mode 100644
index 0000000..93a9420
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/loader_load.go
@@ -0,0 +1,97 @@
+package configload
+
+import (
+        "fmt"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs"
+)
+
+// LoadConfig reads the Terraform module in the given directory and uses it as the
+// root module to build the static module tree that represents a configuration,
+// assuming that all required descendent modules have already been installed.
+//
+// If error diagnostics are returned, the returned configuration may be either
+// nil or incomplete. In the latter case, cautious static analysis is possible
+// in spite of the errors.
+//
+// LoadConfig performs the basic syntax and uniqueness validations that are
+// required to process the individual modules, and also detects
+func (l *Loader) LoadConfig(rootDir string) (*configs.Config, hcl.Diagnostics) {
+        rootMod, diags := l.parser.LoadConfigDir(rootDir)
+        if rootMod == nil {
+                return nil, diags
+        }
+
+        cfg, cDiags := configs.BuildConfig(rootMod, configs.ModuleWalkerFunc(l.moduleWalkerLoad))
+        diags = append(diags, cDiags...)
+
+        return cfg, diags
+}
+
+// moduleWalkerLoad is a configs.ModuleWalkerFunc for loading modules that
+// are presumed to have already been installed. A different function
+// (moduleWalkerInstall) is used for installation.
+func (l *Loader) moduleWalkerLoad(req *configs.ModuleRequest) (*configs.Module, *version.Version, hcl.Diagnostics) {
+        // Since we're just loading here, we expect that all referenced modules
+        // will be already installed and described in our manifest. However, we
+        // do verify that the manifest and the configuration are in agreement
+        // so that we can prompt the user to run "terraform init" if not.
+
+        key := l.modules.manifest.ModuleKey(req.Path)
+        record, exists := l.modules.manifest[key]
+
+        if !exists {
+                return nil, nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Module not installed",
+                                Detail:   "This module is not yet installed. Run \"terraform init\" to install all modules required by this configuration.",
+                                Subject:  &req.CallRange,
+                        },
+                }
+        }
+
+        var diags hcl.Diagnostics
+
+        // Check for inconsistencies between manifest and config
+        if req.SourceAddr != record.SourceAddr {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Module source has changed",
+                        Detail:   "The source address was changed since this module was installed. Run \"terraform init\" to install all modules required by this configuration.",
+                        Subject:  &req.SourceAddrRange,
+                })
+        }
+        if !req.VersionConstraint.Required.Check(record.Version) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Module version requirements have changed",
+                        Detail: fmt.Sprintf(
+                                "The version requirements have changed since this module was installed and the installed version (%s) is no longer acceptable. Run \"terraform init\" to install all modules required by this configuration.",
+                                record.Version,
+                        ),
+                        Subject: &req.SourceAddrRange,
+                })
+        }
+
+        mod, mDiags := l.parser.LoadConfigDir(record.Dir)
+        diags = append(diags, mDiags...)
+        if mod == nil {
+                // nil specifically indicates that the directory does not exist or
+                // cannot be read, so in this case we'll discard any generic diagnostics
+                // returned from LoadConfigDir and produce our own context-sensitive
+                // error message.
+                return nil, nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Module not installed",
+                                Detail:   fmt.Sprintf("This module's local cache directory %s could not be read. Run \"terraform init\" to install all modules required by this configuration.", record.Dir),
+                                Subject:  &req.CallRange,
+                        },
+                }
+        }
+
+        return mod, record.Version, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/loader_snapshot.go b/vendor/github.com/hashicorp/terraform/configs/configload/loader_snapshot.go
new file mode 100644
index 0000000..44c6439
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/loader_snapshot.go
@@ -0,0 +1,504 @@
+package configload
+
+import (
+        "fmt"
+        "io"
+        "os"
+        "path/filepath"
+        "sort"
+        "time"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/internal/modsdir"
+        "github.com/spf13/afero"
+)
+
+// LoadConfigWithSnapshot is a variant of LoadConfig that also simultaneously
+// creates an in-memory snapshot of the configuration files used, which can
+// be later used to create a loader that may read only from this snapshot.
+func (l *Loader) LoadConfigWithSnapshot(rootDir string) (*configs.Config, *Snapshot, hcl.Diagnostics) {
+        rootMod, diags := l.parser.LoadConfigDir(rootDir)
+        if rootMod == nil {
+                return nil, nil, diags
+        }
+
+        snap := &Snapshot{
+                Modules: map[string]*SnapshotModule{},
+        }
+        walker := l.makeModuleWalkerSnapshot(snap)
+        cfg, cDiags := configs.BuildConfig(rootMod, walker)
+        diags = append(diags, cDiags...)
+
+        addDiags := l.addModuleToSnapshot(snap, "", rootDir, "", nil)
+        diags = append(diags, addDiags...)
+
+        return cfg, snap, diags
+}
+
+// NewLoaderFromSnapshot creates a Loader that reads files only from the
+// given snapshot.
+//
+// A snapshot-based loader cannot install modules, so calling InstallModules
+// on the return value will cause a panic.
+//
+// A snapshot-based loader also has access only to configuration files. Its
+// underlying parser does not have access to other files in the native
+// filesystem, such as values files. For those, either use a normal loader
+// (created by NewLoader) or use the configs.Parser API directly.
+func NewLoaderFromSnapshot(snap *Snapshot) *Loader {
+        fs := snapshotFS{snap}
+        parser := configs.NewParser(fs)
+
+        ret := &Loader{
+                parser: parser,
+                modules: moduleMgr{
+                        FS:         afero.Afero{Fs: fs},
+                        CanInstall: false,
+                        manifest:   snap.moduleManifest(),
+                },
+        }
+
+        return ret
+}
+
+// Snapshot is an in-memory representation of the source files from a
+// configuration, which can be used as an alternative configurations source
+// for a loader with NewLoaderFromSnapshot.
+//
+// The primary purpose of a Snapshot is to build the configuration portion
+// of a plan file (see ../../plans/planfile) so that it can later be reloaded
+// and used to recover the exact configuration that the plan was built from.
+type Snapshot struct {
+        // Modules is a map from opaque module keys (suitable for use as directory
+        // names on all supported operating systems) to the snapshot information
+        // about each module.
+        Modules map[string]*SnapshotModule
+}
+
+// NewEmptySnapshot constructs and returns a snapshot containing only an empty
+// root module. This is not useful for anything except placeholders in tests.
+func NewEmptySnapshot() *Snapshot {
+        return &Snapshot{
+                Modules: map[string]*SnapshotModule{
+                        "": &SnapshotModule{
+                                Files: map[string][]byte{},
+                        },
+                },
+        }
+}
+
+// SnapshotModule represents a single module within a Snapshot.
+type SnapshotModule struct {
+        // Dir is the path, relative to the root directory given when the
+        // snapshot was created, where the module appears in the snapshot's
+        // virtual filesystem.
+        Dir string
+
+        // Files is a map from each configuration file filename for the
+        // module to a raw byte representation of the source file contents.
+        Files map[string][]byte
+
+        // SourceAddr is the source address given for this module in configuration.
+        SourceAddr string `json:"Source"`
+
+        // Version is the version of the module that is installed, or nil if
+        // the module is installed from a source that does not support versions.
+        Version *version.Version `json:"-"`
+}
+
+// moduleManifest constructs a module manifest based on the contents of
+// the receiving snapshot.
+func (s *Snapshot) moduleManifest() modsdir.Manifest {
+        ret := make(modsdir.Manifest)
+
+        for k, modSnap := range s.Modules {
+                ret[k] = modsdir.Record{
+                        Key:        k,
+                        Dir:        modSnap.Dir,
+                        SourceAddr: modSnap.SourceAddr,
+                        Version:    modSnap.Version,
+                }
+        }
+
+        return ret
+}
+
+// makeModuleWalkerSnapshot creates a configs.ModuleWalker that will exhibit
+// the same lookup behaviors as l.moduleWalkerLoad but will additionally write
+// source files from the referenced modules into the given snapshot.
+func (l *Loader) makeModuleWalkerSnapshot(snap *Snapshot) configs.ModuleWalker {
+        return configs.ModuleWalkerFunc(
+                func(req *configs.ModuleRequest) (*configs.Module, *version.Version, hcl.Diagnostics) {
+                        mod, v, diags := l.moduleWalkerLoad(req)
+                        if diags.HasErrors() {
+                                return mod, v, diags
+                        }
+
+                        key := l.modules.manifest.ModuleKey(req.Path)
+                        record, exists := l.modules.manifest[key]
+
+                        if !exists {
+                                // Should never happen, since otherwise moduleWalkerLoader would've
+                                // returned an error and we would've returned already.
+                                panic(fmt.Sprintf("module %s is not present in manifest", key))
+                        }
+
+                        addDiags := l.addModuleToSnapshot(snap, key, record.Dir, record.SourceAddr, record.Version)
+                        diags = append(diags, addDiags...)
+
+                        return mod, v, diags
+                },
+        )
+}
+
+func (l *Loader) addModuleToSnapshot(snap *Snapshot, key string, dir string, sourceAddr string, v *version.Version) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        primaryFiles, overrideFiles, moreDiags := l.parser.ConfigDirFiles(dir)
+        if moreDiags.HasErrors() {
+                // Any diagnostics we get here should be already present
+                // in diags, so it's weird if we get here but we'll allow it
+                // and return a general error message in that case.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Failed to read directory for module",
+                        Detail:   fmt.Sprintf("The source directory %s could not be read", dir),
+                })
+                return diags
+        }
+
+        snapMod := &SnapshotModule{
+                Dir:        dir,
+                Files:      map[string][]byte{},
+                SourceAddr: sourceAddr,
+                Version:    v,
+        }
+
+        files := make([]string, 0, len(primaryFiles)+len(overrideFiles))
+        files = append(files, primaryFiles...)
+        files = append(files, overrideFiles...)
+        sources := l.Sources() // should be populated with all the files we need by now
+        for _, filePath := range files {
+                filename := filepath.Base(filePath)
+                src, exists := sources[filePath]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing source file for snapshot",
+                                Detail:   fmt.Sprintf("The source code for file %s could not be found to produce a configuration snapshot.", filePath),
+                        })
+                        continue
+                }
+                snapMod.Files[filepath.Clean(filename)] = src
+        }
+
+        snap.Modules[key] = snapMod
+
+        return diags
+}
+
+// snapshotFS is an implementation of afero.Fs that reads from a snapshot.
+//
+// This is not intended as a general-purpose filesystem implementation. Instead,
+// it just supports the minimal functionality required to support the
+// configuration loader and parser as an implementation detail of creating
+// a loader from a snapshot.
+type snapshotFS struct {
+        snap *Snapshot
+}
+
+var _ afero.Fs = snapshotFS{}
+
+func (fs snapshotFS) Create(name string) (afero.File, error) {
+        return nil, fmt.Errorf("cannot create file inside configuration snapshot")
+}
+
+func (fs snapshotFS) Mkdir(name string, perm os.FileMode) error {
+        return fmt.Errorf("cannot create directory inside configuration snapshot")
+}
+
+func (fs snapshotFS) MkdirAll(name string, perm os.FileMode) error {
+        return fmt.Errorf("cannot create directories inside configuration snapshot")
+}
+
+func (fs snapshotFS) Open(name string) (afero.File, error) {
+
+        // Our "filesystem" is sparsely populated only with the directories
+        // mentioned by modules in our snapshot, so the high-level process
+        // for opening a file is:
+        // - Find the module snapshot corresponding to the containing directory
+        // - Find the file within that snapshot
+        // - Wrap the resulting byte slice in a snapshotFile to return
+        //
+        // The other possibility handled here is if the given name is for the
+        // module directory itself, in which case we'll return a snapshotDir
+        // instead.
+        //
+        // This function doesn't try to be incredibly robust in supporting
+        // different permutations of paths, etc because in practice we only
+        // need to support the path forms that our own loader and parser will
+        // generate.
+
+        dir := filepath.Dir(name)
+        fn := filepath.Base(name)
+        directDir := filepath.Clean(name)
+
+        // First we'll check to see if this is an exact path for a module directory.
+        // We need to do this first (rather than as part of the next loop below)
+        // because a module in a child directory of another module can otherwise
+        // appear to be a file in that parent directory.
+        for _, candidate := range fs.snap.Modules {
+                modDir := filepath.Clean(candidate.Dir)
+                if modDir == directDir {
+                        // We've matched the module directory itself
+                        filenames := make([]string, 0, len(candidate.Files))
+                        for n := range candidate.Files {
+                                filenames = append(filenames, n)
+                        }
+                        sort.Strings(filenames)
+                        return snapshotDir{
+                                filenames: filenames,
+                        }, nil
+                }
+        }
+
+        // If we get here then the given path isn't a module directory exactly, so
+        // we'll treat it as a file path and try to find a module directory it
+        // could be located in.
+        var modSnap *SnapshotModule
+        for _, candidate := range fs.snap.Modules {
+                modDir := filepath.Clean(candidate.Dir)
+                if modDir == dir {
+                        modSnap = candidate
+                        break
+                }
+        }
+        if modSnap == nil {
+                return nil, os.ErrNotExist
+        }
+
+        src, exists := modSnap.Files[fn]
+        if !exists {
+                return nil, os.ErrNotExist
+        }
+
+        return &snapshotFile{
+                src: src,
+        }, nil
+}
+
+func (fs snapshotFS) OpenFile(name string, flag int, perm os.FileMode) (afero.File, error) {
+        return fs.Open(name)
+}
+
+func (fs snapshotFS) Remove(name string) error {
+        return fmt.Errorf("cannot remove file inside configuration snapshot")
+}
+
+func (fs snapshotFS) RemoveAll(path string) error {
+        return fmt.Errorf("cannot remove files inside configuration snapshot")
+}
+
+func (fs snapshotFS) Rename(old, new string) error {
+        return fmt.Errorf("cannot rename file inside configuration snapshot")
+}
+
+func (fs snapshotFS) Stat(name string) (os.FileInfo, error) {
+        f, err := fs.Open(name)
+        if err != nil {
+                return nil, err
+        }
+        _, isDir := f.(snapshotDir)
+        return snapshotFileInfo{
+                name:  filepath.Base(name),
+                isDir: isDir,
+        }, nil
+}
+
+func (fs snapshotFS) Name() string {
+        return "ConfigSnapshotFS"
+}
+
+func (fs snapshotFS) Chmod(name string, mode os.FileMode) error {
+        return fmt.Errorf("cannot set file mode inside configuration snapshot")
+}
+
+func (fs snapshotFS) Chtimes(name string, atime, mtime time.Time) error {
+        return fmt.Errorf("cannot set file times inside configuration snapshot")
+}
+
+type snapshotFile struct {
+        snapshotFileStub
+        src []byte
+        at  int64
+}
+
+var _ afero.File = (*snapshotFile)(nil)
+
+func (f *snapshotFile) Read(p []byte) (n int, err error) {
+        if len(p) > 0 && f.at == int64(len(f.src)) {
+                return 0, io.EOF
+        }
+        if f.at > int64(len(f.src)) {
+                return 0, io.ErrUnexpectedEOF
+        }
+        if int64(len(f.src))-f.at >= int64(len(p)) {
+                n = len(p)
+        } else {
+                n = int(int64(len(f.src)) - f.at)
+        }
+        copy(p, f.src[f.at:f.at+int64(n)])
+        f.at += int64(n)
+        return
+}
+
+func (f *snapshotFile) ReadAt(p []byte, off int64) (n int, err error) {
+        f.at = off
+        return f.Read(p)
+}
+
+func (f *snapshotFile) Seek(offset int64, whence int) (int64, error) {
+        switch whence {
+        case 0:
+                f.at = offset
+        case 1:
+                f.at += offset
+        case 2:
+                f.at = int64(len(f.src)) + offset
+        }
+        return f.at, nil
+}
+
+type snapshotDir struct {
+        snapshotFileStub
+        filenames []string
+        at        int
+}
+
+var _ afero.File = snapshotDir{}
+
+func (f snapshotDir) Readdir(count int) ([]os.FileInfo, error) {
+        names, err := f.Readdirnames(count)
+        if err != nil {
+                return nil, err
+        }
+        ret := make([]os.FileInfo, len(names))
+        for i, name := range names {
+                ret[i] = snapshotFileInfo{
+                        name:  name,
+                        isDir: false,
+                }
+        }
+        return ret, nil
+}
+
+func (f snapshotDir) Readdirnames(count int) ([]string, error) {
+        var outLen int
+        names := f.filenames[f.at:]
+        if count > 0 {
+                if len(names) < count {
+                        outLen = len(names)
+                } else {
+                        outLen = count
+                }
+                if len(names) == 0 {
+                        return nil, io.EOF
+                }
+        } else {
+                outLen = len(names)
+        }
+        f.at += outLen
+
+        return names[:outLen], nil
+}
+
+// snapshotFileInfo is a minimal implementation of os.FileInfo to support our
+// virtual filesystem from snapshots.
+type snapshotFileInfo struct {
+        name  string
+        isDir bool
+}
+
+var _ os.FileInfo = snapshotFileInfo{}
+
+func (fi snapshotFileInfo) Name() string {
+        return fi.name
+}
+
+func (fi snapshotFileInfo) Size() int64 {
+        // In practice, our parser and loader never call Size
+        return -1
+}
+
+func (fi snapshotFileInfo) Mode() os.FileMode {
+        return os.ModePerm
+}
+
+func (fi snapshotFileInfo) ModTime() time.Time {
+        return time.Now()
+}
+
+func (fi snapshotFileInfo) IsDir() bool {
+        return fi.isDir
+}
+
+func (fi snapshotFileInfo) Sys() interface{} {
+        return nil
+}
+
+type snapshotFileStub struct{}
+
+func (f snapshotFileStub) Close() error {
+        return nil
+}
+
+func (f snapshotFileStub) Read(p []byte) (n int, err error) {
+        return 0, fmt.Errorf("cannot read")
+}
+
+func (f snapshotFileStub) ReadAt(p []byte, off int64) (n int, err error) {
+        return 0, fmt.Errorf("cannot read")
+}
+
+func (f snapshotFileStub) Seek(offset int64, whence int) (int64, error) {
+        return 0, fmt.Errorf("cannot seek")
+}
+
+func (f snapshotFileStub) Write(p []byte) (n int, err error) {
+        return f.WriteAt(p, 0)
+}
+
+func (f snapshotFileStub) WriteAt(p []byte, off int64) (n int, err error) {
+        return 0, fmt.Errorf("cannot write to file in snapshot")
+}
+
+func (f snapshotFileStub) WriteString(s string) (n int, err error) {
+        return 0, fmt.Errorf("cannot write to file in snapshot")
+}
+
+func (f snapshotFileStub) Name() string {
+        // in practice, the loader and parser never use this
+        return "<unimplemented>"
+}
+
+func (f snapshotFileStub) Readdir(count int) ([]os.FileInfo, error) {
+        return nil, fmt.Errorf("cannot use Readdir on a file")
+}
+
+func (f snapshotFileStub) Readdirnames(count int) ([]string, error) {
+        return nil, fmt.Errorf("cannot use Readdir on a file")
+}
+
+func (f snapshotFileStub) Stat() (os.FileInfo, error) {
+        return nil, fmt.Errorf("cannot stat")
+}
+
+func (f snapshotFileStub) Sync() error {
+        return nil
+}
+
+func (f snapshotFileStub) Truncate(size int64) error {
+        return fmt.Errorf("cannot write to file in snapshot")
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/module_mgr.go b/vendor/github.com/hashicorp/terraform/configs/configload/module_mgr.go
new file mode 100644
index 0000000..3c410ee
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/module_mgr.go
@@ -0,0 +1,76 @@
+package configload
+
+import (
+        "os"
+        "path/filepath"
+
+        "github.com/hashicorp/terraform/internal/modsdir"
+        "github.com/hashicorp/terraform/registry"
+        "github.com/hashicorp/terraform/svchost/disco"
+        "github.com/spf13/afero"
+)
+
+type moduleMgr struct {
+        FS afero.Afero
+
+        // CanInstall is true for a module manager that can support installation.
+        //
+        // This must be set only if FS is an afero.OsFs, because the installer
+        // (which uses go-getter) is not aware of the virtual filesystem
+        // abstraction and will always write into the "real" filesystem.
+        CanInstall bool
+
+        // Dir is the path where descendent modules are (or will be) installed.
+        Dir string
+
+        // Services is a service discovery client that will be used to find
+        // remote module registry endpoints. This object may be pre-loaded with
+        // cached discovery information.
+        Services *disco.Disco
+
+        // Registry is a client for the module registry protocol, which is used
+        // when a module is requested from a registry source.
+        Registry *registry.Client
+
+        // manifest tracks the currently-installed modules for this manager.
+        //
+        // The loader may read this. Only the installer may write to it, and
+        // after a set of updates are completed the installer must call
+        // writeModuleManifestSnapshot to persist a snapshot of the manifest
+        // to disk for use on subsequent runs.
+        manifest modsdir.Manifest
+}
+
+func (m *moduleMgr) manifestSnapshotPath() string {
+        return filepath.Join(m.Dir, modsdir.ManifestSnapshotFilename)
+}
+
+// readModuleManifestSnapshot loads a manifest snapshot from the filesystem.
+func (m *moduleMgr) readModuleManifestSnapshot() error {
+        r, err := m.FS.Open(m.manifestSnapshotPath())
+        if err != nil {
+                if os.IsNotExist(err) {
+                        // We'll treat a missing file as an empty manifest
+                        m.manifest = make(modsdir.Manifest)
+                        return nil
+                }
+                return err
+        }
+
+        m.manifest, err = modsdir.ReadManifestSnapshot(r)
+        return err
+}
+
+// writeModuleManifestSnapshot writes a snapshot of the current manifest
+// to the filesystem.
+//
+// The caller must guarantee no concurrent modifications of the manifest for
+// the duration of a call to this function, or the behavior is undefined.
+func (m *moduleMgr) writeModuleManifestSnapshot() error {
+        w, err := m.FS.Create(m.manifestSnapshotPath())
+        if err != nil {
+                return err
+        }
+
+        return m.manifest.WriteSnapshot(w)
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/source_addr.go b/vendor/github.com/hashicorp/terraform/configs/configload/source_addr.go
new file mode 100644
index 0000000..594cf64
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/source_addr.go
@@ -0,0 +1,45 @@
+package configload
+
+import (
+        "strings"
+
+        "github.com/hashicorp/go-getter"
+
+        "github.com/hashicorp/terraform/registry/regsrc"
+)
+
+var localSourcePrefixes = []string{
+        "./",
+        "../",
+        ".\\",
+        "..\\",
+}
+
+func isLocalSourceAddr(addr string) bool {
+        for _, prefix := range localSourcePrefixes {
+                if strings.HasPrefix(addr, prefix) {
+                        return true
+                }
+        }
+        return false
+}
+
+func isRegistrySourceAddr(addr string) bool {
+        _, err := regsrc.ParseModuleSource(addr)
+        return err == nil
+}
+
+// splitAddrSubdir splits the given address (which is assumed to be a
+// registry address or go-getter-style address) into a package portion
+// and a sub-directory portion.
+//
+// The package portion defines what should be downloaded and then the
+// sub-directory portion, if present, specifies a sub-directory within
+// the downloaded object (an archive, VCS repository, etc) that contains
+// the module's configuration files.
+//
+// The subDir portion will be returned as empty if no subdir separator
+// ("//") is present in the address.
+func splitAddrSubdir(addr string) (packageAddr, subDir string) {
+        return getter.SourceDirSubdir(addr)
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/testing.go b/vendor/github.com/hashicorp/terraform/configs/configload/testing.go
new file mode 100644
index 0000000..86ca9d1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/testing.go
@@ -0,0 +1,43 @@
+package configload
+
+import (
+        "io/ioutil"
+        "os"
+        "testing"
+)
+
+// NewLoaderForTests is a variant of NewLoader that is intended to be more
+// convenient for unit tests.
+//
+// The loader's modules directory is a separate temporary directory created
+// for each call. Along with the created loader, this function returns a
+// cleanup function that should be called before the test completes in order
+// to remove that temporary directory.
+//
+// In the case of any errors, t.Fatal (or similar) will be called to halt
+// execution of the test, so the calling test does not need to handle errors
+// itself.
+func NewLoaderForTests(t *testing.T) (*Loader, func()) {
+        t.Helper()
+
+        modulesDir, err := ioutil.TempDir("", "tf-configs")
+        if err != nil {
+                t.Fatalf("failed to create temporary modules dir: %s", err)
+                return nil, func() {}
+        }
+
+        cleanup := func() {
+                os.RemoveAll(modulesDir)
+        }
+
+        loader, err := NewLoader(&Config{
+                ModulesDir: modulesDir,
+        })
+        if err != nil {
+                cleanup()
+                t.Fatalf("failed to create config loader: %s", err)
+                return nil, func() {}
+        }
+
+        return loader, cleanup
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/coerce_value.go b/vendor/github.com/hashicorp/terraform/configs/configschema/coerce_value.go
new file mode 100644
index 0000000..e59f58d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/coerce_value.go
@@ -0,0 +1,274 @@
+package configschema
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+)
+
+// CoerceValue attempts to force the given value to conform to the type
+// implied by the receiever, while also applying the same validation and
+// transformation rules that would be applied by the decoder specification
+// returned by method DecoderSpec.
+//
+// This is useful in situations where a configuration must be derived from
+// an already-decoded value. It is always better to decode directly from
+// configuration where possible since then source location information is
+// still available to produce diagnostics, but in special situations this
+// function allows a compatible result to be obtained even if the
+// configuration objects are not available.
+//
+// If the given value cannot be converted to conform to the receiving schema
+// then an error is returned describing one of possibly many problems. This
+// error may be a cty.PathError indicating a position within the nested
+// data structure where the problem applies.
+func (b *Block) CoerceValue(in cty.Value) (cty.Value, error) {
+        var path cty.Path
+        return b.coerceValue(in, path)
+}
+
+func (b *Block) coerceValue(in cty.Value, path cty.Path) (cty.Value, error) {
+        switch {
+        case in.IsNull():
+                return cty.NullVal(b.ImpliedType()), nil
+        case !in.IsKnown():
+                return cty.UnknownVal(b.ImpliedType()), nil
+        }
+
+        ty := in.Type()
+        if !ty.IsObjectType() {
+                return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("an object is required")
+        }
+
+        for name := range ty.AttributeTypes() {
+                if _, defined := b.Attributes[name]; defined {
+                        continue
+                }
+                if _, defined := b.BlockTypes[name]; defined {
+                        continue
+                }
+                return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("unexpected attribute %q", name)
+        }
+
+        attrs := make(map[string]cty.Value)
+
+        for name, attrS := range b.Attributes {
+                var val cty.Value
+                switch {
+                case ty.HasAttribute(name):
+                        val = in.GetAttr(name)
+                case attrS.Computed || attrS.Optional:
+                        val = cty.NullVal(attrS.Type)
+                default:
+                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("attribute %q is required", name)
+                }
+
+                val, err := attrS.coerceValue(val, append(path, cty.GetAttrStep{Name: name}))
+                if err != nil {
+                        return cty.UnknownVal(b.ImpliedType()), err
+                }
+
+                attrs[name] = val
+        }
+        for typeName, blockS := range b.BlockTypes {
+                switch blockS.Nesting {
+
+                case NestingSingle, NestingGroup:
+                        switch {
+                        case ty.HasAttribute(typeName):
+                                var err error
+                                val := in.GetAttr(typeName)
+                                attrs[typeName], err = blockS.coerceValue(val, append(path, cty.GetAttrStep{Name: typeName}))
+                                if err != nil {
+                                        return cty.UnknownVal(b.ImpliedType()), err
+                                }
+                        case blockS.MinItems != 1 && blockS.MaxItems != 1:
+                                if blockS.Nesting == NestingGroup {
+                                        attrs[typeName] = blockS.EmptyValue()
+                                } else {
+                                        attrs[typeName] = cty.NullVal(blockS.ImpliedType())
+                                }
+                        default:
+                                // We use the word "attribute" here because we're talking about
+                                // the cty sense of that word rather than the HCL sense.
+                                return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("attribute %q is required", typeName)
+                        }
+
+                case NestingList:
+                        switch {
+                        case ty.HasAttribute(typeName):
+                                coll := in.GetAttr(typeName)
+
+                                switch {
+                                case coll.IsNull():
+                                        attrs[typeName] = cty.NullVal(cty.List(blockS.ImpliedType()))
+                                        continue
+                                case !coll.IsKnown():
+                                        attrs[typeName] = cty.UnknownVal(cty.List(blockS.ImpliedType()))
+                                        continue
+                                }
+
+                                if !coll.CanIterateElements() {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("must be a list")
+                                }
+                                l := coll.LengthInt()
+                                if l < blockS.MinItems {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("insufficient items for attribute %q; must have at least %d", typeName, blockS.MinItems)
+                                }
+                                if l > blockS.MaxItems && blockS.MaxItems > 0 {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("too many items for attribute %q; cannot have more than %d", typeName, blockS.MaxItems)
+                                }
+                                if l == 0 {
+                                        attrs[typeName] = cty.ListValEmpty(blockS.ImpliedType())
+                                        continue
+                                }
+                                elems := make([]cty.Value, 0, l)
+                                {
+                                        path = append(path, cty.GetAttrStep{Name: typeName})
+                                        for it := coll.ElementIterator(); it.Next(); {
+                                                var err error
+                                                idx, val := it.Element()
+                                                val, err = blockS.coerceValue(val, append(path, cty.IndexStep{Key: idx}))
+                                                if err != nil {
+                                                        return cty.UnknownVal(b.ImpliedType()), err
+                                                }
+                                                elems = append(elems, val)
+                                        }
+                                }
+                                attrs[typeName] = cty.ListVal(elems)
+                        case blockS.MinItems == 0:
+                                attrs[typeName] = cty.ListValEmpty(blockS.ImpliedType())
+                        default:
+                                return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("attribute %q is required", typeName)
+                        }
+
+                case NestingSet:
+                        switch {
+                        case ty.HasAttribute(typeName):
+                                coll := in.GetAttr(typeName)
+
+                                switch {
+                                case coll.IsNull():
+                                        attrs[typeName] = cty.NullVal(cty.Set(blockS.ImpliedType()))
+                                        continue
+                                case !coll.IsKnown():
+                                        attrs[typeName] = cty.UnknownVal(cty.Set(blockS.ImpliedType()))
+                                        continue
+                                }
+
+                                if !coll.CanIterateElements() {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("must be a set")
+                                }
+                                l := coll.LengthInt()
+                                if l < blockS.MinItems {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("insufficient items for attribute %q; must have at least %d", typeName, blockS.MinItems)
+                                }
+                                if l > blockS.MaxItems && blockS.MaxItems > 0 {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("too many items for attribute %q; cannot have more than %d", typeName, blockS.MaxItems)
+                                }
+                                if l == 0 {
+                                        attrs[typeName] = cty.SetValEmpty(blockS.ImpliedType())
+                                        continue
+                                }
+                                elems := make([]cty.Value, 0, l)
+                                {
+                                        path = append(path, cty.GetAttrStep{Name: typeName})
+                                        for it := coll.ElementIterator(); it.Next(); {
+                                                var err error
+                                                idx, val := it.Element()
+                                                val, err = blockS.coerceValue(val, append(path, cty.IndexStep{Key: idx}))
+                                                if err != nil {
+                                                        return cty.UnknownVal(b.ImpliedType()), err
+                                                }
+                                                elems = append(elems, val)
+                                        }
+                                }
+                                attrs[typeName] = cty.SetVal(elems)
+                        case blockS.MinItems == 0:
+                                attrs[typeName] = cty.SetValEmpty(blockS.ImpliedType())
+                        default:
+                                return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("attribute %q is required", typeName)
+                        }
+
+                case NestingMap:
+                        switch {
+                        case ty.HasAttribute(typeName):
+                                coll := in.GetAttr(typeName)
+
+                                switch {
+                                case coll.IsNull():
+                                        attrs[typeName] = cty.NullVal(cty.Map(blockS.ImpliedType()))
+                                        continue
+                                case !coll.IsKnown():
+                                        attrs[typeName] = cty.UnknownVal(cty.Map(blockS.ImpliedType()))
+                                        continue
+                                }
+
+                                if !coll.CanIterateElements() {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("must be a map")
+                                }
+                                l := coll.LengthInt()
+                                if l == 0 {
+                                        attrs[typeName] = cty.MapValEmpty(blockS.ImpliedType())
+                                        continue
+                                }
+                                elems := make(map[string]cty.Value)
+                                {
+                                        path = append(path, cty.GetAttrStep{Name: typeName})
+                                        for it := coll.ElementIterator(); it.Next(); {
+                                                var err error
+                                                key, val := it.Element()
+                                                if key.Type() != cty.String || key.IsNull() || !key.IsKnown() {
+                                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("must be a map")
+                                                }
+                                                val, err = blockS.coerceValue(val, append(path, cty.IndexStep{Key: key}))
+                                                if err != nil {
+                                                        return cty.UnknownVal(b.ImpliedType()), err
+                                                }
+                                                elems[key.AsString()] = val
+                                        }
+                                }
+
+                                // If the attribute values here contain any DynamicPseudoTypes,
+                                // the concrete type must be an object.
+                                useObject := false
+                                switch {
+                                case coll.Type().IsObjectType():
+                                        useObject = true
+                                default:
+                                        // It's possible that we were given a map, and need to coerce it to an object
+                                        ety := coll.Type().ElementType()
+                                        for _, v := range elems {
+                                                if !v.Type().Equals(ety) {
+                                                        useObject = true
+                                                        break
+                                                }
+                                        }
+                                }
+
+                                if useObject {
+                                        attrs[typeName] = cty.ObjectVal(elems)
+                                } else {
+                                        attrs[typeName] = cty.MapVal(elems)
+                                }
+                        default:
+                                attrs[typeName] = cty.MapValEmpty(blockS.ImpliedType())
+                        }
+
+                default:
+                        // should never happen because above is exhaustive
+                        panic(fmt.Errorf("unsupported nesting mode %#v", blockS.Nesting))
+                }
+        }
+
+        return cty.ObjectVal(attrs), nil
+}
+
+func (a *Attribute) coerceValue(in cty.Value, path cty.Path) (cty.Value, error) {
+        val, err := convert.Convert(in, a.Type)
+        if err != nil {
+                return cty.UnknownVal(a.Type), path.NewError(err)
+        }
+        return val, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/decoder_spec.go b/vendor/github.com/hashicorp/terraform/configs/configschema/decoder_spec.go
new file mode 100644
index 0000000..d8f41ea
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/decoder_spec.go
@@ -0,0 +1,117 @@
+package configschema
+
+import (
+        "github.com/hashicorp/hcl2/hcldec"
+)
+
+var mapLabelNames = []string{"key"}
+
+// DecoderSpec returns a hcldec.Spec that can be used to decode a HCL Body
+// using the facilities in the hcldec package.
+//
+// The returned specification is guaranteed to return a value of the same type
+// returned by method ImpliedType, but it may contain null values if any of the
+// block attributes are defined as optional and/or computed respectively.
+func (b *Block) DecoderSpec() hcldec.Spec {
+        ret := hcldec.ObjectSpec{}
+        if b == nil {
+                return ret
+        }
+
+        for name, attrS := range b.Attributes {
+                ret[name] = attrS.decoderSpec(name)
+        }
+
+        for name, blockS := range b.BlockTypes {
+                if _, exists := ret[name]; exists {
+                        // This indicates an invalid schema, since it's not valid to
+                        // define both an attribute and a block type of the same name.
+                        // However, we don't raise this here since it's checked by
+                        // InternalValidate.
+                        continue
+                }
+
+                childSpec := blockS.Block.DecoderSpec()
+
+                switch blockS.Nesting {
+                case NestingSingle, NestingGroup:
+                        ret[name] = &hcldec.BlockSpec{
+                                TypeName: name,
+                                Nested:   childSpec,
+                                Required: blockS.MinItems == 1 && blockS.MaxItems >= 1,
+                        }
+                        if blockS.Nesting == NestingGroup {
+                                ret[name] = &hcldec.DefaultSpec{
+                                        Primary: ret[name],
+                                        Default: &hcldec.LiteralSpec{
+                                                Value: blockS.EmptyValue(),
+                                        },
+                                }
+                        }
+                case NestingList:
+                        // We prefer to use a list where possible, since it makes our
+                        // implied type more complete, but if there are any
+                        // dynamically-typed attributes inside we must use a tuple
+                        // instead, at the expense of our type then not being predictable.
+                        if blockS.Block.ImpliedType().HasDynamicTypes() {
+                                ret[name] = &hcldec.BlockTupleSpec{
+                                        TypeName: name,
+                                        Nested:   childSpec,
+                                        MinItems: blockS.MinItems,
+                                        MaxItems: blockS.MaxItems,
+                                }
+                        } else {
+                                ret[name] = &hcldec.BlockListSpec{
+                                        TypeName: name,
+                                        Nested:   childSpec,
+                                        MinItems: blockS.MinItems,
+                                        MaxItems: blockS.MaxItems,
+                                }
+                        }
+                case NestingSet:
+                        // We forbid dynamically-typed attributes inside NestingSet in
+                        // InternalValidate, so we don't do anything special to handle
+                        // that here. (There is no set analog to tuple and object types,
+                        // because cty's set implementation depends on knowing the static
+                        // type in order to properly compute its internal hashes.)
+                        ret[name] = &hcldec.BlockSetSpec{
+                                TypeName: name,
+                                Nested:   childSpec,
+                                MinItems: blockS.MinItems,
+                                MaxItems: blockS.MaxItems,
+                        }
+                case NestingMap:
+                        // We prefer to use a list where possible, since it makes our
+                        // implied type more complete, but if there are any
+                        // dynamically-typed attributes inside we must use a tuple
+                        // instead, at the expense of our type then not being predictable.
+                        if blockS.Block.ImpliedType().HasDynamicTypes() {
+                                ret[name] = &hcldec.BlockObjectSpec{
+                                        TypeName:   name,
+                                        Nested:     childSpec,
+                                        LabelNames: mapLabelNames,
+                                }
+                        } else {
+                                ret[name] = &hcldec.BlockMapSpec{
+                                        TypeName:   name,
+                                        Nested:     childSpec,
+                                        LabelNames: mapLabelNames,
+                                }
+                        }
+                default:
+                        // Invalid nesting type is just ignored. It's checked by
+                        // InternalValidate.
+                        continue
+                }
+        }
+
+        return ret
+}
+
+func (a *Attribute) decoderSpec(name string) hcldec.Spec {
+        return &hcldec.AttrSpec{
+                Name:     name,
+                Type:     a.Type,
+                Required: a.Required,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/doc.go b/vendor/github.com/hashicorp/terraform/configs/configschema/doc.go
index caf8d73..caf8d73 100644
--- a/vendor/github.com/hashicorp/terraform/config/configschema/doc.go
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/doc.go
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/empty_value.go b/vendor/github.com/hashicorp/terraform/configs/configschema/empty_value.go
new file mode 100644
index 0000000..005da56
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/empty_value.go
@@ -0,0 +1,59 @@
+package configschema
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// EmptyValue returns the "empty value" for the recieving block, which for
+// a block type is a non-null object where all of the attribute values are
+// the empty values of the block's attributes and nested block types.
+//
+// In other words, it returns the value that would be returned if an empty
+// block were decoded against the recieving schema, assuming that no required
+// attribute or block constraints were honored.
+func (b *Block) EmptyValue() cty.Value {
+        vals := make(map[string]cty.Value)
+        for name, attrS := range b.Attributes {
+                vals[name] = attrS.EmptyValue()
+        }
+        for name, blockS := range b.BlockTypes {
+                vals[name] = blockS.EmptyValue()
+        }
+        return cty.ObjectVal(vals)
+}
+
+// EmptyValue returns the "empty value" for the receiving attribute, which is
+// the value that would be returned if there were no definition of the attribute
+// at all, ignoring any required constraint.
+func (a *Attribute) EmptyValue() cty.Value {
+        return cty.NullVal(a.Type)
+}
+
+// EmptyValue returns the "empty value" for when there are zero nested blocks
+// present of the receiving type.
+func (b *NestedBlock) EmptyValue() cty.Value {
+        switch b.Nesting {
+        case NestingSingle:
+                return cty.NullVal(b.Block.ImpliedType())
+        case NestingGroup:
+                return b.Block.EmptyValue()
+        case NestingList:
+                if ty := b.Block.ImpliedType(); ty.HasDynamicTypes() {
+                        return cty.EmptyTupleVal
+                } else {
+                        return cty.ListValEmpty(ty)
+                }
+        case NestingMap:
+                if ty := b.Block.ImpliedType(); ty.HasDynamicTypes() {
+                        return cty.EmptyObjectVal
+                } else {
+                        return cty.MapValEmpty(ty)
+                }
+        case NestingSet:
+                return cty.SetValEmpty(b.Block.ImpliedType())
+        default:
+                // Should never get here because the above is intended to be exhaustive,
+                // but we'll be robust and return a result nonetheless.
+                return cty.NullVal(cty.DynamicPseudoType)
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/implied_type.go b/vendor/github.com/hashicorp/terraform/configs/configschema/implied_type.go
new file mode 100644
index 0000000..c0ee841
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/implied_type.go
@@ -0,0 +1,42 @@
+package configschema
+
+import (
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// ImpliedType returns the cty.Type that would result from decoding a
+// configuration block using the receiving block schema.
+//
+// ImpliedType always returns a result, even if the given schema is
+// inconsistent. Code that creates configschema.Block objects should be
+// tested using the InternalValidate method to detect any inconsistencies
+// that would cause this method to fall back on defaults and assumptions.
+func (b *Block) ImpliedType() cty.Type {
+        if b == nil {
+                return cty.EmptyObject
+        }
+
+        return hcldec.ImpliedType(b.DecoderSpec())
+}
+
+// ContainsSensitive returns true if any of the attributes of the receiving
+// block or any of its descendent blocks are marked as sensitive.
+//
+// Blocks themselves cannot be sensitive as a whole -- sensitivity is a
+// per-attribute idea -- but sometimes we want to include a whole object
+// decoded from a block in some UI output, and that is safe to do only if
+// none of the contained attributes are sensitive.
+func (b *Block) ContainsSensitive() bool {
+        for _, attrS := range b.Attributes {
+                if attrS.Sensitive {
+                        return true
+                }
+        }
+        for _, blockS := range b.BlockTypes {
+                if blockS.ContainsSensitive() {
+                        return true
+                }
+        }
+        return false
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/internal_validate.go b/vendor/github.com/hashicorp/terraform/configs/configschema/internal_validate.go
index 33cbe88..ebf1abb 100644
--- a/vendor/github.com/hashicorp/terraform/config/configschema/internal_validate.go
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/internal_validate.go
@@ -72,10 +72,23 @@ func (b *Block) internalValidate(prefix string, err error) error {
                         case blockS.MinItems < 0 || blockS.MinItems > 1:
                                 err = multierror.Append(err, fmt.Errorf("%s%s: MinItems and MaxItems must be set to either 0 or 1 in NestingSingle mode", prefix, name))
                         }
+                case NestingGroup:
+                        if blockS.MinItems != 0 || blockS.MaxItems != 0 {
+                                err = multierror.Append(err, fmt.Errorf("%s%s: MinItems and MaxItems cannot be used in NestingGroup mode", prefix, name))
+                        }
                 case NestingList, NestingSet:
                         if blockS.MinItems > blockS.MaxItems && blockS.MaxItems != 0 {
                                 err = multierror.Append(err, fmt.Errorf("%s%s: MinItems must be less than or equal to MaxItems in %s mode", prefix, name, blockS.Nesting))
                         }
+                        if blockS.Nesting == NestingSet {
+                                ety := blockS.Block.ImpliedType()
+                                if ety.HasDynamicTypes() {
+                                        // This is not permitted because the HCL (cty) set implementation
+                                        // needs to know the exact type of set elements in order to
+                                        // properly hash them, and so can't support mixed types.
+                                        err = multierror.Append(err, fmt.Errorf("%s%s: NestingSet blocks may not contain attributes of cty.DynamicPseudoType", prefix, name))
+                                }
+                        }
                 case NestingMap:
                         if blockS.MinItems != 0 || blockS.MaxItems != 0 {
                                 err = multierror.Append(err, fmt.Errorf("%s%s: MinItems and MaxItems must both be 0 in NestingMap mode", prefix, name))
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/nestingmode_string.go b/vendor/github.com/hashicorp/terraform/configs/configschema/nestingmode_string.go
new file mode 100644
index 0000000..febe743
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/nestingmode_string.go
@@ -0,0 +1,28 @@
+// Code generated by "stringer -type=NestingMode"; DO NOT EDIT.
+
+package configschema
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[nestingModeInvalid-0]
+        _ = x[NestingSingle-1]
+        _ = x[NestingGroup-2]
+        _ = x[NestingList-3]
+        _ = x[NestingSet-4]
+        _ = x[NestingMap-5]
+}
+
+const _NestingMode_name = "nestingModeInvalidNestingSingleNestingGroupNestingListNestingSetNestingMap"
+
+var _NestingMode_index = [...]uint8{0, 18, 31, 43, 54, 64, 74}
+
+func (i NestingMode) String() string {
+        if i < 0 || i >= NestingMode(len(_NestingMode_index)-1) {
+                return "NestingMode(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+        return _NestingMode_name[_NestingMode_index[i]:_NestingMode_index[i+1]]
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/none_required.go b/vendor/github.com/hashicorp/terraform/configs/configschema/none_required.go
new file mode 100644
index 0000000..0be3b8f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/none_required.go
@@ -0,0 +1,38 @@
+package configschema
+
+// NoneRequired returns a deep copy of the receiver with any required
+// attributes translated to optional.
+func (b *Block) NoneRequired() *Block {
+        ret := &Block{}
+
+        if b.Attributes != nil {
+                ret.Attributes = make(map[string]*Attribute, len(b.Attributes))
+        }
+        for name, attrS := range b.Attributes {
+                ret.Attributes[name] = attrS.forceOptional()
+        }
+
+        if b.BlockTypes != nil {
+                ret.BlockTypes = make(map[string]*NestedBlock, len(b.BlockTypes))
+        }
+        for name, blockS := range b.BlockTypes {
+                ret.BlockTypes[name] = blockS.noneRequired()
+        }
+
+        return ret
+}
+
+func (b *NestedBlock) noneRequired() *NestedBlock {
+        ret := *b
+        ret.Block = *(ret.Block.NoneRequired())
+        ret.MinItems = 0
+        ret.MaxItems = 0
+        return &ret
+}
+
+func (a *Attribute) forceOptional() *Attribute {
+        ret := *a
+        ret.Optional = true
+        ret.Required = false
+        return &ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/schema.go b/vendor/github.com/hashicorp/terraform/configs/configschema/schema.go
index 9a8ee55..5a67334 100644
--- a/vendor/github.com/hashicorp/terraform/config/configschema/schema.go
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/schema.go
@@ -28,6 +28,12 @@ type Attribute struct {
         // Type is a type specification that the attribute's value must conform to.
         Type cty.Type
 
+        // Description is an English-language description of the purpose and
+        // usage of the attribute. A description should be concise and use only
+        // one or two sentences, leaving full definition to longer-form
+        // documentation defined elsewhere.
+        Description string
+
         // Required, if set to true, specifies that an omitted or null value is
         // not permitted.
         Required bool
@@ -87,6 +93,23 @@ const (
         // provided directly as an object value.
         NestingSingle
 
+        // NestingGroup is similar to NestingSingle in that it calls for only a
+        // single instance of a given block type with no labels, but it additonally
+        // guarantees that its result will never be null, even if the block is
+        // absent, and instead the nested attributes and blocks will be treated
+        // as absent in that case. (Any required attributes or blocks within the
+        // nested block are not enforced unless the block is explicitly present
+        // in the configuration, so they are all effectively optional when the
+        // block is not present.)
+        //
+        // This is useful for the situation where a remote API has a feature that
+        // is always enabled but has a group of settings related to that feature
+        // that themselves have default values. By using NestingGroup instead of
+        // NestingSingle in that case, generated plans will show the block as
+        // present even when not present in configuration, thus allowing any
+        // default values within to be displayed to the user.
+        NestingGroup
+
         // NestingList indicates that multiple blocks of the given type are
         // permitted, with no labels, and that their corresponding objects should
         // be provided in a list.
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/validate_traversal.go b/vendor/github.com/hashicorp/terraform/configs/configschema/validate_traversal.go
new file mode 100644
index 0000000..a41e930
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/validate_traversal.go
@@ -0,0 +1,173 @@
+package configschema
+
+import (
+        "fmt"
+        "sort"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/helper/didyoumean"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// StaticValidateTraversal checks whether the given traversal (which must be
+// relative) refers to a construct in the receiving schema, returning error
+// diagnostics if any problems are found.
+//
+// This method is "optimistic" in that it will not return errors for possible
+// problems that cannot be detected statically. It is possible that an
+// traversal which passed static validation will still fail when evaluated.
+func (b *Block) StaticValidateTraversal(traversal hcl.Traversal) tfdiags.Diagnostics {
+        if !traversal.IsRelative() {
+                panic("StaticValidateTraversal on absolute traversal")
+        }
+        if len(traversal) == 0 {
+                return nil
+        }
+
+        var diags tfdiags.Diagnostics
+
+        next := traversal[0]
+        after := traversal[1:]
+
+        var name string
+        switch step := next.(type) {
+        case hcl.TraverseAttr:
+                name = step.Name
+        case hcl.TraverseIndex:
+                // No other traversal step types are allowed directly at a block.
+                // If it looks like the user was trying to use index syntax to
+                // access an attribute then we'll produce a specialized message.
+                key := step.Key
+                if key.Type() == cty.String && key.IsKnown() && !key.IsNull() {
+                        maybeName := key.AsString()
+                        if hclsyntax.ValidIdentifier(maybeName) {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  `Invalid index operation`,
+                                        Detail:   fmt.Sprintf(`Only attribute access is allowed here. Did you mean to access attribute %q using the dot operator?`, maybeName),
+                                        Subject:  &step.SrcRange,
+                                })
+                                return diags
+                        }
+                }
+                // If it looks like some other kind of index then we'll use a generic error.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid index operation`,
+                        Detail:   `Only attribute access is allowed here, using the dot operator.`,
+                        Subject:  &step.SrcRange,
+                })
+                return diags
+        default:
+                // No other traversal types should appear in a normal valid traversal,
+                // but we'll handle this with a generic error anyway to be robust.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid operation`,
+                        Detail:   `Only attribute access is allowed here, using the dot operator.`,
+                        Subject:  next.SourceRange().Ptr(),
+                })
+                return diags
+        }
+
+        if attrS, exists := b.Attributes[name]; exists {
+                // For attribute validation we will just apply the rest of the
+                // traversal to an unknown value of the attribute type and pass
+                // through HCL's own errors, since we don't want to replicate all of
+                // HCL's type checking rules here.
+                val := cty.UnknownVal(attrS.Type)
+                _, hclDiags := after.TraverseRel(val)
+                diags = diags.Append(hclDiags)
+                return diags
+        }
+
+        if blockS, exists := b.BlockTypes[name]; exists {
+                moreDiags := blockS.staticValidateTraversal(name, after)
+                diags = diags.Append(moreDiags)
+                return diags
+        }
+
+        // If we get here then the name isn't valid at all. We'll collect up
+        // all of the names that _are_ valid to use as suggestions.
+        var suggestions []string
+        for name := range b.Attributes {
+                suggestions = append(suggestions, name)
+        }
+        for name := range b.BlockTypes {
+                suggestions = append(suggestions, name)
+        }
+        sort.Strings(suggestions)
+        suggestion := didyoumean.NameSuggestion(name, suggestions)
+        if suggestion != "" {
+                suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+        }
+        diags = diags.Append(&hcl.Diagnostic{
+                Severity: hcl.DiagError,
+                Summary:  `Unsupported attribute`,
+                Detail:   fmt.Sprintf(`This object has no argument, nested block, or exported attribute named %q.%s`, name, suggestion),
+                Subject:  next.SourceRange().Ptr(),
+        })
+
+        return diags
+}
+
+func (b *NestedBlock) staticValidateTraversal(typeName string, traversal hcl.Traversal) tfdiags.Diagnostics {
+        if b.Nesting == NestingSingle || b.Nesting == NestingGroup {
+                // Single blocks are easy: just pass right through.
+                return b.Block.StaticValidateTraversal(traversal)
+        }
+
+        if len(traversal) == 0 {
+                // It's always valid to access a nested block's attribute directly.
+                return nil
+        }
+
+        var diags tfdiags.Diagnostics
+        next := traversal[0]
+        after := traversal[1:]
+
+        switch b.Nesting {
+
+        case NestingSet:
+                // Can't traverse into a set at all, since it does not have any keys
+                // to index with.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Cannot index a set value`,
+                        Detail:   fmt.Sprintf(`Block type %q is represented by a set of objects, and set elements do not have addressable keys. To find elements matching specific criteria, use a "for" expression with an "if" clause.`, typeName),
+                        Subject:  next.SourceRange().Ptr(),
+                })
+                return diags
+
+        case NestingList:
+                if _, ok := next.(hcl.TraverseIndex); ok {
+                        moreDiags := b.Block.StaticValidateTraversal(after)
+                        diags = diags.Append(moreDiags)
+                } else {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  `Invalid operation`,
+                                Detail:   fmt.Sprintf(`Block type %q is represented by a list of objects, so it must be indexed using a numeric key, like .%s[0].`, typeName, typeName),
+                                Subject:  next.SourceRange().Ptr(),
+                        })
+                }
+                return diags
+
+        case NestingMap:
+                // Both attribute and index steps are valid for maps, so we'll just
+                // pass through here and let normal evaluation catch an
+                // incorrectly-typed index key later, if present.
+                moreDiags := b.Block.StaticValidateTraversal(after)
+                diags = diags.Append(moreDiags)
+                return diags
+
+        default:
+                // Invalid nesting type is just ignored. It's checked by
+                // InternalValidate. (Note that we handled NestingSingle separately
+                // back at the start of this function.)
+                return nil
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/depends_on.go b/vendor/github.com/hashicorp/terraform/configs/depends_on.go
new file mode 100644
index 0000000..b198476
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/depends_on.go
@@ -0,0 +1,23 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+func decodeDependsOn(attr *hcl.Attribute) ([]hcl.Traversal, hcl.Diagnostics) {
+        var ret []hcl.Traversal
+        exprs, diags := hcl.ExprList(attr.Expr)
+
+        for _, expr := range exprs {
+                expr, shimDiags := shimTraversalInString(expr, false)
+                diags = append(diags, shimDiags...)
+
+                traversal, travDiags := hcl.AbsTraversalForExpr(expr)
+                diags = append(diags, travDiags...)
+                if len(traversal) != 0 {
+                        ret = append(ret, traversal)
+                }
+        }
+
+        return ret, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/doc.go b/vendor/github.com/hashicorp/terraform/configs/doc.go
new file mode 100644
index 0000000..f01eb79
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/doc.go
@@ -0,0 +1,19 @@
+// Package configs contains types that represent Terraform configurations and
+// the different elements thereof.
+//
+// The functionality in this package can be used for some static analyses of
+// Terraform configurations, but this package generally exposes representations
+// of the configuration source code rather than the result of evaluating these
+// objects. The sibling package "lang" deals with evaluation of structures
+// and expressions in the configuration.
+//
+// Due to its close relationship with HCL, this package makes frequent use
+// of types from the HCL API, including raw HCL diagnostic messages. Such
+// diagnostics can be converted into Terraform-flavored diagnostics, if needed,
+// using functions in the sibling package tfdiags.
+//
+// The Parser type is the main entry-point into this package. The LoadConfigDir
+// method can be used to load a single module directory, and then a full
+// configuration (including any descendent modules) can be produced using
+// the top-level BuildConfig method.
+package configs
diff --git a/vendor/github.com/hashicorp/terraform/configs/module.go b/vendor/github.com/hashicorp/terraform/configs/module.go
new file mode 100644
index 0000000..250f9d3
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/module.go
@@ -0,0 +1,404 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Module is a container for a set of configuration constructs that are
+// evaluated within a common namespace.
+type Module struct {
+        // SourceDir is the filesystem directory that the module was loaded from.
+        //
+        // This is populated automatically only for configurations loaded with
+        // LoadConfigDir. If the parser is using a virtual filesystem then the
+        // path here will be in terms of that virtual filesystem.
+
+        // Any other caller that constructs a module directly with NewModule may
+        // assign a suitable value to this attribute before using it for other
+        // purposes. It should be treated as immutable by all consumers of Module
+        // values.
+        SourceDir string
+
+        CoreVersionConstraints []VersionConstraint
+
+        Backend              *Backend
+        ProviderConfigs      map[string]*Provider
+        ProviderRequirements map[string][]VersionConstraint
+
+        Variables map[string]*Variable
+        Locals    map[string]*Local
+        Outputs   map[string]*Output
+
+        ModuleCalls map[string]*ModuleCall
+
+        ManagedResources map[string]*Resource
+        DataResources    map[string]*Resource
+}
+
+// File describes the contents of a single configuration file.
+//
+// Individual files are not usually used alone, but rather combined together
+// with other files (conventionally, those in the same directory) to produce
+// a *Module, using NewModule.
+//
+// At the level of an individual file we represent directly the structural
+// elements present in the file, without any attempt to detect conflicting
+// declarations. A File object can therefore be used for some basic static
+// analysis of individual elements, but must be built into a Module to detect
+// duplicate declarations.
+type File struct {
+        CoreVersionConstraints []VersionConstraint
+
+        Backends             []*Backend
+        ProviderConfigs      []*Provider
+        ProviderRequirements []*ProviderRequirement
+
+        Variables []*Variable
+        Locals    []*Local
+        Outputs   []*Output
+
+        ModuleCalls []*ModuleCall
+
+        ManagedResources []*Resource
+        DataResources    []*Resource
+}
+
+// NewModule takes a list of primary files and a list of override files and
+// produces a *Module by combining the files together.
+//
+// If there are any conflicting declarations in the given files -- for example,
+// if the same variable name is defined twice -- then the resulting module
+// will be incomplete and error diagnostics will be returned. Careful static
+// analysis of the returned Module is still possible in this case, but the
+// module will probably not be semantically valid.
+func NewModule(primaryFiles, overrideFiles []*File) (*Module, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        mod := &Module{
+                ProviderConfigs:      map[string]*Provider{},
+                ProviderRequirements: map[string][]VersionConstraint{},
+                Variables:            map[string]*Variable{},
+                Locals:               map[string]*Local{},
+                Outputs:              map[string]*Output{},
+                ModuleCalls:          map[string]*ModuleCall{},
+                ManagedResources:     map[string]*Resource{},
+                DataResources:        map[string]*Resource{},
+        }
+
+        for _, file := range primaryFiles {
+                fileDiags := mod.appendFile(file)
+                diags = append(diags, fileDiags...)
+        }
+
+        for _, file := range overrideFiles {
+                fileDiags := mod.mergeFile(file)
+                diags = append(diags, fileDiags...)
+        }
+
+        return mod, diags
+}
+
+// ResourceByAddr returns the configuration for the resource with the given
+// address, or nil if there is no such resource.
+func (m *Module) ResourceByAddr(addr addrs.Resource) *Resource {
+        key := addr.String()
+        switch addr.Mode {
+        case addrs.ManagedResourceMode:
+                return m.ManagedResources[key]
+        case addrs.DataResourceMode:
+                return m.DataResources[key]
+        default:
+                return nil
+        }
+}
+
+func (m *Module) appendFile(file *File) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        for _, constraint := range file.CoreVersionConstraints {
+                // If there are any conflicting requirements then we'll catch them
+                // when we actually check these constraints.
+                m.CoreVersionConstraints = append(m.CoreVersionConstraints, constraint)
+        }
+
+        for _, b := range file.Backends {
+                if m.Backend != nil {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Duplicate backend configuration",
+                                Detail:   fmt.Sprintf("A module may have only one backend configuration. The backend was previously configured at %s.", m.Backend.DeclRange),
+                                Subject:  &b.DeclRange,
+                        })
+                        continue
+                }
+                m.Backend = b
+        }
+
+        for _, pc := range file.ProviderConfigs {
+                key := pc.moduleUniqueKey()
+                if existing, exists := m.ProviderConfigs[key]; exists {
+                        if existing.Alias == "" {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Duplicate provider configuration",
+                                        Detail:   fmt.Sprintf("A default (non-aliased) provider configuration for %q was already given at %s. If multiple configurations are required, set the \"alias\" argument for alternative configurations.", existing.Name, existing.DeclRange),
+                                        Subject:  &pc.DeclRange,
+                                })
+                        } else {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Duplicate provider configuration",
+                                        Detail:   fmt.Sprintf("A provider configuration for %q with alias %q was already given at %s. Each configuration for the same provider must have a distinct alias.", existing.Name, existing.Alias, existing.DeclRange),
+                                        Subject:  &pc.DeclRange,
+                                })
+                        }
+                        continue
+                }
+                m.ProviderConfigs[key] = pc
+        }
+
+        for _, reqd := range file.ProviderRequirements {
+                m.ProviderRequirements[reqd.Name] = append(m.ProviderRequirements[reqd.Name], reqd.Requirement)
+        }
+
+        for _, v := range file.Variables {
+                if existing, exists := m.Variables[v.Name]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Duplicate variable declaration",
+                                Detail:   fmt.Sprintf("A variable named %q was already declared at %s. Variable names must be unique within a module.", existing.Name, existing.DeclRange),
+                                Subject:  &v.DeclRange,
+                        })
+                }
+                m.Variables[v.Name] = v
+        }
+
+        for _, l := range file.Locals {
+                if existing, exists := m.Locals[l.Name]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Duplicate local value definition",
+                                Detail:   fmt.Sprintf("A local value named %q was already defined at %s. Local value names must be unique within a module.", existing.Name, existing.DeclRange),
+                                Subject:  &l.DeclRange,
+                        })
+                }
+                m.Locals[l.Name] = l
+        }
+
+        for _, o := range file.Outputs {
+                if existing, exists := m.Outputs[o.Name]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Duplicate output definition",
+                                Detail:   fmt.Sprintf("An output named %q was already defined at %s. Output names must be unique within a module.", existing.Name, existing.DeclRange),
+                                Subject:  &o.DeclRange,
+                        })
+                }
+                m.Outputs[o.Name] = o
+        }
+
+        for _, mc := range file.ModuleCalls {
+                if existing, exists := m.ModuleCalls[mc.Name]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Duplicate module call",
+                                Detail:   fmt.Sprintf("An module call named %q was already defined at %s. Module calls must have unique names within a module.", existing.Name, existing.DeclRange),
+                                Subject:  &mc.DeclRange,
+                        })
+                }
+                m.ModuleCalls[mc.Name] = mc
+        }
+
+        for _, r := range file.ManagedResources {
+                key := r.moduleUniqueKey()
+                if existing, exists := m.ManagedResources[key]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Duplicate resource %q configuration", existing.Type),
+                                Detail:   fmt.Sprintf("A %s resource named %q was already declared at %s. Resource names must be unique per type in each module.", existing.Type, existing.Name, existing.DeclRange),
+                                Subject:  &r.DeclRange,
+                        })
+                        continue
+                }
+                m.ManagedResources[key] = r
+        }
+
+        for _, r := range file.DataResources {
+                key := r.moduleUniqueKey()
+                if existing, exists := m.DataResources[key]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Duplicate data %q configuration", existing.Type),
+                                Detail:   fmt.Sprintf("A %s data resource named %q was already declared at %s. Resource names must be unique per type in each module.", existing.Type, existing.Name, existing.DeclRange),
+                                Subject:  &r.DeclRange,
+                        })
+                        continue
+                }
+                m.DataResources[key] = r
+        }
+
+        return diags
+}
+
+func (m *Module) mergeFile(file *File) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        if len(file.CoreVersionConstraints) != 0 {
+                // This is a bit of a strange case for overriding since we normally
+                // would union together across multiple files anyway, but we'll
+                // allow it and have each override file clobber any existing list.
+                m.CoreVersionConstraints = nil
+                for _, constraint := range file.CoreVersionConstraints {
+                        m.CoreVersionConstraints = append(m.CoreVersionConstraints, constraint)
+                }
+        }
+
+        if len(file.Backends) != 0 {
+                switch len(file.Backends) {
+                case 1:
+                        m.Backend = file.Backends[0]
+                default:
+                        // An override file with multiple backends is still invalid, even
+                        // though it can override backends from _other_ files.
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Duplicate backend configuration",
+                                Detail:   fmt.Sprintf("Each override file may have only one backend configuration. A backend was previously configured at %s.", file.Backends[0].DeclRange),
+                                Subject:  &file.Backends[1].DeclRange,
+                        })
+                }
+        }
+
+        for _, pc := range file.ProviderConfigs {
+                key := pc.moduleUniqueKey()
+                existing, exists := m.ProviderConfigs[key]
+                if pc.Alias == "" {
+                        // We allow overriding a non-existing _default_ provider configuration
+                        // because the user model is that an absent provider configuration
+                        // implies an empty provider configuration, which is what the user
+                        // is therefore overriding here.
+                        if exists {
+                                mergeDiags := existing.merge(pc)
+                                diags = append(diags, mergeDiags...)
+                        } else {
+                                m.ProviderConfigs[key] = pc
+                        }
+                } else {
+                        // For aliased providers, there must be a base configuration to
+                        // override. This allows us to detect and report alias typos
+                        // that might otherwise cause the override to not apply.
+                        if !exists {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Missing base provider configuration for override",
+                                        Detail:   fmt.Sprintf("There is no %s provider configuration with the alias %q. An override file can only override an aliased provider configuration that was already defined in a primary configuration file.", pc.Name, pc.Alias),
+                                        Subject:  &pc.DeclRange,
+                                })
+                                continue
+                        }
+                        mergeDiags := existing.merge(pc)
+                        diags = append(diags, mergeDiags...)
+                }
+        }
+
+        if len(file.ProviderRequirements) != 0 {
+                mergeProviderVersionConstraints(m.ProviderRequirements, file.ProviderRequirements)
+        }
+
+        for _, v := range file.Variables {
+                existing, exists := m.Variables[v.Name]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing base variable declaration to override",
+                                Detail:   fmt.Sprintf("There is no variable named %q. An override file can only override a variable that was already declared in a primary configuration file.", v.Name),
+                                Subject:  &v.DeclRange,
+                        })
+                        continue
+                }
+                mergeDiags := existing.merge(v)
+                diags = append(diags, mergeDiags...)
+        }
+
+        for _, l := range file.Locals {
+                existing, exists := m.Locals[l.Name]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing base local value definition to override",
+                                Detail:   fmt.Sprintf("There is no local value named %q. An override file can only override a local value that was already defined in a primary configuration file.", l.Name),
+                                Subject:  &l.DeclRange,
+                        })
+                        continue
+                }
+                mergeDiags := existing.merge(l)
+                diags = append(diags, mergeDiags...)
+        }
+
+        for _, o := range file.Outputs {
+                existing, exists := m.Outputs[o.Name]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing base output definition to override",
+                                Detail:   fmt.Sprintf("There is no output named %q. An override file can only override an output that was already defined in a primary configuration file.", o.Name),
+                                Subject:  &o.DeclRange,
+                        })
+                        continue
+                }
+                mergeDiags := existing.merge(o)
+                diags = append(diags, mergeDiags...)
+        }
+
+        for _, mc := range file.ModuleCalls {
+                existing, exists := m.ModuleCalls[mc.Name]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing module call to override",
+                                Detail:   fmt.Sprintf("There is no module call named %q. An override file can only override a module call that was defined in a primary configuration file.", mc.Name),
+                                Subject:  &mc.DeclRange,
+                        })
+                        continue
+                }
+                mergeDiags := existing.merge(mc)
+                diags = append(diags, mergeDiags...)
+        }
+
+        for _, r := range file.ManagedResources {
+                key := r.moduleUniqueKey()
+                existing, exists := m.ManagedResources[key]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing resource to override",
+                                Detail:   fmt.Sprintf("There is no %s resource named %q. An override file can only override a resource block defined in a primary configuration file.", r.Type, r.Name),
+                                Subject:  &r.DeclRange,
+                        })
+                        continue
+                }
+                mergeDiags := existing.merge(r)
+                diags = append(diags, mergeDiags...)
+        }
+
+        for _, r := range file.DataResources {
+                key := r.moduleUniqueKey()
+                existing, exists := m.DataResources[key]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing data resource to override",
+                                Detail:   fmt.Sprintf("There is no %s data resource named %q. An override file can only override a data block defined in a primary configuration file.", r.Type, r.Name),
+                                Subject:  &r.DeclRange,
+                        })
+                        continue
+                }
+                mergeDiags := existing.merge(r)
+                diags = append(diags, mergeDiags...)
+        }
+
+        return diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/module_call.go b/vendor/github.com/hashicorp/terraform/configs/module_call.go
new file mode 100644
index 0000000..8c3ba67
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/module_call.go
@@ -0,0 +1,188 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/gohcl"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+)
+
+// ModuleCall represents a "module" block in a module or file.
+type ModuleCall struct {
+        Name string
+
+        SourceAddr      string
+        SourceAddrRange hcl.Range
+        SourceSet       bool
+
+        Config hcl.Body
+
+        Version VersionConstraint
+
+        Count   hcl.Expression
+        ForEach hcl.Expression
+
+        Providers []PassedProviderConfig
+
+        DependsOn []hcl.Traversal
+
+        DeclRange hcl.Range
+}
+
+func decodeModuleBlock(block *hcl.Block, override bool) (*ModuleCall, hcl.Diagnostics) {
+        mc := &ModuleCall{
+                Name:      block.Labels[0],
+                DeclRange: block.DefRange,
+        }
+
+        schema := moduleBlockSchema
+        if override {
+                schema = schemaForOverrides(schema)
+        }
+
+        content, remain, diags := block.Body.PartialContent(schema)
+        mc.Config = remain
+
+        if !hclsyntax.ValidIdentifier(mc.Name) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid module instance name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[0],
+                })
+        }
+
+        if attr, exists := content.Attributes["source"]; exists {
+                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &mc.SourceAddr)
+                diags = append(diags, valDiags...)
+                mc.SourceAddrRange = attr.Expr.Range()
+                mc.SourceSet = true
+        }
+
+        if attr, exists := content.Attributes["version"]; exists {
+                var versionDiags hcl.Diagnostics
+                mc.Version, versionDiags = decodeVersionConstraint(attr)
+                diags = append(diags, versionDiags...)
+        }
+
+        if attr, exists := content.Attributes["count"]; exists {
+                mc.Count = attr.Expr
+
+                // We currently parse this, but don't yet do anything with it.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved argument name in module block",
+                        Detail:   fmt.Sprintf("The name %q is reserved for use in a future version of Terraform.", attr.Name),
+                        Subject:  &attr.NameRange,
+                })
+        }
+
+        if attr, exists := content.Attributes["for_each"]; exists {
+                mc.ForEach = attr.Expr
+
+                // We currently parse this, but don't yet do anything with it.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved argument name in module block",
+                        Detail:   fmt.Sprintf("The name %q is reserved for use in a future version of Terraform.", attr.Name),
+                        Subject:  &attr.NameRange,
+                })
+        }
+
+        if attr, exists := content.Attributes["depends_on"]; exists {
+                deps, depsDiags := decodeDependsOn(attr)
+                diags = append(diags, depsDiags...)
+                mc.DependsOn = append(mc.DependsOn, deps...)
+
+                // We currently parse this, but don't yet do anything with it.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved argument name in module block",
+                        Detail:   fmt.Sprintf("The name %q is reserved for use in a future version of Terraform.", attr.Name),
+                        Subject:  &attr.NameRange,
+                })
+        }
+
+        if attr, exists := content.Attributes["providers"]; exists {
+                seen := make(map[string]hcl.Range)
+                pairs, pDiags := hcl.ExprMap(attr.Expr)
+                diags = append(diags, pDiags...)
+                for _, pair := range pairs {
+                        key, keyDiags := decodeProviderConfigRef(pair.Key, "providers")
+                        diags = append(diags, keyDiags...)
+                        value, valueDiags := decodeProviderConfigRef(pair.Value, "providers")
+                        diags = append(diags, valueDiags...)
+                        if keyDiags.HasErrors() || valueDiags.HasErrors() {
+                                continue
+                        }
+
+                        matchKey := key.String()
+                        if prev, exists := seen[matchKey]; exists {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Duplicate provider address",
+                                        Detail:   fmt.Sprintf("A provider configuration was already passed to %s at %s. Each child provider configuration can be assigned only once.", matchKey, prev),
+                                        Subject:  pair.Value.Range().Ptr(),
+                                })
+                                continue
+                        }
+
+                        rng := hcl.RangeBetween(pair.Key.Range(), pair.Value.Range())
+                        seen[matchKey] = rng
+                        mc.Providers = append(mc.Providers, PassedProviderConfig{
+                                InChild:  key,
+                                InParent: value,
+                        })
+                }
+        }
+
+        // Reserved block types (all of them)
+        for _, block := range content.Blocks {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved block type name in module block",
+                        Detail:   fmt.Sprintf("The block type name %q is reserved for use by Terraform in a future version.", block.Type),
+                        Subject:  &block.TypeRange,
+                })
+        }
+
+        return mc, diags
+}
+
+// PassedProviderConfig represents a provider config explicitly passed down to
+// a child module, possibly giving it a new local address in the process.
+type PassedProviderConfig struct {
+        InChild  *ProviderConfigRef
+        InParent *ProviderConfigRef
+}
+
+var moduleBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name:     "source",
+                        Required: true,
+                },
+                {
+                        Name: "version",
+                },
+                {
+                        Name: "count",
+                },
+                {
+                        Name: "for_each",
+                },
+                {
+                        Name: "depends_on",
+                },
+                {
+                        Name: "providers",
+                },
+        },
+        Blocks: []hcl.BlockHeaderSchema{
+                // These are all reserved for future use.
+                {Type: "lifecycle"},
+                {Type: "locals"},
+                {Type: "provider", LabelNames: []string{"type"}},
+        },
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/module_merge.go b/vendor/github.com/hashicorp/terraform/configs/module_merge.go
new file mode 100644
index 0000000..12614c1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/module_merge.go
@@ -0,0 +1,247 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+)
+
+// The methods in this file are used by Module.mergeFile to apply overrides
+// to our different configuration elements. These methods all follow the
+// pattern of mutating the receiver to incorporate settings from the parameter,
+// returning error diagnostics if any aspect of the parameter cannot be merged
+// into the receiver for some reason.
+//
+// User expectation is that anything _explicitly_ set in the given object
+// should take precedence over the corresponding settings in the receiver,
+// but that anything omitted in the given object should be left unchanged.
+// In some cases it may be reasonable to do a "deep merge" of certain nested
+// features, if it is possible to unambiguously correlate the nested elements
+// and their behaviors are orthogonal to each other.
+
+func (p *Provider) merge(op *Provider) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        if op.Version.Required != nil {
+                p.Version = op.Version
+        }
+
+        p.Config = MergeBodies(p.Config, op.Config)
+
+        return diags
+}
+
+func mergeProviderVersionConstraints(recv map[string][]VersionConstraint, ovrd []*ProviderRequirement) {
+        // Any provider name that's mentioned in the override gets nilled out in
+        // our map so that we'll rebuild it below. Any provider not mentioned is
+        // left unchanged.
+        for _, reqd := range ovrd {
+                delete(recv, reqd.Name)
+        }
+        for _, reqd := range ovrd {
+                recv[reqd.Name] = append(recv[reqd.Name], reqd.Requirement)
+        }
+}
+
+func (v *Variable) merge(ov *Variable) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        if ov.DescriptionSet {
+                v.Description = ov.Description
+                v.DescriptionSet = ov.DescriptionSet
+        }
+        if ov.Default != cty.NilVal {
+                v.Default = ov.Default
+        }
+        if ov.Type != cty.NilType {
+                v.Type = ov.Type
+        }
+        if ov.ParsingMode != 0 {
+                v.ParsingMode = ov.ParsingMode
+        }
+
+        // If the override file overrode type without default or vice-versa then
+        // it may have created an invalid situation, which we'll catch now by
+        // attempting to re-convert the value.
+        //
+        // Note that here we may be re-converting an already-converted base value
+        // from the base config. This will be a no-op if the type was not changed,
+        // but in particular might be user-observable in the edge case where the
+        // literal value in config could've been converted to the overridden type
+        // constraint but the converted value cannot. In practice, this situation
+        // should be rare since most of our conversions are interchangable.
+        if v.Default != cty.NilVal {
+                val, err := convert.Convert(v.Default, v.Type)
+                if err != nil {
+                        // What exactly we'll say in the error message here depends on whether
+                        // it was Default or Type that was overridden here.
+                        switch {
+                        case ov.Type != cty.NilType && ov.Default == cty.NilVal:
+                                // If only the type was overridden
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid default value for variable",
+                                        Detail:   fmt.Sprintf("Overriding this variable's type constraint has made its default value invalid: %s.", err),
+                                        Subject:  &ov.DeclRange,
+                                })
+                        case ov.Type == cty.NilType && ov.Default != cty.NilVal:
+                                // Only the default was overridden
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid default value for variable",
+                                        Detail:   fmt.Sprintf("The overridden default value for this variable is not compatible with the variable's type constraint: %s.", err),
+                                        Subject:  &ov.DeclRange,
+                                })
+                        default:
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid default value for variable",
+                                        Detail:   fmt.Sprintf("This variable's default value is not compatible with its type constraint: %s.", err),
+                                        Subject:  &ov.DeclRange,
+                                })
+                        }
+                } else {
+                        v.Default = val
+                }
+        }
+
+        return diags
+}
+
+func (l *Local) merge(ol *Local) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        // Since a local is just a single expression in configuration, the
+        // override definition entirely replaces the base definition, including
+        // the source range so that we'll send the user to the right place if
+        // there is an error.
+        l.Expr = ol.Expr
+        l.DeclRange = ol.DeclRange
+
+        return diags
+}
+
+func (o *Output) merge(oo *Output) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        if oo.Description != "" {
+                o.Description = oo.Description
+        }
+        if oo.Expr != nil {
+                o.Expr = oo.Expr
+        }
+        if oo.SensitiveSet {
+                o.Sensitive = oo.Sensitive
+                o.SensitiveSet = oo.SensitiveSet
+        }
+
+        // We don't allow depends_on to be overridden because that is likely to
+        // cause confusing misbehavior.
+        if len(oo.DependsOn) != 0 {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Unsupported override",
+                        Detail:   "The depends_on argument may not be overridden.",
+                        Subject:  oo.DependsOn[0].SourceRange().Ptr(), // the first item is the closest range we have
+                })
+        }
+
+        return diags
+}
+
+func (mc *ModuleCall) merge(omc *ModuleCall) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        if omc.SourceSet {
+                mc.SourceAddr = omc.SourceAddr
+                mc.SourceAddrRange = omc.SourceAddrRange
+                mc.SourceSet = omc.SourceSet
+        }
+
+        if omc.Count != nil {
+                mc.Count = omc.Count
+        }
+
+        if omc.ForEach != nil {
+                mc.ForEach = omc.ForEach
+        }
+
+        if len(omc.Version.Required) != 0 {
+                mc.Version = omc.Version
+        }
+
+        mc.Config = MergeBodies(mc.Config, omc.Config)
+
+        // We don't allow depends_on to be overridden because that is likely to
+        // cause confusing misbehavior.
+        if len(mc.DependsOn) != 0 {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Unsupported override",
+                        Detail:   "The depends_on argument may not be overridden.",
+                        Subject:  mc.DependsOn[0].SourceRange().Ptr(), // the first item is the closest range we have
+                })
+        }
+
+        return diags
+}
+
+func (r *Resource) merge(or *Resource) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        if r.Mode != or.Mode {
+                // This is always a programming error, since managed and data resources
+                // are kept in separate maps in the configuration structures.
+                panic(fmt.Errorf("can't merge %s into %s", or.Mode, r.Mode))
+        }
+
+        if or.Count != nil {
+                r.Count = or.Count
+        }
+        if or.ForEach != nil {
+                r.ForEach = or.ForEach
+        }
+        if or.ProviderConfigRef != nil {
+                r.ProviderConfigRef = or.ProviderConfigRef
+        }
+        if r.Mode == addrs.ManagedResourceMode {
+                // or.Managed is always non-nil for managed resource mode
+
+                if or.Managed.Connection != nil {
+                        r.Managed.Connection = or.Managed.Connection
+                }
+                if or.Managed.CreateBeforeDestroySet {
+                        r.Managed.CreateBeforeDestroy = or.Managed.CreateBeforeDestroy
+                        r.Managed.CreateBeforeDestroySet = or.Managed.CreateBeforeDestroySet
+                }
+                if len(or.Managed.IgnoreChanges) != 0 {
+                        r.Managed.IgnoreChanges = or.Managed.IgnoreChanges
+                }
+                if or.Managed.PreventDestroySet {
+                        r.Managed.PreventDestroy = or.Managed.PreventDestroy
+                        r.Managed.PreventDestroySet = or.Managed.PreventDestroySet
+                }
+                if len(or.Managed.Provisioners) != 0 {
+                        r.Managed.Provisioners = or.Managed.Provisioners
+                }
+        }
+
+        r.Config = MergeBodies(r.Config, or.Config)
+
+        // We don't allow depends_on to be overridden because that is likely to
+        // cause confusing misbehavior.
+        if len(or.DependsOn) != 0 {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Unsupported override",
+                        Detail:   "The depends_on argument may not be overridden.",
+                        Subject:  or.DependsOn[0].SourceRange().Ptr(), // the first item is the closest range we have
+                })
+        }
+
+        return diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/module_merge_body.go b/vendor/github.com/hashicorp/terraform/configs/module_merge_body.go
new file mode 100644
index 0000000..0ed561e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/module_merge_body.go
@@ -0,0 +1,143 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// MergeBodies creates a new HCL body that contains a combination of the
+// given base and override bodies. Attributes and blocks defined in the
+// override body take precedence over those of the same name defined in
+// the base body.
+//
+// If any block of a particular type appears in "override" then it will
+// replace _all_ of the blocks of the same type in "base" in the new
+// body.
+func MergeBodies(base, override hcl.Body) hcl.Body {
+        return mergeBody{
+                Base:     base,
+                Override: override,
+        }
+}
+
+// mergeBody is a hcl.Body implementation that wraps a pair of other bodies
+// and allows attributes and blocks within the override to take precedence
+// over those defined in the base body.
+//
+// This is used to deal with dynamically-processed bodies in Module.mergeFile.
+// It uses a shallow-only merging strategy where direct attributes defined
+// in Override will override attributes of the same name in Base, while any
+// blocks defined in Override will hide all blocks of the same type in Base.
+//
+// This cannot possibly "do the right thing" in all cases, because we don't
+// have enough information about user intent. However, this behavior is intended
+// to be reasonable for simple overriding use-cases.
+type mergeBody struct {
+        Base     hcl.Body
+        Override hcl.Body
+}
+
+var _ hcl.Body = mergeBody{}
+
+func (b mergeBody) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        baseSchema := schemaWithDynamic(schema)
+        overrideSchema := schemaWithDynamic(schemaForOverrides(schema))
+
+        baseContent, _, cDiags := b.Base.PartialContent(baseSchema)
+        diags = append(diags, cDiags...)
+        overrideContent, _, cDiags := b.Override.PartialContent(overrideSchema)
+        diags = append(diags, cDiags...)
+
+        content := b.prepareContent(baseContent, overrideContent)
+
+        return content, diags
+}
+
+func (b mergeBody) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        baseSchema := schemaWithDynamic(schema)
+        overrideSchema := schemaWithDynamic(schemaForOverrides(schema))
+
+        baseContent, baseRemain, cDiags := b.Base.PartialContent(baseSchema)
+        diags = append(diags, cDiags...)
+        overrideContent, overrideRemain, cDiags := b.Override.PartialContent(overrideSchema)
+        diags = append(diags, cDiags...)
+
+        content := b.prepareContent(baseContent, overrideContent)
+
+        remain := MergeBodies(baseRemain, overrideRemain)
+
+        return content, remain, diags
+}
+
+func (b mergeBody) prepareContent(base *hcl.BodyContent, override *hcl.BodyContent) *hcl.BodyContent {
+        content := &hcl.BodyContent{
+                Attributes: make(hcl.Attributes),
+        }
+
+        // For attributes we just assign from each map in turn and let the override
+        // map clobber any matching entries from base.
+        for k, a := range base.Attributes {
+                content.Attributes[k] = a
+        }
+        for k, a := range override.Attributes {
+                content.Attributes[k] = a
+        }
+
+        // Things are a little more interesting for blocks because they arrive
+        // as a flat list. Our merging semantics call for us to suppress blocks
+        // from base if at least one block of the same type appears in override.
+        // We explicitly do not try to correlate and deeply merge nested blocks,
+        // since we don't have enough context here to infer user intent.
+
+        overriddenBlockTypes := make(map[string]bool)
+        for _, block := range override.Blocks {
+                if block.Type == "dynamic" {
+                        overriddenBlockTypes[block.Labels[0]] = true
+                        continue
+                }
+                overriddenBlockTypes[block.Type] = true
+        }
+        for _, block := range base.Blocks {
+                // We skip over dynamic blocks whose type label is an overridden type
+                // but note that below we do still leave them as dynamic blocks in
+                // the result because expanding the dynamic blocks that are left is
+                // done much later during the core graph walks, where we can safely
+                // evaluate the expressions.
+                if block.Type == "dynamic" && overriddenBlockTypes[block.Labels[0]] {
+                        continue
+                }
+                if overriddenBlockTypes[block.Type] {
+                        continue
+                }
+                content.Blocks = append(content.Blocks, block)
+        }
+        for _, block := range override.Blocks {
+                content.Blocks = append(content.Blocks, block)
+        }
+
+        return content
+}
+
+func (b mergeBody) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        ret := make(hcl.Attributes)
+
+        baseAttrs, aDiags := b.Base.JustAttributes()
+        diags = append(diags, aDiags...)
+        overrideAttrs, aDiags := b.Override.JustAttributes()
+        diags = append(diags, aDiags...)
+
+        for k, a := range baseAttrs {
+                ret[k] = a
+        }
+        for k, a := range overrideAttrs {
+                ret[k] = a
+        }
+
+        return ret, diags
+}
+
+func (b mergeBody) MissingItemRange() hcl.Range {
+        return b.Base.MissingItemRange()
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/named_values.go b/vendor/github.com/hashicorp/terraform/configs/named_values.go
new file mode 100644
index 0000000..6f6b469
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/named_values.go
@@ -0,0 +1,364 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/ext/typeexpr"
+        "github.com/hashicorp/hcl2/gohcl"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// A consistent detail message for all "not a valid identifier" diagnostics.
+const badIdentifierDetail = "A name must start with a letter and may contain only letters, digits, underscores, and dashes."
+
+// Variable represents a "variable" block in a module or file.
+type Variable struct {
+        Name        string
+        Description string
+        Default     cty.Value
+        Type        cty.Type
+        ParsingMode VariableParsingMode
+
+        DescriptionSet bool
+
+        DeclRange hcl.Range
+}
+
+func decodeVariableBlock(block *hcl.Block, override bool) (*Variable, hcl.Diagnostics) {
+        v := &Variable{
+                Name:      block.Labels[0],
+                DeclRange: block.DefRange,
+        }
+
+        // Unless we're building an override, we'll set some defaults
+        // which we might override with attributes below. We leave these
+        // as zero-value in the override case so we can recognize whether
+        // or not they are set when we merge.
+        if !override {
+                v.Type = cty.DynamicPseudoType
+                v.ParsingMode = VariableParseLiteral
+        }
+
+        content, diags := block.Body.Content(variableBlockSchema)
+
+        if !hclsyntax.ValidIdentifier(v.Name) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid variable name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[0],
+                })
+        }
+
+        // Don't allow declaration of variables that would conflict with the
+        // reserved attribute and block type names in a "module" block, since
+        // these won't be usable for child modules.
+        for _, attr := range moduleBlockSchema.Attributes {
+                if attr.Name == v.Name {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid variable name",
+                                Detail:   fmt.Sprintf("The variable name %q is reserved due to its special meaning inside module blocks.", attr.Name),
+                                Subject:  &block.LabelRanges[0],
+                        })
+                }
+        }
+        for _, blockS := range moduleBlockSchema.Blocks {
+                if blockS.Type == v.Name {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid variable name",
+                                Detail:   fmt.Sprintf("The variable name %q is reserved due to its special meaning inside module blocks.", blockS.Type),
+                                Subject:  &block.LabelRanges[0],
+                        })
+                }
+        }
+
+        if attr, exists := content.Attributes["description"]; exists {
+                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &v.Description)
+                diags = append(diags, valDiags...)
+                v.DescriptionSet = true
+        }
+
+        if attr, exists := content.Attributes["type"]; exists {
+                ty, parseMode, tyDiags := decodeVariableType(attr.Expr)
+                diags = append(diags, tyDiags...)
+                v.Type = ty
+                v.ParsingMode = parseMode
+        }
+
+        if attr, exists := content.Attributes["default"]; exists {
+                val, valDiags := attr.Expr.Value(nil)
+                diags = append(diags, valDiags...)
+
+                // Convert the default to the expected type so we can catch invalid
+                // defaults early and allow later code to assume validity.
+                // Note that this depends on us having already processed any "type"
+                // attribute above.
+                // However, we can't do this if we're in an override file where
+                // the type might not be set; we'll catch that during merge.
+                if v.Type != cty.NilType {
+                        var err error
+                        val, err = convert.Convert(val, v.Type)
+                        if err != nil {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid default value for variable",
+                                        Detail:   fmt.Sprintf("This default value is not compatible with the variable's type constraint: %s.", err),
+                                        Subject:  attr.Expr.Range().Ptr(),
+                                })
+                                val = cty.DynamicVal
+                        }
+                }
+
+                v.Default = val
+        }
+
+        return v, diags
+}
+
+func decodeVariableType(expr hcl.Expression) (cty.Type, VariableParsingMode, hcl.Diagnostics) {
+        if exprIsNativeQuotedString(expr) {
+                // Here we're accepting the pre-0.12 form of variable type argument where
+                // the string values "string", "list" and "map" are accepted has a hint
+                // about the type used primarily for deciding how to parse values
+                // given on the command line and in environment variables.
+                // Only the native syntax ends up in this codepath; we handle the
+                // JSON syntax (which is, of course, quoted even in the new format)
+                // in the normal codepath below.
+                val, diags := expr.Value(nil)
+                if diags.HasErrors() {
+                        return cty.DynamicPseudoType, VariableParseHCL, diags
+                }
+                str := val.AsString()
+                switch str {
+                case "string":
+                        return cty.String, VariableParseLiteral, diags
+                case "list":
+                        return cty.List(cty.DynamicPseudoType), VariableParseHCL, diags
+                case "map":
+                        return cty.Map(cty.DynamicPseudoType), VariableParseHCL, diags
+                default:
+                        return cty.DynamicPseudoType, VariableParseHCL, hcl.Diagnostics{{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid legacy variable type hint",
+                                Detail:   `The legacy variable type hint form, using a quoted string, allows only the values "string", "list", and "map". To provide a full type expression, remove the surrounding quotes and give the type expression directly.`,
+                                Subject:  expr.Range().Ptr(),
+                        }}
+                }
+        }
+
+        // First we'll deal with some shorthand forms that the HCL-level type
+        // expression parser doesn't include. These both emulate pre-0.12 behavior
+        // of allowing a list or map of any element type as long as all of the
+        // elements are consistent. This is the same as list(any) or map(any).
+        switch hcl.ExprAsKeyword(expr) {
+        case "list":
+                return cty.List(cty.DynamicPseudoType), VariableParseHCL, nil
+        case "map":
+                return cty.Map(cty.DynamicPseudoType), VariableParseHCL, nil
+        }
+
+        ty, diags := typeexpr.TypeConstraint(expr)
+        if diags.HasErrors() {
+                return cty.DynamicPseudoType, VariableParseHCL, diags
+        }
+
+        switch {
+        case ty.IsPrimitiveType():
+                // Primitive types use literal parsing.
+                return ty, VariableParseLiteral, diags
+        default:
+                // Everything else uses HCL parsing
+                return ty, VariableParseHCL, diags
+        }
+}
+
+// VariableParsingMode defines how values of a particular variable given by
+// text-only mechanisms (command line arguments and environment variables)
+// should be parsed to produce the final value.
+type VariableParsingMode rune
+
+// VariableParseLiteral is a variable parsing mode that just takes the given
+// string directly as a cty.String value.
+const VariableParseLiteral VariableParsingMode = 'L'
+
+// VariableParseHCL is a variable parsing mode that attempts to parse the given
+// string as an HCL expression and returns the result.
+const VariableParseHCL VariableParsingMode = 'H'
+
+// Parse uses the receiving parsing mode to process the given variable value
+// string, returning the result along with any diagnostics.
+//
+// A VariableParsingMode does not know the expected type of the corresponding
+// variable, so it's the caller's responsibility to attempt to convert the
+// result to the appropriate type and return to the user any diagnostics that
+// conversion may produce.
+//
+// The given name is used to create a synthetic filename in case any diagnostics
+// must be generated about the given string value. This should be the name
+// of the root module variable whose value will be populated from the given
+// string.
+//
+// If the returned diagnostics has errors, the returned value may not be
+// valid.
+func (m VariableParsingMode) Parse(name, value string) (cty.Value, hcl.Diagnostics) {
+        switch m {
+        case VariableParseLiteral:
+                return cty.StringVal(value), nil
+        case VariableParseHCL:
+                fakeFilename := fmt.Sprintf("<value for var.%s>", name)
+                expr, diags := hclsyntax.ParseExpression([]byte(value), fakeFilename, hcl.Pos{Line: 1, Column: 1})
+                if diags.HasErrors() {
+                        return cty.DynamicVal, diags
+                }
+                val, valDiags := expr.Value(nil)
+                diags = append(diags, valDiags...)
+                return val, diags
+        default:
+                // Should never happen
+                panic(fmt.Errorf("Parse called on invalid VariableParsingMode %#v", m))
+        }
+}
+
+// Output represents an "output" block in a module or file.
+type Output struct {
+        Name        string
+        Description string
+        Expr        hcl.Expression
+        DependsOn   []hcl.Traversal
+        Sensitive   bool
+
+        DescriptionSet bool
+        SensitiveSet   bool
+
+        DeclRange hcl.Range
+}
+
+func decodeOutputBlock(block *hcl.Block, override bool) (*Output, hcl.Diagnostics) {
+        o := &Output{
+                Name:      block.Labels[0],
+                DeclRange: block.DefRange,
+        }
+
+        schema := outputBlockSchema
+        if override {
+                schema = schemaForOverrides(schema)
+        }
+
+        content, diags := block.Body.Content(schema)
+
+        if !hclsyntax.ValidIdentifier(o.Name) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid output name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[0],
+                })
+        }
+
+        if attr, exists := content.Attributes["description"]; exists {
+                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &o.Description)
+                diags = append(diags, valDiags...)
+                o.DescriptionSet = true
+        }
+
+        if attr, exists := content.Attributes["value"]; exists {
+                o.Expr = attr.Expr
+        }
+
+        if attr, exists := content.Attributes["sensitive"]; exists {
+                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &o.Sensitive)
+                diags = append(diags, valDiags...)
+                o.SensitiveSet = true
+        }
+
+        if attr, exists := content.Attributes["depends_on"]; exists {
+                deps, depsDiags := decodeDependsOn(attr)
+                diags = append(diags, depsDiags...)
+                o.DependsOn = append(o.DependsOn, deps...)
+        }
+
+        return o, diags
+}
+
+// Local represents a single entry from a "locals" block in a module or file.
+// The "locals" block itself is not represented, because it serves only to
+// provide context for us to interpret its contents.
+type Local struct {
+        Name string
+        Expr hcl.Expression
+
+        DeclRange hcl.Range
+}
+
+func decodeLocalsBlock(block *hcl.Block) ([]*Local, hcl.Diagnostics) {
+        attrs, diags := block.Body.JustAttributes()
+        if len(attrs) == 0 {
+                return nil, diags
+        }
+
+        locals := make([]*Local, 0, len(attrs))
+        for name, attr := range attrs {
+                if !hclsyntax.ValidIdentifier(name) {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid local value name",
+                                Detail:   badIdentifierDetail,
+                                Subject:  &attr.NameRange,
+                        })
+                }
+
+                locals = append(locals, &Local{
+                        Name:      name,
+                        Expr:      attr.Expr,
+                        DeclRange: attr.Range,
+                })
+        }
+        return locals, diags
+}
+
+// Addr returns the address of the local value declared by the receiver,
+// relative to its containing module.
+func (l *Local) Addr() addrs.LocalValue {
+        return addrs.LocalValue{
+                Name: l.Name,
+        }
+}
+
+var variableBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "description",
+                },
+                {
+                        Name: "default",
+                },
+                {
+                        Name: "type",
+                },
+        },
+}
+
+var outputBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "description",
+                },
+                {
+                        Name:     "value",
+                        Required: true,
+                },
+                {
+                        Name: "depends_on",
+                },
+                {
+                        Name: "sensitive",
+                },
+        },
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/parser.go b/vendor/github.com/hashicorp/terraform/configs/parser.go
new file mode 100644
index 0000000..8176fa1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/parser.go
@@ -0,0 +1,100 @@
+package configs
+
+import (
+        "fmt"
+        "strings"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hclparse"
+        "github.com/spf13/afero"
+)
+
+// Parser is the main interface to read configuration files and other related
+// files from disk.
+//
+// It retains a cache of all files that are loaded so that they can be used
+// to create source code snippets in diagnostics, etc.
+type Parser struct {
+        fs afero.Afero
+        p  *hclparse.Parser
+}
+
+// NewParser creates and returns a new Parser that reads files from the given
+// filesystem. If a nil filesystem is passed then the system's "real" filesystem
+// will be used, via afero.OsFs.
+func NewParser(fs afero.Fs) *Parser {
+        if fs == nil {
+                fs = afero.OsFs{}
+        }
+
+        return &Parser{
+                fs: afero.Afero{Fs: fs},
+                p:  hclparse.NewParser(),
+        }
+}
+
+// LoadHCLFile is a low-level method that reads the file at the given path,
+// parses it, and returns the hcl.Body representing its root. In many cases
+// it is better to use one of the other Load*File methods on this type,
+// which additionally decode the root body in some way and return a higher-level
+// construct.
+//
+// If the file cannot be read at all -- e.g. because it does not exist -- then
+// this method will return a nil body and error diagnostics. In this case
+// callers may wish to ignore the provided error diagnostics and produce
+// a more context-sensitive error instead.
+//
+// The file will be parsed using the HCL native syntax unless the filename
+// ends with ".json", in which case the HCL JSON syntax will be used.
+func (p *Parser) LoadHCLFile(path string) (hcl.Body, hcl.Diagnostics) {
+        src, err := p.fs.ReadFile(path)
+
+        if err != nil {
+                return nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Failed to read file",
+                                Detail:   fmt.Sprintf("The file %q could not be read.", path),
+                        },
+                }
+        }
+
+        var file *hcl.File
+        var diags hcl.Diagnostics
+        switch {
+        case strings.HasSuffix(path, ".json"):
+                file, diags = p.p.ParseJSON(src, path)
+        default:
+                file, diags = p.p.ParseHCL(src, path)
+        }
+
+        // If the returned file or body is nil, then we'll return a non-nil empty
+        // body so we'll meet our contract that nil means an error reading the file.
+        if file == nil || file.Body == nil {
+                return hcl.EmptyBody(), diags
+        }
+
+        return file.Body, diags
+}
+
+// Sources returns a map of the cached source buffers for all files that
+// have been loaded through this parser, with source filenames (as requested
+// when each file was opened) as the keys.
+func (p *Parser) Sources() map[string][]byte {
+        return p.p.Sources()
+}
+
+// ForceFileSource artificially adds source code to the cache of file sources,
+// as if it had been loaded from the given filename.
+//
+// This should be used only in special situations where configuration is loaded
+// some other way. Most callers should load configuration via methods of
+// Parser, which will update the sources cache automatically.
+func (p *Parser) ForceFileSource(filename string, src []byte) {
+        // We'll make a synthetic hcl.File here just so we can reuse the
+        // existing cache.
+        p.p.AddFile(filename, &hcl.File{
+                Body:  hcl.EmptyBody(),
+                Bytes: src,
+        })
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/parser_config.go b/vendor/github.com/hashicorp/terraform/configs/parser_config.go
new file mode 100644
index 0000000..7f2ff27
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/parser_config.go
@@ -0,0 +1,247 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// LoadConfigFile reads the file at the given path and parses it as a config
+// file.
+//
+// If the file cannot be read -- for example, if it does not exist -- then
+// a nil *File will be returned along with error diagnostics. Callers may wish
+// to disregard the returned diagnostics in this case and instead generate
+// their own error message(s) with additional context.
+//
+// If the returned diagnostics has errors when a non-nil map is returned
+// then the map may be incomplete but should be valid enough for careful
+// static analysis.
+//
+// This method wraps LoadHCLFile, and so it inherits the syntax selection
+// behaviors documented for that method.
+func (p *Parser) LoadConfigFile(path string) (*File, hcl.Diagnostics) {
+        return p.loadConfigFile(path, false)
+}
+
+// LoadConfigFileOverride is the same as LoadConfigFile except that it relaxes
+// certain required attribute constraints in order to interpret the given
+// file as an overrides file.
+func (p *Parser) LoadConfigFileOverride(path string) (*File, hcl.Diagnostics) {
+        return p.loadConfigFile(path, true)
+}
+
+func (p *Parser) loadConfigFile(path string, override bool) (*File, hcl.Diagnostics) {
+
+        body, diags := p.LoadHCLFile(path)
+        if body == nil {
+                return nil, diags
+        }
+
+        file := &File{}
+
+        var reqDiags hcl.Diagnostics
+        file.CoreVersionConstraints, reqDiags = sniffCoreVersionRequirements(body)
+        diags = append(diags, reqDiags...)
+
+        content, contentDiags := body.Content(configFileSchema)
+        diags = append(diags, contentDiags...)
+
+        for _, block := range content.Blocks {
+                switch block.Type {
+
+                case "terraform":
+                        content, contentDiags := block.Body.Content(terraformBlockSchema)
+                        diags = append(diags, contentDiags...)
+
+                        // We ignore the "terraform_version" attribute here because
+                        // sniffCoreVersionRequirements already dealt with that above.
+
+                        for _, innerBlock := range content.Blocks {
+                                switch innerBlock.Type {
+
+                                case "backend":
+                                        backendCfg, cfgDiags := decodeBackendBlock(innerBlock)
+                                        diags = append(diags, cfgDiags...)
+                                        if backendCfg != nil {
+                                                file.Backends = append(file.Backends, backendCfg)
+                                        }
+
+                                case "required_providers":
+                                        reqs, reqsDiags := decodeRequiredProvidersBlock(innerBlock)
+                                        diags = append(diags, reqsDiags...)
+                                        file.ProviderRequirements = append(file.ProviderRequirements, reqs...)
+
+                                default:
+                                        // Should never happen because the above cases should be exhaustive
+                                        // for all block type names in our schema.
+                                        continue
+
+                                }
+                        }
+
+                case "provider":
+                        cfg, cfgDiags := decodeProviderBlock(block)
+                        diags = append(diags, cfgDiags...)
+                        if cfg != nil {
+                                file.ProviderConfigs = append(file.ProviderConfigs, cfg)
+                        }
+
+                case "variable":
+                        cfg, cfgDiags := decodeVariableBlock(block, override)
+                        diags = append(diags, cfgDiags...)
+                        if cfg != nil {
+                                file.Variables = append(file.Variables, cfg)
+                        }
+
+                case "locals":
+                        defs, defsDiags := decodeLocalsBlock(block)
+                        diags = append(diags, defsDiags...)
+                        file.Locals = append(file.Locals, defs...)
+
+                case "output":
+                        cfg, cfgDiags := decodeOutputBlock(block, override)
+                        diags = append(diags, cfgDiags...)
+                        if cfg != nil {
+                                file.Outputs = append(file.Outputs, cfg)
+                        }
+
+                case "module":
+                        cfg, cfgDiags := decodeModuleBlock(block, override)
+                        diags = append(diags, cfgDiags...)
+                        if cfg != nil {
+                                file.ModuleCalls = append(file.ModuleCalls, cfg)
+                        }
+
+                case "resource":
+                        cfg, cfgDiags := decodeResourceBlock(block)
+                        diags = append(diags, cfgDiags...)
+                        if cfg != nil {
+                                file.ManagedResources = append(file.ManagedResources, cfg)
+                        }
+
+                case "data":
+                        cfg, cfgDiags := decodeDataBlock(block)
+                        diags = append(diags, cfgDiags...)
+                        if cfg != nil {
+                                file.DataResources = append(file.DataResources, cfg)
+                        }
+
+                default:
+                        // Should never happen because the above cases should be exhaustive
+                        // for all block type names in our schema.
+                        continue
+
+                }
+        }
+
+        return file, diags
+}
+
+// sniffCoreVersionRequirements does minimal parsing of the given body for
+// "terraform" blocks with "required_version" attributes, returning the
+// requirements found.
+//
+// This is intended to maximize the chance that we'll be able to read the
+// requirements (syntax errors notwithstanding) even if the config file contains
+// constructs that might've been added in future Terraform versions
+//
+// This is a "best effort" sort of method which will return constraints it is
+// able to find, but may return no constraints at all if the given body is
+// so invalid that it cannot be decoded at all.
+func sniffCoreVersionRequirements(body hcl.Body) ([]VersionConstraint, hcl.Diagnostics) {
+        rootContent, _, diags := body.PartialContent(configFileVersionSniffRootSchema)
+
+        var constraints []VersionConstraint
+
+        for _, block := range rootContent.Blocks {
+                content, _, blockDiags := block.Body.PartialContent(configFileVersionSniffBlockSchema)
+                diags = append(diags, blockDiags...)
+
+                attr, exists := content.Attributes["required_version"]
+                if !exists {
+                        continue
+                }
+
+                constraint, constraintDiags := decodeVersionConstraint(attr)
+                diags = append(diags, constraintDiags...)
+                if !constraintDiags.HasErrors() {
+                        constraints = append(constraints, constraint)
+                }
+        }
+
+        return constraints, diags
+}
+
+// configFileSchema is the schema for the top-level of a config file. We use
+// the low-level HCL API for this level so we can easily deal with each
+// block type separately with its own decoding logic.
+var configFileSchema = &hcl.BodySchema{
+        Blocks: []hcl.BlockHeaderSchema{
+                {
+                        Type: "terraform",
+                },
+                {
+                        Type:       "provider",
+                        LabelNames: []string{"name"},
+                },
+                {
+                        Type:       "variable",
+                        LabelNames: []string{"name"},
+                },
+                {
+                        Type: "locals",
+                },
+                {
+                        Type:       "output",
+                        LabelNames: []string{"name"},
+                },
+                {
+                        Type:       "module",
+                        LabelNames: []string{"name"},
+                },
+                {
+                        Type:       "resource",
+                        LabelNames: []string{"type", "name"},
+                },
+                {
+                        Type:       "data",
+                        LabelNames: []string{"type", "name"},
+                },
+        },
+}
+
+// terraformBlockSchema is the schema for a top-level "terraform" block in
+// a configuration file.
+var terraformBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "required_version",
+                },
+        },
+        Blocks: []hcl.BlockHeaderSchema{
+                {
+                        Type:       "backend",
+                        LabelNames: []string{"type"},
+                },
+                {
+                        Type: "required_providers",
+                },
+        },
+}
+
+// configFileVersionSniffRootSchema is a schema for sniffCoreVersionRequirements
+var configFileVersionSniffRootSchema = &hcl.BodySchema{
+        Blocks: []hcl.BlockHeaderSchema{
+                {
+                        Type: "terraform",
+                },
+        },
+}
+
+// configFileVersionSniffBlockSchema is a schema for sniffCoreVersionRequirements
+var configFileVersionSniffBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "required_version",
+                },
+        },
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/parser_config_dir.go b/vendor/github.com/hashicorp/terraform/configs/parser_config_dir.go
new file mode 100644
index 0000000..3014cb4
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/parser_config_dir.go
@@ -0,0 +1,142 @@
+package configs
+
+import (
+        "fmt"
+        "path/filepath"
+        "strings"
+
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// LoadConfigDir reads the .tf and .tf.json files in the given directory
+// as config files (using LoadConfigFile) and then combines these files into
+// a single Module.
+//
+// If this method returns nil, that indicates that the given directory does not
+// exist at all or could not be opened for some reason. Callers may wish to
+// detect this case and ignore the returned diagnostics so that they can
+// produce a more context-aware error message in that case.
+//
+// If this method returns a non-nil module while error diagnostics are returned
+// then the module may be incomplete but can be used carefully for static
+// analysis.
+//
+// This file does not consider a directory with no files to be an error, and
+// will simply return an empty module in that case. Callers should first call
+// Parser.IsConfigDir if they wish to recognize that situation.
+//
+// .tf files are parsed using the HCL native syntax while .tf.json files are
+// parsed using the HCL JSON syntax.
+func (p *Parser) LoadConfigDir(path string) (*Module, hcl.Diagnostics) {
+        primaryPaths, overridePaths, diags := p.dirFiles(path)
+        if diags.HasErrors() {
+                return nil, diags
+        }
+
+        primary, fDiags := p.loadFiles(primaryPaths, false)
+        diags = append(diags, fDiags...)
+        override, fDiags := p.loadFiles(overridePaths, true)
+        diags = append(diags, fDiags...)
+
+        mod, modDiags := NewModule(primary, override)
+        diags = append(diags, modDiags...)
+
+        mod.SourceDir = path
+
+        return mod, diags
+}
+
+// ConfigDirFiles returns lists of the primary and override files configuration
+// files in the given directory.
+//
+// If the given directory does not exist or cannot be read, error diagnostics
+// are returned. If errors are returned, the resulting lists may be incomplete.
+func (p Parser) ConfigDirFiles(dir string) (primary, override []string, diags hcl.Diagnostics) {
+        return p.dirFiles(dir)
+}
+
+// IsConfigDir determines whether the given path refers to a directory that
+// exists and contains at least one Terraform config file (with a .tf or
+// .tf.json extension.)
+func (p *Parser) IsConfigDir(path string) bool {
+        primaryPaths, overridePaths, _ := p.dirFiles(path)
+        return (len(primaryPaths) + len(overridePaths)) > 0
+}
+
+func (p *Parser) loadFiles(paths []string, override bool) ([]*File, hcl.Diagnostics) {
+        var files []*File
+        var diags hcl.Diagnostics
+
+        for _, path := range paths {
+                var f *File
+                var fDiags hcl.Diagnostics
+                if override {
+                        f, fDiags = p.LoadConfigFileOverride(path)
+                } else {
+                        f, fDiags = p.LoadConfigFile(path)
+                }
+                diags = append(diags, fDiags...)
+                if f != nil {
+                        files = append(files, f)
+                }
+        }
+
+        return files, diags
+}
+
+func (p *Parser) dirFiles(dir string) (primary, override []string, diags hcl.Diagnostics) {
+        infos, err := p.fs.ReadDir(dir)
+        if err != nil {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Failed to read module directory",
+                        Detail:   fmt.Sprintf("Module directory %s does not exist or cannot be read.", dir),
+                })
+                return
+        }
+
+        for _, info := range infos {
+                if info.IsDir() {
+                        // We only care about files
+                        continue
+                }
+
+                name := info.Name()
+                ext := fileExt(name)
+                if ext == "" || IsIgnoredFile(name) {
+                        continue
+                }
+
+                baseName := name[:len(name)-len(ext)] // strip extension
+                isOverride := baseName == "override" || strings.HasSuffix(baseName, "_override")
+
+                fullPath := filepath.Join(dir, name)
+                if isOverride {
+                        override = append(override, fullPath)
+                } else {
+                        primary = append(primary, fullPath)
+                }
+        }
+
+        return
+}
+
+// fileExt returns the Terraform configuration extension of the given
+// path, or a blank string if it is not a recognized extension.
+func fileExt(path string) string {
+        if strings.HasSuffix(path, ".tf") {
+                return ".tf"
+        } else if strings.HasSuffix(path, ".tf.json") {
+                return ".tf.json"
+        } else {
+                return ""
+        }
+}
+
+// IsIgnoredFile returns true if the given filename (which must not have a
+// directory path ahead of it) should be ignored as e.g. an editor swap file.
+func IsIgnoredFile(name string) bool {
+        return strings.HasPrefix(name, ".") || // Unix-like hidden files
+                strings.HasSuffix(name, "~") || // vim
+                strings.HasPrefix(name, "#") && strings.HasSuffix(name, "#") // emacs
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/parser_values.go b/vendor/github.com/hashicorp/terraform/configs/parser_values.go
new file mode 100644
index 0000000..b7f1c1c
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/parser_values.go
@@ -0,0 +1,43 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// LoadValuesFile reads the file at the given path and parses it as a "values
+// file", which is an HCL config file whose top-level attributes are treated
+// as arbitrary key.value pairs.
+//
+// If the file cannot be read -- for example, if it does not exist -- then
+// a nil map will be returned along with error diagnostics. Callers may wish
+// to disregard the returned diagnostics in this case and instead generate
+// their own error message(s) with additional context.
+//
+// If the returned diagnostics has errors when a non-nil map is returned
+// then the map may be incomplete but should be valid enough for careful
+// static analysis.
+//
+// This method wraps LoadHCLFile, and so it inherits the syntax selection
+// behaviors documented for that method.
+func (p *Parser) LoadValuesFile(path string) (map[string]cty.Value, hcl.Diagnostics) {
+        body, diags := p.LoadHCLFile(path)
+        if body == nil {
+                return nil, diags
+        }
+
+        vals := make(map[string]cty.Value)
+        attrs, attrDiags := body.JustAttributes()
+        diags = append(diags, attrDiags...)
+        if attrs == nil {
+                return vals, diags
+        }
+
+        for name, attr := range attrs {
+                val, valDiags := attr.Expr.Value(nil)
+                diags = append(diags, valDiags...)
+                vals[name] = val
+        }
+
+        return vals, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/provider.go b/vendor/github.com/hashicorp/terraform/configs/provider.go
new file mode 100644
index 0000000..d01d5cf
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/provider.go
@@ -0,0 +1,144 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/gohcl"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Provider represents a "provider" block in a module or file. A provider
+// block is a provider configuration, and there can be zero or more
+// configurations for each actual provider.
+type Provider struct {
+        Name       string
+        NameRange  hcl.Range
+        Alias      string
+        AliasRange *hcl.Range // nil if no alias set
+
+        Version VersionConstraint
+
+        Config hcl.Body
+
+        DeclRange hcl.Range
+}
+
+func decodeProviderBlock(block *hcl.Block) (*Provider, hcl.Diagnostics) {
+        content, config, diags := block.Body.PartialContent(providerBlockSchema)
+
+        provider := &Provider{
+                Name:      block.Labels[0],
+                NameRange: block.LabelRanges[0],
+                Config:    config,
+                DeclRange: block.DefRange,
+        }
+
+        if attr, exists := content.Attributes["alias"]; exists {
+                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &provider.Alias)
+                diags = append(diags, valDiags...)
+                provider.AliasRange = attr.Expr.Range().Ptr()
+
+                if !hclsyntax.ValidIdentifier(provider.Alias) {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid provider configuration alias",
+                                Detail:   fmt.Sprintf("An alias must be a valid name. %s", badIdentifierDetail),
+                        })
+                }
+        }
+
+        if attr, exists := content.Attributes["version"]; exists {
+                var versionDiags hcl.Diagnostics
+                provider.Version, versionDiags = decodeVersionConstraint(attr)
+                diags = append(diags, versionDiags...)
+        }
+
+        // Reserved attribute names
+        for _, name := range []string{"count", "depends_on", "for_each", "source"} {
+                if attr, exists := content.Attributes[name]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Reserved argument name in provider block",
+                                Detail:   fmt.Sprintf("The provider argument name %q is reserved for use by Terraform in a future version.", name),
+                                Subject:  &attr.NameRange,
+                        })
+                }
+        }
+
+        // Reserved block types (all of them)
+        for _, block := range content.Blocks {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved block type name in provider block",
+                        Detail:   fmt.Sprintf("The block type name %q is reserved for use by Terraform in a future version.", block.Type),
+                        Subject:  &block.TypeRange,
+                })
+        }
+
+        return provider, diags
+}
+
+// Addr returns the address of the receiving provider configuration, relative
+// to its containing module.
+func (p *Provider) Addr() addrs.ProviderConfig {
+        return addrs.ProviderConfig{
+                Type:  p.Name,
+                Alias: p.Alias,
+        }
+}
+
+func (p *Provider) moduleUniqueKey() string {
+        if p.Alias != "" {
+                return fmt.Sprintf("%s.%s", p.Name, p.Alias)
+        }
+        return p.Name
+}
+
+// ProviderRequirement represents a declaration of a dependency on a particular
+// provider version without actually configuring that provider. This is used in
+// child modules that expect a provider to be passed in from their parent.
+type ProviderRequirement struct {
+        Name        string
+        Requirement VersionConstraint
+}
+
+func decodeRequiredProvidersBlock(block *hcl.Block) ([]*ProviderRequirement, hcl.Diagnostics) {
+        attrs, diags := block.Body.JustAttributes()
+        var reqs []*ProviderRequirement
+        for name, attr := range attrs {
+                req, reqDiags := decodeVersionConstraint(attr)
+                diags = append(diags, reqDiags...)
+                if !diags.HasErrors() {
+                        reqs = append(reqs, &ProviderRequirement{
+                                Name:        name,
+                                Requirement: req,
+                        })
+                }
+        }
+        return reqs, diags
+}
+
+var providerBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "alias",
+                },
+                {
+                        Name: "version",
+                },
+
+                // Attribute names reserved for future expansion.
+                {Name: "count"},
+                {Name: "depends_on"},
+                {Name: "for_each"},
+                {Name: "source"},
+        },
+        Blocks: []hcl.BlockHeaderSchema{
+                // _All_ of these are reserved for future expansion.
+                {Type: "lifecycle"},
+                {Type: "locals"},
+        },
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/provisioner.go b/vendor/github.com/hashicorp/terraform/configs/provisioner.go
new file mode 100644
index 0000000..b031dd0
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/provisioner.go
@@ -0,0 +1,150 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// Provisioner represents a "provisioner" block when used within a
+// "resource" block in a module or file.
+type Provisioner struct {
+        Type       string
+        Config     hcl.Body
+        Connection *Connection
+        When       ProvisionerWhen
+        OnFailure  ProvisionerOnFailure
+
+        DeclRange hcl.Range
+        TypeRange hcl.Range
+}
+
+func decodeProvisionerBlock(block *hcl.Block) (*Provisioner, hcl.Diagnostics) {
+        pv := &Provisioner{
+                Type:      block.Labels[0],
+                TypeRange: block.LabelRanges[0],
+                DeclRange: block.DefRange,
+                When:      ProvisionerWhenCreate,
+                OnFailure: ProvisionerOnFailureFail,
+        }
+
+        content, config, diags := block.Body.PartialContent(provisionerBlockSchema)
+        pv.Config = config
+
+        if attr, exists := content.Attributes["when"]; exists {
+                expr, shimDiags := shimTraversalInString(attr.Expr, true)
+                diags = append(diags, shimDiags...)
+
+                switch hcl.ExprAsKeyword(expr) {
+                case "create":
+                        pv.When = ProvisionerWhenCreate
+                case "destroy":
+                        pv.When = ProvisionerWhenDestroy
+                default:
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid \"when\" keyword",
+                                Detail:   "The \"when\" argument requires one of the following keywords: create or destroy.",
+                                Subject:  expr.Range().Ptr(),
+                        })
+                }
+        }
+
+        if attr, exists := content.Attributes["on_failure"]; exists {
+                expr, shimDiags := shimTraversalInString(attr.Expr, true)
+                diags = append(diags, shimDiags...)
+
+                switch hcl.ExprAsKeyword(expr) {
+                case "continue":
+                        pv.OnFailure = ProvisionerOnFailureContinue
+                case "fail":
+                        pv.OnFailure = ProvisionerOnFailureFail
+                default:
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid \"on_failure\" keyword",
+                                Detail:   "The \"on_failure\" argument requires one of the following keywords: continue or fail.",
+                                Subject:  attr.Expr.Range().Ptr(),
+                        })
+                }
+        }
+
+        var seenConnection *hcl.Block
+        for _, block := range content.Blocks {
+                switch block.Type {
+
+                case "connection":
+                        if seenConnection != nil {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Duplicate connection block",
+                                        Detail:   fmt.Sprintf("This provisioner already has a connection block at %s.", seenConnection.DefRange),
+                                        Subject:  &block.DefRange,
+                                })
+                                continue
+                        }
+                        seenConnection = block
+
+                        //conn, connDiags := decodeConnectionBlock(block)
+                        //diags = append(diags, connDiags...)
+                        pv.Connection = &Connection{
+                                Config:    block.Body,
+                                DeclRange: block.DefRange,
+                        }
+
+                default:
+                        // Any other block types are ones we've reserved for future use,
+                        // so they get a generic message.
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Reserved block type name in provisioner block",
+                                Detail:   fmt.Sprintf("The block type name %q is reserved for use by Terraform in a future version.", block.Type),
+                                Subject:  &block.TypeRange,
+                        })
+                }
+        }
+
+        return pv, diags
+}
+
+// Connection represents a "connection" block when used within either a
+// "resource" or "provisioner" block in a module or file.
+type Connection struct {
+        Config hcl.Body
+
+        DeclRange hcl.Range
+}
+
+// ProvisionerWhen is an enum for valid values for when to run provisioners.
+type ProvisionerWhen int
+
+//go:generate stringer -type ProvisionerWhen
+
+const (
+        ProvisionerWhenInvalid ProvisionerWhen = iota
+        ProvisionerWhenCreate
+        ProvisionerWhenDestroy
+)
+
+// ProvisionerOnFailure is an enum for valid values for on_failure options
+// for provisioners.
+type ProvisionerOnFailure int
+
+//go:generate stringer -type ProvisionerOnFailure
+
+const (
+        ProvisionerOnFailureInvalid ProvisionerOnFailure = iota
+        ProvisionerOnFailureContinue
+        ProvisionerOnFailureFail
+)
+
+var provisionerBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {Name: "when"},
+                {Name: "on_failure"},
+        },
+        Blocks: []hcl.BlockHeaderSchema{
+                {Type: "connection"},
+                {Type: "lifecycle"}, // reserved for future use
+        },
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/provisioneronfailure_string.go b/vendor/github.com/hashicorp/terraform/configs/provisioneronfailure_string.go
new file mode 100644
index 0000000..7ff5a6e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/provisioneronfailure_string.go
@@ -0,0 +1,25 @@
+// Code generated by "stringer -type ProvisionerOnFailure"; DO NOT EDIT.
+
+package configs
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[ProvisionerOnFailureInvalid-0]
+        _ = x[ProvisionerOnFailureContinue-1]
+        _ = x[ProvisionerOnFailureFail-2]
+}
+
+const _ProvisionerOnFailure_name = "ProvisionerOnFailureInvalidProvisionerOnFailureContinueProvisionerOnFailureFail"
+
+var _ProvisionerOnFailure_index = [...]uint8{0, 27, 55, 79}
+
+func (i ProvisionerOnFailure) String() string {
+        if i < 0 || i >= ProvisionerOnFailure(len(_ProvisionerOnFailure_index)-1) {
+                return "ProvisionerOnFailure(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+        return _ProvisionerOnFailure_name[_ProvisionerOnFailure_index[i]:_ProvisionerOnFailure_index[i+1]]
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/provisionerwhen_string.go b/vendor/github.com/hashicorp/terraform/configs/provisionerwhen_string.go
new file mode 100644
index 0000000..9f21b3a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/provisionerwhen_string.go
@@ -0,0 +1,25 @@
+// Code generated by "stringer -type ProvisionerWhen"; DO NOT EDIT.
+
+package configs
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[ProvisionerWhenInvalid-0]
+        _ = x[ProvisionerWhenCreate-1]
+        _ = x[ProvisionerWhenDestroy-2]
+}
+
+const _ProvisionerWhen_name = "ProvisionerWhenInvalidProvisionerWhenCreateProvisionerWhenDestroy"
+
+var _ProvisionerWhen_index = [...]uint8{0, 22, 43, 65}
+
+func (i ProvisionerWhen) String() string {
+        if i < 0 || i >= ProvisionerWhen(len(_ProvisionerWhen_index)-1) {
+                return "ProvisionerWhen(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+        return _ProvisionerWhen_name[_ProvisionerWhen_index[i]:_ProvisionerWhen_index[i+1]]
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/resource.go b/vendor/github.com/hashicorp/terraform/configs/resource.go
new file mode 100644
index 0000000..de1a343
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/resource.go
@@ -0,0 +1,486 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/gohcl"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Resource represents a "resource" or "data" block in a module or file.
+type Resource struct {
+        Mode    addrs.ResourceMode
+        Name    string
+        Type    string
+        Config  hcl.Body
+        Count   hcl.Expression
+        ForEach hcl.Expression
+
+        ProviderConfigRef *ProviderConfigRef
+
+        DependsOn []hcl.Traversal
+
+        // Managed is populated only for Mode = addrs.ManagedResourceMode,
+        // containing the additional fields that apply to managed resources.
+        // For all other resource modes, this field is nil.
+        Managed *ManagedResource
+
+        DeclRange hcl.Range
+        TypeRange hcl.Range
+}
+
+// ManagedResource represents a "resource" block in a module or file.
+type ManagedResource struct {
+        Connection   *Connection
+        Provisioners []*Provisioner
+
+        CreateBeforeDestroy bool
+        PreventDestroy      bool
+        IgnoreChanges       []hcl.Traversal
+        IgnoreAllChanges    bool
+
+        CreateBeforeDestroySet bool
+        PreventDestroySet      bool
+}
+
+func (r *Resource) moduleUniqueKey() string {
+        return r.Addr().String()
+}
+
+// Addr returns a resource address for the receiver that is relative to the
+// resource's containing module.
+func (r *Resource) Addr() addrs.Resource {
+        return addrs.Resource{
+                Mode: r.Mode,
+                Type: r.Type,
+                Name: r.Name,
+        }
+}
+
+// ProviderConfigAddr returns the address for the provider configuration
+// that should be used for this resource. This function implements the
+// default behavior of extracting the type from the resource type name if
+// an explicit "provider" argument was not provided.
+func (r *Resource) ProviderConfigAddr() addrs.ProviderConfig {
+        if r.ProviderConfigRef == nil {
+                return r.Addr().DefaultProviderConfig()
+        }
+
+        return addrs.ProviderConfig{
+                Type:  r.ProviderConfigRef.Name,
+                Alias: r.ProviderConfigRef.Alias,
+        }
+}
+
+func decodeResourceBlock(block *hcl.Block) (*Resource, hcl.Diagnostics) {
+        r := &Resource{
+                Mode:      addrs.ManagedResourceMode,
+                Type:      block.Labels[0],
+                Name:      block.Labels[1],
+                DeclRange: block.DefRange,
+                TypeRange: block.LabelRanges[0],
+                Managed:   &ManagedResource{},
+        }
+
+        content, remain, diags := block.Body.PartialContent(resourceBlockSchema)
+        r.Config = remain
+
+        if !hclsyntax.ValidIdentifier(r.Type) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid resource type name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[0],
+                })
+        }
+        if !hclsyntax.ValidIdentifier(r.Name) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid resource name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[1],
+                })
+        }
+
+        if attr, exists := content.Attributes["count"]; exists {
+                r.Count = attr.Expr
+        }
+
+        if attr, exists := content.Attributes["for_each"]; exists {
+                r.ForEach = attr.Expr
+                // We currently parse this, but don't yet do anything with it.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved argument name in resource block",
+                        Detail:   fmt.Sprintf("The name %q is reserved for use in a future version of Terraform.", attr.Name),
+                        Subject:  &attr.NameRange,
+                })
+        }
+
+        if attr, exists := content.Attributes["provider"]; exists {
+                var providerDiags hcl.Diagnostics
+                r.ProviderConfigRef, providerDiags = decodeProviderConfigRef(attr.Expr, "provider")
+                diags = append(diags, providerDiags...)
+        }
+
+        if attr, exists := content.Attributes["depends_on"]; exists {
+                deps, depsDiags := decodeDependsOn(attr)
+                diags = append(diags, depsDiags...)
+                r.DependsOn = append(r.DependsOn, deps...)
+        }
+
+        var seenLifecycle *hcl.Block
+        var seenConnection *hcl.Block
+        for _, block := range content.Blocks {
+                switch block.Type {
+                case "lifecycle":
+                        if seenLifecycle != nil {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Duplicate lifecycle block",
+                                        Detail:   fmt.Sprintf("This resource already has a lifecycle block at %s.", seenLifecycle.DefRange),
+                                        Subject:  &block.DefRange,
+                                })
+                                continue
+                        }
+                        seenLifecycle = block
+
+                        lcContent, lcDiags := block.Body.Content(resourceLifecycleBlockSchema)
+                        diags = append(diags, lcDiags...)
+
+                        if attr, exists := lcContent.Attributes["create_before_destroy"]; exists {
+                                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &r.Managed.CreateBeforeDestroy)
+                                diags = append(diags, valDiags...)
+                                r.Managed.CreateBeforeDestroySet = true
+                        }
+
+                        if attr, exists := lcContent.Attributes["prevent_destroy"]; exists {
+                                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &r.Managed.PreventDestroy)
+                                diags = append(diags, valDiags...)
+                                r.Managed.PreventDestroySet = true
+                        }
+
+                        if attr, exists := lcContent.Attributes["ignore_changes"]; exists {
+
+                                // ignore_changes can either be a list of relative traversals
+                                // or it can be just the keyword "all" to ignore changes to this
+                                // resource entirely.
+                                //   ignore_changes = [ami, instance_type]
+                                //   ignore_changes = all
+                                // We also allow two legacy forms for compatibility with earlier
+                                // versions:
+                                //   ignore_changes = ["ami", "instance_type"]
+                                //   ignore_changes = ["*"]
+
+                                kw := hcl.ExprAsKeyword(attr.Expr)
+
+                                switch {
+                                case kw == "all":
+                                        r.Managed.IgnoreAllChanges = true
+                                default:
+                                        exprs, listDiags := hcl.ExprList(attr.Expr)
+                                        diags = append(diags, listDiags...)
+
+                                        var ignoreAllRange hcl.Range
+
+                                        for _, expr := range exprs {
+
+                                                // our expr might be the literal string "*", which
+                                                // we accept as a deprecated way of saying "all".
+                                                if shimIsIgnoreChangesStar(expr) {
+                                                        r.Managed.IgnoreAllChanges = true
+                                                        ignoreAllRange = expr.Range()
+                                                        diags = append(diags, &hcl.Diagnostic{
+                                                                Severity: hcl.DiagWarning,
+                                                                Summary:  "Deprecated ignore_changes wildcard",
+                                                                Detail:   "The [\"*\"] form of ignore_changes wildcard is deprecated. Use \"ignore_changes = all\" to ignore changes to all attributes.",
+                                                                Subject:  attr.Expr.Range().Ptr(),
+                                                        })
+                                                        continue
+                                                }
+
+                                                expr, shimDiags := shimTraversalInString(expr, false)
+                                                diags = append(diags, shimDiags...)
+
+                                                traversal, travDiags := hcl.RelTraversalForExpr(expr)
+                                                diags = append(diags, travDiags...)
+                                                if len(traversal) != 0 {
+                                                        r.Managed.IgnoreChanges = append(r.Managed.IgnoreChanges, traversal)
+                                                }
+                                        }
+
+                                        if r.Managed.IgnoreAllChanges && len(r.Managed.IgnoreChanges) != 0 {
+                                                diags = append(diags, &hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Invalid ignore_changes ruleset",
+                                                        Detail:   "Cannot mix wildcard string \"*\" with non-wildcard references.",
+                                                        Subject:  &ignoreAllRange,
+                                                        Context:  attr.Expr.Range().Ptr(),
+                                                })
+                                        }
+
+                                }
+
+                        }
+
+                case "connection":
+                        if seenConnection != nil {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Duplicate connection block",
+                                        Detail:   fmt.Sprintf("This resource already has a connection block at %s.", seenConnection.DefRange),
+                                        Subject:  &block.DefRange,
+                                })
+                                continue
+                        }
+                        seenConnection = block
+
+                        r.Managed.Connection = &Connection{
+                                Config:    block.Body,
+                                DeclRange: block.DefRange,
+                        }
+
+                case "provisioner":
+                        pv, pvDiags := decodeProvisionerBlock(block)
+                        diags = append(diags, pvDiags...)
+                        if pv != nil {
+                                r.Managed.Provisioners = append(r.Managed.Provisioners, pv)
+                        }
+
+                default:
+                        // Any other block types are ones we've reserved for future use,
+                        // so they get a generic message.
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Reserved block type name in resource block",
+                                Detail:   fmt.Sprintf("The block type name %q is reserved for use by Terraform in a future version.", block.Type),
+                                Subject:  &block.TypeRange,
+                        })
+                }
+        }
+
+        return r, diags
+}
+
+func decodeDataBlock(block *hcl.Block) (*Resource, hcl.Diagnostics) {
+        r := &Resource{
+                Mode:      addrs.DataResourceMode,
+                Type:      block.Labels[0],
+                Name:      block.Labels[1],
+                DeclRange: block.DefRange,
+                TypeRange: block.LabelRanges[0],
+        }
+
+        content, remain, diags := block.Body.PartialContent(dataBlockSchema)
+        r.Config = remain
+
+        if !hclsyntax.ValidIdentifier(r.Type) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid data source name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[0],
+                })
+        }
+        if !hclsyntax.ValidIdentifier(r.Name) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid data resource name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[1],
+                })
+        }
+
+        if attr, exists := content.Attributes["count"]; exists {
+                r.Count = attr.Expr
+        }
+
+        if attr, exists := content.Attributes["for_each"]; exists {
+                r.ForEach = attr.Expr
+                // We currently parse this, but don't yet do anything with it.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved argument name in module block",
+                        Detail:   fmt.Sprintf("The name %q is reserved for use in a future version of Terraform.", attr.Name),
+                        Subject:  &attr.NameRange,
+                })
+        }
+
+        if attr, exists := content.Attributes["provider"]; exists {
+                var providerDiags hcl.Diagnostics
+                r.ProviderConfigRef, providerDiags = decodeProviderConfigRef(attr.Expr, "provider")
+                diags = append(diags, providerDiags...)
+        }
+
+        if attr, exists := content.Attributes["depends_on"]; exists {
+                deps, depsDiags := decodeDependsOn(attr)
+                diags = append(diags, depsDiags...)
+                r.DependsOn = append(r.DependsOn, deps...)
+        }
+
+        for _, block := range content.Blocks {
+                // All of the block types we accept are just reserved for future use, but some get a specialized error message.
+                switch block.Type {
+                case "lifecycle":
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Unsupported lifecycle block",
+                                Detail:   "Data resources do not have lifecycle settings, so a lifecycle block is not allowed.",
+                                Subject:  &block.DefRange,
+                        })
+                default:
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Reserved block type name in data block",
+                                Detail:   fmt.Sprintf("The block type name %q is reserved for use by Terraform in a future version.", block.Type),
+                                Subject:  &block.TypeRange,
+                        })
+                }
+        }
+
+        return r, diags
+}
+
+type ProviderConfigRef struct {
+        Name       string
+        NameRange  hcl.Range
+        Alias      string
+        AliasRange *hcl.Range // nil if alias not set
+}
+
+func decodeProviderConfigRef(expr hcl.Expression, argName string) (*ProviderConfigRef, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        var shimDiags hcl.Diagnostics
+        expr, shimDiags = shimTraversalInString(expr, false)
+        diags = append(diags, shimDiags...)
+
+        traversal, travDiags := hcl.AbsTraversalForExpr(expr)
+
+        // AbsTraversalForExpr produces only generic errors, so we'll discard
+        // the errors given and produce our own with extra context. If we didn't
+        // get any errors then we might still have warnings, though.
+        if !travDiags.HasErrors() {
+                diags = append(diags, travDiags...)
+        }
+
+        if len(traversal) < 1 || len(traversal) > 2 {
+                // A provider reference was given as a string literal in the legacy
+                // configuration language and there are lots of examples out there
+                // showing that usage, so we'll sniff for that situation here and
+                // produce a specialized error message for it to help users find
+                // the new correct form.
+                if exprIsNativeQuotedString(expr) {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid provider configuration reference",
+                                Detail:   "A provider configuration reference must not be given in quotes.",
+                                Subject:  expr.Range().Ptr(),
+                        })
+                        return nil, diags
+                }
+
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid provider configuration reference",
+                        Detail:   fmt.Sprintf("The %s argument requires a provider type name, optionally followed by a period and then a configuration alias.", argName),
+                        Subject:  expr.Range().Ptr(),
+                })
+                return nil, diags
+        }
+
+        ret := &ProviderConfigRef{
+                Name:      traversal.RootName(),
+                NameRange: traversal[0].SourceRange(),
+        }
+
+        if len(traversal) > 1 {
+                aliasStep, ok := traversal[1].(hcl.TraverseAttr)
+                if !ok {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid provider configuration reference",
+                                Detail:   "Provider name must either stand alone or be followed by a period and then a configuration alias.",
+                                Subject:  traversal[1].SourceRange().Ptr(),
+                        })
+                        return ret, diags
+                }
+
+                ret.Alias = aliasStep.Name
+                ret.AliasRange = aliasStep.SourceRange().Ptr()
+        }
+
+        return ret, diags
+}
+
+// Addr returns the provider config address corresponding to the receiving
+// config reference.
+//
+// This is a trivial conversion, essentially just discarding the source
+// location information and keeping just the addressing information.
+func (r *ProviderConfigRef) Addr() addrs.ProviderConfig {
+        return addrs.ProviderConfig{
+                Type:  r.Name,
+                Alias: r.Alias,
+        }
+}
+
+func (r *ProviderConfigRef) String() string {
+        if r == nil {
+                return "<nil>"
+        }
+        if r.Alias != "" {
+                return fmt.Sprintf("%s.%s", r.Name, r.Alias)
+        }
+        return r.Name
+}
+
+var commonResourceAttributes = []hcl.AttributeSchema{
+        {
+                Name: "count",
+        },
+        {
+                Name: "for_each",
+        },
+        {
+                Name: "provider",
+        },
+        {
+                Name: "depends_on",
+        },
+}
+
+var resourceBlockSchema = &hcl.BodySchema{
+        Attributes: commonResourceAttributes,
+        Blocks: []hcl.BlockHeaderSchema{
+                {Type: "locals"}, // reserved for future use
+                {Type: "lifecycle"},
+                {Type: "connection"},
+                {Type: "provisioner", LabelNames: []string{"type"}},
+        },
+}
+
+var dataBlockSchema = &hcl.BodySchema{
+        Attributes: commonResourceAttributes,
+        Blocks: []hcl.BlockHeaderSchema{
+                {Type: "lifecycle"}, // reserved for future use
+                {Type: "locals"},    // reserved for future use
+        },
+}
+
+var resourceLifecycleBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "create_before_destroy",
+                },
+                {
+                        Name: "prevent_destroy",
+                },
+                {
+                        Name: "ignore_changes",
+                },
+        },
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/synth_body.go b/vendor/github.com/hashicorp/terraform/configs/synth_body.go
new file mode 100644
index 0000000..3ae1bff
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/synth_body.go
@@ -0,0 +1,118 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// SynthBody produces a synthetic hcl.Body that behaves as if it had attributes
+// corresponding to the elements given in the values map.
+//
+// This is useful in situations where, for example, values provided on the
+// command line can override values given in configuration, using MergeBodies.
+//
+// The given filename is used in case any diagnostics are returned. Since
+// the created body is synthetic, it is likely that this will not be a "real"
+// filename. For example, if from a command line argument it could be
+// a representation of that argument's name, such as "-var=...".
+func SynthBody(filename string, values map[string]cty.Value) hcl.Body {
+        return synthBody{
+                Filename: filename,
+                Values:   values,
+        }
+}
+
+type synthBody struct {
+        Filename string
+        Values   map[string]cty.Value
+}
+
+func (b synthBody) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) {
+        content, remain, diags := b.PartialContent(schema)
+        remainS := remain.(synthBody)
+        for name := range remainS.Values {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Unsupported attribute",
+                        Detail:   fmt.Sprintf("An attribute named %q is not expected here.", name),
+                        Subject:  b.synthRange().Ptr(),
+                })
+        }
+        return content, diags
+}
+
+func (b synthBody) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        content := &hcl.BodyContent{
+                Attributes:       make(hcl.Attributes),
+                MissingItemRange: b.synthRange(),
+        }
+
+        remainValues := make(map[string]cty.Value)
+        for attrName, val := range b.Values {
+                remainValues[attrName] = val
+        }
+
+        for _, attrS := range schema.Attributes {
+                delete(remainValues, attrS.Name)
+                val, defined := b.Values[attrS.Name]
+                if !defined {
+                        if attrS.Required {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Missing required attribute",
+                                        Detail:   fmt.Sprintf("The attribute %q is required, but no definition was found.", attrS.Name),
+                                        Subject:  b.synthRange().Ptr(),
+                                })
+                        }
+                        continue
+                }
+                content.Attributes[attrS.Name] = b.synthAttribute(attrS.Name, val)
+        }
+
+        // We just ignore blocks altogether, because this body type never has
+        // nested blocks.
+
+        remain := synthBody{
+                Filename: b.Filename,
+                Values:   remainValues,
+        }
+
+        return content, remain, diags
+}
+
+func (b synthBody) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
+        ret := make(hcl.Attributes)
+        for name, val := range b.Values {
+                ret[name] = b.synthAttribute(name, val)
+        }
+        return ret, nil
+}
+
+func (b synthBody) MissingItemRange() hcl.Range {
+        return b.synthRange()
+}
+
+func (b synthBody) synthAttribute(name string, val cty.Value) *hcl.Attribute {
+        rng := b.synthRange()
+        return &hcl.Attribute{
+                Name: name,
+                Expr: &hclsyntax.LiteralValueExpr{
+                        Val:      val,
+                        SrcRange: rng,
+                },
+                NameRange: rng,
+                Range:     rng,
+        }
+}
+
+func (b synthBody) synthRange() hcl.Range {
+        return hcl.Range{
+                Filename: b.Filename,
+                Start:    hcl.Pos{Line: 1, Column: 1},
+                End:      hcl.Pos{Line: 1, Column: 1},
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/util.go b/vendor/github.com/hashicorp/terraform/configs/util.go
new file mode 100644
index 0000000..5fbde43
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/util.go
@@ -0,0 +1,63 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+)
+
+// exprIsNativeQuotedString determines whether the given expression looks like
+// it's a quoted string in the HCL native syntax.
+//
+// This should be used sparingly only for situations where our legacy HCL
+// decoding would've expected a keyword or reference in quotes but our new
+// decoding expects the keyword or reference to be provided directly as
+// an identifier-based expression.
+func exprIsNativeQuotedString(expr hcl.Expression) bool {
+        _, ok := expr.(*hclsyntax.TemplateExpr)
+        return ok
+}
+
+// schemaForOverrides takes a *hcl.BodySchema and produces a new one that is
+// equivalent except that any required attributes are forced to not be required.
+//
+// This is useful for dealing with "override" config files, which are allowed
+// to omit things that they don't wish to override from the main configuration.
+//
+// The returned schema may have some pointers in common with the given schema,
+// so neither the given schema nor the returned schema should be modified after
+// using this function in order to avoid confusion.
+//
+// Overrides are rarely used, so it's recommended to just create the override
+// schema on the fly only when it's needed, rather than storing it in a global
+// variable as we tend to do for a primary schema.
+func schemaForOverrides(schema *hcl.BodySchema) *hcl.BodySchema {
+        ret := &hcl.BodySchema{
+                Attributes: make([]hcl.AttributeSchema, len(schema.Attributes)),
+                Blocks:     schema.Blocks,
+        }
+
+        for i, attrS := range schema.Attributes {
+                ret.Attributes[i] = attrS
+                ret.Attributes[i].Required = false
+        }
+
+        return ret
+}
+
+// schemaWithDynamic takes a *hcl.BodySchema and produces a new one that
+// is equivalent except that it accepts an additional block type "dynamic" with
+// a single label, used to recognize usage of the HCL dynamic block extension.
+func schemaWithDynamic(schema *hcl.BodySchema) *hcl.BodySchema {
+        ret := &hcl.BodySchema{
+                Attributes: schema.Attributes,
+                Blocks:     make([]hcl.BlockHeaderSchema, len(schema.Blocks), len(schema.Blocks)+1),
+        }
+
+        copy(ret.Blocks, schema.Blocks)
+        ret.Blocks = append(ret.Blocks, hcl.BlockHeaderSchema{
+                Type:       "dynamic",
+                LabelNames: []string{"type"},
+        })
+
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/variable_type_hint.go b/vendor/github.com/hashicorp/terraform/configs/variable_type_hint.go
new file mode 100644
index 0000000..204efd1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/variable_type_hint.go
@@ -0,0 +1,45 @@
+package configs
+
+// VariableTypeHint is an enumeration used for the Variable.TypeHint field,
+// which is an incompletely-specified type for the variable which is used
+// as a hint for whether a value provided in an ambiguous context (on the
+// command line or in an environment variable) should be taken literally as a
+// string or parsed as an HCL expression to produce a data structure.
+//
+// The type hint is applied to runtime values as well, but since it does not
+// accurately describe a precise type it is not fully-sufficient to infer
+// the dynamic type of a value passed through a variable.
+//
+// These hints use inaccurate terminology for historical reasons. Full details
+// are in the documentation for each constant in this enumeration, but in
+// summary:
+//
+//     TypeHintString requires a primitive type
+//     TypeHintList requires a type that could be converted to a tuple
+//     TypeHintMap requires a type that could be converted to an object
+type VariableTypeHint rune
+
+//go:generate stringer -type VariableTypeHint
+
+// TypeHintNone indicates the absense of a type hint. Values specified in
+// ambiguous contexts will be treated as literal strings, as if TypeHintString
+// were selected, but no runtime value checks will be applied. This is reasonable
+// type hint for a module that is never intended to be used at the top-level
+// of a configuration, since descendent modules never recieve values from
+// ambiguous contexts.
+const TypeHintNone VariableTypeHint = 0
+
+// TypeHintString spec indicates that a value provided in an ambiguous context
+// should be treated as a literal string, and additionally requires that the
+// runtime value for the variable is of a primitive type (string, number, bool).
+const TypeHintString VariableTypeHint = 'S'
+
+// TypeHintList indicates that a value provided in an ambiguous context should
+// be treated as an HCL expression, and additionally requires that the
+// runtime value for the variable is of an tuple, list, or set type.
+const TypeHintList VariableTypeHint = 'L'
+
+// TypeHintMap indicates that a value provided in an ambiguous context should
+// be treated as an HCL expression, and additionally requires that the
+// runtime value for the variable is of an object or map type.
+const TypeHintMap VariableTypeHint = 'M'
diff --git a/vendor/github.com/hashicorp/terraform/configs/variabletypehint_string.go b/vendor/github.com/hashicorp/terraform/configs/variabletypehint_string.go
new file mode 100644
index 0000000..2b50428
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/variabletypehint_string.go
@@ -0,0 +1,39 @@
+// Code generated by "stringer -type VariableTypeHint"; DO NOT EDIT.
+
+package configs
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[TypeHintNone-0]
+        _ = x[TypeHintString-83]
+        _ = x[TypeHintList-76]
+        _ = x[TypeHintMap-77]
+}
+
+const (
+        _VariableTypeHint_name_0 = "TypeHintNone"
+        _VariableTypeHint_name_1 = "TypeHintListTypeHintMap"
+        _VariableTypeHint_name_2 = "TypeHintString"
+)
+
+var (
+        _VariableTypeHint_index_1 = [...]uint8{0, 12, 23}
+)
+
+func (i VariableTypeHint) String() string {
+        switch {
+        case i == 0:
+                return _VariableTypeHint_name_0
+        case 76 <= i && i <= 77:
+                i -= 76
+                return _VariableTypeHint_name_1[_VariableTypeHint_index_1[i]:_VariableTypeHint_index_1[i+1]]
+        case i == 83:
+                return _VariableTypeHint_name_2
+        default:
+                return "VariableTypeHint(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/version_constraint.go b/vendor/github.com/hashicorp/terraform/configs/version_constraint.go
new file mode 100644
index 0000000..7aa19ef
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/version_constraint.go
@@ -0,0 +1,64 @@
+package configs
+
+import (
+        "fmt"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+)
+
+// VersionConstraint represents a version constraint on some resource
+// (e.g. Terraform Core, a provider, a module, ...) that carries with it
+// a source range so that a helpful diagnostic can be printed in the event
+// that a particular constraint does not match.
+type VersionConstraint struct {
+        Required  version.Constraints
+        DeclRange hcl.Range
+}
+
+func decodeVersionConstraint(attr *hcl.Attribute) (VersionConstraint, hcl.Diagnostics) {
+        ret := VersionConstraint{
+                DeclRange: attr.Range,
+        }
+
+        val, diags := attr.Expr.Value(nil)
+        if diags.HasErrors() {
+                return ret, diags
+        }
+        var err error
+        val, err = convert.Convert(val, cty.String)
+        if err != nil {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid version constraint",
+                        Detail:   fmt.Sprintf("A string value is required for %s.", attr.Name),
+                        Subject:  attr.Expr.Range().Ptr(),
+                })
+                return ret, diags
+        }
+
+        if val.IsNull() {
+                // A null version constraint is strange, but we'll just treat it
+                // like an empty constraint set.
+                return ret, diags
+        }
+
+        constraintStr := val.AsString()
+        constraints, err := version.NewConstraint(constraintStr)
+        if err != nil {
+                // NewConstraint doesn't return user-friendly errors, so we'll just
+                // ignore the provided error and produce our own generic one.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid version constraint",
+                        Detail:   "This string does not use correct version constraint syntax.", // Not very actionable :(
+                        Subject:  attr.Expr.Range().Ptr(),
+                })
+                return ret, diags
+        }
+
+        ret.Required = constraints
+        return ret, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/dag/dag.go b/vendor/github.com/hashicorp/terraform/dag/dag.go
index b7eb10c..77c67ef 100644
--- a/vendor/github.com/hashicorp/terraform/dag/dag.go
+++ b/vendor/github.com/hashicorp/terraform/dag/dag.go
@@ -5,6 +5,8 @@ import (
         "sort"
         "strings"
 
+        "github.com/hashicorp/terraform/tfdiags"
+
         "github.com/hashicorp/go-multierror"
 )
 
@@ -15,7 +17,7 @@ type AcyclicGraph struct {
 }
 
 // WalkFunc is the callback used for walking the graph.
-type WalkFunc func(Vertex) error
+type WalkFunc func(Vertex) tfdiags.Diagnostics
 
 // DepthWalkFunc is a walk function that also receives the current depth of the
 // walk as an argument
@@ -161,9 +163,9 @@ func (g *AcyclicGraph) Cycles() [][]Vertex {
 }
 
 // Walk walks the graph, calling your callback as each node is visited.
-// This will walk nodes in parallel if it can. Because the walk is done
-// in parallel, the error returned will be a multierror.
-func (g *AcyclicGraph) Walk(cb WalkFunc) error {
+// This will walk nodes in parallel if it can. The resulting diagnostics
+// contains problems from all graphs visited, in no particular order.
+func (g *AcyclicGraph) Walk(cb WalkFunc) tfdiags.Diagnostics {
         defer g.debug.BeginOperation(typeWalk, "").End("")
 
         w := &Walker{Callback: cb, Reverse: true}
diff --git a/vendor/github.com/hashicorp/terraform/dag/walk.go b/vendor/github.com/hashicorp/terraform/dag/walk.go
index f03b100..1c926c2 100644
--- a/vendor/github.com/hashicorp/terraform/dag/walk.go
+++ b/vendor/github.com/hashicorp/terraform/dag/walk.go
@@ -2,12 +2,11 @@ package dag
 
 import (
         "errors"
-        "fmt"
         "log"
         "sync"
         "time"
 
-        "github.com/hashicorp/go-multierror"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // Walker is used to walk every vertex of a graph in parallel.
@@ -54,10 +53,15 @@ type Walker struct {
         // if new vertices are added.
         wait sync.WaitGroup
 
-        // errMap contains the errors recorded so far for execution. Reading
-        // and writing should hold errLock.
-        errMap  map[Vertex]error
-        errLock sync.Mutex
+        // diagsMap contains the diagnostics recorded so far for execution,
+        // and upstreamFailed contains all the vertices whose problems were
+        // caused by upstream failures, and thus whose diagnostics should be
+        // excluded from the final set.
+        //
+        // Readers and writers of either map must hold diagsLock.
+        diagsMap       map[Vertex]tfdiags.Diagnostics
+        upstreamFailed map[Vertex]struct{}
+        diagsLock      sync.Mutex
 }
 
 type walkerVertex struct {
@@ -98,31 +102,30 @@ type walkerVertex struct {
 // user-returned error.
 var errWalkUpstream = errors.New("upstream dependency failed")
 
-// Wait waits for the completion of the walk and returns any errors (
-// in the form of a multierror) that occurred. Update should be called
-// to populate the walk with vertices and edges prior to calling this.
+// Wait waits for the completion of the walk and returns diagnostics describing
+// any problems that arose. Update should be called to populate the walk with
+// vertices and edges prior to calling this.
 //
 // Wait will return as soon as all currently known vertices are complete.
 // If you plan on calling Update with more vertices in the future, you
 // should not call Wait until after this is done.
-func (w *Walker) Wait() error {
+func (w *Walker) Wait() tfdiags.Diagnostics {
         // Wait for completion
         w.wait.Wait()
 
-        // Grab the error lock
-        w.errLock.Lock()
-        defer w.errLock.Unlock()
-
-        // Build the error
-        var result error
-        for v, err := range w.errMap {
-                if err != nil && err != errWalkUpstream {
-                        result = multierror.Append(result, fmt.Errorf(
-                                "%s: %s", VertexName(v), err))
+        var diags tfdiags.Diagnostics
+        w.diagsLock.Lock()
+        for v, vDiags := range w.diagsMap {
+                if _, upstream := w.upstreamFailed[v]; upstream {
+                        // Ignore diagnostics for nodes that had failed upstreams, since
+                        // the downstream diagnostics are likely to be redundant.
+                        continue
                 }
+                diags = diags.Append(vDiags)
         }
+        w.diagsLock.Unlock()
 
-        return result
+        return diags
 }
 
 // Update updates the currently executing walk with the given graph.
@@ -136,6 +139,7 @@ func (w *Walker) Wait() error {
 // Multiple Updates can be called in parallel. Update can be called at any
 // time during a walk.
 func (w *Walker) Update(g *AcyclicGraph) {
+        log.Print("[TRACE] dag/walk: updating graph")
         var v, e *Set
         if g != nil {
                 v, e = g.vertices, g.edges
@@ -381,25 +385,34 @@ func (w *Walker) walkVertex(v Vertex, info *walkerVertex) {
         }
 
         // Run our callback or note that our upstream failed
-        var err error
+        var diags tfdiags.Diagnostics
+        var upstreamFailed bool
         if depsSuccess {
-                log.Printf("[TRACE] dag/walk: walking %q", VertexName(v))
-                err = w.Callback(v)
+                log.Printf("[TRACE] dag/walk: visiting %q", VertexName(v))
+                diags = w.Callback(v)
         } else {
-                log.Printf("[TRACE] dag/walk: upstream errored, not walking %q", VertexName(v))
-                err = errWalkUpstream
+                log.Printf("[TRACE] dag/walk: upstream of %q errored, so skipping", VertexName(v))
+                // This won't be displayed to the user because we'll set upstreamFailed,
+                // but we need to ensure there's at least one error in here so that
+                // the failures will cascade downstream.
+                diags = diags.Append(errors.New("upstream dependencies failed"))
+                upstreamFailed = true
         }
 
-        // Record the error
-        if err != nil {
-                w.errLock.Lock()
-                defer w.errLock.Unlock()
-
-                if w.errMap == nil {
-                        w.errMap = make(map[Vertex]error)
-                }
-                w.errMap[v] = err
+        // Record the result (we must do this after execution because we mustn't
+        // hold diagsLock while visiting a vertex.)
+        w.diagsLock.Lock()
+        if w.diagsMap == nil {
+                w.diagsMap = make(map[Vertex]tfdiags.Diagnostics)
+        }
+        w.diagsMap[v] = diags
+        if w.upstreamFailed == nil {
+                w.upstreamFailed = make(map[Vertex]struct{})
         }
+        if upstreamFailed {
+                w.upstreamFailed[v] = struct{}{}
+        }
+        w.diagsLock.Unlock()
 }
 
 func (w *Walker) waitDeps(
@@ -407,6 +420,7 @@ func (w *Walker) waitDeps(
         deps map[Vertex]<-chan struct{},
         doneCh chan<- bool,
         cancelCh <-chan struct{}) {
+
         // For each dependency given to us, wait for it to complete
         for dep, depCh := range deps {
         DepSatisfied:
@@ -423,17 +437,17 @@ func (w *Walker) waitDeps(
                                 return
 
                         case <-time.After(time.Second * 5):
-                                log.Printf("[TRACE] dag/walk: vertex %q, waiting for: %q",
+                                log.Printf("[TRACE] dag/walk: vertex %q is waiting for %q",
                                         VertexName(v), VertexName(dep))
                         }
                 }
         }
 
         // Dependencies satisfied! We need to check if any errored
-        w.errLock.Lock()
-        defer w.errLock.Unlock()
-        for dep, _ := range deps {
-                if w.errMap[dep] != nil {
+        w.diagsLock.Lock()
+        defer w.diagsLock.Unlock()
+        for dep := range deps {
+                if w.diagsMap[dep].HasErrors() {
                         // One of our dependencies failed, so return false
                         doneCh <- false
                         return
diff --git a/vendor/github.com/hashicorp/terraform/helper/didyoumean/name_suggestion.go b/vendor/github.com/hashicorp/terraform/helper/didyoumean/name_suggestion.go
new file mode 100644
index 0000000..54899bc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/didyoumean/name_suggestion.go
@@ -0,0 +1,24 @@
+package didyoumean
+
+import (
+        "github.com/agext/levenshtein"
+)
+
+// NameSuggestion tries to find a name from the given slice of suggested names
+// that is close to the given name and returns it if found. If no suggestion
+// is close enough, returns the empty string.
+//
+// The suggestions are tried in order, so earlier suggestions take precedence
+// if the given string is similar to two or more suggestions.
+//
+// This function is intended to be used with a relatively-small number of
+// suggestions. It's not optimized for hundreds or thousands of them.
+func NameSuggestion(given string, suggestions []string) string {
+        for _, suggestion := range suggestions {
+                dist := levenshtein.Distance(given, suggestion, nil)
+                if dist < 3 { // threshold determined experimentally
+                        return suggestion
+                }
+        }
+        return ""
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/plugin/doc.go b/vendor/github.com/hashicorp/terraform/helper/plugin/doc.go
new file mode 100644
index 0000000..82b5937
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/plugin/doc.go
@@ -0,0 +1,6 @@
+// Package plugin contains types and functions to help Terraform plugins
+// implement the plugin rpc interface.
+// The primary Provider type will be responsible for converting from the grpc
+// wire protocol to the types and methods known to the provider
+// implementations.
+package plugin
diff --git a/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provider.go b/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provider.go
new file mode 100644
index 0000000..510f47f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provider.go
@@ -0,0 +1,1338 @@
+package plugin
+
+import (
+        "encoding/json"
+        "errors"
+        "fmt"
+        "log"
+        "strconv"
+
+        "github.com/zclconf/go-cty/cty"
+        ctyconvert "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/msgpack"
+        context "golang.org/x/net/context"
+
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/helper/schema"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/plugin/convert"
+        "github.com/hashicorp/terraform/terraform"
+)
+
+const newExtraKey = "_new_extra_shim"
+
+// NewGRPCProviderServerShim wraps a terraform.ResourceProvider in a
+// proto.ProviderServer implementation. If the provided provider is not a
+// *schema.Provider, this will return nil,
+func NewGRPCProviderServerShim(p terraform.ResourceProvider) *GRPCProviderServer {
+        sp, ok := p.(*schema.Provider)
+        if !ok {
+                return nil
+        }
+
+        return &GRPCProviderServer{
+                provider: sp,
+        }
+}
+
+// GRPCProviderServer handles the server, or plugin side of the rpc connection.
+type GRPCProviderServer struct {
+        provider *schema.Provider
+}
+
+func (s *GRPCProviderServer) GetSchema(_ context.Context, req *proto.GetProviderSchema_Request) (*proto.GetProviderSchema_Response, error) {
+        // Here we are certain that the provider is being called through grpc, so
+        // make sure the feature flag for helper/schema is set
+        schema.SetProto5()
+
+        resp := &proto.GetProviderSchema_Response{
+                ResourceSchemas:   make(map[string]*proto.Schema),
+                DataSourceSchemas: make(map[string]*proto.Schema),
+        }
+
+        resp.Provider = &proto.Schema{
+                Block: convert.ConfigSchemaToProto(s.getProviderSchemaBlock()),
+        }
+
+        for typ, res := range s.provider.ResourcesMap {
+                resp.ResourceSchemas[typ] = &proto.Schema{
+                        Version: int64(res.SchemaVersion),
+                        Block:   convert.ConfigSchemaToProto(res.CoreConfigSchema()),
+                }
+        }
+
+        for typ, dat := range s.provider.DataSourcesMap {
+                resp.DataSourceSchemas[typ] = &proto.Schema{
+                        Version: int64(dat.SchemaVersion),
+                        Block:   convert.ConfigSchemaToProto(dat.CoreConfigSchema()),
+                }
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) getProviderSchemaBlock() *configschema.Block {
+        return schema.InternalMap(s.provider.Schema).CoreConfigSchema()
+}
+
+func (s *GRPCProviderServer) getResourceSchemaBlock(name string) *configschema.Block {
+        res := s.provider.ResourcesMap[name]
+        return res.CoreConfigSchema()
+}
+
+func (s *GRPCProviderServer) getDatasourceSchemaBlock(name string) *configschema.Block {
+        dat := s.provider.DataSourcesMap[name]
+        return dat.CoreConfigSchema()
+}
+
+func (s *GRPCProviderServer) PrepareProviderConfig(_ context.Context, req *proto.PrepareProviderConfig_Request) (*proto.PrepareProviderConfig_Response, error) {
+        resp := &proto.PrepareProviderConfig_Response{}
+
+        schemaBlock := s.getProviderSchemaBlock()
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // lookup any required, top-level attributes that are Null, and see if we
+        // have a Default value available.
+        configVal, err = cty.Transform(configVal, func(path cty.Path, val cty.Value) (cty.Value, error) {
+                // we're only looking for top-level attributes
+                if len(path) != 1 {
+                        return val, nil
+                }
+
+                // nothing to do if we already have a value
+                if !val.IsNull() {
+                        return val, nil
+                }
+
+                // get the Schema definition for this attribute
+                getAttr, ok := path[0].(cty.GetAttrStep)
+                // these should all exist, but just ignore anything strange
+                if !ok {
+                        return val, nil
+                }
+
+                attrSchema := s.provider.Schema[getAttr.Name]
+                // continue to ignore anything that doesn't match
+                if attrSchema == nil {
+                        return val, nil
+                }
+
+                // this is deprecated, so don't set it
+                if attrSchema.Deprecated != "" || attrSchema.Removed != "" {
+                        return val, nil
+                }
+
+                // find a default value if it exists
+                def, err := attrSchema.DefaultValue()
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, fmt.Errorf("error getting default for %q: %s", getAttr.Name, err))
+                        return val, err
+                }
+
+                // no default
+                if def == nil {
+                        return val, nil
+                }
+
+                // create a cty.Value and make sure it's the correct type
+                tmpVal := hcl2shim.HCL2ValueFromConfigValue(def)
+
+                // helper/schema used to allow setting "" to a bool
+                if val.Type() == cty.Bool && tmpVal.RawEquals(cty.StringVal("")) {
+                        // return a warning about the conversion
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, "provider set empty string as default value for bool "+getAttr.Name)
+                        tmpVal = cty.False
+                }
+
+                val, err = ctyconvert.Convert(tmpVal, val.Type())
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, fmt.Errorf("error setting default for %q: %s", getAttr.Name, err))
+                }
+
+                return val, err
+        })
+        if err != nil {
+                // any error here was already added to the diagnostics
+                return resp, nil
+        }
+
+        configVal, err = schemaBlock.CoerceValue(configVal)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // Ensure there are no nulls that will cause helper/schema to panic.
+        if err := validateConfigNulls(configVal, nil); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, schemaBlock)
+
+        warns, errs := s.provider.Validate(config)
+        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, convert.WarnsAndErrsToProto(warns, errs))
+
+        preparedConfigMP, err := msgpack.Marshal(configVal, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        resp.PreparedConfig = &proto.DynamicValue{Msgpack: preparedConfigMP}
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ValidateResourceTypeConfig(_ context.Context, req *proto.ValidateResourceTypeConfig_Request) (*proto.ValidateResourceTypeConfig_Response, error) {
+        resp := &proto.ValidateResourceTypeConfig_Response{}
+
+        schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, schemaBlock)
+
+        warns, errs := s.provider.ValidateResource(req.TypeName, config)
+        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, convert.WarnsAndErrsToProto(warns, errs))
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ValidateDataSourceConfig(_ context.Context, req *proto.ValidateDataSourceConfig_Request) (*proto.ValidateDataSourceConfig_Response, error) {
+        resp := &proto.ValidateDataSourceConfig_Response{}
+
+        schemaBlock := s.getDatasourceSchemaBlock(req.TypeName)
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // Ensure there are no nulls that will cause helper/schema to panic.
+        if err := validateConfigNulls(configVal, nil); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, schemaBlock)
+
+        warns, errs := s.provider.ValidateDataSource(req.TypeName, config)
+        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, convert.WarnsAndErrsToProto(warns, errs))
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) UpgradeResourceState(_ context.Context, req *proto.UpgradeResourceState_Request) (*proto.UpgradeResourceState_Response, error) {
+        resp := &proto.UpgradeResourceState_Response{}
+
+        res := s.provider.ResourcesMap[req.TypeName]
+        schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
+        version := int(req.Version)
+
+        jsonMap := map[string]interface{}{}
+        var err error
+
+        switch {
+        // We first need to upgrade a flatmap state if it exists.
+        // There should never be both a JSON and Flatmap state in the request.
+        case len(req.RawState.Flatmap) > 0:
+                jsonMap, version, err = s.upgradeFlatmapState(version, req.RawState.Flatmap, res)
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        // if there's a JSON state, we need to decode it.
+        case len(req.RawState.Json) > 0:
+                err = json.Unmarshal(req.RawState.Json, &jsonMap)
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        default:
+                log.Println("[DEBUG] no state provided to upgrade")
+                return resp, nil
+        }
+
+        // complete the upgrade of the JSON states
+        jsonMap, err = s.upgradeJSONState(version, jsonMap, res)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // The provider isn't required to clean out removed fields
+        s.removeAttributes(jsonMap, schemaBlock.ImpliedType())
+
+        // now we need to turn the state into the default json representation, so
+        // that it can be re-decoded using the actual schema.
+        val, err := schema.JSONMapToStateValue(jsonMap, schemaBlock)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // encode the final state to the expected msgpack format
+        newStateMP, err := msgpack.Marshal(val, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        resp.UpgradedState = &proto.DynamicValue{Msgpack: newStateMP}
+        return resp, nil
+}
+
+// upgradeFlatmapState takes a legacy flatmap state, upgrades it using Migrate
+// state if necessary, and converts it to the new JSON state format decoded as a
+// map[string]interface{}.
+// upgradeFlatmapState returns the json map along with the corresponding schema
+// version.
+func (s *GRPCProviderServer) upgradeFlatmapState(version int, m map[string]string, res *schema.Resource) (map[string]interface{}, int, error) {
+        // this will be the version we've upgraded so, defaulting to the given
+        // version in case no migration was called.
+        upgradedVersion := version
+
+        // first determine if we need to call the legacy MigrateState func
+        requiresMigrate := version < res.SchemaVersion
+
+        schemaType := res.CoreConfigSchema().ImpliedType()
+
+        // if there are any StateUpgraders, then we need to only compare
+        // against the first version there
+        if len(res.StateUpgraders) > 0 {
+                requiresMigrate = version < res.StateUpgraders[0].Version
+        }
+
+        if requiresMigrate {
+                if res.MigrateState == nil {
+                        return nil, 0, errors.New("cannot upgrade state, missing MigrateState function")
+                }
+
+                is := &terraform.InstanceState{
+                        ID:         m["id"],
+                        Attributes: m,
+                        Meta: map[string]interface{}{
+                                "schema_version": strconv.Itoa(version),
+                        },
+                }
+
+                is, err := res.MigrateState(version, is, s.provider.Meta())
+                if err != nil {
+                        return nil, 0, err
+                }
+
+                // re-assign the map in case there was a copy made, making sure to keep
+                // the ID
+                m := is.Attributes
+                m["id"] = is.ID
+
+                // if there are further upgraders, then we've only updated that far
+                if len(res.StateUpgraders) > 0 {
+                        schemaType = res.StateUpgraders[0].Type
+                        upgradedVersion = res.StateUpgraders[0].Version
+                }
+        } else {
+                // the schema version may be newer than the MigrateState functions
+                // handled and older than the current, but still stored in the flatmap
+                // form. If that's the case, we need to find the correct schema type to
+                // convert the state.
+                for _, upgrader := range res.StateUpgraders {
+                        if upgrader.Version == version {
+                                schemaType = upgrader.Type
+                                break
+                        }
+                }
+        }
+
+        // now we know the state is up to the latest version that handled the
+        // flatmap format state. Now we can upgrade the format and continue from
+        // there.
+        newConfigVal, err := hcl2shim.HCL2ValueFromFlatmap(m, schemaType)
+        if err != nil {
+                return nil, 0, err
+        }
+
+        jsonMap, err := schema.StateValueToJSONMap(newConfigVal, schemaType)
+        return jsonMap, upgradedVersion, err
+}
+
+func (s *GRPCProviderServer) upgradeJSONState(version int, m map[string]interface{}, res *schema.Resource) (map[string]interface{}, error) {
+        var err error
+
+        for _, upgrader := range res.StateUpgraders {
+                if version != upgrader.Version {
+                        continue
+                }
+
+                m, err = upgrader.Upgrade(m, s.provider.Meta())
+                if err != nil {
+                        return nil, err
+                }
+                version++
+        }
+
+        return m, nil
+}
+
+// Remove any attributes no longer present in the schema, so that the json can
+// be correctly decoded.
+func (s *GRPCProviderServer) removeAttributes(v interface{}, ty cty.Type) {
+        // we're only concerned with finding maps that corespond to object
+        // attributes
+        switch v := v.(type) {
+        case []interface{}:
+                // If these aren't blocks the next call will be a noop
+                if ty.IsListType() || ty.IsSetType() {
+                        eTy := ty.ElementType()
+                        for _, eV := range v {
+                                s.removeAttributes(eV, eTy)
+                        }
+                }
+                return
+        case map[string]interface{}:
+                // map blocks aren't yet supported, but handle this just in case
+                if ty.IsMapType() {
+                        eTy := ty.ElementType()
+                        for _, eV := range v {
+                                s.removeAttributes(eV, eTy)
+                        }
+                        return
+                }
+
+                if ty == cty.DynamicPseudoType {
+                        log.Printf("[DEBUG] ignoring dynamic block: %#v\n", v)
+                        return
+                }
+
+                if !ty.IsObjectType() {
+                        // This shouldn't happen, and will fail to decode further on, so
+                        // there's no need to handle it here.
+                        log.Printf("[WARN] unexpected type %#v for map in json state", ty)
+                        return
+                }
+
+                attrTypes := ty.AttributeTypes()
+                for attr, attrV := range v {
+                        attrTy, ok := attrTypes[attr]
+                        if !ok {
+                                log.Printf("[DEBUG] attribute %q no longer present in schema", attr)
+                                delete(v, attr)
+                                continue
+                        }
+
+                        s.removeAttributes(attrV, attrTy)
+                }
+        }
+}
+
+func (s *GRPCProviderServer) Stop(_ context.Context, _ *proto.Stop_Request) (*proto.Stop_Response, error) {
+        resp := &proto.Stop_Response{}
+
+        err := s.provider.Stop()
+        if err != nil {
+                resp.Error = err.Error()
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) Configure(_ context.Context, req *proto.Configure_Request) (*proto.Configure_Response, error) {
+        resp := &proto.Configure_Response{}
+
+        schemaBlock := s.getProviderSchemaBlock()
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        s.provider.TerraformVersion = req.TerraformVersion
+
+        // Ensure there are no nulls that will cause helper/schema to panic.
+        if err := validateConfigNulls(configVal, nil); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, schemaBlock)
+        err = s.provider.Configure(config)
+        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ReadResource(_ context.Context, req *proto.ReadResource_Request) (*proto.ReadResource_Response, error) {
+        resp := &proto.ReadResource_Response{}
+
+        res := s.provider.ResourcesMap[req.TypeName]
+        schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
+        stateVal, err := msgpack.Unmarshal(req.CurrentState.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        instanceState, err := res.ShimInstanceStateFromValue(stateVal)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        newInstanceState, err := res.RefreshWithoutUpgrade(instanceState, s.provider.Meta())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        if newInstanceState == nil || newInstanceState.ID == "" {
+                // The old provider API used an empty id to signal that the remote
+                // object appears to have been deleted, but our new protocol expects
+                // to see a null value (in the cty sense) in that case.
+                newStateMP, err := msgpack.Marshal(cty.NullVal(schemaBlock.ImpliedType()), schemaBlock.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                }
+                resp.NewState = &proto.DynamicValue{
+                        Msgpack: newStateMP,
+                }
+                return resp, nil
+        }
+
+        // helper/schema should always copy the ID over, but do it again just to be safe
+        newInstanceState.Attributes["id"] = newInstanceState.ID
+
+        newStateVal, err := hcl2shim.HCL2ValueFromFlatmap(newInstanceState.Attributes, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        newStateVal = normalizeNullValues(newStateVal, stateVal, false)
+        newStateVal = copyTimeoutValues(newStateVal, stateVal)
+
+        newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        resp.NewState = &proto.DynamicValue{
+                Msgpack: newStateMP,
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) PlanResourceChange(_ context.Context, req *proto.PlanResourceChange_Request) (*proto.PlanResourceChange_Response, error) {
+        resp := &proto.PlanResourceChange_Response{}
+
+        // This is a signal to Terraform Core that we're doing the best we can to
+        // shim the legacy type system of the SDK onto the Terraform type system
+        // but we need it to cut us some slack. This setting should not be taken
+        // forward to any new SDK implementations, since setting it prevents us
+        // from catching certain classes of provider bug that can lead to
+        // confusing downstream errors.
+        resp.LegacyTypeSystem = true
+
+        res := s.provider.ResourcesMap[req.TypeName]
+        schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
+        priorStateVal, err := msgpack.Unmarshal(req.PriorState.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        create := priorStateVal.IsNull()
+
+        proposedNewStateVal, err := msgpack.Unmarshal(req.ProposedNewState.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // We don't usually plan destroys, but this can return early in any case.
+        if proposedNewStateVal.IsNull() {
+                resp.PlannedState = req.ProposedNewState
+                return resp, nil
+        }
+
+        info := &terraform.InstanceInfo{
+                Type: req.TypeName,
+        }
+
+        priorState, err := res.ShimInstanceStateFromValue(priorStateVal)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        priorPrivate := make(map[string]interface{})
+        if len(req.PriorPrivate) > 0 {
+                if err := json.Unmarshal(req.PriorPrivate, &priorPrivate); err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        }
+
+        priorState.Meta = priorPrivate
+
+        // Ensure there are no nulls that will cause helper/schema to panic.
+        if err := validateConfigNulls(proposedNewStateVal, nil); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // turn the proposed state into a legacy configuration
+        cfg := terraform.NewResourceConfigShimmed(proposedNewStateVal, schemaBlock)
+
+        diff, err := s.provider.SimpleDiff(info, priorState, cfg)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // if this is a new instance, we need to make sure ID is going to be computed
+        if create {
+                if diff == nil {
+                        diff = terraform.NewInstanceDiff()
+                }
+
+                diff.Attributes["id"] = &terraform.ResourceAttrDiff{
+                        NewComputed: true,
+                }
+        }
+
+        if diff == nil || len(diff.Attributes) == 0 {
+                // schema.Provider.Diff returns nil if it ends up making a diff with no
+                // changes, but our new interface wants us to return an actual change
+                // description that _shows_ there are no changes. This is always the
+                // prior state, because we force a diff above if this is a new instance.
+                resp.PlannedState = req.PriorState
+                return resp, nil
+        }
+
+        if priorState == nil {
+                priorState = &terraform.InstanceState{}
+        }
+
+        // now we need to apply the diff to the prior state, so get the planned state
+        plannedAttrs, err := diff.Apply(priorState.Attributes, schemaBlock)
+
+        plannedStateVal, err := hcl2shim.HCL2ValueFromFlatmap(plannedAttrs, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        plannedStateVal, err = schemaBlock.CoerceValue(plannedStateVal)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        plannedStateVal = normalizeNullValues(plannedStateVal, proposedNewStateVal, false)
+
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        plannedStateVal = copyTimeoutValues(plannedStateVal, proposedNewStateVal)
+
+        // The old SDK code has some imprecisions that cause it to sometimes
+        // generate differences that the SDK itself does not consider significant
+        // but Terraform Core would. To avoid producing weird do-nothing diffs
+        // in that case, we'll check if the provider as produced something we
+        // think is "equivalent" to the prior state and just return the prior state
+        // itself if so, thus ensuring that Terraform Core will treat this as
+        // a no-op. See the docs for ValuesSDKEquivalent for some caveats on its
+        // accuracy.
+        forceNoChanges := false
+        if hcl2shim.ValuesSDKEquivalent(priorStateVal, plannedStateVal) {
+                plannedStateVal = priorStateVal
+                forceNoChanges = true
+        }
+
+        // if this was creating the resource, we need to set any remaining computed
+        // fields
+        if create {
+                plannedStateVal = SetUnknowns(plannedStateVal, schemaBlock)
+        }
+
+        plannedMP, err := msgpack.Marshal(plannedStateVal, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        resp.PlannedState = &proto.DynamicValue{
+                Msgpack: plannedMP,
+        }
+
+        // Now we need to store any NewExtra values, which are where any actual
+        // StateFunc modified config fields are hidden.
+        privateMap := diff.Meta
+        if privateMap == nil {
+                privateMap = map[string]interface{}{}
+        }
+
+        newExtra := map[string]interface{}{}
+
+        for k, v := range diff.Attributes {
+                if v.NewExtra != nil {
+                        newExtra[k] = v.NewExtra
+                }
+        }
+        privateMap[newExtraKey] = newExtra
+
+        // the Meta field gets encoded into PlannedPrivate
+        plannedPrivate, err := json.Marshal(privateMap)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        resp.PlannedPrivate = plannedPrivate
+
+        // collect the attributes that require instance replacement, and convert
+        // them to cty.Paths.
+        var requiresNew []string
+        if !forceNoChanges {
+                for attr, d := range diff.Attributes {
+                        if d.RequiresNew {
+                                requiresNew = append(requiresNew, attr)
+                        }
+                }
+        }
+
+        // If anything requires a new resource already, or the "id" field indicates
+        // that we will be creating a new resource, then we need to add that to
+        // RequiresReplace so that core can tell if the instance is being replaced
+        // even if changes are being suppressed via "ignore_changes".
+        id := plannedStateVal.GetAttr("id")
+        if len(requiresNew) > 0 || id.IsNull() || !id.IsKnown() {
+                requiresNew = append(requiresNew, "id")
+        }
+
+        requiresReplace, err := hcl2shim.RequiresReplace(requiresNew, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // convert these to the protocol structures
+        for _, p := range requiresReplace {
+                resp.RequiresReplace = append(resp.RequiresReplace, pathToAttributePath(p))
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ApplyResourceChange(_ context.Context, req *proto.ApplyResourceChange_Request) (*proto.ApplyResourceChange_Response, error) {
+        resp := &proto.ApplyResourceChange_Response{
+                // Start with the existing state as a fallback
+                NewState: req.PriorState,
+        }
+
+        res := s.provider.ResourcesMap[req.TypeName]
+        schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
+        priorStateVal, err := msgpack.Unmarshal(req.PriorState.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        plannedStateVal, err := msgpack.Unmarshal(req.PlannedState.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        info := &terraform.InstanceInfo{
+                Type: req.TypeName,
+        }
+
+        priorState, err := res.ShimInstanceStateFromValue(priorStateVal)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        private := make(map[string]interface{})
+        if len(req.PlannedPrivate) > 0 {
+                if err := json.Unmarshal(req.PlannedPrivate, &private); err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        }
+
+        var diff *terraform.InstanceDiff
+        destroy := false
+
+        // a null state means we are destroying the instance
+        if plannedStateVal.IsNull() {
+                destroy = true
+                diff = &terraform.InstanceDiff{
+                        Attributes: make(map[string]*terraform.ResourceAttrDiff),
+                        Meta:       make(map[string]interface{}),
+                        Destroy:    true,
+                }
+        } else {
+                diff, err = schema.DiffFromValues(priorStateVal, plannedStateVal, stripResourceModifiers(res))
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        }
+
+        if diff == nil {
+                diff = &terraform.InstanceDiff{
+                        Attributes: make(map[string]*terraform.ResourceAttrDiff),
+                        Meta:       make(map[string]interface{}),
+                }
+        }
+
+        // add NewExtra Fields that may have been stored in the private data
+        if newExtra := private[newExtraKey]; newExtra != nil {
+                for k, v := range newExtra.(map[string]interface{}) {
+                        d := diff.Attributes[k]
+
+                        if d == nil {
+                                d = &terraform.ResourceAttrDiff{}
+                        }
+
+                        d.NewExtra = v
+                        diff.Attributes[k] = d
+                }
+        }
+
+        if private != nil {
+                diff.Meta = private
+        }
+
+        for k, d := range diff.Attributes {
+                // We need to turn off any RequiresNew. There could be attributes
+                // without changes in here inserted by helper/schema, but if they have
+                // RequiresNew then the state will be dropped from the ResourceData.
+                d.RequiresNew = false
+
+                // Check that any "removed" attributes that don't actually exist in the
+                // prior state, or helper/schema will confuse itself
+                if d.NewRemoved {
+                        if _, ok := priorState.Attributes[k]; !ok {
+                                delete(diff.Attributes, k)
+                        }
+                }
+        }
+
+        newInstanceState, err := s.provider.Apply(info, priorState, diff)
+        // we record the error here, but continue processing any returned state.
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+        }
+        newStateVal := cty.NullVal(schemaBlock.ImpliedType())
+
+        // Always return a null value for destroy.
+        // While this is usually indicated by a nil state, check for missing ID or
+        // attributes in the case of a provider failure.
+        if destroy || newInstanceState == nil || newInstanceState.Attributes == nil || newInstanceState.ID == "" {
+                newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+                resp.NewState = &proto.DynamicValue{
+                        Msgpack: newStateMP,
+                }
+                return resp, nil
+        }
+
+        // We keep the null val if we destroyed the resource, otherwise build the
+        // entire object, even if the new state was nil.
+        newStateVal, err = schema.StateValueFromInstanceState(newInstanceState, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        newStateVal = normalizeNullValues(newStateVal, plannedStateVal, true)
+
+        newStateVal = copyTimeoutValues(newStateVal, plannedStateVal)
+
+        newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        resp.NewState = &proto.DynamicValue{
+                Msgpack: newStateMP,
+        }
+
+        meta, err := json.Marshal(newInstanceState.Meta)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        resp.Private = meta
+
+        // This is a signal to Terraform Core that we're doing the best we can to
+        // shim the legacy type system of the SDK onto the Terraform type system
+        // but we need it to cut us some slack. This setting should not be taken
+        // forward to any new SDK implementations, since setting it prevents us
+        // from catching certain classes of provider bug that can lead to
+        // confusing downstream errors.
+        resp.LegacyTypeSystem = true
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ImportResourceState(_ context.Context, req *proto.ImportResourceState_Request) (*proto.ImportResourceState_Response, error) {
+        resp := &proto.ImportResourceState_Response{}
+
+        info := &terraform.InstanceInfo{
+                Type: req.TypeName,
+        }
+
+        newInstanceStates, err := s.provider.ImportState(info, req.Id)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        for _, is := range newInstanceStates {
+                // copy the ID again just to be sure it wasn't missed
+                is.Attributes["id"] = is.ID
+
+                resourceType := is.Ephemeral.Type
+                if resourceType == "" {
+                        resourceType = req.TypeName
+                }
+
+                schemaBlock := s.getResourceSchemaBlock(resourceType)
+                newStateVal, err := hcl2shim.HCL2ValueFromFlatmap(is.Attributes, schemaBlock.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+
+                newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+
+                meta, err := json.Marshal(is.Meta)
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+
+                importedResource := &proto.ImportResourceState_ImportedResource{
+                        TypeName: resourceType,
+                        State: &proto.DynamicValue{
+                                Msgpack: newStateMP,
+                        },
+                        Private: meta,
+                }
+
+                resp.ImportedResources = append(resp.ImportedResources, importedResource)
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ReadDataSource(_ context.Context, req *proto.ReadDataSource_Request) (*proto.ReadDataSource_Response, error) {
+        resp := &proto.ReadDataSource_Response{}
+
+        schemaBlock := s.getDatasourceSchemaBlock(req.TypeName)
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        info := &terraform.InstanceInfo{
+                Type: req.TypeName,
+        }
+
+        // Ensure there are no nulls that will cause helper/schema to panic.
+        if err := validateConfigNulls(configVal, nil); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, schemaBlock)
+
+        // we need to still build the diff separately with the Read method to match
+        // the old behavior
+        diff, err := s.provider.ReadDataDiff(info, config)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // now we can get the new complete data source
+        newInstanceState, err := s.provider.ReadDataApply(info, diff)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        newStateVal, err := schema.StateValueFromInstanceState(newInstanceState, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        newStateVal = copyTimeoutValues(newStateVal, configVal)
+
+        newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        resp.State = &proto.DynamicValue{
+                Msgpack: newStateMP,
+        }
+        return resp, nil
+}
+
+func pathToAttributePath(path cty.Path) *proto.AttributePath {
+        var steps []*proto.AttributePath_Step
+
+        for _, step := range path {
+                switch s := step.(type) {
+                case cty.GetAttrStep:
+                        steps = append(steps, &proto.AttributePath_Step{
+                                Selector: &proto.AttributePath_Step_AttributeName{
+                                        AttributeName: s.Name,
+                                },
+                        })
+                case cty.IndexStep:
+                        ty := s.Key.Type()
+                        switch ty {
+                        case cty.Number:
+                                i, _ := s.Key.AsBigFloat().Int64()
+                                steps = append(steps, &proto.AttributePath_Step{
+                                        Selector: &proto.AttributePath_Step_ElementKeyInt{
+                                                ElementKeyInt: i,
+                                        },
+                                })
+                        case cty.String:
+                                steps = append(steps, &proto.AttributePath_Step{
+                                        Selector: &proto.AttributePath_Step_ElementKeyString{
+                                                ElementKeyString: s.Key.AsString(),
+                                        },
+                                })
+                        }
+                }
+        }
+
+        return &proto.AttributePath{Steps: steps}
+}
+
+// helper/schema throws away timeout values from the config and stores them in
+// the Private/Meta fields. we need to copy those values into the planned state
+// so that core doesn't see a perpetual diff with the timeout block.
+func copyTimeoutValues(to cty.Value, from cty.Value) cty.Value {
+        // if `to` is null we are planning to remove it altogether.
+        if to.IsNull() {
+                return to
+        }
+        toAttrs := to.AsValueMap()
+        // We need to remove the key since the hcl2shims will add a non-null block
+        // because we can't determine if a single block was null from the flatmapped
+        // values. This needs to conform to the correct schema for marshaling, so
+        // change the value to null rather than deleting it from the object map.
+        timeouts, ok := toAttrs[schema.TimeoutsConfigKey]
+        if ok {
+                toAttrs[schema.TimeoutsConfigKey] = cty.NullVal(timeouts.Type())
+        }
+
+        // if from is null then there are no timeouts to copy
+        if from.IsNull() {
+                return cty.ObjectVal(toAttrs)
+        }
+
+        fromAttrs := from.AsValueMap()
+        timeouts, ok = fromAttrs[schema.TimeoutsConfigKey]
+
+        // timeouts shouldn't be unknown, but don't copy possibly invalid values either
+        if !ok || timeouts.IsNull() || !timeouts.IsWhollyKnown() {
+                // no timeouts block to copy
+                return cty.ObjectVal(toAttrs)
+        }
+
+        toAttrs[schema.TimeoutsConfigKey] = timeouts
+
+        return cty.ObjectVal(toAttrs)
+}
+
+// stripResourceModifiers takes a *schema.Resource and returns a deep copy with all
+// StateFuncs and CustomizeDiffs removed. This will be used during apply to
+// create a diff from a planned state where the diff modifications have already
+// been applied.
+func stripResourceModifiers(r *schema.Resource) *schema.Resource {
+        if r == nil {
+                return nil
+        }
+        // start with a shallow copy
+        newResource := new(schema.Resource)
+        *newResource = *r
+
+        newResource.CustomizeDiff = nil
+        newResource.Schema = map[string]*schema.Schema{}
+
+        for k, s := range r.Schema {
+                newResource.Schema[k] = stripSchema(s)
+        }
+
+        return newResource
+}
+
+func stripSchema(s *schema.Schema) *schema.Schema {
+        if s == nil {
+                return nil
+        }
+        // start with a shallow copy
+        newSchema := new(schema.Schema)
+        *newSchema = *s
+
+        newSchema.StateFunc = nil
+
+        switch e := newSchema.Elem.(type) {
+        case *schema.Schema:
+                newSchema.Elem = stripSchema(e)
+        case *schema.Resource:
+                newSchema.Elem = stripResourceModifiers(e)
+        }
+
+        return newSchema
+}
+
+// Zero values and empty containers may be interchanged by the apply process.
+// When there is a discrepency between src and dst value being null or empty,
+// prefer the src value. This takes a little more liberty with set types, since
+// we can't correlate modified set values. In the case of sets, if the src set
+// was wholly known we assume the value was correctly applied and copy that
+// entirely to the new value.
+// While apply prefers the src value, during plan we prefer dst whenever there
+// is an unknown or a set is involved, since the plan can alter the value
+// however it sees fit. This however means that a CustomizeDiffFunction may not
+// be able to change a null to an empty value or vice versa, but that should be
+// very uncommon nor was it reliable before 0.12 either.
+func normalizeNullValues(dst, src cty.Value, apply bool) cty.Value {
+        ty := dst.Type()
+        if !src.IsNull() && !src.IsKnown() {
+                // Return src during plan to retain unknown interpolated placeholders,
+                // which could be lost if we're only updating a resource. If this is a
+                // read scenario, then there shouldn't be any unknowns at all.
+                if dst.IsNull() && !apply {
+                        return src
+                }
+                return dst
+        }
+
+        // Handle null/empty changes for collections during apply.
+        // A change between null and empty values prefers src to make sure the state
+        // is consistent between plan and apply.
+        if ty.IsCollectionType() && apply {
+                dstEmpty := !dst.IsNull() && dst.IsKnown() && dst.LengthInt() == 0
+                srcEmpty := !src.IsNull() && src.IsKnown() && src.LengthInt() == 0
+
+                if (src.IsNull() && dstEmpty) || (srcEmpty && dst.IsNull()) {
+                        return src
+                }
+        }
+
+        if src.IsNull() || !src.IsKnown() || !dst.IsKnown() {
+                return dst
+        }
+
+        switch {
+        case ty.IsMapType(), ty.IsObjectType():
+                var dstMap map[string]cty.Value
+                if !dst.IsNull() {
+                        dstMap = dst.AsValueMap()
+                }
+                if dstMap == nil {
+                        dstMap = map[string]cty.Value{}
+                }
+
+                srcMap := src.AsValueMap()
+                for key, v := range srcMap {
+                        dstVal, ok := dstMap[key]
+                        if !ok && apply && ty.IsMapType() {
+                                // don't transfer old map values to dst during apply
+                                continue
+                        }
+
+                        if dstVal == cty.NilVal {
+                                if !apply && ty.IsMapType() {
+                                        // let plan shape this map however it wants
+                                        continue
+                                }
+                                dstVal = cty.NullVal(v.Type())
+                        }
+
+                        dstMap[key] = normalizeNullValues(dstVal, v, apply)
+                }
+
+                // you can't call MapVal/ObjectVal with empty maps, but nothing was
+                // copied in anyway. If the dst is nil, and the src is known, assume the
+                // src is correct.
+                if len(dstMap) == 0 {
+                        if dst.IsNull() && src.IsWhollyKnown() && apply {
+                                return src
+                        }
+                        return dst
+                }
+
+                if ty.IsMapType() {
+                        // helper/schema will populate an optional+computed map with
+                        // unknowns which we have to fixup here.
+                        // It would be preferable to simply prevent any known value from
+                        // becoming unknown, but concessions have to be made to retain the
+                        // broken legacy behavior when possible.
+                        for k, srcVal := range srcMap {
+                                if !srcVal.IsNull() && srcVal.IsKnown() {
+                                        dstVal, ok := dstMap[k]
+                                        if !ok {
+                                                continue
+                                        }
+
+                                        if !dstVal.IsNull() && !dstVal.IsKnown() {
+                                                dstMap[k] = srcVal
+                                        }
+                                }
+                        }
+
+                        return cty.MapVal(dstMap)
+                }
+
+                return cty.ObjectVal(dstMap)
+
+        case ty.IsSetType():
+                // If the original was wholly known, then we expect that is what the
+                // provider applied. The apply process loses too much information to
+                // reliably re-create the set.
+                if src.IsWhollyKnown() && apply {
+                        return src
+                }
+
+        case ty.IsListType(), ty.IsTupleType():
+                // If the dst is null, and the src is known, then we lost an empty value
+                // so take the original.
+                if dst.IsNull() {
+                        if src.IsWhollyKnown() && src.LengthInt() == 0 && apply {
+                                return src
+                        }
+
+                        // if dst is null and src only contains unknown values, then we lost
+                        // those during a read or plan.
+                        if !apply && !src.IsNull() {
+                                allUnknown := true
+                                for _, v := range src.AsValueSlice() {
+                                        if v.IsKnown() {
+                                                allUnknown = false
+                                                break
+                                        }
+                                }
+                                if allUnknown {
+                                        return src
+                                }
+                        }
+
+                        return dst
+                }
+
+                // if the lengths are identical, then iterate over each element in succession.
+                srcLen := src.LengthInt()
+                dstLen := dst.LengthInt()
+                if srcLen == dstLen && srcLen > 0 {
+                        srcs := src.AsValueSlice()
+                        dsts := dst.AsValueSlice()
+
+                        for i := 0; i < srcLen; i++ {
+                                dsts[i] = normalizeNullValues(dsts[i], srcs[i], apply)
+                        }
+
+                        if ty.IsTupleType() {
+                                return cty.TupleVal(dsts)
+                        }
+                        return cty.ListVal(dsts)
+                }
+
+        case ty.IsPrimitiveType():
+                if dst.IsNull() && src.IsWhollyKnown() && apply {
+                        return src
+                }
+        }
+
+        return dst
+}
+
+// validateConfigNulls checks a config value for unsupported nulls before
+// attempting to shim the value. While null values can mostly be ignored in the
+// configuration, since they're not supported in HCL1, the case where a null
+// appears in a list-like attribute (list, set, tuple) will present a nil value
+// to helper/schema which can panic. Return an error to the user in this case,
+// indicating the attribute with the null value.
+func validateConfigNulls(v cty.Value, path cty.Path) []*proto.Diagnostic {
+        var diags []*proto.Diagnostic
+        if v.IsNull() || !v.IsKnown() {
+                return diags
+        }
+
+        switch {
+        case v.Type().IsListType() || v.Type().IsSetType() || v.Type().IsTupleType():
+                it := v.ElementIterator()
+                for it.Next() {
+                        kv, ev := it.Element()
+                        if ev.IsNull() {
+                                diags = append(diags, &proto.Diagnostic{
+                                        Severity:  proto.Diagnostic_ERROR,
+                                        Summary:   "Null value found in list",
+                                        Detail:    "Null values are not allowed for this attribute value.",
+                                        Attribute: convert.PathToAttributePath(append(path, cty.IndexStep{Key: kv})),
+                                })
+                                continue
+                        }
+
+                        d := validateConfigNulls(ev, append(path, cty.IndexStep{Key: kv}))
+                        diags = convert.AppendProtoDiag(diags, d)
+                }
+
+        case v.Type().IsMapType() || v.Type().IsObjectType():
+                it := v.ElementIterator()
+                for it.Next() {
+                        kv, ev := it.Element()
+                        var step cty.PathStep
+                        switch {
+                        case v.Type().IsMapType():
+                                step = cty.IndexStep{Key: kv}
+                        case v.Type().IsObjectType():
+                                step = cty.GetAttrStep{Name: kv.AsString()}
+                        }
+                        d := validateConfigNulls(ev, append(path, step))
+                        diags = convert.AppendProtoDiag(diags, d)
+                }
+        }
+
+        return diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provisioner.go b/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provisioner.go
new file mode 100644
index 0000000..14494e4
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provisioner.go
@@ -0,0 +1,147 @@
+package plugin
+
+import (
+        "log"
+
+        "github.com/hashicorp/terraform/helper/schema"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/plugin/convert"
+        "github.com/hashicorp/terraform/terraform"
+        "github.com/zclconf/go-cty/cty"
+        ctyconvert "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/msgpack"
+        context "golang.org/x/net/context"
+)
+
+// NewGRPCProvisionerServerShim wraps a terraform.ResourceProvisioner in a
+// proto.ProvisionerServer implementation. If the provided provisioner is not a
+// *schema.Provisioner, this will return nil,
+func NewGRPCProvisionerServerShim(p terraform.ResourceProvisioner) *GRPCProvisionerServer {
+        sp, ok := p.(*schema.Provisioner)
+        if !ok {
+                return nil
+        }
+        return &GRPCProvisionerServer{
+                provisioner: sp,
+        }
+}
+
+type GRPCProvisionerServer struct {
+        provisioner *schema.Provisioner
+}
+
+func (s *GRPCProvisionerServer) GetSchema(_ context.Context, req *proto.GetProvisionerSchema_Request) (*proto.GetProvisionerSchema_Response, error) {
+        resp := &proto.GetProvisionerSchema_Response{}
+
+        resp.Provisioner = &proto.Schema{
+                Block: convert.ConfigSchemaToProto(schema.InternalMap(s.provisioner.Schema).CoreConfigSchema()),
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProvisionerServer) ValidateProvisionerConfig(_ context.Context, req *proto.ValidateProvisionerConfig_Request) (*proto.ValidateProvisionerConfig_Response, error) {
+        resp := &proto.ValidateProvisionerConfig_Response{}
+
+        cfgSchema := schema.InternalMap(s.provisioner.Schema).CoreConfigSchema()
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, cfgSchema.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, cfgSchema)
+
+        warns, errs := s.provisioner.Validate(config)
+        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, convert.WarnsAndErrsToProto(warns, errs))
+
+        return resp, nil
+}
+
+// stringMapFromValue converts a cty.Value to a map[stirng]string.
+// This will panic if the val is not a cty.Map(cty.String).
+func stringMapFromValue(val cty.Value) map[string]string {
+        m := map[string]string{}
+        if val.IsNull() || !val.IsKnown() {
+                return m
+        }
+
+        for it := val.ElementIterator(); it.Next(); {
+                ak, av := it.Element()
+                name := ak.AsString()
+
+                if !av.IsKnown() || av.IsNull() {
+                        continue
+                }
+
+                av, _ = ctyconvert.Convert(av, cty.String)
+                m[name] = av.AsString()
+        }
+
+        return m
+}
+
+// uiOutput implements the terraform.UIOutput interface to adapt the grpc
+// stream to the legacy Provisioner.Apply method.
+type uiOutput struct {
+        srv proto.Provisioner_ProvisionResourceServer
+}
+
+func (o uiOutput) Output(s string) {
+        err := o.srv.Send(&proto.ProvisionResource_Response{
+                Output: s,
+        })
+        if err != nil {
+                log.Printf("[ERROR] %s", err)
+        }
+}
+
+func (s *GRPCProvisionerServer) ProvisionResource(req *proto.ProvisionResource_Request, srv proto.Provisioner_ProvisionResourceServer) error {
+        // We send back a diagnostics over the stream if there was a
+        // provisioner-side problem.
+        srvResp := &proto.ProvisionResource_Response{}
+
+        cfgSchema := schema.InternalMap(s.provisioner.Schema).CoreConfigSchema()
+        cfgVal, err := msgpack.Unmarshal(req.Config.Msgpack, cfgSchema.ImpliedType())
+        if err != nil {
+                srvResp.Diagnostics = convert.AppendProtoDiag(srvResp.Diagnostics, err)
+                srv.Send(srvResp)
+                return nil
+        }
+        resourceConfig := terraform.NewResourceConfigShimmed(cfgVal, cfgSchema)
+
+        connVal, err := msgpack.Unmarshal(req.Connection.Msgpack, cty.Map(cty.String))
+        if err != nil {
+                srvResp.Diagnostics = convert.AppendProtoDiag(srvResp.Diagnostics, err)
+                srv.Send(srvResp)
+                return nil
+        }
+
+        conn := stringMapFromValue(connVal)
+
+        instanceState := &terraform.InstanceState{
+                Ephemeral: terraform.EphemeralState{
+                        ConnInfo: conn,
+                },
+                Meta: make(map[string]interface{}),
+        }
+
+        err = s.provisioner.Apply(uiOutput{srv}, instanceState, resourceConfig)
+        if err != nil {
+                srvResp.Diagnostics = convert.AppendProtoDiag(srvResp.Diagnostics, err)
+                srv.Send(srvResp)
+        }
+        return nil
+}
+
+func (s *GRPCProvisionerServer) Stop(_ context.Context, req *proto.Stop_Request) (*proto.Stop_Response, error) {
+        resp := &proto.Stop_Response{}
+
+        err := s.provisioner.Stop()
+        if err != nil {
+                resp.Error = err.Error()
+        }
+
+        return resp, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/plugin/unknown.go b/vendor/github.com/hashicorp/terraform/helper/plugin/unknown.go
new file mode 100644
index 0000000..64a6784
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/plugin/unknown.go
@@ -0,0 +1,131 @@
+package plugin
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// SetUnknowns takes a cty.Value, and compares it to the schema setting any null
+// values which are computed to unknown.
+func SetUnknowns(val cty.Value, schema *configschema.Block) cty.Value {
+        if !val.IsKnown() {
+                return val
+        }
+
+        // If the object was null, we still need to handle the top level attributes
+        // which might be computed, but we don't need to expand the blocks.
+        if val.IsNull() {
+                objMap := map[string]cty.Value{}
+                allNull := true
+                for name, attr := range schema.Attributes {
+                        switch {
+                        case attr.Computed:
+                                objMap[name] = cty.UnknownVal(attr.Type)
+                                allNull = false
+                        default:
+                                objMap[name] = cty.NullVal(attr.Type)
+                        }
+                }
+
+                // If this object has no unknown attributes, then we can leave it null.
+                if allNull {
+                        return val
+                }
+
+                return cty.ObjectVal(objMap)
+        }
+
+        valMap := val.AsValueMap()
+        newVals := make(map[string]cty.Value)
+
+        for name, attr := range schema.Attributes {
+                v := valMap[name]
+
+                if attr.Computed && v.IsNull() {
+                        newVals[name] = cty.UnknownVal(attr.Type)
+                        continue
+                }
+
+                newVals[name] = v
+        }
+
+        for name, blockS := range schema.BlockTypes {
+                blockVal := valMap[name]
+                if blockVal.IsNull() || !blockVal.IsKnown() {
+                        newVals[name] = blockVal
+                        continue
+                }
+
+                blockValType := blockVal.Type()
+                blockElementType := blockS.Block.ImpliedType()
+
+                // This switches on the value type here, so we can correctly switch
+                // between Tuples/Lists and Maps/Objects.
+                switch {
+                case blockS.Nesting == configschema.NestingSingle || blockS.Nesting == configschema.NestingGroup:
+                        // NestingSingle is the only exception here, where we treat the
+                        // block directly as an object
+                        newVals[name] = SetUnknowns(blockVal, &blockS.Block)
+
+                case blockValType.IsSetType(), blockValType.IsListType(), blockValType.IsTupleType():
+                        listVals := blockVal.AsValueSlice()
+                        newListVals := make([]cty.Value, 0, len(listVals))
+
+                        for _, v := range listVals {
+                                newListVals = append(newListVals, SetUnknowns(v, &blockS.Block))
+                        }
+
+                        switch {
+                        case blockValType.IsSetType():
+                                switch len(newListVals) {
+                                case 0:
+                                        newVals[name] = cty.SetValEmpty(blockElementType)
+                                default:
+                                        newVals[name] = cty.SetVal(newListVals)
+                                }
+                        case blockValType.IsListType():
+                                switch len(newListVals) {
+                                case 0:
+                                        newVals[name] = cty.ListValEmpty(blockElementType)
+                                default:
+                                        newVals[name] = cty.ListVal(newListVals)
+                                }
+                        case blockValType.IsTupleType():
+                                newVals[name] = cty.TupleVal(newListVals)
+                        }
+
+                case blockValType.IsMapType(), blockValType.IsObjectType():
+                        mapVals := blockVal.AsValueMap()
+                        newMapVals := make(map[string]cty.Value)
+
+                        for k, v := range mapVals {
+                                newMapVals[k] = SetUnknowns(v, &blockS.Block)
+                        }
+
+                        switch {
+                        case blockValType.IsMapType():
+                                switch len(newMapVals) {
+                                case 0:
+                                        newVals[name] = cty.MapValEmpty(blockElementType)
+                                default:
+                                        newVals[name] = cty.MapVal(newMapVals)
+                                }
+                        case blockValType.IsObjectType():
+                                if len(newMapVals) == 0 {
+                                        // We need to populate empty values to make a valid object.
+                                        for attr, ty := range blockElementType.AttributeTypes() {
+                                                newMapVals[attr] = cty.NullVal(ty)
+                                        }
+                                }
+                                newVals[name] = cty.ObjectVal(newMapVals)
+                        }
+
+                default:
+                        panic(fmt.Sprintf("failed to set unknown values for nested block %q:%#v", name, blockValType))
+                }
+        }
+
+        return cty.ObjectVal(newVals)
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/grpc_test_provider.go b/vendor/github.com/hashicorp/terraform/helper/resource/grpc_test_provider.go
new file mode 100644
index 0000000..0742e99
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/grpc_test_provider.go
@@ -0,0 +1,43 @@
+package resource
+
+import (
+        "context"
+        "net"
+        "time"
+
+        "github.com/hashicorp/terraform/helper/plugin"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        tfplugin "github.com/hashicorp/terraform/plugin"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/terraform"
+        "google.golang.org/grpc"
+        "google.golang.org/grpc/test/bufconn"
+)
+
+// GRPCTestProvider takes a legacy ResourceProvider, wraps it in the new GRPC
+// shim and starts it in a grpc server using an inmem connection. It returns a
+// GRPCClient for this new server to test the shimmed resource provider.
+func GRPCTestProvider(rp terraform.ResourceProvider) providers.Interface {
+        listener := bufconn.Listen(256 * 1024)
+        grpcServer := grpc.NewServer()
+
+        p := plugin.NewGRPCProviderServerShim(rp)
+        proto.RegisterProviderServer(grpcServer, p)
+
+        go grpcServer.Serve(listener)
+
+        conn, err := grpc.Dial("", grpc.WithDialer(func(string, time.Duration) (net.Conn, error) {
+                return listener.Dial()
+        }), grpc.WithInsecure())
+        if err != nil {
+                panic(err)
+        }
+
+        var pp tfplugin.GRPCProviderPlugin
+        client, _ := pp.GRPCClient(context.Background(), nil, conn)
+
+        grpcClient := client.(*tfplugin.GRPCProvider)
+        grpcClient.TestServer = grpcServer
+
+        return grpcClient
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/state.go b/vendor/github.com/hashicorp/terraform/helper/resource/state.go
index c34e21b..88a8396 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/state.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/state.go
@@ -38,7 +38,7 @@ type StateChangeConf struct {
 // specified in the configuration using the specified Refresh() func,
 // waiting the number of seconds specified in the timeout configuration.
 //
-// If the Refresh function returns a error, exit immediately with that error.
+// If the Refresh function returns an error, exit immediately with that error.
 //
 // If the Refresh function returns a state other than the Target state or one
 // listed in Pending, return immediately with an error.
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/state_shim.go b/vendor/github.com/hashicorp/terraform/helper/resource/state_shim.go
new file mode 100644
index 0000000..b2aff99
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/state_shim.go
@@ -0,0 +1,163 @@
+package resource
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/helper/schema"
+
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/terraform"
+)
+
+// shimState takes a new *states.State and reverts it to a legacy state for the provider ACC tests
+func shimNewState(newState *states.State, providers map[string]terraform.ResourceProvider) (*terraform.State, error) {
+        state := terraform.NewState()
+
+        // in the odd case of a nil state, let the helper packages handle it
+        if newState == nil {
+                return nil, nil
+        }
+
+        for _, newMod := range newState.Modules {
+                mod := state.AddModule(newMod.Addr)
+
+                for name, out := range newMod.OutputValues {
+                        outputType := ""
+                        val := hcl2shim.ConfigValueFromHCL2(out.Value)
+                        ty := out.Value.Type()
+                        switch {
+                        case ty == cty.String:
+                                outputType = "string"
+                        case ty.IsTupleType() || ty.IsListType():
+                                outputType = "list"
+                        case ty.IsMapType():
+                                outputType = "map"
+                        }
+
+                        mod.Outputs[name] = &terraform.OutputState{
+                                Type:      outputType,
+                                Value:     val,
+                                Sensitive: out.Sensitive,
+                        }
+                }
+
+                for _, res := range newMod.Resources {
+                        resType := res.Addr.Type
+                        providerType := res.ProviderConfig.ProviderConfig.Type
+
+                        resource := getResource(providers, providerType, res.Addr)
+
+                        for key, i := range res.Instances {
+                                flatmap, err := shimmedAttributes(i.Current, resource)
+                                if err != nil {
+                                        return nil, fmt.Errorf("error decoding state for %q: %s", resType, err)
+                                }
+
+                                resState := &terraform.ResourceState{
+                                        Type: resType,
+                                        Primary: &terraform.InstanceState{
+                                                ID:         flatmap["id"],
+                                                Attributes: flatmap,
+                                                Tainted:    i.Current.Status == states.ObjectTainted,
+                                        },
+                                        Provider: res.ProviderConfig.String(),
+                                }
+                                if i.Current.SchemaVersion != 0 {
+                                        resState.Primary.Meta = map[string]interface{}{
+                                                "schema_version": i.Current.SchemaVersion,
+                                        }
+                                }
+
+                                for _, dep := range i.Current.Dependencies {
+                                        resState.Dependencies = append(resState.Dependencies, dep.String())
+                                }
+
+                                // convert the indexes to the old style flapmap indexes
+                                idx := ""
+                                switch key.(type) {
+                                case addrs.IntKey:
+                                        // don't add numeric index values to resources with a count of 0
+                                        if len(res.Instances) > 1 {
+                                                idx = fmt.Sprintf(".%d", key)
+                                        }
+                                case addrs.StringKey:
+                                        idx = "." + key.String()
+                                }
+
+                                mod.Resources[res.Addr.String()+idx] = resState
+
+                                // add any deposed instances
+                                for _, dep := range i.Deposed {
+                                        flatmap, err := shimmedAttributes(dep, resource)
+                                        if err != nil {
+                                                return nil, fmt.Errorf("error decoding deposed state for %q: %s", resType, err)
+                                        }
+
+                                        deposed := &terraform.InstanceState{
+                                                ID:         flatmap["id"],
+                                                Attributes: flatmap,
+                                                Tainted:    dep.Status == states.ObjectTainted,
+                                        }
+                                        if dep.SchemaVersion != 0 {
+                                                deposed.Meta = map[string]interface{}{
+                                                        "schema_version": dep.SchemaVersion,
+                                                }
+                                        }
+
+                                        resState.Deposed = append(resState.Deposed, deposed)
+                                }
+                        }
+                }
+        }
+
+        return state, nil
+}
+
+func getResource(providers map[string]terraform.ResourceProvider, providerName string, addr addrs.Resource) *schema.Resource {
+        p := providers[providerName]
+        if p == nil {
+                panic(fmt.Sprintf("provider %q not found in test step", providerName))
+        }
+
+        // this is only for tests, so should only see schema.Providers
+        provider := p.(*schema.Provider)
+
+        switch addr.Mode {
+        case addrs.ManagedResourceMode:
+                resource := provider.ResourcesMap[addr.Type]
+                if resource != nil {
+                        return resource
+                }
+        case addrs.DataResourceMode:
+                resource := provider.DataSourcesMap[addr.Type]
+                if resource != nil {
+                        return resource
+                }
+        }
+
+        panic(fmt.Sprintf("resource %s not found in test step", addr.Type))
+}
+
+func shimmedAttributes(instance *states.ResourceInstanceObjectSrc, res *schema.Resource) (map[string]string, error) {
+        flatmap := instance.AttrsFlat
+        if flatmap != nil {
+                return flatmap, nil
+        }
+
+        // if we have json attrs, they need to be decoded
+        rio, err := instance.Decode(res.CoreConfigSchema().ImpliedType())
+        if err != nil {
+                return nil, err
+        }
+
+        instanceState, err := res.ShimInstanceStateFromValue(rio.Value)
+        if err != nil {
+                return nil, err
+        }
+
+        return instanceState.Attributes, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
index b97673f..aa7454d 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
@@ -1,6 +1,7 @@
 package resource
 
 import (
+        "bytes"
         "flag"
         "fmt"
         "io"
@@ -18,9 +19,18 @@ import (
         "github.com/hashicorp/errwrap"
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/logutils"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/mitchellh/colorstring"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/command/format"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configload"
         "github.com/hashicorp/terraform/helper/logging"
+        "github.com/hashicorp/terraform/internal/initwd"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
         "github.com/hashicorp/terraform/terraform"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // flagSweep is a flag available when running tests on the command line. It
@@ -373,6 +383,10 @@ type TestStep struct {
         // be refreshed and don't matter.
         ImportStateVerify       bool
         ImportStateVerifyIgnore []string
+
+        // provider s is used internally to maintain a reference to the
+        // underlying providers during the tests
+        providers map[string]terraform.ResourceProvider
 }
 
 // Set to a file mask in sprintf format where %s is test name
@@ -467,10 +481,22 @@ func Test(t TestT, c TestCase) {
                 c.PreCheck()
         }
 
+        // get instances of all providers, so we can use the individual
+        // resources to shim the state during the tests.
+        providers := make(map[string]terraform.ResourceProvider)
+        for name, pf := range testProviderFactories(c) {
+                p, err := pf()
+                if err != nil {
+                        t.Fatal(err)
+                }
+                providers[name] = p
+        }
+
         providerResolver, err := testProviderResolver(c)
         if err != nil {
                 t.Fatal(err)
         }
+
         opts := terraform.ContextOpts{ProviderResolver: providerResolver}
 
         // A single state variable to track the lifecycle, starting with no state
@@ -481,6 +507,10 @@ func Test(t TestT, c TestCase) {
         idRefresh := c.IDRefreshName != ""
         errored := false
         for i, step := range c.Steps {
+                // insert the providers into the step so we can get the resources for
+                // shimming the state
+                step.providers = providers
+
                 var err error
                 log.Printf("[DEBUG] Test: Executing step %d", i)
 
@@ -535,8 +565,7 @@ func Test(t TestT, c TestCase) {
                                 }
                         } else {
                                 errored = true
-                                t.Error(fmt.Sprintf(
-                                        "Step %d error: %s", i, err))
+                                t.Error(fmt.Sprintf("Step %d error: %s", i, detailedErrorMessage(err)))
                                 break
                         }
                 }
@@ -591,6 +620,7 @@ func Test(t TestT, c TestCase) {
                         Destroy:                   true,
                         PreventDiskCleanup:        lastStep.PreventDiskCleanup,
                         PreventPostDestroyRefresh: c.PreventPostDestroyRefresh,
+                        providers:                 providers,
                 }
 
                 log.Printf("[WARN] Test: Executing destroy step")
@@ -620,39 +650,50 @@ func testProviderConfig(c TestCase) string {
         return strings.Join(lines, "")
 }
 
-// testProviderResolver is a helper to build a ResourceProviderResolver
-// with pre instantiated ResourceProviders, so that we can reset them for the
-// test, while only calling the factory function once.
-// Any errors are stored so that they can be returned by the factory in
-// terraform to match non-test behavior.
-func testProviderResolver(c TestCase) (terraform.ResourceProviderResolver, error) {
-        ctxProviders := c.ProviderFactories
-        if ctxProviders == nil {
-                ctxProviders = make(map[string]terraform.ResourceProviderFactory)
+// testProviderFactories combines the fixed Providers and
+// ResourceProviderFactory functions into a single map of
+// ResourceProviderFactory functions.
+func testProviderFactories(c TestCase) map[string]terraform.ResourceProviderFactory {
+        ctxProviders := make(map[string]terraform.ResourceProviderFactory)
+        for k, pf := range c.ProviderFactories {
+                ctxProviders[k] = pf
         }
 
         // add any fixed providers
         for k, p := range c.Providers {
                 ctxProviders[k] = terraform.ResourceProviderFactoryFixed(p)
         }
+        return ctxProviders
+}
+
+// testProviderResolver is a helper to build a ResourceProviderResolver
+// with pre instantiated ResourceProviders, so that we can reset them for the
+// test, while only calling the factory function once.
+// Any errors are stored so that they can be returned by the factory in
+// terraform to match non-test behavior.
+func testProviderResolver(c TestCase) (providers.Resolver, error) {
+        ctxProviders := testProviderFactories(c)
+
+        // wrap the old provider factories in the test grpc server so they can be
+        // called from terraform.
+        newProviders := make(map[string]providers.Factory)
 
-        // reset the providers if needed
         for k, pf := range ctxProviders {
-                // we can ignore any errors here, if we don't have a provider to reset
-                // the error will be handled later
-                p, err := pf()
-                if err != nil {
-                        return nil, err
-                }
-                if p, ok := p.(TestProvider); ok {
-                        err := p.TestReset()
+                factory := pf // must copy to ensure each closure sees its own value
+                newProviders[k] = func() (providers.Interface, error) {
+                        p, err := factory()
                         if err != nil {
-                                return nil, fmt.Errorf("[ERROR] failed to reset provider %q: %s", k, err)
+                                return nil, err
                         }
+
+                        // The provider is wrapped in a GRPCTestProvider so that it can be
+                        // passed back to terraform core as a providers.Interface, rather
+                        // than the legacy ResourceProvider.
+                        return GRPCTestProvider(p), nil
                 }
         }
 
-        return terraform.ResourceProviderResolverFixed(ctxProviders), nil
+        return providers.ResolverFixed(newProviders), nil
 }
 
 // UnitTest is a helper to force the acceptance testing harness to run in the
@@ -670,33 +711,40 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
                 return nil
         }
 
-        name := fmt.Sprintf("%s.foo", r.Type)
+        addr := addrs.Resource{
+                Mode: addrs.ManagedResourceMode,
+                Type: r.Type,
+                Name: "foo",
+        }.Instance(addrs.NoKey)
+        absAddr := addr.Absolute(addrs.RootModuleInstance)
 
         // Build the state. The state is just the resource with an ID. There
         // are no attributes. We only set what is needed to perform a refresh.
-        state := terraform.NewState()
-        state.RootModule().Resources[name] = &terraform.ResourceState{
-                Type: r.Type,
-                Primary: &terraform.InstanceState{
-                        ID: r.Primary.ID,
+        state := states.NewState()
+        state.RootModule().SetResourceInstanceCurrent(
+                addr,
+                &states.ResourceInstanceObjectSrc{
+                        AttrsFlat: r.Primary.Attributes,
+                        Status:    states.ObjectReady,
                 },
-        }
+                addrs.ProviderConfig{Type: "placeholder"}.Absolute(addrs.RootModuleInstance),
+        )
 
         // Create the config module. We use the full config because Refresh
         // doesn't have access to it and we may need things like provider
         // configurations. The initial implementation of id-only checks used
         // an empty config module, but that caused the aforementioned problems.
-        mod, err := testModule(opts, step)
+        cfg, err := testConfig(opts, step)
         if err != nil {
                 return err
         }
 
         // Initialize the context
-        opts.Module = mod
+        opts.Config = cfg
         opts.State = state
-        ctx, err := terraform.NewContext(&opts)
-        if err != nil {
-                return err
+        ctx, ctxDiags := terraform.NewContext(&opts)
+        if ctxDiags.HasErrors() {
+                return ctxDiags.Err()
         }
         if diags := ctx.Validate(); len(diags) > 0 {
                 if diags.HasErrors() {
@@ -707,20 +755,20 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
         }
 
         // Refresh!
-        state, err = ctx.Refresh()
-        if err != nil {
-                return fmt.Errorf("Error refreshing: %s", err)
+        state, refreshDiags := ctx.Refresh()
+        if refreshDiags.HasErrors() {
+                return refreshDiags.Err()
         }
 
         // Verify attribute equivalence.
-        actualR := state.RootModule().Resources[name]
+        actualR := state.ResourceInstance(absAddr)
         if actualR == nil {
                 return fmt.Errorf("Resource gone!")
         }
-        if actualR.Primary == nil {
+        if actualR.Current == nil {
                 return fmt.Errorf("Resource has no primary instance")
         }
-        actual := actualR.Primary.Attributes
+        actual := actualR.Current.AttrsFlat
         expected := r.Primary.Attributes
         // Remove fields we're ignoring
         for _, v := range c.IDRefreshIgnore {
@@ -756,15 +804,14 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
         return nil
 }
 
-func testModule(opts terraform.ContextOpts, step TestStep) (*module.Tree, error) {
+func testConfig(opts terraform.ContextOpts, step TestStep) (*configs.Config, error) {
         if step.PreConfig != nil {
                 step.PreConfig()
         }
 
         cfgPath, err := ioutil.TempDir("", "tf-test")
         if err != nil {
-                return nil, fmt.Errorf(
-                        "Error creating temporary directory for config: %s", err)
+                return nil, fmt.Errorf("Error creating temporary directory for config: %s", err)
         }
 
         if step.PreventDiskCleanup {
@@ -773,38 +820,38 @@ func testModule(opts terraform.ContextOpts, step TestStep) (*module.Tree, error)
                 defer os.RemoveAll(cfgPath)
         }
 
-        // Write the configuration
-        cfgF, err := os.Create(filepath.Join(cfgPath, "main.tf"))
+        // Write the main configuration file
+        err = ioutil.WriteFile(filepath.Join(cfgPath, "main.tf"), []byte(step.Config), os.ModePerm)
         if err != nil {
-                return nil, fmt.Errorf(
-                        "Error creating temporary file for config: %s", err)
+                return nil, fmt.Errorf("Error creating temporary file for config: %s", err)
         }
 
-        _, err = io.Copy(cfgF, strings.NewReader(step.Config))
-        cfgF.Close()
+        // Create directory for our child modules, if any.
+        modulesDir := filepath.Join(cfgPath, ".modules")
+        err = os.Mkdir(modulesDir, os.ModePerm)
         if err != nil {
-                return nil, fmt.Errorf(
-                        "Error creating temporary file for config: %s", err)
+                return nil, fmt.Errorf("Error creating child modules directory: %s", err)
         }
 
-        // Parse the configuration
-        mod, err := module.NewTreeModule("", cfgPath)
-        if err != nil {
-                return nil, fmt.Errorf(
-                        "Error loading configuration: %s", err)
+        inst := initwd.NewModuleInstaller(modulesDir, nil)
+        _, installDiags := inst.InstallModules(cfgPath, true, initwd.ModuleInstallHooksImpl{})
+        if installDiags.HasErrors() {
+                return nil, installDiags.Err()
         }
 
-        // Load the modules
-        modStorage := &module.Storage{
-                StorageDir: filepath.Join(cfgPath, ".tfmodules"),
-                Mode:       module.GetModeGet,
-        }
-        err = mod.Load(modStorage)
+        loader, err := configload.NewLoader(&configload.Config{
+                ModulesDir: modulesDir,
+        })
         if err != nil {
-                return nil, fmt.Errorf("Error downloading modules: %s", err)
+                return nil, fmt.Errorf("failed to create config loader: %s", err)
+        }
+
+        config, configDiags := loader.LoadConfig(cfgPath)
+        if configDiags.HasErrors() {
+                return nil, configDiags
         }
 
-        return mod, nil
+        return config, nil
 }
 
 func testResource(c TestStep, state *terraform.State) (*terraform.ResourceState, error) {
@@ -881,8 +928,9 @@ func TestCheckResourceAttrSet(name, key string) TestCheckFunc {
 // TestCheckModuleResourceAttrSet - as per TestCheckResourceAttrSet but with
 // support for non-root modules
 func TestCheckModuleResourceAttrSet(mp []string, name string, key string) TestCheckFunc {
+        mpt := addrs.Module(mp).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                is, err := modulePathPrimaryInstanceState(s, mpt, name)
                 if err != nil {
                         return err
                 }
@@ -915,8 +963,9 @@ func TestCheckResourceAttr(name, key, value string) TestCheckFunc {
 // TestCheckModuleResourceAttr - as per TestCheckResourceAttr but with
 // support for non-root modules
 func TestCheckModuleResourceAttr(mp []string, name string, key string, value string) TestCheckFunc {
+        mpt := addrs.Module(mp).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                is, err := modulePathPrimaryInstanceState(s, mpt, name)
                 if err != nil {
                         return err
                 }
@@ -926,7 +975,19 @@ func TestCheckModuleResourceAttr(mp []string, name string, key string, value str
 }
 
 func testCheckResourceAttr(is *terraform.InstanceState, name string, key string, value string) error {
+        // Empty containers may be elided from the state.
+        // If the intent here is to check for an empty container, allow the key to
+        // also be non-existent.
+        emptyCheck := false
+        if value == "0" && (strings.HasSuffix(key, ".#") || strings.HasSuffix(key, ".%")) {
+                emptyCheck = true
+        }
+
         if v, ok := is.Attributes[key]; !ok || v != value {
+                if emptyCheck && !ok {
+                        return nil
+                }
+
                 if !ok {
                         return fmt.Errorf("%s: Attribute '%s' not found", name, key)
                 }
@@ -957,8 +1018,9 @@ func TestCheckNoResourceAttr(name, key string) TestCheckFunc {
 // TestCheckModuleNoResourceAttr - as per TestCheckNoResourceAttr but with
 // support for non-root modules
 func TestCheckModuleNoResourceAttr(mp []string, name string, key string) TestCheckFunc {
+        mpt := addrs.Module(mp).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                is, err := modulePathPrimaryInstanceState(s, mpt, name)
                 if err != nil {
                         return err
                 }
@@ -968,7 +1030,20 @@ func TestCheckModuleNoResourceAttr(mp []string, name string, key string) TestChe
 }
 
 func testCheckNoResourceAttr(is *terraform.InstanceState, name string, key string) error {
-        if _, ok := is.Attributes[key]; ok {
+        // Empty containers may sometimes be included in the state.
+        // If the intent here is to check for an empty container, allow the value to
+        // also be "0".
+        emptyCheck := false
+        if strings.HasSuffix(key, ".#") || strings.HasSuffix(key, ".%") {
+                emptyCheck = true
+        }
+
+        val, exists := is.Attributes[key]
+        if emptyCheck && val == "0" {
+                return nil
+        }
+
+        if exists {
                 return fmt.Errorf("%s: Attribute '%s' found when not expected", name, key)
         }
 
@@ -991,8 +1066,9 @@ func TestMatchResourceAttr(name, key string, r *regexp.Regexp) TestCheckFunc {
 // TestModuleMatchResourceAttr - as per TestMatchResourceAttr but with
 // support for non-root modules
 func TestModuleMatchResourceAttr(mp []string, name string, key string, r *regexp.Regexp) TestCheckFunc {
+        mpt := addrs.Module(mp).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                is, err := modulePathPrimaryInstanceState(s, mpt, name)
                 if err != nil {
                         return err
                 }
@@ -1052,13 +1128,15 @@ func TestCheckResourceAttrPair(nameFirst, keyFirst, nameSecond, keySecond string
 // TestCheckModuleResourceAttrPair - as per TestCheckResourceAttrPair but with
 // support for non-root modules
 func TestCheckModuleResourceAttrPair(mpFirst []string, nameFirst string, keyFirst string, mpSecond []string, nameSecond string, keySecond string) TestCheckFunc {
+        mptFirst := addrs.Module(mpFirst).UnkeyedInstanceShim()
+        mptSecond := addrs.Module(mpSecond).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                isFirst, err := modulePathPrimaryInstanceState(s, mpFirst, nameFirst)
+                isFirst, err := modulePathPrimaryInstanceState(s, mptFirst, nameFirst)
                 if err != nil {
                         return err
                 }
 
-                isSecond, err := modulePathPrimaryInstanceState(s, mpSecond, nameSecond)
+                isSecond, err := modulePathPrimaryInstanceState(s, mptSecond, nameSecond)
                 if err != nil {
                         return err
                 }
@@ -1068,14 +1146,32 @@ func TestCheckModuleResourceAttrPair(mpFirst []string, nameFirst string, keyFirs
 }
 
 func testCheckResourceAttrPair(isFirst *terraform.InstanceState, nameFirst string, keyFirst string, isSecond *terraform.InstanceState, nameSecond string, keySecond string) error {
-        vFirst, ok := isFirst.Attributes[keyFirst]
-        if !ok {
-                return fmt.Errorf("%s: Attribute '%s' not found", nameFirst, keyFirst)
+        vFirst, okFirst := isFirst.Attributes[keyFirst]
+        vSecond, okSecond := isSecond.Attributes[keySecond]
+
+        // Container count values of 0 should not be relied upon, and not reliably
+        // maintained by helper/schema. For the purpose of tests, consider unset and
+        // 0 to be equal.
+        if len(keyFirst) > 2 && len(keySecond) > 2 && keyFirst[len(keyFirst)-2:] == keySecond[len(keySecond)-2:] &&
+                (strings.HasSuffix(keyFirst, ".#") || strings.HasSuffix(keyFirst, ".%")) {
+                // they have the same suffix, and it is a collection count key.
+                if vFirst == "0" || vFirst == "" {
+                        okFirst = false
+                }
+                if vSecond == "0" || vSecond == "" {
+                        okSecond = false
+                }
         }
 
-        vSecond, ok := isSecond.Attributes[keySecond]
-        if !ok {
-                return fmt.Errorf("%s: Attribute '%s' not found", nameSecond, keySecond)
+        if okFirst != okSecond {
+                if !okFirst {
+                        return fmt.Errorf("%s: Attribute %q not set, but %q is set in %s as %q", nameFirst, keyFirst, keySecond, nameSecond, vSecond)
+                }
+                return fmt.Errorf("%s: Attribute %q is %q, but %q is not set in %s", nameFirst, keyFirst, vFirst, keySecond, nameSecond)
+        }
+        if !(okFirst || okSecond) {
+                // If they both don't exist then they are equally unset, so that's okay.
+                return nil
         }
 
         if vFirst != vSecond {
@@ -1163,7 +1259,7 @@ func modulePrimaryInstanceState(s *terraform.State, ms *terraform.ModuleState, n
 
 // modulePathPrimaryInstanceState returns the primary instance state for the
 // given resource name in a given module path.
-func modulePathPrimaryInstanceState(s *terraform.State, mp []string, name string) (*terraform.InstanceState, error) {
+func modulePathPrimaryInstanceState(s *terraform.State, mp addrs.ModuleInstance, name string) (*terraform.InstanceState, error) {
         ms := s.ModuleByPath(mp)
         if ms == nil {
                 return nil, fmt.Errorf("No module found at: %s", mp)
@@ -1178,3 +1274,47 @@ func primaryInstanceState(s *terraform.State, name string) (*terraform.InstanceS
         ms := s.RootModule()
         return modulePrimaryInstanceState(s, ms, name)
 }
+
+// operationError is a specialized implementation of error used to describe
+// failures during one of the several operations performed for a particular
+// test case.
+type operationError struct {
+        OpName string
+        Diags  tfdiags.Diagnostics
+}
+
+func newOperationError(opName string, diags tfdiags.Diagnostics) error {
+        return operationError{opName, diags}
+}
+
+// Error returns a terse error string containing just the basic diagnostic
+// messages, for situations where normal Go error behavior is appropriate.
+func (err operationError) Error() string {
+        return fmt.Sprintf("errors during %s: %s", err.OpName, err.Diags.Err().Error())
+}
+
+// ErrorDetail is like Error except it includes verbosely-rendered diagnostics
+// similar to what would come from a normal Terraform run, which include
+// additional context not included in Error().
+func (err operationError) ErrorDetail() string {
+        var buf bytes.Buffer
+        fmt.Fprintf(&buf, "errors during %s:", err.OpName)
+        clr := &colorstring.Colorize{Disable: true, Colors: colorstring.DefaultColors}
+        for _, diag := range err.Diags {
+                diagStr := format.Diagnostic(diag, nil, clr, 78)
+                buf.WriteByte('\n')
+                buf.WriteString(diagStr)
+        }
+        return buf.String()
+}
+
+// detailedErrorMessage is a helper for calling ErrorDetail on an error if
+// it is an operationError or just taking Error otherwise.
+func detailedErrorMessage(err error) string {
+        switch tErr := err.(type) {
+        case operationError:
+                return tErr.ErrorDetail()
+        default:
+                return err.Error()
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
index 033f126..311fdb6 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
@@ -1,13 +1,23 @@
 package resource
 
 import (
+        "bufio"
+        "bytes"
         "errors"
         "fmt"
         "log"
+        "sort"
         "strings"
 
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/states"
+
         "github.com/hashicorp/errwrap"
+        "github.com/hashicorp/terraform/plans"
         "github.com/hashicorp/terraform/terraform"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // testStepConfig runs a config-mode test step
@@ -18,69 +28,79 @@ func testStepConfig(
         return testStep(opts, state, step)
 }
 
-func testStep(
-        opts terraform.ContextOpts,
-        state *terraform.State,
-        step TestStep) (*terraform.State, error) {
-        // Pre-taint any resources that have been defined in Taint, as long as this
-        // is not a destroy step.
+func testStep(opts terraform.ContextOpts, state *terraform.State, step TestStep) (*terraform.State, error) {
         if !step.Destroy {
                 if err := testStepTaint(state, step); err != nil {
                         return state, err
                 }
         }
 
-        mod, err := testModule(opts, step)
+        cfg, err := testConfig(opts, step)
         if err != nil {
                 return state, err
         }
 
+        var stepDiags tfdiags.Diagnostics
+
         // Build the context
-        opts.Module = mod
-        opts.State = state
-        opts.Destroy = step.Destroy
-        ctx, err := terraform.NewContext(&opts)
+        opts.Config = cfg
+        opts.State, err = terraform.ShimLegacyState(state)
         if err != nil {
-                return state, fmt.Errorf("Error initializing context: %s", err)
+                return nil, err
+        }
+
+        opts.Destroy = step.Destroy
+        ctx, stepDiags := terraform.NewContext(&opts)
+        if stepDiags.HasErrors() {
+                return state, fmt.Errorf("Error initializing context: %s", stepDiags.Err())
         }
-        if diags := ctx.Validate(); len(diags) > 0 {
-                if diags.HasErrors() {
-                        return nil, errwrap.Wrapf("config is invalid: {{err}}", diags.Err())
+        if stepDiags := ctx.Validate(); len(stepDiags) > 0 {
+                if stepDiags.HasErrors() {
+                        return state, errwrap.Wrapf("config is invalid: {{err}}", stepDiags.Err())
                 }
 
-                log.Printf("[WARN] Config warnings:\n%s", diags)
+                log.Printf("[WARN] Config warnings:\n%s", stepDiags)
         }
 
         // Refresh!
-        state, err = ctx.Refresh()
+        newState, stepDiags := ctx.Refresh()
+        // shim the state first so the test can check the state on errors
+
+        state, err = shimNewState(newState, step.providers)
         if err != nil {
-                return state, fmt.Errorf(
-                        "Error refreshing: %s", err)
+                return nil, err
+        }
+        if stepDiags.HasErrors() {
+                return state, newOperationError("refresh", stepDiags)
         }
 
         // If this step is a PlanOnly step, skip over this first Plan and subsequent
         // Apply, and use the follow up Plan that checks for perpetual diffs
         if !step.PlanOnly {
                 // Plan!
-                if p, err := ctx.Plan(); err != nil {
-                        return state, fmt.Errorf(
-                                "Error planning: %s", err)
+                if p, stepDiags := ctx.Plan(); stepDiags.HasErrors() {
+                        return state, newOperationError("plan", stepDiags)
                 } else {
-                        log.Printf("[WARN] Test: Step plan: %s", p)
+                        log.Printf("[WARN] Test: Step plan: %s", legacyPlanComparisonString(newState, p.Changes))
                 }
 
                 // We need to keep a copy of the state prior to destroying
-                // such that destroy steps can verify their behaviour in the check
+                // such that destroy steps can verify their behavior in the check
                 // function
                 stateBeforeApplication := state.DeepCopy()
 
-                // Apply!
-                state, err = ctx.Apply()
+                // Apply the diff, creating real resources.
+                newState, stepDiags = ctx.Apply()
+                // shim the state first so the test can check the state on errors
+                state, err = shimNewState(newState, step.providers)
                 if err != nil {
-                        return state, fmt.Errorf("Error applying: %s", err)
+                        return nil, err
+                }
+                if stepDiags.HasErrors() {
+                        return state, newOperationError("apply", stepDiags)
                 }
 
-                // Check! Excitement!
+                // Run any configured checks
                 if step.Check != nil {
                         if step.Destroy {
                                 if err := step.Check(stateBeforeApplication); err != nil {
@@ -96,31 +116,35 @@ func testStep(
 
         // Now, verify that Plan is now empty and we don't have a perpetual diff issue
         // We do this with TWO plans. One without a refresh.
-        var p *terraform.Plan
-        if p, err = ctx.Plan(); err != nil {
-                return state, fmt.Errorf("Error on follow-up plan: %s", err)
+        var p *plans.Plan
+        if p, stepDiags = ctx.Plan(); stepDiags.HasErrors() {
+                return state, newOperationError("follow-up plan", stepDiags)
         }
-        if p.Diff != nil && !p.Diff.Empty() {
+        if !p.Changes.Empty() {
                 if step.ExpectNonEmptyPlan {
-                        log.Printf("[INFO] Got non-empty plan, as expected:\n\n%s", p)
+                        log.Printf("[INFO] Got non-empty plan, as expected:\n\n%s", legacyPlanComparisonString(newState, p.Changes))
                 } else {
                         return state, fmt.Errorf(
-                                "After applying this step, the plan was not empty:\n\n%s", p)
+                                "After applying this step, the plan was not empty:\n\n%s", legacyPlanComparisonString(newState, p.Changes))
                 }
         }
 
         // And another after a Refresh.
         if !step.Destroy || (step.Destroy && !step.PreventPostDestroyRefresh) {
-                state, err = ctx.Refresh()
+                newState, stepDiags = ctx.Refresh()
+                if stepDiags.HasErrors() {
+                        return state, newOperationError("follow-up refresh", stepDiags)
+                }
+
+                state, err = shimNewState(newState, step.providers)
                 if err != nil {
-                        return state, fmt.Errorf(
-                                "Error on follow-up refresh: %s", err)
+                        return nil, err
                 }
         }
-        if p, err = ctx.Plan(); err != nil {
-                return state, fmt.Errorf("Error on second follow-up plan: %s", err)
+        if p, stepDiags = ctx.Plan(); stepDiags.HasErrors() {
+                return state, newOperationError("second follow-up refresh", stepDiags)
         }
-        empty := p.Diff == nil || p.Diff.Empty()
+        empty := p.Changes.Empty()
 
         // Data resources are tricky because they legitimately get instantiated
         // during refresh so that they will be already populated during the
@@ -128,35 +152,28 @@ func testStep(
         // config we'll end up wanting to destroy them again here. This is
         // acceptable and expected, and we'll treat it as "empty" for the
         // sake of this testing.
-        if step.Destroy {
+        if step.Destroy && !empty {
                 empty = true
-
-                for _, moduleDiff := range p.Diff.Modules {
-                        for k, instanceDiff := range moduleDiff.Resources {
-                                if !strings.HasPrefix(k, "data.") {
-                                        empty = false
-                                        break
-                                }
-
-                                if !instanceDiff.Destroy {
-                                        empty = false
-                                }
+                for _, change := range p.Changes.Resources {
+                        if change.Addr.Resource.Resource.Mode != addrs.DataResourceMode {
+                                empty = false
+                                break
                         }
                 }
         }
 
         if !empty {
                 if step.ExpectNonEmptyPlan {
-                        log.Printf("[INFO] Got non-empty plan, as expected:\n\n%s", p)
+                        log.Printf("[INFO] Got non-empty plan, as expected:\n\n%s", legacyPlanComparisonString(newState, p.Changes))
                 } else {
                         return state, fmt.Errorf(
                                 "After applying this step and refreshing, "+
-                                        "the plan was not empty:\n\n%s", p)
+                                        "the plan was not empty:\n\n%s", legacyPlanComparisonString(newState, p.Changes))
                 }
         }
 
         // Made it here, but expected a non-empty plan, fail!
-        if step.ExpectNonEmptyPlan && (p.Diff == nil || p.Diff.Empty()) {
+        if step.ExpectNonEmptyPlan && empty {
                 return state, fmt.Errorf("Expected a non-empty plan, but got an empty plan!")
         }
 
@@ -164,6 +181,213 @@ func testStep(
         return state, nil
 }
 
+// legacyPlanComparisonString produces a string representation of the changes
+// from a plan and a given state togther, as was formerly produced by the
+// String method of terraform.Plan.
+//
+// This is here only for compatibility with existing tests that predate our
+// new plan and state types, and should not be used in new tests. Instead, use
+// a library like "cmp" to do a deep equality  and diff on the two
+// data structures.
+func legacyPlanComparisonString(state *states.State, changes *plans.Changes) string {
+        return fmt.Sprintf(
+                "DIFF:\n\n%s\n\nSTATE:\n\n%s",
+                legacyDiffComparisonString(changes),
+                state.String(),
+        )
+}
+
+// legacyDiffComparisonString produces a string representation of the changes
+// from a planned changes object, as was formerly produced by the String method
+// of terraform.Diff.
+//
+// This is here only for compatibility with existing tests that predate our
+// new plan types, and should not be used in new tests. Instead, use a library
+// like "cmp" to do a deep equality check and diff on the two data structures.
+func legacyDiffComparisonString(changes *plans.Changes) string {
+        // The old string representation of a plan was grouped by module, but
+        // our new plan structure is not grouped in that way and so we'll need
+        // to preprocess it in order to produce that grouping.
+        type ResourceChanges struct {
+                Current *plans.ResourceInstanceChangeSrc
+                Deposed map[states.DeposedKey]*plans.ResourceInstanceChangeSrc
+        }
+        byModule := map[string]map[string]*ResourceChanges{}
+        resourceKeys := map[string][]string{}
+        requiresReplace := map[string][]string{}
+        var moduleKeys []string
+        for _, rc := range changes.Resources {
+                if rc.Action == plans.NoOp {
+                        // We won't mention no-op changes here at all, since the old plan
+                        // model we are emulating here didn't have such a concept.
+                        continue
+                }
+                moduleKey := rc.Addr.Module.String()
+                if _, exists := byModule[moduleKey]; !exists {
+                        moduleKeys = append(moduleKeys, moduleKey)
+                        byModule[moduleKey] = make(map[string]*ResourceChanges)
+                }
+                resourceKey := rc.Addr.Resource.String()
+                if _, exists := byModule[moduleKey][resourceKey]; !exists {
+                        resourceKeys[moduleKey] = append(resourceKeys[moduleKey], resourceKey)
+                        byModule[moduleKey][resourceKey] = &ResourceChanges{
+                                Deposed: make(map[states.DeposedKey]*plans.ResourceInstanceChangeSrc),
+                        }
+                }
+
+                if rc.DeposedKey == states.NotDeposed {
+                        byModule[moduleKey][resourceKey].Current = rc
+                } else {
+                        byModule[moduleKey][resourceKey].Deposed[rc.DeposedKey] = rc
+                }
+
+                rr := []string{}
+                for _, p := range rc.RequiredReplace.List() {
+                        rr = append(rr, hcl2shim.FlatmapKeyFromPath(p))
+                }
+                requiresReplace[resourceKey] = rr
+        }
+        sort.Strings(moduleKeys)
+        for _, ks := range resourceKeys {
+                sort.Strings(ks)
+        }
+
+        var buf bytes.Buffer
+
+        for _, moduleKey := range moduleKeys {
+                rcs := byModule[moduleKey]
+                var mBuf bytes.Buffer
+
+                for _, resourceKey := range resourceKeys[moduleKey] {
+                        rc := rcs[resourceKey]
+
+                        forceNewAttrs := requiresReplace[resourceKey]
+
+                        crud := "UPDATE"
+                        if rc.Current != nil {
+                                switch rc.Current.Action {
+                                case plans.DeleteThenCreate:
+                                        crud = "DESTROY/CREATE"
+                                case plans.CreateThenDelete:
+                                        crud = "CREATE/DESTROY"
+                                case plans.Delete:
+                                        crud = "DESTROY"
+                                case plans.Create:
+                                        crud = "CREATE"
+                                }
+                        } else {
+                                // We must be working on a deposed object then, in which
+                                // case destroying is the only possible action.
+                                crud = "DESTROY"
+                        }
+
+                        extra := ""
+                        if rc.Current == nil && len(rc.Deposed) > 0 {
+                                extra = " (deposed only)"
+                        }
+
+                        fmt.Fprintf(
+                                &mBuf, "%s: %s%s\n",
+                                crud, resourceKey, extra,
+                        )
+
+                        attrNames := map[string]bool{}
+                        var oldAttrs map[string]string
+                        var newAttrs map[string]string
+                        if rc.Current != nil {
+                                if before := rc.Current.Before; before != nil {
+                                        ty, err := before.ImpliedType()
+                                        if err == nil {
+                                                val, err := before.Decode(ty)
+                                                if err == nil {
+                                                        oldAttrs = hcl2shim.FlatmapValueFromHCL2(val)
+                                                        for k := range oldAttrs {
+                                                                attrNames[k] = true
+                                                        }
+                                                }
+                                        }
+                                }
+                                if after := rc.Current.After; after != nil {
+                                        ty, err := after.ImpliedType()
+                                        if err == nil {
+                                                val, err := after.Decode(ty)
+                                                if err == nil {
+                                                        newAttrs = hcl2shim.FlatmapValueFromHCL2(val)
+                                                        for k := range newAttrs {
+                                                                attrNames[k] = true
+                                                        }
+                                                }
+                                        }
+                                }
+                        }
+                        if oldAttrs == nil {
+                                oldAttrs = make(map[string]string)
+                        }
+                        if newAttrs == nil {
+                                newAttrs = make(map[string]string)
+                        }
+
+                        attrNamesOrder := make([]string, 0, len(attrNames))
+                        keyLen := 0
+                        for n := range attrNames {
+                                attrNamesOrder = append(attrNamesOrder, n)
+                                if len(n) > keyLen {
+                                        keyLen = len(n)
+                                }
+                        }
+                        sort.Strings(attrNamesOrder)
+
+                        for _, attrK := range attrNamesOrder {
+                                v := newAttrs[attrK]
+                                u := oldAttrs[attrK]
+
+                                if v == config.UnknownVariableValue {
+                                        v = "<computed>"
+                                }
+                                // NOTE: we don't support <sensitive> here because we would
+                                // need schema to do that. Excluding sensitive values
+                                // is now done at the UI layer, and so should not be tested
+                                // at the core layer.
+
+                                updateMsg := ""
+
+                                // This may not be as precise as in the old diff, as it matches
+                                // everything under the attribute that was originally marked as
+                                // ForceNew, but should help make it easier to determine what
+                                // caused replacement here.
+                                for _, k := range forceNewAttrs {
+                                        if strings.HasPrefix(attrK, k) {
+                                                updateMsg = " (forces new resource)"
+                                                break
+                                        }
+                                }
+
+                                fmt.Fprintf(
+                                        &mBuf, "  %s:%s %#v => %#v%s\n",
+                                        attrK,
+                                        strings.Repeat(" ", keyLen-len(attrK)),
+                                        u, v,
+                                        updateMsg,
+                                )
+                        }
+                }
+
+                if moduleKey == "" { // root module
+                        buf.Write(mBuf.Bytes())
+                        buf.WriteByte('\n')
+                        continue
+                }
+
+                fmt.Fprintf(&buf, "%s:\n", moduleKey)
+                s := bufio.NewScanner(&mBuf)
+                for s.Scan() {
+                        buf.WriteString(fmt.Sprintf("  %s\n", s.Text()))
+                }
+        }
+
+        return buf.String()
+}
+
 func testStepTaint(state *terraform.State, step TestStep) error {
         for _, p := range step.Taint {
                 m := state.RootModule()
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
index 94fef3c..e1b7aea 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
@@ -7,6 +7,12 @@ import (
         "strings"
 
         "github.com/davecgh/go-spew/spew"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/helper/schema"
+        "github.com/hashicorp/terraform/states"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -15,6 +21,7 @@ func testStepImportState(
         opts terraform.ContextOpts,
         state *terraform.State,
         step TestStep) (*terraform.State, error) {
+
         // Determine the ID to import
         var importId string
         switch {
@@ -41,33 +48,53 @@ func testStepImportState(
 
         // Setup the context. We initialize with an empty state. We use the
         // full config for provider configurations.
-        mod, err := testModule(opts, step)
+        cfg, err := testConfig(opts, step)
         if err != nil {
                 return state, err
         }
 
-        opts.Module = mod
-        opts.State = terraform.NewState()
-        ctx, err := terraform.NewContext(&opts)
-        if err != nil {
-                return state, err
+        opts.Config = cfg
+
+        // import tests start with empty state
+        opts.State = states.NewState()
+
+        ctx, stepDiags := terraform.NewContext(&opts)
+        if stepDiags.HasErrors() {
+                return state, stepDiags.Err()
         }
 
-        // Do the import!
-        newState, err := ctx.Import(&terraform.ImportOpts{
+        // The test step provides the resource address as a string, so we need
+        // to parse it to get an addrs.AbsResourceAddress to pass in to the
+        // import method.
+        traversal, hclDiags := hclsyntax.ParseTraversalAbs([]byte(step.ResourceName), "", hcl.Pos{})
+        if hclDiags.HasErrors() {
+                return nil, hclDiags
+        }
+        importAddr, stepDiags := addrs.ParseAbsResourceInstance(traversal)
+        if stepDiags.HasErrors() {
+                return nil, stepDiags.Err()
+        }
+
+        // Do the import
+        importedState, stepDiags := ctx.Import(&terraform.ImportOpts{
                 // Set the module so that any provider config is loaded
-                Module: mod,
+                Config: cfg,
 
                 Targets: []*terraform.ImportTarget{
                         &terraform.ImportTarget{
-                                Addr: step.ResourceName,
+                                Addr: importAddr,
                                 ID:   importId,
                         },
                 },
         })
+        if stepDiags.HasErrors() {
+                log.Printf("[ERROR] Test: ImportState failure: %s", stepDiags.Err())
+                return state, stepDiags.Err()
+        }
+
+        newState, err := shimNewState(importedState, step.providers)
         if err != nil {
-                log.Printf("[ERROR] Test: ImportState failure: %s", err)
-                return state, err
+                return nil, err
         }
 
         // Go through the new state and verify
@@ -75,7 +102,9 @@ func testStepImportState(
                 var states []*terraform.InstanceState
                 for _, r := range newState.RootModule().Resources {
                         if r.Primary != nil {
-                                states = append(states, r.Primary)
+                                is := r.Primary.DeepCopy()
+                                is.Ephemeral.Type = r.Type // otherwise the check function cannot see the type
+                                states = append(states, is)
                         }
                 }
                 if err := step.ImportStateCheck(states); err != nil {
@@ -102,30 +131,84 @@ func testStepImportState(
                                         r.Primary.ID)
                         }
 
+                        // We'll try our best to find the schema for this resource type
+                        // so we can ignore Removed fields during validation. If we fail
+                        // to find the schema then we won't ignore them and so the test
+                        // will need to rely on explicit ImportStateVerifyIgnore, though
+                        // this shouldn't happen in any reasonable case.
+                        var rsrcSchema *schema.Resource
+                        if providerAddr, diags := addrs.ParseAbsProviderConfigStr(r.Provider); !diags.HasErrors() {
+                                providerType := providerAddr.ProviderConfig.Type
+                                if provider, ok := step.providers[providerType]; ok {
+                                        if provider, ok := provider.(*schema.Provider); ok {
+                                                rsrcSchema = provider.ResourcesMap[r.Type]
+                                        }
+                                }
+                        }
+
+                        // don't add empty flatmapped containers, so we can more easily
+                        // compare the attributes
+                        skipEmpty := func(k, v string) bool {
+                                if strings.HasSuffix(k, ".#") || strings.HasSuffix(k, ".%") {
+                                        if v == "0" {
+                                                return true
+                                        }
+                                }
+                                return false
+                        }
+
                         // Compare their attributes
                         actual := make(map[string]string)
                         for k, v := range r.Primary.Attributes {
+                                if skipEmpty(k, v) {
+                                        continue
+                                }
                                 actual[k] = v
                         }
+
                         expected := make(map[string]string)
                         for k, v := range oldR.Primary.Attributes {
+                                if skipEmpty(k, v) {
+                                        continue
+                                }
                                 expected[k] = v
                         }
 
                         // Remove fields we're ignoring
                         for _, v := range step.ImportStateVerifyIgnore {
-                                for k, _ := range actual {
+                                for k := range actual {
                                         if strings.HasPrefix(k, v) {
                                                 delete(actual, k)
                                         }
                                 }
-                                for k, _ := range expected {
+                                for k := range expected {
                                         if strings.HasPrefix(k, v) {
                                                 delete(expected, k)
                                         }
                                 }
                         }
 
+                        // Also remove any attributes that are marked as "Removed" in the
+                        // schema, if we have a schema to check that against.
+                        if rsrcSchema != nil {
+                                for k := range actual {
+                                        for _, schema := range rsrcSchema.SchemasForFlatmapPath(k) {
+                                                if schema.Removed != "" {
+                                                        delete(actual, k)
+                                                        break
+                                                }
+                                        }
+                                }
+                                for k := range expected {
+                                        for _, schema := range rsrcSchema.SchemasForFlatmapPath(k) {
+                                                if schema.Removed != "" {
+                                                        delete(expected, k)
+                                                        break
+                                                }
+                                        }
+                                }
+                        }
+
                         if !reflect.DeepEqual(actual, expected) {
                                 // Determine only the different attributes
                                 for k, v := range expected {
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/backend.go b/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
index 57fbba7..c8d8ae2 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
@@ -2,8 +2,15 @@ package schema
 
 import (
         "context"
+        "fmt"
 
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/terraform"
+        ctyconvert "github.com/zclconf/go-cty/cty/convert"
 )
 
 // Backend represents a partial backend.Backend implementation and simplifies
@@ -38,41 +45,123 @@ func FromContextBackendConfig(ctx context.Context) *ResourceData {
         return ctx.Value(backendConfigKey).(*ResourceData)
 }
 
-func (b *Backend) Input(
-        input terraform.UIInput,
-        c *terraform.ResourceConfig) (*terraform.ResourceConfig, error) {
+func (b *Backend) ConfigSchema() *configschema.Block {
+        // This is an alias of CoreConfigSchema just to implement the
+        // backend.Backend interface.
+        return b.CoreConfigSchema()
+}
+
+func (b *Backend) PrepareConfig(configVal cty.Value) (cty.Value, tfdiags.Diagnostics) {
         if b == nil {
-                return c, nil
+                return configVal, nil
         }
+        var diags tfdiags.Diagnostics
+        var err error
 
-        return schemaMap(b.Schema).Input(input, c)
-}
+        // In order to use Transform below, this needs to be filled out completely
+        // according the schema.
+        configVal, err = b.CoreConfigSchema().CoerceValue(configVal)
+        if err != nil {
+                return configVal, diags.Append(err)
+        }
 
-func (b *Backend) Validate(c *terraform.ResourceConfig) ([]string, []error) {
-        if b == nil {
-                return nil, nil
+        // lookup any required, top-level attributes that are Null, and see if we
+        // have a Default value available.
+        configVal, err = cty.Transform(configVal, func(path cty.Path, val cty.Value) (cty.Value, error) {
+                // we're only looking for top-level attributes
+                if len(path) != 1 {
+                        return val, nil
+                }
+
+                // nothing to do if we already have a value
+                if !val.IsNull() {
+                        return val, nil
+                }
+
+                // get the Schema definition for this attribute
+                getAttr, ok := path[0].(cty.GetAttrStep)
+                // these should all exist, but just ignore anything strange
+                if !ok {
+                        return val, nil
+                }
+
+                attrSchema := b.Schema[getAttr.Name]
+                // continue to ignore anything that doesn't match
+                if attrSchema == nil {
+                        return val, nil
+                }
+
+                // this is deprecated, so don't set it
+                if attrSchema.Deprecated != "" || attrSchema.Removed != "" {
+                        return val, nil
+                }
+
+                // find a default value if it exists
+                def, err := attrSchema.DefaultValue()
+                if err != nil {
+                        diags = diags.Append(fmt.Errorf("error getting default for %q: %s", getAttr.Name, err))
+                        return val, err
+                }
+
+                // no default
+                if def == nil {
+                        return val, nil
+                }
+
+                // create a cty.Value and make sure it's the correct type
+                tmpVal := hcl2shim.HCL2ValueFromConfigValue(def)
+
+                // helper/schema used to allow setting "" to a bool
+                if val.Type() == cty.Bool && tmpVal.RawEquals(cty.StringVal("")) {
+                        // return a warning about the conversion
+                        diags = diags.Append("provider set empty string as default value for bool " + getAttr.Name)
+                        tmpVal = cty.False
+                }
+
+                val, err = ctyconvert.Convert(tmpVal, val.Type())
+                if err != nil {
+                        diags = diags.Append(fmt.Errorf("error setting default for %q: %s", getAttr.Name, err))
+                }
+
+                return val, err
+        })
+        if err != nil {
+                // any error here was already added to the diagnostics
+                return configVal, diags
         }
 
-        return schemaMap(b.Schema).Validate(c)
+        shimRC := b.shimConfig(configVal)
+        warns, errs := schemaMap(b.Schema).Validate(shimRC)
+        for _, warn := range warns {
+                diags = diags.Append(tfdiags.SimpleWarning(warn))
+        }
+        for _, err := range errs {
+                diags = diags.Append(err)
+        }
+        return configVal, diags
 }
 
-func (b *Backend) Configure(c *terraform.ResourceConfig) error {
+func (b *Backend) Configure(obj cty.Value) tfdiags.Diagnostics {
         if b == nil {
                 return nil
         }
 
+        var diags tfdiags.Diagnostics
         sm := schemaMap(b.Schema)
+        shimRC := b.shimConfig(obj)
 
         // Get a ResourceData for this configuration. To do this, we actually
         // generate an intermediary "diff" although that is never exposed.
-        diff, err := sm.Diff(nil, c, nil, nil)
+        diff, err := sm.Diff(nil, shimRC, nil, nil, true)
         if err != nil {
-                return err
+                diags = diags.Append(err)
+                return diags
         }
 
         data, err := sm.Data(nil, diff)
         if err != nil {
-                return err
+                diags = diags.Append(err)
+                return diags
         }
         b.config = data
 
@@ -80,11 +169,28 @@ func (b *Backend) Configure(c *terraform.ResourceConfig) error {
                 err = b.ConfigureFunc(context.WithValue(
                         context.Background(), backendConfigKey, data))
                 if err != nil {
-                        return err
+                        diags = diags.Append(err)
+                        return diags
                 }
         }
 
-        return nil
+        return diags
+}
+
+// shimConfig turns a new-style cty.Value configuration (which must be of
+// an object type) into a minimal old-style *terraform.ResourceConfig object
+// that should be populated enough to appease the not-yet-updated functionality
+// in this package. This should be removed once everything is updated.
+func (b *Backend) shimConfig(obj cty.Value) *terraform.ResourceConfig {
+        shimMap, ok := hcl2shim.ConfigValueFromHCL2(obj).(map[string]interface{})
+        if !ok {
+                // If the configVal was nil, we still want a non-nil map here.
+                shimMap = map[string]interface{}{}
+        }
+        return &terraform.ResourceConfig{
+                Config: shimMap,
+                Raw:    shimMap,
+        }
 }
 
 // Config returns the configuration. This is available after Configure is
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go b/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
index bf952f6..875677e 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
@@ -3,7 +3,7 @@ package schema
 import (
         "fmt"
 
-        "github.com/hashicorp/terraform/config/configschema"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/zclconf/go-cty/cty"
 )
 
@@ -39,14 +39,42 @@ func (m schemaMap) CoreConfigSchema() *configschema.Block {
                         ret.Attributes[name] = schema.coreConfigSchemaAttribute()
                         continue
                 }
-                switch schema.Elem.(type) {
-                case *Schema:
+                if schema.Type == TypeMap {
+                        // For TypeMap in particular, it isn't valid for Elem to be a
+                        // *Resource (since that would be ambiguous in flatmap) and
+                        // so Elem is treated as a TypeString schema if so. This matches
+                        // how the field readers treat this situation, for compatibility
+                        // with configurations targeting Terraform 0.11 and earlier.
+                        if _, isResource := schema.Elem.(*Resource); isResource {
+                                sch := *schema // shallow copy
+                                sch.Elem = &Schema{
+                                        Type: TypeString,
+                                }
+                                ret.Attributes[name] = sch.coreConfigSchemaAttribute()
+                                continue
+                        }
+                }
+                switch schema.ConfigMode {
+                case SchemaConfigModeAttr:
                         ret.Attributes[name] = schema.coreConfigSchemaAttribute()
-                case *Resource:
+                case SchemaConfigModeBlock:
                         ret.BlockTypes[name] = schema.coreConfigSchemaBlock()
-                default:
-                        // Should never happen for a valid schema
-                        panic(fmt.Errorf("invalid Schema.Elem %#v; need *Schema or *Resource", schema.Elem))
+                default: // SchemaConfigModeAuto, or any other invalid value
+                        if schema.Computed && !schema.Optional {
+                                // Computed-only schemas are always handled as attributes,
+                                // because they never appear in configuration.
+                                ret.Attributes[name] = schema.coreConfigSchemaAttribute()
+                                continue
+                        }
+                        switch schema.Elem.(type) {
+                        case *Schema, ValueType:
+                                ret.Attributes[name] = schema.coreConfigSchemaAttribute()
+                        case *Resource:
+                                ret.BlockTypes[name] = schema.coreConfigSchemaBlock()
+                        default:
+                                // Should never happen for a valid schema
+                                panic(fmt.Errorf("invalid Schema.Elem %#v; need *Schema or *Resource", schema.Elem))
+                        }
                 }
         }
 
@@ -58,12 +86,42 @@ func (m schemaMap) CoreConfigSchema() *configschema.Block {
 // Elem is an instance of Schema. Use coreConfigSchemaBlock for collections
 // whose elem is a whole resource.
 func (s *Schema) coreConfigSchemaAttribute() *configschema.Attribute {
+        // The Schema.DefaultFunc capability adds some extra weirdness here since
+        // it can be combined with "Required: true" to create a sitution where
+        // required-ness is conditional. Terraform Core doesn't share this concept,
+        // so we must sniff for this possibility here and conditionally turn
+        // off the "Required" flag if it looks like the DefaultFunc is going
+        // to provide a value.
+        // This is not 100% true to the original interface of DefaultFunc but
+        // works well enough for the EnvDefaultFunc and MultiEnvDefaultFunc
+        // situations, which are the main cases we care about.
+        //
+        // Note that this also has a consequence for commands that return schema
+        // information for documentation purposes: running those for certain
+        // providers will produce different results depending on which environment
+        // variables are set. We accept that weirdness in order to keep this
+        // interface to core otherwise simple.
+        reqd := s.Required
+        opt := s.Optional
+        if reqd && s.DefaultFunc != nil {
+                v, err := s.DefaultFunc()
+                // We can't report errors from here, so we'll instead just force
+                // "Required" to false and let the provider try calling its
+                // DefaultFunc again during the validate step, where it can then
+                // return the error.
+                if err != nil || (err == nil && v != nil) {
+                        reqd = false
+                        opt = true
+                }
+        }
+
         return &configschema.Attribute{
-                Type:      s.coreConfigSchemaType(),
-                Optional:  s.Optional,
-                Required:  s.Required,
-                Computed:  s.Computed,
-                Sensitive: s.Sensitive,
+                Type:        s.coreConfigSchemaType(),
+                Optional:    opt,
+                Required:    reqd,
+                Computed:    s.Computed,
+                Sensitive:   s.Sensitive,
+                Description: s.Description,
         }
 }
 
@@ -72,7 +130,7 @@ func (s *Schema) coreConfigSchemaAttribute() *configschema.Attribute {
 // of Resource, and will panic otherwise.
 func (s *Schema) coreConfigSchemaBlock() *configschema.NestedBlock {
         ret := &configschema.NestedBlock{}
-        if nested := s.Elem.(*Resource).CoreConfigSchema(); nested != nil {
+        if nested := s.Elem.(*Resource).coreConfigSchema(); nested != nil {
                 ret.Block = *nested
         }
         switch s.Type {
@@ -95,6 +153,20 @@ func (s *Schema) coreConfigSchemaBlock() *configschema.NestedBlock {
                 // blocks, but we can fake it by requiring at least one item.
                 ret.MinItems = 1
         }
+        if s.Optional && s.MinItems > 0 {
+                // Historically helper/schema would ignore MinItems if Optional were
+                // set, so we must mimic this behavior here to ensure that providers
+                // relying on that undocumented behavior can continue to operate as
+                // they did before.
+                ret.MinItems = 0
+        }
+        if s.Computed && !s.Optional {
+                // MinItems/MaxItems are meaningless for computed nested blocks, since
+                // they are never set by the user anyway. This ensures that we'll never
+                // generate weird errors about them.
+                ret.MinItems = 0
+                ret.MaxItems = 0
+        }
 
         return ret
 }
@@ -117,11 +189,16 @@ func (s *Schema) coreConfigSchemaType() cty.Type {
                 switch set := s.Elem.(type) {
                 case *Schema:
                         elemType = set.coreConfigSchemaType()
+                case ValueType:
+                        // This represents a mistake in the provider code, but it's a
+                        // common one so we'll just shim it.
+                        elemType = (&Schema{Type: set}).coreConfigSchemaType()
                 case *Resource:
-                        // In practice we don't actually use this for normal schema
-                        // construction because we construct a NestedBlock in that
-                        // case instead. See schemaMap.CoreConfigSchema.
-                        elemType = set.CoreConfigSchema().ImpliedType()
+                        // By default we construct a NestedBlock in this case, but this
+                        // behavior is selected either for computed-only schemas or
+                        // when ConfigMode is explicitly SchemaConfigModeBlock.
+                        // See schemaMap.CoreConfigSchema for the exact rules.
+                        elemType = set.coreConfigSchema().ImpliedType()
                 default:
                         if set != nil {
                                 // Should never happen for a valid schema
@@ -148,8 +225,85 @@ func (s *Schema) coreConfigSchemaType() cty.Type {
         }
 }
 
-// CoreConfigSchema is a convenient shortcut for calling CoreConfigSchema
-// on the resource's schema.
+// CoreConfigSchema is a convenient shortcut for calling CoreConfigSchema on
+// the resource's schema. CoreConfigSchema adds the implicitly required "id"
+// attribute for top level resources if it doesn't exist.
 func (r *Resource) CoreConfigSchema() *configschema.Block {
+        block := r.coreConfigSchema()
+
+        if block.Attributes == nil {
+                block.Attributes = map[string]*configschema.Attribute{}
+        }
+
+        // Add the implicitly required "id" field if it doesn't exist
+        if block.Attributes["id"] == nil {
+                block.Attributes["id"] = &configschema.Attribute{
+                        Type:     cty.String,
+                        Optional: true,
+                        Computed: true,
+                }
+        }
+
+        _, timeoutsAttr := block.Attributes[TimeoutsConfigKey]
+        _, timeoutsBlock := block.BlockTypes[TimeoutsConfigKey]
+
+        // Insert configured timeout values into the schema, as long as the schema
+        // didn't define anything else by that name.
+        if r.Timeouts != nil && !timeoutsAttr && !timeoutsBlock {
+                timeouts := configschema.Block{
+                        Attributes: map[string]*configschema.Attribute{},
+                }
+
+                if r.Timeouts.Create != nil {
+                        timeouts.Attributes[TimeoutCreate] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                if r.Timeouts.Read != nil {
+                        timeouts.Attributes[TimeoutRead] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                if r.Timeouts.Update != nil {
+                        timeouts.Attributes[TimeoutUpdate] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                if r.Timeouts.Delete != nil {
+                        timeouts.Attributes[TimeoutDelete] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                if r.Timeouts.Default != nil {
+                        timeouts.Attributes[TimeoutDefault] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                block.BlockTypes[TimeoutsConfigKey] = &configschema.NestedBlock{
+                        Nesting: configschema.NestingSingle,
+                        Block:   timeouts,
+                }
+        }
+
+        return block
+}
+
+func (r *Resource) coreConfigSchema() *configschema.Block {
+        return schemaMap(r.Schema).CoreConfigSchema()
+}
+
+// CoreConfigSchema is a convenient shortcut for calling CoreConfigSchema
+// on the backends's schema.
+func (r *Backend) CoreConfigSchema() *configschema.Block {
         return schemaMap(r.Schema).CoreConfigSchema()
 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
index b80b223..2a66a06 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
@@ -3,6 +3,7 @@ package schema
 import (
         "fmt"
         "strconv"
+        "strings"
 )
 
 // FieldReaders are responsible for decoding fields out of data into
@@ -41,6 +42,13 @@ func (r *FieldReadResult) ValueOrZero(s *Schema) interface{} {
         return s.ZeroValue()
 }
 
+// SchemasForFlatmapPath tries its best to find a sequence of schemas that
+// the given dot-delimited attribute path traverses through.
+func SchemasForFlatmapPath(path string, schemaMap map[string]*Schema) []*Schema {
+        parts := strings.Split(path, ".")
+        return addrToSchema(parts, schemaMap)
+}
+
 // addrToSchema finds the final element schema for the given address
 // and the given schema. It returns all the schemas that led to the final
 // schema. These are in order of the address (out to in).
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
index 55a301d..808375c 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
@@ -2,6 +2,7 @@ package schema
 
 import (
         "fmt"
+        "log"
         "strconv"
         "strings"
         "sync"
@@ -93,6 +94,22 @@ func (r *ConfigFieldReader) readField(
                 }
         }
 
+        if protoVersion5 {
+                switch schema.Type {
+                case TypeList, TypeSet, TypeMap, typeObject:
+                        // Check if the value itself is unknown.
+                        // The new protocol shims will add unknown values to this list of
+                        // ComputedKeys. This is the only way we have to indicate that a
+                        // collection is unknown in the config
+                        for _, unknown := range r.Config.ComputedKeys {
+                                if k == unknown {
+                                        log.Printf("[DEBUG] setting computed for %q from ComputedKeys", k)
+                                        return FieldReadResult{Computed: true, Exists: true}, nil
+                                }
+                        }
+                }
+        }
+
         switch schema.Type {
         case TypeBool, TypeFloat, TypeInt, TypeString:
                 return r.readPrimitive(k, schema)
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
index d558a5b..ae35b4a 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
@@ -174,6 +174,9 @@ func (r *DiffFieldReader) readPrimitive(
 
 func (r *DiffFieldReader) readSet(
         address []string, schema *Schema) (FieldReadResult, error) {
+        // copy address to ensure we don't modify the argument
+        address = append([]string(nil), address...)
+
         prefix := strings.Join(address, ".") + "."
 
         // Create the set that will be our result
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
index 054efe0..53f73b7 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
@@ -98,6 +98,9 @@ func (r *MapFieldReader) readPrimitive(
 
 func (r *MapFieldReader) readSet(
         address []string, schema *Schema) (FieldReadResult, error) {
+        // copy address to ensure we don't modify the argument
+        address = append([]string(nil), address...)
+
         // Get the number of elements in the list
         countRaw, err := r.readPrimitive(
                 append(address, "#"), &Schema{Type: TypeInt})
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
index 814c7ba..c09358b 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
@@ -297,13 +297,14 @@ func (w *MapFieldWriter) setSet(
         // we get the proper order back based on the hash code.
         if v := reflect.ValueOf(value); v.Kind() == reflect.Slice {
                 // Build a temp *ResourceData to use for the conversion
+                tempAddr := addr[len(addr)-1:]
                 tempSchema := *schema
                 tempSchema.Type = TypeList
-                tempSchemaMap := map[string]*Schema{addr[0]: &tempSchema}
+                tempSchemaMap := map[string]*Schema{tempAddr[0]: &tempSchema}
                 tempW := &MapFieldWriter{Schema: tempSchemaMap}
 
                 // Set the entire list, this lets us get sane values out of it
-                if err := tempW.WriteField(addr, value); err != nil {
+                if err := tempW.WriteField(tempAddr, value); err != nil {
                         return err
                 }
 
@@ -319,7 +320,7 @@ func (w *MapFieldWriter) setSet(
                 }
                 for i := 0; i < v.Len(); i++ {
                         is := strconv.FormatInt(int64(i), 10)
-                        result, err := tempR.ReadField(append(addrCopy, is))
+                        result, err := tempR.ReadField(append(tempAddr, is))
                         if err != nil {
                                 return err
                         }
@@ -340,6 +341,11 @@ func (w *MapFieldWriter) setSet(
         // problems when the old data isn't wiped first.
         w.clearTree(addr)
 
+        if value.(*Set) == nil {
+                w.result[k+".#"] = "0"
+                return nil
+        }
+
         for code, elem := range value.(*Set).m {
                 if err := w.set(append(addrCopy, code), elem); err != nil {
                         return err
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go b/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
index 38cd8c7..0184d7b 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
@@ -4,6 +4,18 @@ package schema
 
 import "strconv"
 
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[getSourceState-1]
+        _ = x[getSourceConfig-2]
+        _ = x[getSourceDiff-4]
+        _ = x[getSourceSet-8]
+        _ = x[getSourceExact-16]
+        _ = x[getSourceLevelMask-15]
+}
+
 const (
         _getSource_name_0 = "getSourceStategetSourceConfig"
         _getSource_name_1 = "getSourceDiff"
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/provider.go b/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
index 6cd325d..9702447 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
@@ -9,7 +9,7 @@ import (
 
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/configschema"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -64,6 +64,8 @@ type Provider struct {
         stopCtx       context.Context
         stopCtxCancel context.CancelFunc
         stopOnce      sync.Once
+
+        TerraformVersion string
 }
 
 // ConfigureFunc is the function used to configure a Provider.
@@ -251,7 +253,7 @@ func (p *Provider) Configure(c *terraform.ResourceConfig) error {
 
         // Get a ResourceData for this configuration. To do this, we actually
         // generate an intermediary "diff" although that is never exposed.
-        diff, err := sm.Diff(nil, c, nil, p.meta)
+        diff, err := sm.Diff(nil, c, nil, p.meta, true)
         if err != nil {
                 return err
         }
@@ -296,6 +298,20 @@ func (p *Provider) Diff(
         return r.Diff(s, c, p.meta)
 }
 
+// SimpleDiff is used by the new protocol wrappers to get a diff that doesn't
+// attempt to calculate ignore_changes.
+func (p *Provider) SimpleDiff(
+        info *terraform.InstanceInfo,
+        s *terraform.InstanceState,
+        c *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
+        r, ok := p.ResourcesMap[info.Type]
+        if !ok {
+                return nil, fmt.Errorf("unknown resource type: %s", info.Type)
+        }
+
+        return r.simpleDiff(s, c, p.meta)
+}
+
 // Refresh implementation of terraform.ResourceProvider interface.
 func (p *Provider) Refresh(
         info *terraform.InstanceInfo,
@@ -311,7 +327,7 @@ func (p *Provider) Refresh(
 // Resources implementation of terraform.ResourceProvider interface.
 func (p *Provider) Resources() []terraform.ResourceType {
         keys := make([]string, 0, len(p.ResourcesMap))
-        for k, _ := range p.ResourcesMap {
+        for k := range p.ResourcesMap {
                 keys = append(keys, k)
         }
         sort.Strings(keys)
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go b/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
index a8d42db..637e221 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
@@ -8,6 +8,7 @@ import (
 
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -121,6 +122,11 @@ func (p *Provisioner) Stop() error {
         return nil
 }
 
+// GetConfigSchema implementation of terraform.ResourceProvisioner interface.
+func (p *Provisioner) GetConfigSchema() (*configschema.Block, error) {
+        return schemaMap(p.Schema).CoreConfigSchema(), nil
+}
+
 // Apply implementation of terraform.ResourceProvisioner interface.
 func (p *Provisioner) Apply(
         o terraform.UIOutput,
@@ -146,7 +152,7 @@ func (p *Provisioner) Apply(
                 }
 
                 sm := schemaMap(p.ConnSchema)
-                diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil)
+                diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil, true)
                 if err != nil {
                         return err
                 }
@@ -160,7 +166,7 @@ func (p *Provisioner) Apply(
                 // Build the configuration data. Doing this requires making a "diff"
                 // even though that's never used. We use that just to get the correct types.
                 configMap := schemaMap(p.Schema)
-                diff, err := configMap.Diff(nil, c, nil, nil)
+                diff, err := configMap.Diff(nil, c, nil, nil, true)
                 if err != nil {
                         return err
                 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
index d3be2d6..b5e3065 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
@@ -8,6 +8,7 @@ import (
 
         "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/terraform"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // Resource represents a thing in Terraform that has a set of configurable
@@ -44,6 +45,12 @@ type Resource struct {
         // their Versioning at any integer >= 1
         SchemaVersion int
 
+        // MigrateState is deprecated and any new changes to a resource's schema
+        // should be handled by StateUpgraders. Existing MigrateState implementations
+        // should remain for compatibility with existing state. MigrateState will
+        // still be called if the stored SchemaVersion is less than the
+        // first version of the StateUpgraders.
+        //
         // MigrateState is responsible for updating an InstanceState with an old
         // version to the format expected by the current version of the Schema.
         //
@@ -56,6 +63,18 @@ type Resource struct {
         // needs to make any remote API calls.
         MigrateState StateMigrateFunc
 
+        // StateUpgraders contains the functions responsible for upgrading an
+        // existing state with an old schema version to a newer schema. It is
+        // called specifically by Terraform when the stored schema version is less
+        // than the current SchemaVersion of the Resource.
+        //
+        // StateUpgraders map specific schema versions to a StateUpgrader
+        // function. The registered versions are expected to be ordered,
+        // consecutive values. The initial value may be greater than 0 to account
+        // for legacy schemas that weren't recorded and can be handled by
+        // MigrateState.
+        StateUpgraders []StateUpgrader
+
         // The functions below are the CRUD operations for this resource.
         //
         // The only optional operation is Update. If Update is not implemented,
@@ -136,6 +155,27 @@ type Resource struct {
         Timeouts *ResourceTimeout
 }
 
+// ShimInstanceStateFromValue converts a cty.Value to a
+// terraform.InstanceState.
+func (r *Resource) ShimInstanceStateFromValue(state cty.Value) (*terraform.InstanceState, error) {
+        // Get the raw shimmed value. While this is correct, the set hashes don't
+        // match those from the Schema.
+        s := terraform.NewInstanceStateShimmedFromValue(state, r.SchemaVersion)
+
+        // We now rebuild the state through the ResourceData, so that the set indexes
+        // match what helper/schema expects.
+        data, err := schemaMap(r.Schema).Data(s, nil)
+        if err != nil {
+                return nil, err
+        }
+
+        s = data.State()
+        if s == nil {
+                s = &terraform.InstanceState{}
+        }
+        return s, nil
+}
+
 // See Resource documentation.
 type CreateFunc func(*ResourceData, interface{}) error
 
@@ -155,6 +195,27 @@ type ExistsFunc func(*ResourceData, interface{}) (bool, error)
 type StateMigrateFunc func(
         int, *terraform.InstanceState, interface{}) (*terraform.InstanceState, error)
 
+type StateUpgrader struct {
+        // Version is the version schema that this Upgrader will handle, converting
+        // it to Version+1.
+        Version int
+
+        // Type describes the schema that this function can upgrade. Type is
+        // required to decode the schema if the state was stored in a legacy
+        // flatmap format.
+        Type cty.Type
+
+        // Upgrade takes the JSON encoded state and the provider meta value, and
+        // upgrades the state one single schema version. The provided state is
+        // deocded into the default json types using a map[string]interface{}. It
+        // is up to the StateUpgradeFunc to ensure that the returned value can be
+        // encoded using the new schema.
+        Upgrade StateUpgradeFunc
+}
+
+// See StateUpgrader
+type StateUpgradeFunc func(rawState map[string]interface{}, meta interface{}) (map[string]interface{}, error)
+
 // See Resource documentation.
 type CustomizeDiffFunc func(*ResourceDiff, interface{}) error
 
@@ -247,7 +308,7 @@ func (r *Resource) Diff(
                 return nil, fmt.Errorf("[ERR] Error decoding timeout: %s", err)
         }
 
-        instanceDiff, err := schemaMap(r.Schema).Diff(s, c, r.CustomizeDiff, meta)
+        instanceDiff, err := schemaMap(r.Schema).Diff(s, c, r.CustomizeDiff, meta, true)
         if err != nil {
                 return instanceDiff, err
         }
@@ -263,6 +324,45 @@ func (r *Resource) Diff(
         return instanceDiff, err
 }
 
+func (r *Resource) simpleDiff(
+        s *terraform.InstanceState,
+        c *terraform.ResourceConfig,
+        meta interface{}) (*terraform.InstanceDiff, error) {
+
+        t := &ResourceTimeout{}
+        err := t.ConfigDecode(r, c)
+
+        if err != nil {
+                return nil, fmt.Errorf("[ERR] Error decoding timeout: %s", err)
+        }
+
+        instanceDiff, err := schemaMap(r.Schema).Diff(s, c, r.CustomizeDiff, meta, false)
+        if err != nil {
+                return instanceDiff, err
+        }
+
+        if instanceDiff == nil {
+                log.Printf("[DEBUG] Instance Diff is nil in SimpleDiff()")
+                return nil, err
+        }
+
+        // Make sure the old value is set in each of the instance diffs.
+        // This was done by the RequiresNew logic in the full legacy Diff.
+        for k, attr := range instanceDiff.Attributes {
+                if attr == nil {
+                        continue
+                }
+                if s != nil {
+                        attr.Old = s.Attributes[k]
+                }
+        }
+
+        if err := t.DiffEncode(instanceDiff); err != nil {
+                log.Printf("[ERR] Error encoding timeout to instance diff: %s", err)
+        }
+        return instanceDiff, err
+}
+
 // Validate validates the resource configuration against the schema.
 func (r *Resource) Validate(c *terraform.ResourceConfig) ([]string, []error) {
         warns, errs := schemaMap(r.Schema).Validate(c)
@@ -300,8 +400,11 @@ func (r *Resource) ReadDataApply(
         return r.recordCurrentSchemaVersion(state), err
 }
 
-// Refresh refreshes the state of the resource.
-func (r *Resource) Refresh(
+// RefreshWithoutUpgrade reads the instance state, but does not call
+// MigrateState or the StateUpgraders, since those are now invoked in a
+// separate API call.
+// RefreshWithoutUpgrade is part of the new plugin shims.
+func (r *Resource) RefreshWithoutUpgrade(
         s *terraform.InstanceState,
         meta interface{}) (*terraform.InstanceState, error) {
         // If the ID is already somehow blank, it doesn't exist
@@ -335,12 +438,60 @@ func (r *Resource) Refresh(
                 }
         }
 
-        needsMigration, stateSchemaVersion := r.checkSchemaVersion(s)
-        if needsMigration && r.MigrateState != nil {
-                s, err := r.MigrateState(stateSchemaVersion, s, meta)
+        data, err := schemaMap(r.Schema).Data(s, nil)
+        data.timeouts = &rt
+        if err != nil {
+                return s, err
+        }
+
+        err = r.Read(data, meta)
+        state := data.State()
+        if state != nil && state.ID == "" {
+                state = nil
+        }
+
+        return r.recordCurrentSchemaVersion(state), err
+}
+
+// Refresh refreshes the state of the resource.
+func (r *Resource) Refresh(
+        s *terraform.InstanceState,
+        meta interface{}) (*terraform.InstanceState, error) {
+        // If the ID is already somehow blank, it doesn't exist
+        if s.ID == "" {
+                return nil, nil
+        }
+
+        rt := ResourceTimeout{}
+        if _, ok := s.Meta[TimeoutKey]; ok {
+                if err := rt.StateDecode(s); err != nil {
+                        log.Printf("[ERR] Error decoding ResourceTimeout: %s", err)
+                }
+        }
+
+        if r.Exists != nil {
+                // Make a copy of data so that if it is modified it doesn't
+                // affect our Read later.
+                data, err := schemaMap(r.Schema).Data(s, nil)
+                data.timeouts = &rt
+
                 if err != nil {
                         return s, err
                 }
+
+                exists, err := r.Exists(data, meta)
+                if err != nil {
+                        return s, err
+                }
+                if !exists {
+                        return nil, nil
+                }
+        }
+
+        // there may be new StateUpgraders that need to be run
+        s, err := r.upgradeState(s, meta)
+        if err != nil {
+                return s, err
         }
 
         data, err := schemaMap(r.Schema).Data(s, nil)
@@ -358,6 +509,71 @@ func (r *Resource) Refresh(
         return r.recordCurrentSchemaVersion(state), err
 }
 
+func (r *Resource) upgradeState(s *terraform.InstanceState, meta interface{}) (*terraform.InstanceState, error) {
+        var err error
+
+        needsMigration, stateSchemaVersion := r.checkSchemaVersion(s)
+        migrate := needsMigration && r.MigrateState != nil
+
+        if migrate {
+                s, err = r.MigrateState(stateSchemaVersion, s, meta)
+                if err != nil {
+                        return s, err
+                }
+        }
+
+        if len(r.StateUpgraders) == 0 {
+                return s, nil
+        }
+
+        // If we ran MigrateState, then the stateSchemaVersion value is no longer
+        // correct. We can expect the first upgrade function to be the correct
+        // schema type version.
+        if migrate {
+                stateSchemaVersion = r.StateUpgraders[0].Version
+        }
+
+        schemaType := r.CoreConfigSchema().ImpliedType()
+        // find the expected type to convert the state
+        for _, upgrader := range r.StateUpgraders {
+                if stateSchemaVersion == upgrader.Version {
+                        schemaType = upgrader.Type
+                }
+        }
+
+        // StateUpgraders only operate on the new JSON format state, so the state
+        // need to be converted.
+        stateVal, err := StateValueFromInstanceState(s, schemaType)
+        if err != nil {
+                return nil, err
+        }
+
+        jsonState, err := StateValueToJSONMap(stateVal, schemaType)
+        if err != nil {
+                return nil, err
+        }
+
+        for _, upgrader := range r.StateUpgraders {
+                if stateSchemaVersion != upgrader.Version {
+                        continue
+                }
+
+                jsonState, err = upgrader.Upgrade(jsonState, meta)
+                if err != nil {
+                        return nil, err
+                }
+                stateSchemaVersion++
+        }
+
+        // now we need to re-flatmap the new state
+        stateVal, err = JSONMapToStateValue(jsonState, r.CoreConfigSchema())
+        if err != nil {
+                return nil, err
+        }
+
+        return r.ShimInstanceStateFromValue(stateVal)
+}
+
 // InternalValidate should be called to validate the structure
 // of the resource.
 //
@@ -437,6 +653,31 @@ func (r *Resource) InternalValidate(topSchemaMap schemaMap, writable bool) error
                 }
         }
 
+        lastVersion := -1
+        for _, u := range r.StateUpgraders {
+                if lastVersion >= 0 && u.Version-lastVersion > 1 {
+                        return fmt.Errorf("missing schema version between %d and %d", lastVersion, u.Version)
+                }
+
+                if u.Version >= r.SchemaVersion {
+                        return fmt.Errorf("StateUpgrader version %d is >= current version %d", u.Version, r.SchemaVersion)
+                }
+
+                if !u.Type.IsObjectType() {
+                        return fmt.Errorf("StateUpgrader %d type is not cty.Object", u.Version)
+                }
+
+                if u.Upgrade == nil {
+                        return fmt.Errorf("StateUpgrader %d missing StateUpgradeFunc", u.Version)
+                }
+
+                lastVersion = u.Version
+        }
+
+        if lastVersion >= 0 && lastVersion != r.SchemaVersion-1 {
+                return fmt.Errorf("missing StateUpgrader between %d and %d", lastVersion, r.SchemaVersion)
+        }
+
         // Data source
         if r.isTopLevel() && !writable {
                 tsm = schemaMap(r.Schema)
@@ -513,6 +754,13 @@ func (r *Resource) TestResourceData() *ResourceData {
         }
 }
 
+// SchemasForFlatmapPath tries its best to find a sequence of schemas that
+// the given dot-delimited attribute path traverses through in the schema
+// of the receiving Resource.
+func (r *Resource) SchemasForFlatmapPath(path string) []*Schema {
+        return SchemasForFlatmapPath(path, r.Schema)
+}
+
 // Returns true if the resource is "top level" i.e. not a sub-resource.
 func (r *Resource) isTopLevel() bool {
         // TODO: This is a heuristic; replace with a definitive attribute?
@@ -538,7 +786,15 @@ func (r *Resource) checkSchemaVersion(is *terraform.InstanceState) (bool, int) {
         }
 
         stateSchemaVersion, _ := strconv.Atoi(rawString)
-        return stateSchemaVersion < r.SchemaVersion, stateSchemaVersion
+
+        // Don't run MigrateState if the version is handled by a StateUpgrader,
+        // since StateMigrateFuncs are not required to handle unknown versions
+        maxVersion := r.SchemaVersion
+        if len(r.StateUpgraders) > 0 {
+                maxVersion = r.StateUpgraders[0].Version
+        }
+
+        return stateSchemaVersion < maxVersion, stateSchemaVersion
 }
 
 func (r *Resource) recordCurrentSchemaVersion(
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
index 6cc01ee..1c39070 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
@@ -52,6 +52,8 @@ type getResult struct {
 // UnsafeSetFieldRaw allows setting arbitrary values in state to arbitrary
 // values, bypassing schema. This MUST NOT be used in normal circumstances -
 // it exists only to support the remote_state data source.
+//
+// Deprecated: Fully define schema attributes and use Set() instead.
 func (d *ResourceData) UnsafeSetFieldRaw(key string, value string) {
         d.once.Do(d.init)
 
@@ -219,10 +221,16 @@ func (d *ResourceData) Id() string {
 
         if d.state != nil {
                 result = d.state.ID
+                if result == "" {
+                        result = d.state.Attributes["id"]
+                }
         }
 
         if d.newState != nil {
                 result = d.newState.ID
+                if result == "" {
+                        result = d.newState.Attributes["id"]
+                }
         }
 
         return result
@@ -246,6 +254,18 @@ func (d *ResourceData) ConnInfo() map[string]string {
 func (d *ResourceData) SetId(v string) {
         d.once.Do(d.init)
         d.newState.ID = v
+
+        // once we transition away from the legacy state types, "id" will no longer
+        // be a special field, and will become a normal attribute.
+        // set the attribute normally
+        d.setWriter.unsafeWriteField("id", v)
+
+        // Make sure the newState is also set, otherwise the old value
+        // may get precedence.
+        if d.newState.Attributes == nil {
+                d.newState.Attributes = map[string]string{}
+        }
+        d.newState.Attributes["id"] = v
 }
 
 // SetConnInfo sets the connection info for a resource.
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
index 7db3dec..47b5481 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
@@ -367,7 +367,7 @@ func (d *ResourceDiff) Get(key string) interface{} {
 }
 
 // GetChange gets the change between the state and diff, checking first to see
-// if a overridden diff exists.
+// if an overridden diff exists.
 //
 // This implementation differs from ResourceData's in the way that we first get
 // results from the exact levels for the new diff, then from state and diff as
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go
index 445819f..9e422c1 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go
@@ -5,6 +5,7 @@ import (
         "log"
         "time"
 
+        "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/terraform"
         "github.com/mitchellh/copystructure"
 )
@@ -62,55 +63,70 @@ func (t *ResourceTimeout) ConfigDecode(s *Resource, c *terraform.ResourceConfig)
         }
 
         if raw, ok := c.Config[TimeoutsConfigKey]; ok {
-                if configTimeouts, ok := raw.([]map[string]interface{}); ok {
-                        for _, timeoutValues := range configTimeouts {
-                                // loop through each Timeout given in the configuration and validate they
-                                // the Timeout defined in the resource
-                                for timeKey, timeValue := range timeoutValues {
-                                        // validate that we're dealing with the normal CRUD actions
-                                        var found bool
-                                        for _, key := range timeoutKeys() {
-                                                if timeKey == key {
-                                                        found = true
-                                                        break
-                                                }
-                                        }
+                var rawTimeouts []map[string]interface{}
+                switch raw := raw.(type) {
+                case map[string]interface{}:
+                        rawTimeouts = append(rawTimeouts, raw)
+                case []map[string]interface{}:
+                        rawTimeouts = raw
+                case string:
+                        if raw == config.UnknownVariableValue {
+                                // Timeout is not defined in the config
+                                // Defaults will be used instead
+                                return nil
+                        } else {
+                                log.Printf("[ERROR] Invalid timeout value: %q", raw)
+                                return fmt.Errorf("Invalid Timeout value found")
+                        }
+                default:
+                        log.Printf("[ERROR] Invalid timeout structure: %#v", raw)
+                        return fmt.Errorf("Invalid Timeout structure found")
+                }
 
-                                        if !found {
-                                                return fmt.Errorf("Unsupported Timeout configuration key found (%s)", timeKey)
+                for _, timeoutValues := range rawTimeouts {
+                        for timeKey, timeValue := range timeoutValues {
+                                // validate that we're dealing with the normal CRUD actions
+                                var found bool
+                                for _, key := range timeoutKeys() {
+                                        if timeKey == key {
+                                                found = true
+                                                break
                                         }
+                                }
 
-                                        // Get timeout
-                                        rt, err := time.ParseDuration(timeValue.(string))
-                                        if err != nil {
-                                                return fmt.Errorf("Error parsing Timeout for (%s): %s", timeKey, err)
-                                        }
+                                if !found {
+                                        return fmt.Errorf("Unsupported Timeout configuration key found (%s)", timeKey)
+                                }
 
-                                        var timeout *time.Duration
-                                        switch timeKey {
-                                        case TimeoutCreate:
-                                                timeout = t.Create
-                                        case TimeoutUpdate:
-                                                timeout = t.Update
-                                        case TimeoutRead:
-                                                timeout = t.Read
-                                        case TimeoutDelete:
-                                                timeout = t.Delete
-                                        case TimeoutDefault:
-                                                timeout = t.Default
-                                        }
+                                // Get timeout
+                                rt, err := time.ParseDuration(timeValue.(string))
+                                if err != nil {
+                                        return fmt.Errorf("Error parsing %q timeout: %s", timeKey, err)
+                                }
 
-                                        // If the resource has not delcared this in the definition, then error
-                                        // with an unsupported message
-                                        if timeout == nil {
-                                                return unsupportedTimeoutKeyError(timeKey)
-                                        }
+                                var timeout *time.Duration
+                                switch timeKey {
+                                case TimeoutCreate:
+                                        timeout = t.Create
+                                case TimeoutUpdate:
+                                        timeout = t.Update
+                                case TimeoutRead:
+                                        timeout = t.Read
+                                case TimeoutDelete:
+                                        timeout = t.Delete
+                                case TimeoutDefault:
+                                        timeout = t.Default
+                                }
 
-                                        *timeout = rt
+                                // If the resource has not delcared this in the definition, then error
+                                // with an unsupported message
+                                if timeout == nil {
+                                        return unsupportedTimeoutKeyError(timeKey)
                                 }
+
+                                *timeout = rt
                         }
-                } else {
-                        log.Printf("[WARN] Invalid Timeout structure found, skipping timeouts")
+                        return nil
                 }
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
index 0ea5aad..6a3c15a 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
@@ -12,6 +12,7 @@
 package schema
 
 import (
+        "context"
         "fmt"
         "os"
         "reflect"
@@ -19,7 +20,9 @@ import (
         "sort"
         "strconv"
         "strings"
+        "sync"
 
+        "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/terraform"
         "github.com/mitchellh/copystructure"
         "github.com/mitchellh/mapstructure"
@@ -31,6 +34,27 @@ const PanicOnErr = "TF_SCHEMA_PANIC_ON_ERROR"
 // type used for schema package context keys
 type contextKey string
 
+var (
+        protoVersionMu sync.Mutex
+        protoVersion5  = false
+)
+
+func isProto5() bool {
+        protoVersionMu.Lock()
+        defer protoVersionMu.Unlock()
+        return protoVersion5
+
+}
+
+// SetProto5 enables a feature flag for any internal changes required required
+// to work with the new plugin protocol.  This should not be called by
+// provider.
+func SetProto5() {
+        protoVersionMu.Lock()
+        defer protoVersionMu.Unlock()
+        protoVersion5 = true
+}
+
 // Schema is used to describe the structure of a value.
 //
 // Read the documentation of the struct elements for important details.
@@ -51,6 +75,26 @@ type Schema struct {
         //
         Type ValueType
 
+        // ConfigMode allows for overriding the default behaviors for mapping
+        // schema entries onto configuration constructs.
+        //
+        // By default, the Elem field is used to choose whether a particular
+        // schema is represented in configuration as an attribute or as a nested
+        // block; if Elem is a *schema.Resource then it's a block and it's an
+        // attribute otherwise.
+        //
+        // If Elem is *schema.Resource then setting ConfigMode to
+        // SchemaConfigModeAttr will force it to be represented in configuration
+        // as an attribute, which means that the Computed flag can be used to
+        // provide default elements when the argument isn't set at all, while still
+        // allowing the user to force zero elements by explicitly assigning an
+        // empty list.
+        //
+        // When Computed is set without Optional, the attribute is not settable
+        // in configuration at all and so SchemaConfigModeAttr is the automatic
+        // behavior, and SchemaConfigModeBlock is not permitted.
+        ConfigMode SchemaConfigMode
+
         // If one of these is set, then this item can come from the configuration.
         // Both cannot be set. If Optional is set, the value is optional. If
         // Required is set, the value is required.
@@ -123,7 +167,8 @@ type Schema struct {
         // The following fields are only set for a TypeList, TypeSet, or TypeMap.
         //
         // Elem represents the element type. For a TypeMap, it must be a *Schema
-        // with a Type of TypeString, otherwise it may be either a *Schema or a
+        // with a Type that is one of the primitives: TypeString, TypeBool,
+        // TypeInt, or TypeFloat. Otherwise it may be either a *Schema or a
         // *Resource. If it is *Schema, the element type is just a simple value.
         // If it is *Resource, the element type is a complex structure,
         // potentially with its own lifecycle.
@@ -141,13 +186,17 @@ type Schema struct {
         // used to wrap a complex structure, however less than one instance would
         // cause instability.
         //
-        // PromoteSingle, if true, will allow single elements to be standalone
-        // and promote them to a list. For example "foo" would be promoted to
-        // ["foo"] automatically. This is primarily for legacy reasons and the
-        // ambiguity is not recommended for new usage. Promotion is only allowed
-        // for primitive element types.
-        MaxItems      int
-        MinItems      int
+        // If the field Optional is set to true then MinItems is ignored and thus
+        // effectively zero.
+        MaxItems int
+        MinItems int
+
+        // PromoteSingle originally allowed for a single element to be assigned
+        // where a primitive list was expected, but this no longer works from
+        // Terraform v0.12 onwards (Terraform Core will require a list to be set
+        // regardless of what this is set to) and so only applies to Terraform v0.11
+        // and earlier, and so should be used only to retain this functionality
+        // for those still using v0.11 with a provider that formerly used this.
         PromoteSingle bool
 
         // The following fields are only valid for a TypeSet type.
@@ -189,7 +238,8 @@ type Schema struct {
         // guaranteed to be of the proper Schema type, and it can yield warnings or
         // errors based on inspection of that value.
         //
-        // ValidateFunc currently only works for primitive types.
+        // ValidateFunc is honored only when the schema's Type is set to TypeInt,
+        // TypeFloat, TypeString, TypeBool, or TypeMap. It is ignored for all other types.
         ValidateFunc SchemaValidateFunc
 
         // Sensitive ensures that the attribute's value does not get displayed in
@@ -199,6 +249,17 @@ type Schema struct {
         Sensitive bool
 }
 
+// SchemaConfigMode is used to influence how a schema item is mapped into a
+// corresponding configuration construct, using the ConfigMode field of
+// Schema.
+type SchemaConfigMode int
+
+const (
+        SchemaConfigModeAuto SchemaConfigMode = iota
+        SchemaConfigModeAttr
+        SchemaConfigModeBlock
+)
+
 // SchemaDiffSuppressFunc is a function which can be used to determine
 // whether a detected diff on a schema element is "valid" or not, and
 // suppress it from the plan if necessary.
@@ -364,6 +425,11 @@ func (s *Schema) finalizeDiff(d *terraform.ResourceAttrDiff, customized bool) *t
         return d
 }
 
+// InternalMap is used to aid in the transition to the new schema types and
+// protocol. The name is not meant to convey any usefulness, as this is not to
+// be used directly by any providers.
+type InternalMap = schemaMap
+
 // schemaMap is a wrapper that adds nice functions on top of schemas.
 type schemaMap map[string]*Schema
 
@@ -404,7 +470,8 @@ func (m schemaMap) Diff(
         s *terraform.InstanceState,
         c *terraform.ResourceConfig,
         customizeDiff CustomizeDiffFunc,
-        meta interface{}) (*terraform.InstanceDiff, error) {
+        meta interface{},
+        handleRequiresNew bool) (*terraform.InstanceDiff, error) {
         result := new(terraform.InstanceDiff)
         result.Attributes = make(map[string]*terraform.ResourceAttrDiff)
 
@@ -450,82 +517,85 @@ func (m schemaMap) Diff(
                 }
         }
 
-        // If the diff requires a new resource, then we recompute the diff
-        // so we have the complete new resource diff, and preserve the
-        // RequiresNew fields where necessary so the user knows exactly what
-        // caused that.
-        if result.RequiresNew() {
-                // Create the new diff
-                result2 := new(terraform.InstanceDiff)
-                result2.Attributes = make(map[string]*terraform.ResourceAttrDiff)
-
-                // Preserve the DestroyTainted flag
-                result2.DestroyTainted = result.DestroyTainted
+        if handleRequiresNew {
+                // If the diff requires a new resource, then we recompute the diff
+                // so we have the complete new resource diff, and preserve the
+                // RequiresNew fields where necessary so the user knows exactly what
+                // caused that.
+                if result.RequiresNew() {
+                        // Create the new diff
+                        result2 := new(terraform.InstanceDiff)
+                        result2.Attributes = make(map[string]*terraform.ResourceAttrDiff)
 
-                // Reset the data to not contain state. We have to call init()
-                // again in order to reset the FieldReaders.
-                d.state = nil
-                d.init()
+                        // Preserve the DestroyTainted flag
+                        result2.DestroyTainted = result.DestroyTainted
 
-                // Perform the diff again
-                for k, schema := range m {
-                        err := m.diff(k, schema, result2, d, false)
-                        if err != nil {
-                                return nil, err
-                        }
-                }
+                        // Reset the data to not contain state. We have to call init()
+                        // again in order to reset the FieldReaders.
+                        d.state = nil
+                        d.init()
 
-                // Re-run customization
-                if !result2.DestroyTainted && customizeDiff != nil {
-                        mc := m.DeepCopy()
-                        rd := newResourceDiff(mc, c, d.state, result2)
-                        if err := customizeDiff(rd, meta); err != nil {
-                                return nil, err
-                        }
-                        for _, k := range rd.UpdatedKeys() {
-                                err := m.diff(k, mc[k], result2, rd, false)
+                        // Perform the diff again
+                        for k, schema := range m {
+                                err := m.diff(k, schema, result2, d, false)
                                 if err != nil {
                                         return nil, err
                                 }
                         }
-                }
 
-                // Force all the fields to not force a new since we know what we
-                // want to force new.
-                for k, attr := range result2.Attributes {
-                        if attr == nil {
-                                continue
+                        // Re-run customization
+                        if !result2.DestroyTainted && customizeDiff != nil {
+                                mc := m.DeepCopy()
+                                rd := newResourceDiff(mc, c, d.state, result2)
+                                if err := customizeDiff(rd, meta); err != nil {
+                                        return nil, err
+                                }
+                                for _, k := range rd.UpdatedKeys() {
+                                        err := m.diff(k, mc[k], result2, rd, false)
+                                        if err != nil {
+                                                return nil, err
+                                        }
+                                }
                         }
 
-                        if attr.RequiresNew {
-                                attr.RequiresNew = false
-                        }
+                        // Force all the fields to not force a new since we know what we
+                        // want to force new.
+                        for k, attr := range result2.Attributes {
+                                if attr == nil {
+                                        continue
+                                }
 
-                        if s != nil {
-                                attr.Old = s.Attributes[k]
-                        }
-                }
+                                if attr.RequiresNew {
+                                        attr.RequiresNew = false
+                                }
 
-                // Now copy in all the requires new diffs...
-                for k, attr := range result.Attributes {
-                        if attr == nil {
-                                continue
+                                if s != nil {
+                                        attr.Old = s.Attributes[k]
+                                }
                         }
 
-                        newAttr, ok := result2.Attributes[k]
-                        if !ok {
-                                newAttr = attr
-                        }
+                        // Now copy in all the requires new diffs...
+                        for k, attr := range result.Attributes {
+                                if attr == nil {
+                                        continue
+                                }
 
-                        if attr.RequiresNew {
-                                newAttr.RequiresNew = true
+                                newAttr, ok := result2.Attributes[k]
+                                if !ok {
+                                        newAttr = attr
+                                }
+
+                                if attr.RequiresNew {
+                                        newAttr.RequiresNew = true
+                                }
+
+                                result2.Attributes[k] = newAttr
                         }
 
-                        result2.Attributes[k] = newAttr
+                        // And set the diff!
+                        result = result2
                 }
 
-                // And set the diff!
-                result = result2
         }
 
         // Go through and detect all of the ComputedWhens now that we've
@@ -611,6 +681,10 @@ func (m schemaMap) Validate(c *terraform.ResourceConfig) ([]string, []error) {
 // from a unit test (and not in user-path code) to verify that a schema
 // is properly built.
 func (m schemaMap) InternalValidate(topSchemaMap schemaMap) error {
+        return m.internalValidate(topSchemaMap, false)
+}
+
+func (m schemaMap) internalValidate(topSchemaMap schemaMap, attrsOnly bool) error {
         if topSchemaMap == nil {
                 topSchemaMap = m
         }
@@ -631,6 +705,34 @@ func (m schemaMap) InternalValidate(topSchemaMap schemaMap) error {
                         return fmt.Errorf("%s: One of optional, required, or computed must be set", k)
                 }
 
+                computedOnly := v.Computed && !v.Optional
+
+                switch v.ConfigMode {
+                case SchemaConfigModeBlock:
+                        if _, ok := v.Elem.(*Resource); !ok {
+                                return fmt.Errorf("%s: ConfigMode of block is allowed only when Elem is *schema.Resource", k)
+                        }
+                        if attrsOnly {
+                                return fmt.Errorf("%s: ConfigMode of block cannot be used in child of schema with ConfigMode of attribute", k)
+                        }
+                        if computedOnly {
+                                return fmt.Errorf("%s: ConfigMode of block cannot be used for computed schema", k)
+                        }
+                case SchemaConfigModeAttr:
+                        // anything goes
+                case SchemaConfigModeAuto:
+                        // Since "Auto" for Elem: *Resource would create a nested block,
+                        // and that's impossible inside an attribute, we require it to be
+                        // explicitly overridden as mode "Attr" for clarity.
+                        if _, ok := v.Elem.(*Resource); ok {
+                                if attrsOnly {
+                                        return fmt.Errorf("%s: in *schema.Resource with ConfigMode of attribute, so must also have ConfigMode of attribute", k)
+                                }
+                        }
+                default:
+                        return fmt.Errorf("%s: invalid ConfigMode value", k)
+                }
+
                 if v.Computed && v.Default != nil {
                         return fmt.Errorf("%s: Default must be nil if computed", k)
                 }
@@ -695,7 +797,9 @@ func (m schemaMap) InternalValidate(topSchemaMap schemaMap) error {
 
                         switch t := v.Elem.(type) {
                         case *Resource:
-                                if err := t.InternalValidate(topSchemaMap, true); err != nil {
+                                attrsOnly := attrsOnly || v.ConfigMode == SchemaConfigModeAttr
+
+                                if err := schemaMap(t.Schema).internalValidate(topSchemaMap, attrsOnly); err != nil {
                                         return err
                                 }
                         case *Schema:
@@ -785,10 +889,19 @@ func (m schemaMap) diff(
         for attrK, attrV := range unsupressedDiff.Attributes {
                 switch rd := d.(type) {
                 case *ResourceData:
-                        if schema.DiffSuppressFunc != nil &&
-                                attrV != nil &&
+                        if schema.DiffSuppressFunc != nil && attrV != nil &&
                                 schema.DiffSuppressFunc(attrK, attrV.Old, attrV.New, rd) {
-                                continue
+                                // If this attr diff is suppressed, we may still need it in the
+                                // overall diff if it's contained within a set. Rather than
+                                // dropping the diff, make it a NOOP.
+                                if !all {
+                                        continue
+                                }
+
+                                attrV = &terraform.ResourceAttrDiff{
+                                        Old: attrV.Old,
+                                        New: attrV.Old,
+                                }
                         }
                 }
                 diff.Attributes[attrK] = attrV
@@ -1171,7 +1284,7 @@ func (m schemaMap) diffString(
                 return fmt.Errorf("%s: %s", k, err)
         }
 
-        if os == ns && !all {
+        if os == ns && !all && !computed {
                 // They're the same value. If there old value is not blank or we
                 // have an ID, then return right away since we're already setup.
                 if os != "" || d.Id() != "" {
@@ -1179,7 +1292,7 @@ func (m schemaMap) diffString(
                 }
 
                 // Otherwise, only continue if we're computed
-                if !schema.Computed && !computed {
+                if !schema.Computed {
                         return nil
                 }
         }
@@ -1210,7 +1323,7 @@ func (m schemaMap) inputString(
         input terraform.UIInput,
         k string,
         schema *Schema) (interface{}, error) {
-        result, err := input.Input(&terraform.InputOpts{
+        result, err := input.Input(context.Background(), &terraform.InputOpts{
                 Id:          k,
                 Query:       k,
                 Description: schema.Description,
@@ -1252,6 +1365,13 @@ func (m schemaMap) validate(
                         "%q: this field cannot be set", k)}
         }
 
+        if raw == config.UnknownVariableValue {
+                // If the value is unknown then we can't validate it yet.
+                // In particular, this avoids spurious type errors where downstream
+                // validation code sees UnknownVariableValue as being just a string.
+                return nil, nil
+        }
+
         err := m.validateConflictingAttributes(k, schema, c)
         if err != nil {
                 return nil, []error{err}
@@ -1269,10 +1389,15 @@ func (m schemaMap) validateConflictingAttributes(
                 return nil
         }
 
-        for _, conflicting_key := range schema.ConflictsWith {
-                if _, ok := c.Get(conflicting_key); ok {
+        for _, conflictingKey := range schema.ConflictsWith {
+                if raw, ok := c.Get(conflictingKey); ok {
+                        if raw == config.UnknownVariableValue {
+                                // An unknown value might become unset (null) once known, so
+                                // we must defer validation until it's known.
+                                continue
+                        }
                         return fmt.Errorf(
-                                "%q: conflicts with %s", k, conflicting_key)
+                                "%q: conflicts with %s", k, conflictingKey)
                 }
         }
 
@@ -1284,6 +1409,13 @@ func (m schemaMap) validateList(
         raw interface{},
         schema *Schema,
         c *terraform.ResourceConfig) ([]string, []error) {
+        // first check if the list is wholly unknown
+        if s, ok := raw.(string); ok {
+                if s == config.UnknownVariableValue {
+                        return nil, nil
+                }
+        }
+
         // We use reflection to verify the slice because you can't
         // case to []interface{} unless the slice is exactly that type.
         rawV := reflect.ValueOf(raw)
@@ -1355,6 +1487,13 @@ func (m schemaMap) validateMap(
         raw interface{},
         schema *Schema,
         c *terraform.ResourceConfig) ([]string, []error) {
+        // first check if the list is wholly unknown
+        if s, ok := raw.(string); ok {
+                if s == config.UnknownVariableValue {
+                        return nil, nil
+                }
+        }
+
         // We use reflection to verify the slice because you can't
         // case to []interface{} unless the slice is exactly that type.
         rawV := reflect.ValueOf(raw)
@@ -1556,12 +1695,25 @@ func (m schemaMap) validatePrimitive(
                 }
                 decoded = n
         case TypeInt:
-                // Verify that we can parse this as an int
-                var n int
-                if err := mapstructure.WeakDecode(raw, &n); err != nil {
-                        return nil, []error{fmt.Errorf("%s: %s", k, err)}
+                switch {
+                case isProto5():
+                        // We need to verify the type precisely, because WeakDecode will
+                        // decode a float as an integer.
+
+                        // the config shims only use int for integral number values
+                        if v, ok := raw.(int); ok {
+                                decoded = v
+                        } else {
+                                return nil, []error{fmt.Errorf("%s: must be a whole number, got %v", k, raw)}
+                        }
+                default:
+                        // Verify that we can parse this as an int
+                        var n int
+                        if err := mapstructure.WeakDecode(raw, &n); err != nil {
+                                return nil, []error{fmt.Errorf("%s: %s", k, err)}
+                        }
+                        decoded = n
                 }
-                decoded = n
         case TypeFloat:
                 // Verify that we can parse this as an int
                 var n float64
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/set.go b/vendor/github.com/hashicorp/terraform/helper/schema/set.go
index cba2890..8ee89e4 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/set.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/set.go
@@ -198,6 +198,16 @@ func (s *Set) add(item interface{}, computed bool) string {
         code := s.hash(item)
         if computed {
                 code = "~" + code
+
+                if isProto5() {
+                        tmpCode := code
+                        count := 0
+                        for _, exists := s.m[tmpCode]; exists; _, exists = s.m[tmpCode] {
+                                count++
+                                tmpCode = fmt.Sprintf("%s%d", code, count)
+                        }
+                        code = tmpCode
+                }
         }
 
         if _, ok := s.m[code]; !ok {
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/shims.go b/vendor/github.com/hashicorp/terraform/helper/schema/shims.go
new file mode 100644
index 0000000..203d017
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/shims.go
@@ -0,0 +1,115 @@
+package schema
+
+import (
+        "encoding/json"
+
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/terraform"
+)
+
+// DiffFromValues takes the current state and desired state as cty.Values and
+// derives a terraform.InstanceDiff to give to the legacy providers. This is
+// used to take the states provided by the new ApplyResourceChange method and
+// convert them to a state+diff required for the legacy Apply method.
+func DiffFromValues(prior, planned cty.Value, res *Resource) (*terraform.InstanceDiff, error) {
+        return diffFromValues(prior, planned, res, nil)
+}
+
+// diffFromValues takes an additional CustomizeDiffFunc, so we can generate our
+// test fixtures from the legacy tests. In the new provider protocol the diff
+// only needs to be created for the apply operation, and any customizations
+// have already been done.
+func diffFromValues(prior, planned cty.Value, res *Resource, cust CustomizeDiffFunc) (*terraform.InstanceDiff, error) {
+        instanceState, err := res.ShimInstanceStateFromValue(prior)
+        if err != nil {
+                return nil, err
+        }
+
+        configSchema := res.CoreConfigSchema()
+
+        cfg := terraform.NewResourceConfigShimmed(planned, configSchema)
+        removeConfigUnknowns(cfg.Config)
+        removeConfigUnknowns(cfg.Raw)
+
+        diff, err := schemaMap(res.Schema).Diff(instanceState, cfg, cust, nil, false)
+        if err != nil {
+                return nil, err
+        }
+
+        return diff, err
+}
+
+// During apply the only unknown values are those which are to be computed by
+// the resource itself. These may have been marked as unknown config values, and
+// need to be removed to prevent the UnknownVariableValue from appearing the diff.
+func removeConfigUnknowns(cfg map[string]interface{}) {
+        for k, v := range cfg {
+                switch v := v.(type) {
+                case string:
+                        if v == config.UnknownVariableValue {
+                                delete(cfg, k)
+                        }
+                case []interface{}:
+                        for _, i := range v {
+                                if m, ok := i.(map[string]interface{}); ok {
+                                        removeConfigUnknowns(m)
+                                }
+                        }
+                case map[string]interface{}:
+                        removeConfigUnknowns(v)
+                }
+        }
+}
+
+// ApplyDiff takes a cty.Value state and applies a terraform.InstanceDiff to
+// get a new cty.Value state. This is used to convert the diff returned from
+// the legacy provider Diff method to the state required for the new
+// PlanResourceChange method.
+func ApplyDiff(base cty.Value, d *terraform.InstanceDiff, schema *configschema.Block) (cty.Value, error) {
+        return d.ApplyToValue(base, schema)
+}
+
+// StateValueToJSONMap converts a cty.Value to generic JSON map via the cty JSON
+// encoding.
+func StateValueToJSONMap(val cty.Value, ty cty.Type) (map[string]interface{}, error) {
+        js, err := ctyjson.Marshal(val, ty)
+        if err != nil {
+                return nil, err
+        }
+
+        var m map[string]interface{}
+        if err := json.Unmarshal(js, &m); err != nil {
+                return nil, err
+        }
+
+        return m, nil
+}
+
+// JSONMapToStateValue takes a generic json map[string]interface{} and converts it
+// to the specific type, ensuring that the values conform to the schema.
+func JSONMapToStateValue(m map[string]interface{}, block *configschema.Block) (cty.Value, error) {
+        var val cty.Value
+
+        js, err := json.Marshal(m)
+        if err != nil {
+                return val, err
+        }
+
+        val, err = ctyjson.Unmarshal(js, block.ImpliedType())
+        if err != nil {
+                return val, err
+        }
+
+        return block.CoerceValue(val)
+}
+
+// StateValueFromInstanceState converts a terraform.InstanceState to a
+// cty.Value as described by the provided cty.Type, and maintains the resource
+// ID as the "id" attribute.
+func StateValueFromInstanceState(is *terraform.InstanceState, ty cty.Type) (cty.Value, error) {
+        return is.AttrsAsObjectValue(ty)
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/testing.go b/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
index da754ac..a367a1f 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
@@ -18,7 +18,7 @@ func TestResourceDataRaw(
         }
 
         sm := schemaMap(schema)
-        diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil)
+        diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil, true)
         if err != nil {
                 t.Fatalf("err: %s", err)
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go b/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
index 3bc3ac4..914ca32 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
@@ -4,6 +4,21 @@ package schema
 
 import "strconv"
 
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[TypeInvalid-0]
+        _ = x[TypeBool-1]
+        _ = x[TypeInt-2]
+        _ = x[TypeFloat-3]
+        _ = x[TypeString-4]
+        _ = x[TypeList-5]
+        _ = x[TypeMap-6]
+        _ = x[TypeSet-7]
+        _ = x[typeObject-8]
+}
+
 const _ValueType_name = "TypeInvalidTypeBoolTypeIntTypeFloatTypeStringTypeListTypeMapTypeSettypeObject"
 
 var _ValueType_index = [...]uint8{0, 11, 19, 26, 35, 45, 53, 60, 67, 77}
diff --git a/vendor/github.com/hashicorp/terraform/internal/earlyconfig/config.go b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/config.go
new file mode 100644
index 0000000..a9b8f98
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/config.go
@@ -0,0 +1,123 @@
+package earlyconfig
+
+import (
+        "fmt"
+        "sort"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/moduledeps"
+        "github.com/hashicorp/terraform/plugin/discovery"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// A Config is a node in the tree of modules within a configuration.
+//
+// The module tree is constructed by following ModuleCall instances recursively
+// through the root module transitively into descendent modules.
+type Config struct {
+        // RootModule points to the Config for the root module within the same
+        // module tree as this module. If this module _is_ the root module then
+        // this is self-referential.
+        Root *Config
+
+        // ParentModule points to the Config for the module that directly calls
+        // this module. If this is the root module then this field is nil.
+        Parent *Config
+
+        // Path is a sequence of module logical names that traverse from the root
+        // module to this config. Path is empty for the root module.
+        //
+        // This should only be used to display paths to the end-user in rare cases
+        // where we are talking about the static module tree, before module calls
+        // have been resolved. In most cases, an addrs.ModuleInstance describing
+        // a node in the dynamic module tree is better, since it will then include
+        // any keys resulting from evaluating "count" and "for_each" arguments.
+        Path addrs.Module
+
+        // ChildModules points to the Config for each of the direct child modules
+        // called from this module. The keys in this map match the keys in
+        // Module.ModuleCalls.
+        Children map[string]*Config
+
+        // Module points to the object describing the configuration for the
+        // various elements (variables, resources, etc) defined by this module.
+        Module *tfconfig.Module
+
+        // CallPos is the source position for the header of the module block that
+        // requested this module.
+        //
+        // This field is meaningless for the root module, where its contents are undefined.
+        CallPos tfconfig.SourcePos
+
+        // SourceAddr is the source address that the referenced module was requested
+        // from, as specified in configuration.
+        //
+        // This field is meaningless for the root module, where its contents are undefined.
+        SourceAddr string
+
+        // Version is the specific version that was selected for this module,
+        // based on version constraints given in configuration.
+        //
+        // This field is nil if the module was loaded from a non-registry source,
+        // since versions are not supported for other sources.
+        //
+        // This field is meaningless for the root module, where it will always
+        // be nil.
+        Version *version.Version
+}
+
+// ProviderDependencies returns the provider dependencies for the recieving
+// config, including all of its descendent modules.
+func (c *Config) ProviderDependencies() (*moduledeps.Module, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        var name string
+        if len(c.Path) > 0 {
+                name = c.Path[len(c.Path)-1]
+        }
+
+        ret := &moduledeps.Module{
+                Name: name,
+        }
+
+        providers := make(moduledeps.Providers)
+        for name, reqs := range c.Module.RequiredProviders {
+                inst := moduledeps.ProviderInstance(name)
+                var constraints version.Constraints
+                for _, reqStr := range reqs {
+                        if reqStr != "" {
+                                constraint, err := version.NewConstraint(reqStr)
+                                if err != nil {
+                                        diags = diags.Append(wrapDiagnostic(tfconfig.Diagnostic{
+                                                Severity: tfconfig.DiagError,
+                                                Summary:  "Invalid provider version constraint",
+                                                Detail:   fmt.Sprintf("Invalid version constraint %q for provider %s.", reqStr, name),
+                                        }))
+                                        continue
+                                }
+                                constraints = append(constraints, constraint...)
+                        }
+                }
+                providers[inst] = moduledeps.ProviderDependency{
+                        Constraints: discovery.NewConstraints(constraints),
+                        Reason:      moduledeps.ProviderDependencyExplicit,
+                }
+        }
+        ret.Providers = providers
+
+        childNames := make([]string, 0, len(c.Children))
+        for name := range c.Children {
+                childNames = append(childNames, name)
+        }
+        sort.Strings(childNames)
+
+        for _, name := range childNames {
+                child, childDiags := c.Children[name].ProviderDependencies()
+                ret.Children = append(ret.Children, child)
+                diags = diags.Append(childDiags)
+        }
+
+        return ret, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/earlyconfig/config_build.go b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/config_build.go
new file mode 100644
index 0000000..770d5df
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/config_build.go
@@ -0,0 +1,144 @@
+package earlyconfig
+
+import (
+        "fmt"
+        "sort"
+        "strings"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// BuildConfig constructs a Config from a root module by loading all of its
+// descendent modules via the given ModuleWalker.
+func BuildConfig(root *tfconfig.Module, walker ModuleWalker) (*Config, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        cfg := &Config{
+                Module: root,
+        }
+        cfg.Root = cfg // Root module is self-referential.
+        cfg.Children, diags = buildChildModules(cfg, walker)
+        return cfg, diags
+}
+
+func buildChildModules(parent *Config, walker ModuleWalker) (map[string]*Config, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        ret := map[string]*Config{}
+        calls := parent.Module.ModuleCalls
+
+        // We'll sort the calls by their local names so that they'll appear in a
+        // predictable order in any logging that's produced during the walk.
+        callNames := make([]string, 0, len(calls))
+        for k := range calls {
+                callNames = append(callNames, k)
+        }
+        sort.Strings(callNames)
+
+        for _, callName := range callNames {
+                call := calls[callName]
+                path := make([]string, len(parent.Path)+1)
+                copy(path, parent.Path)
+                path[len(path)-1] = call.Name
+
+                var vc version.Constraints
+                if strings.TrimSpace(call.Version) != "" {
+                        var err error
+                        vc, err = version.NewConstraint(call.Version)
+                        if err != nil {
+                                diags = diags.Append(wrapDiagnostic(tfconfig.Diagnostic{
+                                        Severity: tfconfig.DiagError,
+                                        Summary:  "Invalid version constraint",
+                                        Detail:   fmt.Sprintf("Module %q (declared at %s line %d) has invalid version constraint %q: %s.", callName, call.Pos.Filename, call.Pos.Line, call.Version, err),
+                                }))
+                                continue
+                        }
+                }
+
+                req := ModuleRequest{
+                        Name:               call.Name,
+                        Path:               path,
+                        SourceAddr:         call.Source,
+                        VersionConstraints: vc,
+                        Parent:             parent,
+                        CallPos:            call.Pos,
+                }
+
+                mod, ver, modDiags := walker.LoadModule(&req)
+                diags = append(diags, modDiags...)
+                if mod == nil {
+                        // nil can be returned if the source address was invalid and so
+                        // nothing could be loaded whatsoever. LoadModule should've
+                        // returned at least one error diagnostic in that case.
+                        continue
+                }
+
+                child := &Config{
+                        Parent:     parent,
+                        Root:       parent.Root,
+                        Path:       path,
+                        Module:     mod,
+                        CallPos:    call.Pos,
+                        SourceAddr: call.Source,
+                        Version:    ver,
+                }
+
+                child.Children, modDiags = buildChildModules(child, walker)
+                diags = diags.Append(modDiags)
+
+                ret[call.Name] = child
+        }
+
+        return ret, diags
+}
+
+// ModuleRequest is used as part of the ModuleWalker interface used with
+// function BuildConfig.
+type ModuleRequest struct {
+        // Name is the "logical name" of the module call within configuration.
+        // This is provided in case the name is used as part of a storage key
+        // for the module, but implementations must otherwise treat it as an
+        // opaque string. It is guaranteed to have already been validated as an
+        // HCL identifier and UTF-8 encoded.
+        Name string
+
+        // Path is a list of logical names that traverse from the root module to
+        // this module. This can be used, for example, to form a lookup key for
+        // each distinct module call in a configuration, allowing for multiple
+        // calls with the same name at different points in the tree.
+        Path addrs.Module
+
+        // SourceAddr is the source address string provided by the user in
+        // configuration.
+        SourceAddr string
+
+        // VersionConstraint is the version constraint applied to the module in
+        // configuration.
+        VersionConstraints version.Constraints
+
+        // Parent is the partially-constructed module tree node that the loaded
+        // module will be added to. Callers may refer to any field of this
+        // structure except Children, which is still under construction when
+        // ModuleRequest objects are created and thus has undefined content.
+        // The main reason this is provided is so that full module paths can
+        // be constructed for uniqueness.
+        Parent *Config
+
+        // CallRange is the source position for the header of the "module" block
+        // in configuration that prompted this request.
+        CallPos tfconfig.SourcePos
+}
+
+// ModuleWalker is an interface used with BuildConfig.
+type ModuleWalker interface {
+        LoadModule(req *ModuleRequest) (*tfconfig.Module, *version.Version, tfdiags.Diagnostics)
+}
+
+// ModuleWalkerFunc is an implementation of ModuleWalker that directly wraps
+// a callback function, for more convenient use of that interface.
+type ModuleWalkerFunc func(req *ModuleRequest) (*tfconfig.Module, *version.Version, tfdiags.Diagnostics)
+
+func (f ModuleWalkerFunc) LoadModule(req *ModuleRequest) (*tfconfig.Module, *version.Version, tfdiags.Diagnostics) {
+        return f(req)
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/earlyconfig/diagnostics.go b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/diagnostics.go
new file mode 100644
index 0000000..9b2fd7f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/diagnostics.go
@@ -0,0 +1,78 @@
+package earlyconfig
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func wrapDiagnostics(diags tfconfig.Diagnostics) tfdiags.Diagnostics {
+        ret := make(tfdiags.Diagnostics, len(diags))
+        for i, diag := range diags {
+                ret[i] = wrapDiagnostic(diag)
+        }
+        return ret
+}
+
+func wrapDiagnostic(diag tfconfig.Diagnostic) tfdiags.Diagnostic {
+        return wrappedDiagnostic{
+                d: diag,
+        }
+}
+
+type wrappedDiagnostic struct {
+        d tfconfig.Diagnostic
+}
+
+func (d wrappedDiagnostic) Severity() tfdiags.Severity {
+        switch d.d.Severity {
+        case tfconfig.DiagError:
+                return tfdiags.Error
+        case tfconfig.DiagWarning:
+                return tfdiags.Warning
+        default:
+                // Should never happen since there are no other severities
+                return 0
+        }
+}
+
+func (d wrappedDiagnostic) Description() tfdiags.Description {
+        // Since the inspect library doesn't produce precise source locations,
+        // we include the position information as part of the error message text.
+        // See the comment inside method "Source" for more information.
+        switch {
+        case d.d.Pos == nil:
+                return tfdiags.Description{
+                        Summary: d.d.Summary,
+                        Detail:  d.d.Detail,
+                }
+        case d.d.Detail != "":
+                return tfdiags.Description{
+                        Summary: d.d.Summary,
+                        Detail:  fmt.Sprintf("On %s line %d: %s", d.d.Pos.Filename, d.d.Pos.Line, d.d.Detail),
+                }
+        default:
+                return tfdiags.Description{
+                        Summary: fmt.Sprintf("%s (on %s line %d)", d.d.Summary, d.d.Pos.Filename, d.d.Pos.Line),
+                }
+        }
+}
+
+func (d wrappedDiagnostic) Source() tfdiags.Source {
+        // Since the inspect library is constrained by the lowest common denominator
+        // between legacy HCL and modern HCL, it only returns ranges at whole-line
+        // granularity, and that isn't sufficient to populate a tfdiags.Source
+        // and so we'll just omit ranges altogether and include the line number in
+        // the Description text.
+        //
+        // Callers that want to return nicer errors should consider reacting to
+        // earlyconfig errors by attempting a follow-up parse with the normal
+        // config loader, which can produce more precise source location
+        // information.
+        return tfdiags.Source{}
+}
+
+func (d wrappedDiagnostic) FromExpr() *tfdiags.FromExpr {
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/earlyconfig/doc.go b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/doc.go
new file mode 100644
index 0000000..a9cf10f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/doc.go
@@ -0,0 +1,20 @@
+// Package earlyconfig is a specialized alternative to the top-level "configs"
+// package that does only shallow processing of configuration and is therefore
+// able to be much more liberal than the full config loader in what it accepts.
+//
+// In particular, it can accept both current and legacy HCL syntax, and it
+// ignores top-level blocks that it doesn't recognize. These two characteristics
+// make this package ideal for dependency-checking use-cases so that we are
+// more likely to be able to return an error message about an explicit
+// incompatibility than to return a less-actionable message about a construct
+// not being supported.
+//
+// However, its liberal approach also means it should be used sparingly. It
+// exists primarily for "terraform init", so that it is able to detect
+// incompatibilities more robustly when installing dependencies. For most
+// other use-cases, use the "configs" and "configs/configload" packages.
+//
+// Package earlyconfig is a wrapper around the terraform-config-inspect
+// codebase, adding to it just some helper functionality for Terraform's own
+// use-cases.
+package earlyconfig
diff --git a/vendor/github.com/hashicorp/terraform/internal/earlyconfig/module.go b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/module.go
new file mode 100644
index 0000000..d2d6287
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/module.go
@@ -0,0 +1,13 @@
+package earlyconfig
+
+import (
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// LoadModule loads some top-level metadata for the module in the given
+// directory.
+func LoadModule(dir string) (*tfconfig.Module, tfdiags.Diagnostics) {
+        mod, diags := tfconfig.LoadModule(dir)
+        return mod, wrapDiagnostics(diags)
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/copy_dir.go b/vendor/github.com/hashicorp/terraform/internal/initwd/copy_dir.go
new file mode 100644
index 0000000..7096ff7
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/copy_dir.go
@@ -0,0 +1,125 @@
+package initwd
+
+import (
+        "io"
+        "os"
+        "path/filepath"
+        "strings"
+)
+
+// copyDir copies the src directory contents into dst. Both directories
+// should already exist.
+func copyDir(dst, src string) error {
+        src, err := filepath.EvalSymlinks(src)
+        if err != nil {
+                return err
+        }
+
+        walkFn := func(path string, info os.FileInfo, err error) error {
+                if err != nil {
+                        return err
+                }
+
+                if path == src {
+                        return nil
+                }
+
+                if strings.HasPrefix(filepath.Base(path), ".") {
+                        // Skip any dot files
+                        if info.IsDir() {
+                                return filepath.SkipDir
+                        } else {
+                                return nil
+                        }
+                }
+
+                // The "path" has the src prefixed to it. We need to join our
+                // destination with the path without the src on it.
+                dstPath := filepath.Join(dst, path[len(src):])
+
+                // we don't want to try and copy the same file over itself.
+                if eq, err := sameFile(path, dstPath); eq {
+                        return nil
+                } else if err != nil {
+                        return err
+                }
+
+                // If we have a directory, make that subdirectory, then continue
+                // the walk.
+                if info.IsDir() {
+                        if path == filepath.Join(src, dst) {
+                                // dst is in src; don't walk it.
+                                return nil
+                        }
+
+                        if err := os.MkdirAll(dstPath, 0755); err != nil {
+                                return err
+                        }
+
+                        return nil
+                }
+
+                // If the current path is a symlink, recreate the symlink relative to
+                // the dst directory
+                if info.Mode()&os.ModeSymlink == os.ModeSymlink {
+                        target, err := os.Readlink(path)
+                        if err != nil {
+                                return err
+                        }
+
+                        return os.Symlink(target, dstPath)
+                }
+
+                // If we have a file, copy the contents.
+                srcF, err := os.Open(path)
+                if err != nil {
+                        return err
+                }
+                defer srcF.Close()
+
+                dstF, err := os.Create(dstPath)
+                if err != nil {
+                        return err
+                }
+                defer dstF.Close()
+
+                if _, err := io.Copy(dstF, srcF); err != nil {
+                        return err
+                }
+
+                // Chmod it
+                return os.Chmod(dstPath, info.Mode())
+        }
+
+        return filepath.Walk(src, walkFn)
+}
+
+// sameFile tried to determine if to paths are the same file.
+// If the paths don't match, we lookup the inode on supported systems.
+func sameFile(a, b string) (bool, error) {
+        if a == b {
+                return true, nil
+        }
+
+        aIno, err := inode(a)
+        if err != nil {
+                if os.IsNotExist(err) {
+                        return false, nil
+                }
+                return false, err
+        }
+
+        bIno, err := inode(b)
+        if err != nil {
+                if os.IsNotExist(err) {
+                        return false, nil
+                }
+                return false, err
+        }
+
+        if aIno > 0 && aIno == bIno {
+                return true, nil
+        }
+
+        return false, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/doc.go b/vendor/github.com/hashicorp/terraform/internal/initwd/doc.go
new file mode 100644
index 0000000..b9d938d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/doc.go
@@ -0,0 +1,7 @@
+// Package initwd contains various helper functions used by the "terraform init"
+// command to initialize a working directory.
+//
+// These functions may also be used from testing code to simulate the behaviors
+// of "terraform init" against test fixtures, but should not be used elsewhere
+// in the main code.
+package initwd
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/from_module.go b/vendor/github.com/hashicorp/terraform/internal/initwd/from_module.go
new file mode 100644
index 0000000..6b40d08
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/from_module.go
@@ -0,0 +1,363 @@
+package initwd
+
+import (
+        "fmt"
+        "github.com/hashicorp/terraform/internal/earlyconfig"
+        "io/ioutil"
+        "log"
+        "os"
+        "path/filepath"
+        "sort"
+        "strings"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/internal/modsdir"
+        "github.com/hashicorp/terraform/registry"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+const initFromModuleRootCallName = "root"
+const initFromModuleRootKeyPrefix = initFromModuleRootCallName + "."
+
+// DirFromModule populates the given directory (which must exist and be
+// empty) with the contents of the module at the given source address.
+//
+// It does this by installing the given module and all of its descendent
+// modules in a temporary root directory and then copying the installed
+// files into suitable locations. As a consequence, any diagnostics it
+// generates will reveal the location of this temporary directory to the
+// user.
+//
+// This rather roundabout installation approach is taken to ensure that
+// installation proceeds in a manner identical to normal module installation.
+//
+// If the given source address specifies a sub-directory of the given
+// package then only the sub-directory and its descendents will be copied
+// into the given root directory, which will cause any relative module
+// references using ../ from that module to be unresolvable. Error diagnostics
+// are produced in that case, to prompt the user to rewrite the source strings
+// to be absolute references to the original remote module.
+func DirFromModule(rootDir, modulesDir, sourceAddr string, reg *registry.Client, hooks ModuleInstallHooks) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        // The way this function works is pretty ugly, but we accept it because
+        // -from-module is a less important case than normal module installation
+        // and so it's better to keep this ugly complexity out here rather than
+        // adding even more complexity to the normal module installer.
+
+        // The target directory must exist but be empty.
+        {
+                entries, err := ioutil.ReadDir(rootDir)
+                if err != nil {
+                        if os.IsNotExist(err) {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Target directory does not exist",
+                                        fmt.Sprintf("Cannot initialize non-existent directory %s.", rootDir),
+                                ))
+                        } else {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Failed to read target directory",
+                                        fmt.Sprintf("Error reading %s to ensure it is empty: %s.", rootDir, err),
+                                ))
+                        }
+                        return diags
+                }
+                haveEntries := false
+                for _, entry := range entries {
+                        if entry.Name() == "." || entry.Name() == ".." || entry.Name() == ".terraform" {
+                                continue
+                        }
+                        haveEntries = true
+                }
+                if haveEntries {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Can't populate non-empty directory",
+                                fmt.Sprintf("The target directory %s is not empty, so it cannot be initialized with the -from-module=... option.", rootDir),
+                        ))
+                        return diags
+                }
+        }
+
+        instDir := filepath.Join(rootDir, ".terraform/init-from-module")
+        inst := NewModuleInstaller(instDir, reg)
+        log.Printf("[DEBUG] installing modules in %s to initialize working directory from %q", instDir, sourceAddr)
+        os.RemoveAll(instDir) // if this fails then we'll fail on MkdirAll below too
+        err := os.MkdirAll(instDir, os.ModePerm)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to create temporary directory",
+                        fmt.Sprintf("Failed to create temporary directory %s: %s.", instDir, err),
+                ))
+                return diags
+        }
+
+        instManifest := make(modsdir.Manifest)
+        retManifest := make(modsdir.Manifest)
+
+        fakeFilename := fmt.Sprintf("-from-module=%q", sourceAddr)
+        fakePos := tfconfig.SourcePos{
+                Filename: fakeFilename,
+                Line:     1,
+        }
+
+        // -from-module allows relative paths but it's different than a normal
+        // module address where it'd be resolved relative to the module call
+        // (which is synthetic, here.) To address this, we'll just patch up any
+        // relative paths to be absolute paths before we run, ensuring we'll
+        // get the right result. This also, as an important side-effect, ensures
+        // that the result will be "downloaded" with go-getter (copied from the
+        // source location), rather than just recorded as a relative path.
+        {
+                maybePath := filepath.ToSlash(sourceAddr)
+                if maybePath == "." || strings.HasPrefix(maybePath, "./") || strings.HasPrefix(maybePath, "../") {
+                        if wd, err := os.Getwd(); err == nil {
+                                sourceAddr = filepath.Join(wd, sourceAddr)
+                                log.Printf("[TRACE] -from-module relative path rewritten to absolute path %s", sourceAddr)
+                        }
+                }
+        }
+
+        // Now we need to create an artificial root module that will seed our
+        // installation process.
+        fakeRootModule := &tfconfig.Module{
+                ModuleCalls: map[string]*tfconfig.ModuleCall{
+                        initFromModuleRootCallName: {
+                                Name:   initFromModuleRootCallName,
+                                Source: sourceAddr,
+                                Pos:    fakePos,
+                        },
+                },
+        }
+
+        // wrapHooks filters hook notifications to only include Download calls
+        // and to trim off the initFromModuleRootCallName prefix. We'll produce
+        // our own Install notifications directly below.
+        wrapHooks := installHooksInitDir{
+                Wrapped: hooks,
+        }
+        getter := reusingGetter{}
+        _, instDiags := inst.installDescendentModules(fakeRootModule, rootDir, instManifest, true, wrapHooks, getter)
+        diags = append(diags, instDiags...)
+        if instDiags.HasErrors() {
+                return diags
+        }
+
+        // If all of that succeeded then we'll now migrate what was installed
+        // into the final directory structure.
+        err = os.MkdirAll(modulesDir, os.ModePerm)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to create local modules directory",
+                        fmt.Sprintf("Failed to create modules directory %s: %s.", modulesDir, err),
+                ))
+                return diags
+        }
+
+        recordKeys := make([]string, 0, len(instManifest))
+        for k := range instManifest {
+                recordKeys = append(recordKeys, k)
+        }
+        sort.Strings(recordKeys)
+
+        for _, recordKey := range recordKeys {
+                record := instManifest[recordKey]
+
+                if record.Key == initFromModuleRootCallName {
+                        // We've found the module the user requested, which we must
+                        // now copy into rootDir so it can be used directly.
+                        log.Printf("[TRACE] copying new root module from %s to %s", record.Dir, rootDir)
+                        err := copyDir(rootDir, record.Dir)
+                        if err != nil {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Failed to copy root module",
+                                        fmt.Sprintf("Error copying root module %q from %s to %s: %s.", sourceAddr, record.Dir, rootDir, err),
+                                ))
+                                continue
+                        }
+
+                        // We'll try to load the newly-copied module here just so we can
+                        // sniff for any module calls that ../ out of the root directory
+                        // and must thus be rewritten to be absolute addresses again.
+                        // For now we can't do this rewriting automatically, but we'll
+                        // generate an error to help the user do it manually.
+                        mod, _ := earlyconfig.LoadModule(rootDir) // ignore diagnostics since we're just doing value-add here anyway
+                        if mod != nil {
+                                for _, mc := range mod.ModuleCalls {
+                                        if pathTraversesUp(mc.Source) {
+                                                packageAddr, givenSubdir := splitAddrSubdir(sourceAddr)
+                                                newSubdir := filepath.Join(givenSubdir, mc.Source)
+                                                if pathTraversesUp(newSubdir) {
+                                                        // This should never happen in any reasonable
+                                                        // configuration since this suggests a path that
+                                                        // traverses up out of the package root. We'll just
+                                                        // ignore this, since we'll fail soon enough anyway
+                                                        // trying to resolve this path when this module is
+                                                        // loaded.
+                                                        continue
+                                                }
+
+                                                var newAddr = packageAddr
+                                                if newSubdir != "" {
+                                                        newAddr = fmt.Sprintf("%s//%s", newAddr, filepath.ToSlash(newSubdir))
+                                                }
+                                                diags = diags.Append(tfdiags.Sourceless(
+                                                        tfdiags.Error,
+                                                        "Root module references parent directory",
+                                                        fmt.Sprintf("The requested module %q refers to a module via its parent directory. To use this as a new root module this source string must be rewritten as a remote source address, such as %q.", sourceAddr, newAddr),
+                                                ))
+                                                continue
+                                        }
+                                }
+                        }
+
+                        retManifest[""] = modsdir.Record{
+                                Key: "",
+                                Dir: rootDir,
+                        }
+                        continue
+                }
+
+                if !strings.HasPrefix(record.Key, initFromModuleRootKeyPrefix) {
+                        // Ignore the *real* root module, whose key is empty, since
+                        // we're only interested in the module named "root" and its
+                        // descendents.
+                        continue
+                }
+
+                newKey := record.Key[len(initFromModuleRootKeyPrefix):]
+                instPath := filepath.Join(modulesDir, newKey)
+                tempPath := filepath.Join(instDir, record.Key)
+
+                // tempPath won't be present for a module that was installed from
+                // a relative path, so in that case we just record the installation
+                // directory and assume it was already copied into place as part
+                // of its parent.
+                if _, err := os.Stat(tempPath); err != nil {
+                        if !os.IsNotExist(err) {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Failed to stat temporary module install directory",
+                                        fmt.Sprintf("Error from stat %s for module %s: %s.", instPath, newKey, err),
+                                ))
+                                continue
+                        }
+
+                        var parentKey string
+                        if lastDot := strings.LastIndexByte(newKey, '.'); lastDot != -1 {
+                                parentKey = newKey[:lastDot]
+                        } else {
+                                parentKey = "" // parent is the root module
+                        }
+
+                        parentOld := instManifest[initFromModuleRootKeyPrefix+parentKey]
+                        parentNew := retManifest[parentKey]
+
+                        // We need to figure out which portion of our directory is the
+                        // parent package path and which portion is the subdirectory
+                        // under that.
+                        baseDirRel, err := filepath.Rel(parentOld.Dir, record.Dir)
+                        if err != nil {
+                                // Should never happen, because we constructed both directories
+                                // from the same base and so they must have a common prefix.
+                                panic(err)
+                        }
+
+                        newDir := filepath.Join(parentNew.Dir, baseDirRel)
+                        log.Printf("[TRACE] relative reference for %s rewritten from %s to %s", newKey, record.Dir, newDir)
+                        newRecord := record // shallow copy
+                        newRecord.Dir = newDir
+                        newRecord.Key = newKey
+                        retManifest[newKey] = newRecord
+                        hooks.Install(newRecord.Key, newRecord.Version, newRecord.Dir)
+                        continue
+                }
+
+                err = os.MkdirAll(instPath, os.ModePerm)
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to create module install directory",
+                                fmt.Sprintf("Error creating directory %s for module %s: %s.", instPath, newKey, err),
+                        ))
+                        continue
+                }
+
+                // We copy rather than "rename" here because renaming between directories
+                // can be tricky in edge-cases like network filesystems, etc.
+                log.Printf("[TRACE] copying new module %s from %s to %s", newKey, record.Dir, instPath)
+                err := copyDir(instPath, tempPath)
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to copy descendent module",
+                                fmt.Sprintf("Error copying module %q from %s to %s: %s.", newKey, tempPath, rootDir, err),
+                        ))
+                        continue
+                }
+
+                subDir, err := filepath.Rel(tempPath, record.Dir)
+                if err != nil {
+                        // Should never happen, because we constructed both directories
+                        // from the same base and so they must have a common prefix.
+                        panic(err)
+                }
+
+                newRecord := record // shallow copy
+                newRecord.Dir = filepath.Join(instPath, subDir)
+                newRecord.Key = newKey
+                retManifest[newKey] = newRecord
+                hooks.Install(newRecord.Key, newRecord.Version, newRecord.Dir)
+        }
+
+        retManifest.WriteSnapshotToDir(modulesDir)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to write module manifest",
+                        fmt.Sprintf("Error writing module manifest: %s.", err),
+                ))
+        }
+
+        if !diags.HasErrors() {
+                // Try to clean up our temporary directory, but don't worry if we don't
+                // succeed since it shouldn't hurt anything.
+                os.RemoveAll(instDir)
+        }
+
+        return diags
+}
+
+func pathTraversesUp(path string) bool {
+        return strings.HasPrefix(filepath.ToSlash(path), "../")
+}
+
+// installHooksInitDir is an adapter wrapper for an InstallHooks that
+// does some fakery to make downloads look like they are happening in their
+// final locations, rather than in the temporary loader we use.
+//
+// It also suppresses "Install" calls entirely, since InitDirFromModule
+// does its own installation steps after the initial installation pass
+// has completed.
+type installHooksInitDir struct {
+        Wrapped ModuleInstallHooks
+        ModuleInstallHooksImpl
+}
+
+func (h installHooksInitDir) Download(moduleAddr, packageAddr string, version *version.Version) {
+        if !strings.HasPrefix(moduleAddr, initFromModuleRootKeyPrefix) {
+                // We won't announce the root module, since hook implementations
+                // don't expect to see that and the caller will usually have produced
+                // its own user-facing notification about what it's doing anyway.
+                return
+        }
+
+        trimAddr := moduleAddr[len(initFromModuleRootKeyPrefix):]
+        h.Wrapped.Download(trimAddr, packageAddr, version)
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/getter.go b/vendor/github.com/hashicorp/terraform/internal/initwd/getter.go
new file mode 100644
index 0000000..50e2572
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/getter.go
@@ -0,0 +1,210 @@
+package initwd
+
+import (
+        "fmt"
+        "log"
+        "os"
+        "path/filepath"
+        "strings"
+
+        cleanhttp "github.com/hashicorp/go-cleanhttp"
+        getter "github.com/hashicorp/go-getter"
+        "github.com/hashicorp/terraform/registry/regsrc"
+)
+
+// We configure our own go-getter detector and getter sets here, because
+// the set of sources we support is part of Terraform's documentation and
+// so we don't want any new sources introduced in go-getter to sneak in here
+// and work even though they aren't documented. This also insulates us from
+// any meddling that might be done by other go-getter callers linked into our
+// executable.
+
+var goGetterDetectors = []getter.Detector{
+        new(getter.GitHubDetector),
+        new(getter.BitBucketDetector),
+        new(getter.S3Detector),
+        new(getter.FileDetector),
+}
+
+var goGetterNoDetectors = []getter.Detector{}
+
+var goGetterDecompressors = map[string]getter.Decompressor{
+        "bz2": new(getter.Bzip2Decompressor),
+        "gz":  new(getter.GzipDecompressor),
+        "xz":  new(getter.XzDecompressor),
+        "zip": new(getter.ZipDecompressor),
+
+        "tar.bz2":  new(getter.TarBzip2Decompressor),
+        "tar.tbz2": new(getter.TarBzip2Decompressor),
+
+        "tar.gz": new(getter.TarGzipDecompressor),
+        "tgz":    new(getter.TarGzipDecompressor),
+
+        "tar.xz": new(getter.TarXzDecompressor),
+        "txz":    new(getter.TarXzDecompressor),
+}
+
+var goGetterGetters = map[string]getter.Getter{
+        "file":  new(getter.FileGetter),
+        "git":   new(getter.GitGetter),
+        "hg":    new(getter.HgGetter),
+        "s3":    new(getter.S3Getter),
+        "http":  getterHTTPGetter,
+        "https": getterHTTPGetter,
+}
+
+var getterHTTPClient = cleanhttp.DefaultClient()
+
+var getterHTTPGetter = &getter.HttpGetter{
+        Client: getterHTTPClient,
+        Netrc:  true,
+}
+
+// A reusingGetter is a helper for the module installer that remembers
+// the final resolved addresses of all of the sources it has already been
+// asked to install, and will copy from a prior installation directory if
+// it has the same resolved source address.
+//
+// The keys in a reusingGetter are resolved and trimmed source addresses
+// (with a scheme always present, and without any "subdir" component),
+// and the values are the paths where each source was previously installed.
+type reusingGetter map[string]string
+
+// getWithGoGetter retrieves the package referenced in the given address
+// into the installation path and then returns the full path to any subdir
+// indicated in the address.
+//
+// The errors returned by this function are those surfaced by the underlying
+// go-getter library, which have very inconsistent quality as
+// end-user-actionable error messages. At this time we do not have any
+// reasonable way to improve these error messages at this layer because
+// the underlying errors are not separately recognizable.
+func (g reusingGetter) getWithGoGetter(instPath, addr string) (string, error) {
+        packageAddr, subDir := splitAddrSubdir(addr)
+
+        log.Printf("[DEBUG] will download %q to %s", packageAddr, instPath)
+
+        realAddr, err := getter.Detect(packageAddr, instPath, getter.Detectors)
+        if err != nil {
+                return "", err
+        }
+
+        if isMaybeRelativeLocalPath(realAddr) {
+                return "", &MaybeRelativePathErr{addr}
+        }
+
+        var realSubDir string
+        realAddr, realSubDir = splitAddrSubdir(realAddr)
+        if realSubDir != "" {
+                subDir = filepath.Join(realSubDir, subDir)
+        }
+
+        if realAddr != packageAddr {
+                log.Printf("[TRACE] go-getter detectors rewrote %q to %q", packageAddr, realAddr)
+        }
+
+        if prevDir, exists := g[realAddr]; exists {
+                log.Printf("[TRACE] copying previous install %s to %s", prevDir, instPath)
+                err := os.Mkdir(instPath, os.ModePerm)
+                if err != nil {
+                        return "", fmt.Errorf("failed to create directory %s: %s", instPath, err)
+                }
+                err = copyDir(instPath, prevDir)
+                if err != nil {
+                        return "", fmt.Errorf("failed to copy from %s to %s: %s", prevDir, instPath, err)
+                }
+        } else {
+                log.Printf("[TRACE] fetching %q to %q", realAddr, instPath)
+                client := getter.Client{
+                        Src: realAddr,
+                        Dst: instPath,
+                        Pwd: instPath,
+
+                        Mode: getter.ClientModeDir,
+
+                        Detectors:     goGetterNoDetectors, // we already did detection above
+                        Decompressors: goGetterDecompressors,
+                        Getters:       goGetterGetters,
+                }
+                err = client.Get()
+                if err != nil {
+                        return "", err
+                }
+                // Remember where we installed this so we might reuse this directory
+                // on subsequent calls to avoid re-downloading.
+                g[realAddr] = instPath
+        }
+
+        // Our subDir string can contain wildcards until this point, so that
+        // e.g. a subDir of * can expand to one top-level directory in a .tar.gz
+        // archive. Now that we've expanded the archive successfully we must
+        // resolve that into a concrete path.
+        var finalDir string
+        if subDir != "" {
+                finalDir, err = getter.SubdirGlob(instPath, subDir)
+                log.Printf("[TRACE] expanded %q to %q", subDir, finalDir)
+                if err != nil {
+                        return "", err
+                }
+        } else {
+                finalDir = instPath
+        }
+
+        // If we got this far then we have apparently succeeded in downloading
+        // the requested object!
+        return filepath.Clean(finalDir), nil
+}
+
+// splitAddrSubdir splits the given address (which is assumed to be a
+// registry address or go-getter-style address) into a package portion
+// and a sub-directory portion.
+//
+// The package portion defines what should be downloaded and then the
+// sub-directory portion, if present, specifies a sub-directory within
+// the downloaded object (an archive, VCS repository, etc) that contains
+// the module's configuration files.
+//
+// The subDir portion will be returned as empty if no subdir separator
+// ("//") is present in the address.
+func splitAddrSubdir(addr string) (packageAddr, subDir string) {
+        return getter.SourceDirSubdir(addr)
+}
+
+var localSourcePrefixes = []string{
+        "./",
+        "../",
+        ".\\",
+        "..\\",
+}
+
+func isLocalSourceAddr(addr string) bool {
+        for _, prefix := range localSourcePrefixes {
+                if strings.HasPrefix(addr, prefix) {
+                        return true
+                }
+        }
+        return false
+}
+
+func isRegistrySourceAddr(addr string) bool {
+        _, err := regsrc.ParseModuleSource(addr)
+        return err == nil
+}
+
+type MaybeRelativePathErr struct {
+        Addr string
+}
+
+func (e *MaybeRelativePathErr) Error() string {
+        return fmt.Sprintf("Terraform cannot determine the module source for %s", e.Addr)
+}
+
+func isMaybeRelativeLocalPath(addr string) bool {
+        if strings.HasPrefix(addr, "file://") {
+                _, err := os.Stat(addr[7:])
+                if err != nil {
+                        return true
+                }
+        }
+        return false
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/inode.go b/vendor/github.com/hashicorp/terraform/internal/initwd/inode.go
new file mode 100644
index 0000000..1150b09
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/inode.go
@@ -0,0 +1,21 @@
+// +build linux darwin openbsd netbsd solaris dragonfly
+
+package initwd
+
+import (
+        "fmt"
+        "os"
+        "syscall"
+)
+
+// lookup the inode of a file on posix systems
+func inode(path string) (uint64, error) {
+        stat, err := os.Stat(path)
+        if err != nil {
+                return 0, err
+        }
+        if st, ok := stat.Sys().(*syscall.Stat_t); ok {
+                return st.Ino, nil
+        }
+        return 0, fmt.Errorf("could not determine file inode")
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/inode_freebsd.go b/vendor/github.com/hashicorp/terraform/internal/initwd/inode_freebsd.go
new file mode 100644
index 0000000..30532f5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/inode_freebsd.go
@@ -0,0 +1,21 @@
+// +build freebsd
+
+package initwd
+
+import (
+        "fmt"
+        "os"
+        "syscall"
+)
+
+// lookup the inode of a file on posix systems
+func inode(path string) (uint64, error) {
+        stat, err := os.Stat(path)
+        if err != nil {
+                return 0, err
+        }
+        if st, ok := stat.Sys().(*syscall.Stat_t); ok {
+                return uint64(st.Ino), nil
+        }
+        return 0, fmt.Errorf("could not determine file inode")
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/inode_windows.go b/vendor/github.com/hashicorp/terraform/internal/initwd/inode_windows.go
new file mode 100644
index 0000000..3ed58e4
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/inode_windows.go
@@ -0,0 +1,8 @@
+// +build windows
+
+package initwd
+
+// no syscall.Stat_t on windows, return 0 for inodes
+func inode(path string) (uint64, error) {
+        return 0, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/load_config.go b/vendor/github.com/hashicorp/terraform/internal/initwd/load_config.go
new file mode 100644
index 0000000..6f77dcd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/load_config.go
@@ -0,0 +1,56 @@
+package initwd
+
+import (
+        "fmt"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/internal/earlyconfig"
+        "github.com/hashicorp/terraform/internal/modsdir"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// LoadConfig loads a full configuration tree that has previously had all of
+// its dependent modules installed to the given modulesDir using a
+// ModuleInstaller.
+//
+// This uses the early configuration loader and thus only reads top-level
+// metadata from the modules in the configuration. Most callers should use
+// the configs/configload package to fully load a configuration.
+func LoadConfig(rootDir, modulesDir string) (*earlyconfig.Config, tfdiags.Diagnostics) {
+        rootMod, diags := earlyconfig.LoadModule(rootDir)
+        if rootMod == nil {
+                return nil, diags
+        }
+
+        manifest, err := modsdir.ReadManifestSnapshotForDir(modulesDir)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to read module manifest",
+                        fmt.Sprintf("Terraform failed to read its manifest of locally-cached modules: %s.", err),
+                ))
+                return nil, diags
+        }
+
+        return earlyconfig.BuildConfig(rootMod, earlyconfig.ModuleWalkerFunc(
+                func(req *earlyconfig.ModuleRequest) (*tfconfig.Module, *version.Version, tfdiags.Diagnostics) {
+                        var diags tfdiags.Diagnostics
+
+                        key := manifest.ModuleKey(req.Path)
+                        record, exists := manifest[key]
+                        if !exists {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Module not installed",
+                                        fmt.Sprintf("Module %s is not yet installed. Run \"terraform init\" to install all modules required by this configuration.", req.Path.String()),
+                                ))
+                                return nil, nil, diags
+                        }
+
+                        mod, mDiags := earlyconfig.LoadModule(record.Dir)
+                        diags = diags.Append(mDiags)
+                        return mod, record.Version, diags
+                },
+        ))
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/module_install.go b/vendor/github.com/hashicorp/terraform/internal/initwd/module_install.go
new file mode 100644
index 0000000..531310a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/module_install.go
@@ -0,0 +1,558 @@
+package initwd
+
+import (
+        "fmt"
+        "log"
+        "os"
+        "path/filepath"
+        "strings"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/internal/earlyconfig"
+        "github.com/hashicorp/terraform/internal/modsdir"
+        "github.com/hashicorp/terraform/registry"
+        "github.com/hashicorp/terraform/registry/regsrc"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+type ModuleInstaller struct {
+        modsDir string
+        reg     *registry.Client
+}
+
+func NewModuleInstaller(modsDir string, reg *registry.Client) *ModuleInstaller {
+        return &ModuleInstaller{
+                modsDir: modsDir,
+                reg:     reg,
+        }
+}
+
+// InstallModules analyses the root module in the given directory and installs
+// all of its direct and transitive dependencies into the given modules
+// directory, which must already exist.
+//
+// Since InstallModules makes possibly-time-consuming calls to remote services,
+// a hook interface is supported to allow the caller to be notified when
+// each module is installed and, for remote modules, when downloading begins.
+// LoadConfig guarantees that two hook calls will not happen concurrently but
+// it does not guarantee any particular ordering of hook calls. This mechanism
+// is for UI feedback only and does not give the caller any control over the
+// process.
+//
+// If modules are already installed in the target directory, they will be
+// skipped unless their source address or version have changed or unless
+// the upgrade flag is set.
+//
+// InstallModules never deletes any directory, except in the case where it
+// needs to replace a directory that is already present with a newly-extracted
+// package.
+//
+// If the returned diagnostics contains errors then the module installation
+// may have wholly or partially completed. Modules must be loaded in order
+// to find their dependencies, so this function does many of the same checks
+// as LoadConfig as a side-effect.
+//
+// If successful (the returned diagnostics contains no errors) then the
+// first return value is the early configuration tree that was constructed by
+// the installation process.
+func (i *ModuleInstaller) InstallModules(rootDir string, upgrade bool, hooks ModuleInstallHooks) (*earlyconfig.Config, tfdiags.Diagnostics) {
+        log.Printf("[TRACE] ModuleInstaller: installing child modules for %s into %s", rootDir, i.modsDir)
+
+        rootMod, diags := earlyconfig.LoadModule(rootDir)
+        if rootMod == nil {
+                return nil, diags
+        }
+
+        manifest, err := modsdir.ReadManifestSnapshotForDir(i.modsDir)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to read modules manifest file",
+                        fmt.Sprintf("Error reading manifest for %s: %s.", i.modsDir, err),
+                ))
+                return nil, diags
+        }
+
+        getter := reusingGetter{}
+        cfg, instDiags := i.installDescendentModules(rootMod, rootDir, manifest, upgrade, hooks, getter)
+        diags = append(diags, instDiags...)
+
+        return cfg, diags
+}
+
+func (i *ModuleInstaller) installDescendentModules(rootMod *tfconfig.Module, rootDir string, manifest modsdir.Manifest, upgrade bool, hooks ModuleInstallHooks, getter reusingGetter) (*earlyconfig.Config, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        if hooks == nil {
+                // Use our no-op implementation as a placeholder
+                hooks = ModuleInstallHooksImpl{}
+        }
+
+        // Create a manifest record for the root module. This will be used if
+        // there are any relative-pathed modules in the root.
+        manifest[""] = modsdir.Record{
+                Key: "",
+                Dir: rootDir,
+        }
+
+        cfg, cDiags := earlyconfig.BuildConfig(rootMod, earlyconfig.ModuleWalkerFunc(
+                func(req *earlyconfig.ModuleRequest) (*tfconfig.Module, *version.Version, tfdiags.Diagnostics) {
+
+                        key := manifest.ModuleKey(req.Path)
+                        instPath := i.packageInstallPath(req.Path)
+
+                        log.Printf("[DEBUG] Module installer: begin %s", key)
+
+                        // First we'll check if we need to upgrade/replace an existing
+                        // installed module, and delete it out of the way if so.
+                        replace := upgrade
+                        if !replace {
+                                record, recorded := manifest[key]
+                                switch {
+                                case !recorded:
+                                        log.Printf("[TRACE] ModuleInstaller: %s is not yet installed", key)
+                                        replace = true
+                                case record.SourceAddr != req.SourceAddr:
+                                        log.Printf("[TRACE] ModuleInstaller: %s source address has changed from %q to %q", key, record.SourceAddr, req.SourceAddr)
+                                        replace = true
+                                case record.Version != nil && !req.VersionConstraints.Check(record.Version):
+                                        log.Printf("[TRACE] ModuleInstaller: %s version %s no longer compatible with constraints %s", key, record.Version, req.VersionConstraints)
+                                        replace = true
+                                }
+                        }
+
+                        // If we _are_ planning to replace this module, then we'll remove
+                        // it now so our installation code below won't conflict with any
+                        // existing remnants.
+                        if replace {
+                                if _, recorded := manifest[key]; recorded {
+                                        log.Printf("[TRACE] ModuleInstaller: discarding previous record of %s prior to reinstall", key)
+                                }
+                                delete(manifest, key)
+                                // Deleting a module invalidates all of its descendent modules too.
+                                keyPrefix := key + "."
+                                for subKey := range manifest {
+                                        if strings.HasPrefix(subKey, keyPrefix) {
+                                                if _, recorded := manifest[subKey]; recorded {
+                                                        log.Printf("[TRACE] ModuleInstaller: also discarding downstream %s", subKey)
+                                                }
+                                                delete(manifest, subKey)
+                                        }
+                                }
+                        }
+
+                        record, recorded := manifest[key]
+                        if !recorded {
+                                // Clean up any stale cache directory that might be present.
+                                // If this is a local (relative) source then the dir will
+                                // not exist, but we'll ignore that.
+                                log.Printf("[TRACE] ModuleInstaller: cleaning directory %s prior to install of %s", instPath, key)
+                                err := os.RemoveAll(instPath)
+                                if err != nil && !os.IsNotExist(err) {
+                                        log.Printf("[TRACE] ModuleInstaller: failed to remove %s: %s", key, err)
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Failed to remove local module cache",
+                                                fmt.Sprintf(
+                                                        "Terraform tried to remove %s in order to reinstall this module, but encountered an error: %s",
+                                                        instPath, err,
+                                                ),
+                                        ))
+                                        return nil, nil, diags
+                                }
+                        } else {
+                                // If this module is already recorded and its root directory
+                                // exists then we will just load what's already there and
+                                // keep our existing record.
+                                info, err := os.Stat(record.Dir)
+                                if err == nil && info.IsDir() {
+                                        mod, mDiags := earlyconfig.LoadModule(record.Dir)
+                                        diags = diags.Append(mDiags)
+
+                                        log.Printf("[TRACE] ModuleInstaller: Module installer: %s %s already installed in %s", key, record.Version, record.Dir)
+                                        return mod, record.Version, diags
+                                }
+                        }
+
+                        // If we get down here then it's finally time to actually install
+                        // the module. There are some variants to this process depending
+                        // on what type of module source address we have.
+                        switch {
+
+                        case isLocalSourceAddr(req.SourceAddr):
+                                log.Printf("[TRACE] ModuleInstaller: %s has local path %q", key, req.SourceAddr)
+                                mod, mDiags := i.installLocalModule(req, key, manifest, hooks)
+                                diags = append(diags, mDiags...)
+                                return mod, nil, diags
+
+                        case isRegistrySourceAddr(req.SourceAddr):
+                                addr, err := regsrc.ParseModuleSource(req.SourceAddr)
+                                if err != nil {
+                                        // Should never happen because isRegistrySourceAddr already validated
+                                        panic(err)
+                                }
+                                log.Printf("[TRACE] ModuleInstaller: %s is a registry module at %s", key, addr)
+
+                                mod, v, mDiags := i.installRegistryModule(req, key, instPath, addr, manifest, hooks, getter)
+                                diags = append(diags, mDiags...)
+                                return mod, v, diags
+
+                        default:
+                                log.Printf("[TRACE] ModuleInstaller: %s address %q will be handled by go-getter", key, req.SourceAddr)
+
+                                mod, mDiags := i.installGoGetterModule(req, key, instPath, manifest, hooks, getter)
+                                diags = append(diags, mDiags...)
+                                return mod, nil, diags
+                        }
+
+                },
+        ))
+        diags = append(diags, cDiags...)
+
+        err := manifest.WriteSnapshotToDir(i.modsDir)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to update module manifest",
+                        fmt.Sprintf("Unable to write the module manifest file: %s", err),
+                ))
+        }
+
+        return cfg, diags
+}
+
+func (i *ModuleInstaller) installLocalModule(req *earlyconfig.ModuleRequest, key string, manifest modsdir.Manifest, hooks ModuleInstallHooks) (*tfconfig.Module, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        parentKey := manifest.ModuleKey(req.Parent.Path)
+        parentRecord, recorded := manifest[parentKey]
+        if !recorded {
+                // This is indicative of a bug rather than a user-actionable error
+                panic(fmt.Errorf("missing manifest record for parent module %s", parentKey))
+        }
+
+        if len(req.VersionConstraints) != 0 {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Invalid version constraint",
+                        fmt.Sprintf("Cannot apply a version constraint to module %q (at %s:%d) because it has a relative local path.", req.Name, req.CallPos.Filename, req.CallPos.Line),
+                ))
+        }
+
+        // For local sources we don't actually need to modify the
+        // filesystem at all because the parent already wrote
+        // the files we need, and so we just load up what's already here.
+        newDir := filepath.Join(parentRecord.Dir, req.SourceAddr)
+
+        log.Printf("[TRACE] ModuleInstaller: %s uses directory from parent: %s", key, newDir)
+        // it is possible that the local directory is a symlink
+        newDir, err := filepath.EvalSymlinks(newDir)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Unreadable module directory",
+                        fmt.Sprintf("Unable to evaluate directory symlink: %s", err.Error()),
+                ))
+        }
+
+        mod, mDiags := earlyconfig.LoadModule(newDir)
+        if mod == nil {
+                // nil indicates missing or unreadable directory, so we'll
+                // discard the returned diags and return a more specific
+                // error message here.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Unreadable module directory",
+                        fmt.Sprintf("The directory %s could not be read for module %q at %s:%d.", newDir, req.Name, req.CallPos.Filename, req.CallPos.Line),
+                ))
+        } else {
+                diags = diags.Append(mDiags)
+        }
+
+        // Note the local location in our manifest.
+        manifest[key] = modsdir.Record{
+                Key:        key,
+                Dir:        newDir,
+                SourceAddr: req.SourceAddr,
+        }
+        log.Printf("[DEBUG] Module installer: %s installed at %s", key, newDir)
+        hooks.Install(key, nil, newDir)
+
+        return mod, diags
+}
+
+func (i *ModuleInstaller) installRegistryModule(req *earlyconfig.ModuleRequest, key string, instPath string, addr *regsrc.Module, manifest modsdir.Manifest, hooks ModuleInstallHooks, getter reusingGetter) (*tfconfig.Module, *version.Version, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        hostname, err := addr.SvcHost()
+        if err != nil {
+                // If it looks like the user was trying to use punycode then we'll generate
+                // a specialized error for that case. We require the unicode form of
+                // hostname so that hostnames are always human-readable in configuration
+                // and punycode can't be used to hide a malicious module hostname.
+                if strings.HasPrefix(addr.RawHost.Raw, "xn--") {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid module registry hostname",
+                                fmt.Sprintf("The hostname portion of the module %q source address (at %s:%d) is not an acceptable hostname. Internationalized domain names must be given in unicode form rather than ASCII (\"punycode\") form.", req.Name, req.CallPos.Filename, req.CallPos.Line),
+                        ))
+                } else {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid module registry hostname",
+                                fmt.Sprintf("The hostname portion of the module %q source address (at %s:%d) is not a valid hostname.", req.Name, req.CallPos.Filename, req.CallPos.Line),
+                        ))
+                }
+                return nil, nil, diags
+        }
+
+        reg := i.reg
+
+        log.Printf("[DEBUG] %s listing available versions of %s at %s", key, addr, hostname)
+        resp, err := reg.ModuleVersions(addr)
+        if err != nil {
+                if registry.IsModuleNotFound(err) {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Module not found",
+                                fmt.Sprintf("Module %q (from %s:%d) cannot be found in the module registry at %s.", req.Name, req.CallPos.Filename, req.CallPos.Line, hostname),
+                        ))
+                } else {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Error accessing remote module registry",
+                                fmt.Sprintf("Failed to retrieve available versions for module %q (%s:%d) from %s: %s.", req.Name, req.CallPos.Filename, req.CallPos.Line, hostname, err),
+                        ))
+                }
+                return nil, nil, diags
+        }
+
+        // The response might contain information about dependencies to allow us
+        // to potentially optimize future requests, but we don't currently do that
+        // and so for now we'll just take the first item which is guaranteed to
+        // be the address we requested.
+        if len(resp.Modules) < 1 {
+                // Should never happen, but since this is a remote service that may
+                // be implemented by third-parties we will handle it gracefully.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Invalid response from remote module registry",
+                        fmt.Sprintf("The registry at %s returned an invalid response when Terraform requested available versions for module %q (%s:%d).", hostname, req.Name, req.CallPos.Filename, req.CallPos.Line),
+                ))
+                return nil, nil, diags
+        }
+
+        modMeta := resp.Modules[0]
+
+        var latestMatch *version.Version
+        var latestVersion *version.Version
+        for _, mv := range modMeta.Versions {
+                v, err := version.NewVersion(mv.Version)
+                if err != nil {
+                        // Should never happen if the registry server is compliant with
+                        // the protocol, but we'll warn if not to assist someone who
+                        // might be developing a module registry server.
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Warning,
+                                "Invalid response from remote module registry",
+                                fmt.Sprintf("The registry at %s returned an invalid version string %q for module %q (%s:%d), which Terraform ignored.", hostname, mv.Version, req.Name, req.CallPos.Filename, req.CallPos.Line),
+                        ))
+                        continue
+                }
+
+                // If we've found a pre-release version then we'll ignore it unless
+                // it was exactly requested.
+                if v.Prerelease() != "" && req.VersionConstraints.String() != v.String() {
+                        log.Printf("[TRACE] ModuleInstaller: %s ignoring %s because it is a pre-release and was not requested exactly", key, v)
+                        continue
+                }
+
+                if latestVersion == nil || v.GreaterThan(latestVersion) {
+                        latestVersion = v
+                }
+
+                if req.VersionConstraints.Check(v) {
+                        if latestMatch == nil || v.GreaterThan(latestMatch) {
+                                latestMatch = v
+                        }
+                }
+        }
+
+        if latestVersion == nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Module has no versions",
+                        fmt.Sprintf("Module %q (%s:%d) has no versions available on %s.", addr, req.CallPos.Filename, req.CallPos.Line, hostname),
+                ))
+                return nil, nil, diags
+        }
+
+        if latestMatch == nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Unresolvable module version constraint",
+                        fmt.Sprintf("There is no available version of module %q (%s:%d) which matches the given version constraint. The newest available version is %s.", addr, req.CallPos.Filename, req.CallPos.Line, latestVersion),
+                ))
+                return nil, nil, diags
+        }
+
+        // Report up to the caller that we're about to start downloading.
+        packageAddr, _ := splitAddrSubdir(req.SourceAddr)
+        hooks.Download(key, packageAddr, latestMatch)
+
+        // If we manage to get down here then we've found a suitable version to
+        // install, so we need to ask the registry where we should download it from.
+        // The response to this is a go-getter-style address string.
+        dlAddr, err := reg.ModuleLocation(addr, latestMatch.String())
+        if err != nil {
+                log.Printf("[ERROR] %s from %s %s: %s", key, addr, latestMatch, err)
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Invalid response from remote module registry",
+                        fmt.Sprintf("The remote registry at %s failed to return a download URL for %s %s.", hostname, addr, latestMatch),
+                ))
+                return nil, nil, diags
+        }
+
+        log.Printf("[TRACE] ModuleInstaller: %s %s %s is available at %q", key, addr, latestMatch, dlAddr)
+
+        modDir, err := getter.getWithGoGetter(instPath, dlAddr)
+        if err != nil {
+                // Errors returned by go-getter have very inconsistent quality as
+                // end-user error messages, but for now we're accepting that because
+                // we have no way to recognize any specific errors to improve them
+                // and masking the error entirely would hide valuable diagnostic
+                // information from the user.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to download module",
+                        fmt.Sprintf("Could not download module %q (%s:%d) source code from %q: %s.", req.Name, req.CallPos.Filename, req.CallPos.Line, dlAddr, err),
+                ))
+                return nil, nil, diags
+        }
+
+        log.Printf("[TRACE] ModuleInstaller: %s %q was downloaded to %s", key, dlAddr, modDir)
+
+        if addr.RawSubmodule != "" {
+                // Append the user's requested subdirectory to any subdirectory that
+                // was implied by any of the nested layers we expanded within go-getter.
+                modDir = filepath.Join(modDir, addr.RawSubmodule)
+        }
+
+        log.Printf("[TRACE] ModuleInstaller: %s should now be at %s", key, modDir)
+
+        // Finally we are ready to try actually loading the module.
+        mod, mDiags := earlyconfig.LoadModule(modDir)
+        if mod == nil {
+                // nil indicates missing or unreadable directory, so we'll
+                // discard the returned diags and return a more specific
+                // error message here. For registry modules this actually
+                // indicates a bug in the code above, since it's not the
+                // user's responsibility to create the directory in this case.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Unreadable module directory",
+                        fmt.Sprintf("The directory %s could not be read. This is a bug in Terraform and should be reported.", modDir),
+                ))
+        } else {
+                diags = append(diags, mDiags...)
+        }
+
+        // Note the local location in our manifest.
+        manifest[key] = modsdir.Record{
+                Key:        key,
+                Version:    latestMatch,
+                Dir:        modDir,
+                SourceAddr: req.SourceAddr,
+        }
+        log.Printf("[DEBUG] Module installer: %s installed at %s", key, modDir)
+        hooks.Install(key, latestMatch, modDir)
+
+        return mod, latestMatch, diags
+}
+
+func (i *ModuleInstaller) installGoGetterModule(req *earlyconfig.ModuleRequest, key string, instPath string, manifest modsdir.Manifest, hooks ModuleInstallHooks, getter reusingGetter) (*tfconfig.Module, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // Report up to the caller that we're about to start downloading.
+        packageAddr, _ := splitAddrSubdir(req.SourceAddr)
+        hooks.Download(key, packageAddr, nil)
+
+        if len(req.VersionConstraints) != 0 {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Invalid version constraint",
+                        fmt.Sprintf("Cannot apply a version constraint to module %q (at %s:%d) because it has a non Registry URL.", req.Name, req.CallPos.Filename, req.CallPos.Line),
+                ))
+                return nil, diags
+        }
+
+        modDir, err := getter.getWithGoGetter(instPath, req.SourceAddr)
+        if err != nil {
+                if _, ok := err.(*MaybeRelativePathErr); ok {
+                        log.Printf(
+                                "[TRACE] ModuleInstaller: %s looks like a local path but is missing ./ or ../",
+                                req.SourceAddr,
+                        )
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Module not found",
+                                fmt.Sprintf(
+                                        "The module address %q could not be resolved.\n\n"+
+                                                "If you intended this as a path relative to the current "+
+                                                "module, use \"./%s\" instead. The \"./\" prefix "+
+                                                "indicates that the address is a relative filesystem path.",
+                                        req.SourceAddr, req.SourceAddr,
+                                ),
+                        ))
+                } else {
+                        // Errors returned by go-getter have very inconsistent quality as
+                        // end-user error messages, but for now we're accepting that because
+                        // we have no way to recognize any specific errors to improve them
+                        // and masking the error entirely would hide valuable diagnostic
+                        // information from the user.
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to download module",
+                                fmt.Sprintf("Could not download module %q (%s:%d) source code from %q: %s", req.Name, req.CallPos.Filename, req.CallPos.Line, packageAddr, err),
+                        ))
+                }
+                return nil, diags
+
+        }
+
+        log.Printf("[TRACE] ModuleInstaller: %s %q was downloaded to %s", key, req.SourceAddr, modDir)
+
+        mod, mDiags := earlyconfig.LoadModule(modDir)
+        if mod == nil {
+                // nil indicates missing or unreadable directory, so we'll
+                // discard the returned diags and return a more specific
+                // error message here. For go-getter modules this actually
+                // indicates a bug in the code above, since it's not the
+                // user's responsibility to create the directory in this case.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Unreadable module directory",
+                        fmt.Sprintf("The directory %s could not be read. This is a bug in Terraform and should be reported.", modDir),
+                ))
+        } else {
+                diags = append(diags, mDiags...)
+        }
+
+        // Note the local location in our manifest.
+        manifest[key] = modsdir.Record{
+                Key:        key,
+                Dir:        modDir,
+                SourceAddr: req.SourceAddr,
+        }
+        log.Printf("[DEBUG] Module installer: %s installed at %s", key, modDir)
+        hooks.Install(key, nil, modDir)
+
+        return mod, diags
+}
+
+func (i *ModuleInstaller) packageInstallPath(modulePath addrs.Module) string {
+        return filepath.Join(i.modsDir, strings.Join(modulePath, "."))
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/module_install_hooks.go b/vendor/github.com/hashicorp/terraform/internal/initwd/module_install_hooks.go
new file mode 100644
index 0000000..817a6dc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/module_install_hooks.go
@@ -0,0 +1,36 @@
+package initwd
+
+import (
+        version "github.com/hashicorp/go-version"
+)
+
+// ModuleInstallHooks is an interface used to provide notifications about the
+// installation process being orchestrated by InstallModules.
+//
+// This interface may have new methods added in future, so implementers should
+// embed InstallHooksImpl to get no-op implementations of any unimplemented
+// methods.
+type ModuleInstallHooks interface {
+        // Download is called for modules that are retrieved from a remote source
+        // before that download begins, to allow a caller to give feedback
+        // on progress through a possibly-long sequence of downloads.
+        Download(moduleAddr, packageAddr string, version *version.Version)
+
+        // Install is called for each module that is installed, even if it did
+        // not need to be downloaded from a remote source.
+        Install(moduleAddr string, version *version.Version, localPath string)
+}
+
+// ModuleInstallHooksImpl is a do-nothing implementation of InstallHooks that
+// can be embedded in another implementation struct to allow only partial
+// implementation of the interface.
+type ModuleInstallHooksImpl struct {
+}
+
+func (h ModuleInstallHooksImpl) Download(moduleAddr, packageAddr string, version *version.Version) {
+}
+
+func (h ModuleInstallHooksImpl) Install(moduleAddr string, version *version.Version, localPath string) {
+}
+
+var _ ModuleInstallHooks = ModuleInstallHooksImpl{}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/testing.go b/vendor/github.com/hashicorp/terraform/internal/initwd/testing.go
new file mode 100644
index 0000000..8cef80a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/testing.go
@@ -0,0 +1,73 @@
+package initwd
+
+import (
+        "github.com/hashicorp/terraform/registry"
+        "testing"
+
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configload"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// LoadConfigForTests is a convenience wrapper around configload.NewLoaderForTests,
+// ModuleInstaller.InstallModules and configload.Loader.LoadConfig that allows
+// a test configuration to be loaded in a single step.
+//
+// If module installation fails, t.Fatal (or similar) is called to halt
+// execution of the test, under the assumption that installation failures are
+// not expected. If installation failures _are_ expected then use
+// NewLoaderForTests and work with the loader object directly. If module
+// installation succeeds but generates warnings, these warnings are discarded.
+//
+// If installation succeeds but errors are detected during loading then a
+// possibly-incomplete config is returned along with error diagnostics. The
+// test run is not aborted in this case, so that the caller can make assertions
+// against the returned diagnostics.
+//
+// As with NewLoaderForTests, a cleanup function is returned which must be
+// called before the test completes in order to remove the temporary
+// modules directory.
+func LoadConfigForTests(t *testing.T, rootDir string) (*configs.Config, *configload.Loader, func(), tfdiags.Diagnostics) {
+        t.Helper()
+
+        var diags tfdiags.Diagnostics
+
+        loader, cleanup := configload.NewLoaderForTests(t)
+        inst := NewModuleInstaller(loader.ModulesDir(), registry.NewClient(nil, nil))
+
+        _, moreDiags := inst.InstallModules(rootDir, true, ModuleInstallHooksImpl{})
+        diags = diags.Append(moreDiags)
+        if diags.HasErrors() {
+                cleanup()
+                t.Fatal(diags.Err())
+                return nil, nil, func() {}, diags
+        }
+
+        // Since module installer has modified the module manifest on disk, we need
+        // to refresh the cache of it in the loader.
+        if err := loader.RefreshModules(); err != nil {
+                t.Fatalf("failed to refresh modules after installation: %s", err)
+        }
+
+        config, hclDiags := loader.LoadConfig(rootDir)
+        diags = diags.Append(hclDiags)
+        return config, loader, cleanup, diags
+}
+
+// MustLoadConfigForTests is a variant of LoadConfigForTests which calls
+// t.Fatal (or similar) if there are any errors during loading, and thus
+// does not return diagnostics at all.
+//
+// This is useful for concisely writing tests that don't expect errors at
+// all. For tests that expect errors and need to assert against them, use
+// LoadConfigForTests instead.
+func MustLoadConfigForTests(t *testing.T, rootDir string) (*configs.Config, *configload.Loader, func()) {
+        t.Helper()
+
+        config, loader, cleanup, diags := LoadConfigForTests(t, rootDir)
+        if diags.HasErrors() {
+                cleanup()
+                t.Fatal(diags.Err())
+        }
+        return config, loader, cleanup
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/version_required.go b/vendor/github.com/hashicorp/terraform/internal/initwd/version_required.go
new file mode 100644
index 0000000..104840b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/version_required.go
@@ -0,0 +1,83 @@
+package initwd
+
+import (
+        "fmt"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform/internal/earlyconfig"
+        "github.com/hashicorp/terraform/tfdiags"
+        tfversion "github.com/hashicorp/terraform/version"
+)
+
+// CheckCoreVersionRequirements visits each of the modules in the given
+// early configuration tree and verifies that any given Core version constraints
+// match with the version of Terraform Core that is being used.
+//
+// The returned diagnostics will contain errors if any constraints do not match.
+// The returned diagnostics might also return warnings, which should be
+// displayed to the user.
+func CheckCoreVersionRequirements(earlyConfig *earlyconfig.Config) tfdiags.Diagnostics {
+        if earlyConfig == nil {
+                return nil
+        }
+
+        var diags tfdiags.Diagnostics
+        module := earlyConfig.Module
+
+        var constraints version.Constraints
+        for _, constraintStr := range module.RequiredCore {
+                constraint, err := version.NewConstraint(constraintStr)
+                if err != nil {
+                        // Unfortunately the early config parser doesn't preserve a source
+                        // location for this, so we're unable to indicate a specific
+                        // location where this constraint came from, but we can at least
+                        // say which module set it.
+                        switch {
+                        case len(earlyConfig.Path) == 0:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid provider version constraint",
+                                        fmt.Sprintf("Invalid version core constraint %q in the root module.", constraintStr),
+                                ))
+                        default:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid provider version constraint",
+                                        fmt.Sprintf("Invalid version core constraint %q in %s.", constraintStr, earlyConfig.Path),
+                                ))
+                        }
+                        continue
+                }
+                constraints = append(constraints, constraint...)
+        }
+
+        if !constraints.Check(tfversion.SemVer) {
+                switch {
+                case len(earlyConfig.Path) == 0:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Unsupported Terraform Core version",
+                                fmt.Sprintf(
+                                        "This configuration does not support Terraform version %s. To proceed, either choose another supported Terraform version or update the root module's version constraint. Version constraints are normally set for good reason, so updating the constraint may lead to other errors or unexpected behavior.",
+                                        tfversion.String(),
+                                ),
+                        ))
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Unsupported Terraform Core version",
+                                fmt.Sprintf(
+                                        "Module %s (from %q) does not support Terraform version %s. To proceed, either choose another supported Terraform version or update the module's version constraint. Version constraints are normally set for good reason, so updating the constraint may lead to other errors or unexpected behavior.",
+                                        earlyConfig.Path, earlyConfig.SourceAddr, tfversion.String(),
+                                ),
+                        ))
+                }
+        }
+
+        for _, c := range earlyConfig.Children {
+                childDiags := CheckCoreVersionRequirements(c)
+                diags = diags.Append(childDiags)
+        }
+
+        return diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/modsdir/doc.go b/vendor/github.com/hashicorp/terraform/internal/modsdir/doc.go
new file mode 100644
index 0000000..0d7d664
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/modsdir/doc.go
@@ -0,0 +1,3 @@
+// Package modsdir is an internal package containing the model types used to
+// represent the manifest of modules in a local modules cache directory.
+package modsdir
diff --git a/vendor/github.com/hashicorp/terraform/internal/modsdir/manifest.go b/vendor/github.com/hashicorp/terraform/internal/modsdir/manifest.go
new file mode 100644
index 0000000..36f6c03
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/modsdir/manifest.go
@@ -0,0 +1,138 @@
+package modsdir
+
+import (
+        "encoding/json"
+        "fmt"
+        "io"
+        "io/ioutil"
+        "log"
+        "os"
+        "path/filepath"
+
+        version "github.com/hashicorp/go-version"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Record represents some metadata about an installed module, as part
+// of a ModuleManifest.
+type Record struct {
+        // Key is a unique identifier for this particular module, based on its
+        // position within the static module tree.
+        Key string `json:"Key"`
+
+        // SourceAddr is the source address given for this module in configuration.
+        // This is used only to detect if the source was changed in configuration
+        // since the module was last installed, which means that the installer
+        // must re-install it.
+        SourceAddr string `json:"Source"`
+
+        // Version is the exact version of the module, which results from parsing
+        // VersionStr. nil for un-versioned modules.
+        Version *version.Version `json:"-"`
+
+        // VersionStr is the version specifier string. This is used only for
+        // serialization in snapshots and should not be accessed or updated
+        // by any other codepaths; use "Version" instead.
+        VersionStr string `json:"Version,omitempty"`
+
+        // Dir is the path to the local directory where the module is installed.
+        Dir string `json:"Dir"`
+}
+
+// Manifest is a map used to keep track of the filesystem locations
+// and other metadata about installed modules.
+//
+// The configuration loader refers to this, while the module installer updates
+// it to reflect any changes to the installed modules.
+type Manifest map[string]Record
+
+func (m Manifest) ModuleKey(path addrs.Module) string {
+        return path.String()
+}
+
+// manifestSnapshotFile is an internal struct used only to assist in our JSON
+// serialization of manifest snapshots. It should not be used for any other
+// purpose.
+type manifestSnapshotFile struct {
+        Records []Record `json:"Modules"`
+}
+
+func ReadManifestSnapshot(r io.Reader) (Manifest, error) {
+        src, err := ioutil.ReadAll(r)
+        if err != nil {
+                return nil, err
+        }
+
+        if len(src) == 0 {
+                // This should never happen, but we'll tolerate it as if it were
+                // a valid empty JSON object.
+                return make(Manifest), nil
+        }
+
+        var read manifestSnapshotFile
+        err = json.Unmarshal(src, &read)
+
+        new := make(Manifest)
+        for _, record := range read.Records {
+                if record.VersionStr != "" {
+                        record.Version, err = version.NewVersion(record.VersionStr)
+                        if err != nil {
+                                return nil, fmt.Errorf("invalid version %q for %s: %s", record.VersionStr, record.Key, err)
+                        }
+                }
+                if _, exists := new[record.Key]; exists {
+                        // This should never happen in any valid file, so we'll catch it
+                        // and report it to avoid confusing/undefined behavior if the
+                        // snapshot file was edited incorrectly outside of Terraform.
+                        return nil, fmt.Errorf("snapshot file contains two records for path %s", record.Key)
+                }
+                new[record.Key] = record
+        }
+        return new, nil
+}
+
+func ReadManifestSnapshotForDir(dir string) (Manifest, error) {
+        fn := filepath.Join(dir, ManifestSnapshotFilename)
+        r, err := os.Open(fn)
+        if err != nil {
+                if os.IsNotExist(err) {
+                        return make(Manifest), nil // missing file is okay and treated as empty
+                }
+                return nil, err
+        }
+        return ReadManifestSnapshot(r)
+}
+
+func (m Manifest) WriteSnapshot(w io.Writer) error {
+        var write manifestSnapshotFile
+
+        for _, record := range m {
+                // Make sure VersionStr is in sync with Version, since we encourage
+                // callers to manipulate Version and ignore VersionStr.
+                if record.Version != nil {
+                        record.VersionStr = record.Version.String()
+                } else {
+                        record.VersionStr = ""
+                }
+                write.Records = append(write.Records, record)
+        }
+
+        src, err := json.Marshal(write)
+        if err != nil {
+                return err
+        }
+
+        _, err = w.Write(src)
+        return err
+}
+
+func (m Manifest) WriteSnapshotToDir(dir string) error {
+        fn := filepath.Join(dir, ManifestSnapshotFilename)
+        log.Printf("[TRACE] modsdir: writing modules manifest to %s", fn)
+        w, err := os.Create(fn)
+        if err != nil {
+                return err
+        }
+        return m.WriteSnapshot(w)
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/modsdir/paths.go b/vendor/github.com/hashicorp/terraform/internal/modsdir/paths.go
new file mode 100644
index 0000000..9ebb524
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/modsdir/paths.go
@@ -0,0 +1,3 @@
+package modsdir
+
+const ManifestSnapshotFilename = "modules.json"
diff --git a/vendor/github.com/hashicorp/terraform/internal/tfplugin5/generate.sh b/vendor/github.com/hashicorp/terraform/internal/tfplugin5/generate.sh
new file mode 100644
index 0000000..de1d693
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/tfplugin5/generate.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+# We do not run protoc under go:generate because we want to ensure that all
+# dependencies of go:generate are "go get"-able for general dev environment
+# usability. To compile all protobuf files in this repository, run
+# "make protobuf" at the top-level.
+
+set -eu
+
+SOURCE="${BASH_SOURCE[0]}"
+while [ -h "$SOURCE" ] ; do SOURCE="$(readlink "$SOURCE")"; done
+DIR="$( cd -P "$( dirname "$SOURCE" )" && pwd )"
+
+cd "$DIR"
+
+protoc -I ./ tfplugin5.proto --go_out=plugins=grpc:./
diff --git a/vendor/github.com/hashicorp/terraform/internal/tfplugin5/tfplugin5.pb.go b/vendor/github.com/hashicorp/terraform/internal/tfplugin5/tfplugin5.pb.go
new file mode 100644
index 0000000..87a6bec
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/tfplugin5/tfplugin5.pb.go
@@ -0,0 +1,3455 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// source: tfplugin5.proto
+
+package tfplugin5
+
+import proto "github.com/golang/protobuf/proto"
+import fmt "fmt"
+import math "math"
+
+import (
+        context "golang.org/x/net/context"
+        grpc "google.golang.org/grpc"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
+
+type Diagnostic_Severity int32
+
+const (
+        Diagnostic_INVALID Diagnostic_Severity = 0
+        Diagnostic_ERROR   Diagnostic_Severity = 1
+        Diagnostic_WARNING Diagnostic_Severity = 2
+)
+
+var Diagnostic_Severity_name = map[int32]string{
+        0: "INVALID",
+        1: "ERROR",
+        2: "WARNING",
+}
+var Diagnostic_Severity_value = map[string]int32{
+        "INVALID": 0,
+        "ERROR":   1,
+        "WARNING": 2,
+}
+
+func (x Diagnostic_Severity) String() string {
+        return proto.EnumName(Diagnostic_Severity_name, int32(x))
+}
+func (Diagnostic_Severity) EnumDescriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{1, 0}
+}
+
+type Schema_NestedBlock_NestingMode int32
+
+const (
+        Schema_NestedBlock_INVALID Schema_NestedBlock_NestingMode = 0
+        Schema_NestedBlock_SINGLE  Schema_NestedBlock_NestingMode = 1
+        Schema_NestedBlock_LIST    Schema_NestedBlock_NestingMode = 2
+        Schema_NestedBlock_SET     Schema_NestedBlock_NestingMode = 3
+        Schema_NestedBlock_MAP     Schema_NestedBlock_NestingMode = 4
+        Schema_NestedBlock_GROUP   Schema_NestedBlock_NestingMode = 5
+)
+
+var Schema_NestedBlock_NestingMode_name = map[int32]string{
+        0: "INVALID",
+        1: "SINGLE",
+        2: "LIST",
+        3: "SET",
+        4: "MAP",
+        5: "GROUP",
+}
+var Schema_NestedBlock_NestingMode_value = map[string]int32{
+        "INVALID": 0,
+        "SINGLE":  1,
+        "LIST":    2,
+        "SET":     3,
+        "MAP":     4,
+        "GROUP":   5,
+}
+
+func (x Schema_NestedBlock_NestingMode) String() string {
+        return proto.EnumName(Schema_NestedBlock_NestingMode_name, int32(x))
+}
+func (Schema_NestedBlock_NestingMode) EnumDescriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{5, 2, 0}
+}
+
+// DynamicValue is an opaque encoding of terraform data, with the field name
+// indicating the encoding scheme used.
+type DynamicValue struct {
+        Msgpack              []byte   `protobuf:"bytes,1,opt,name=msgpack,proto3" json:"msgpack,omitempty"`
+        Json                 []byte   `protobuf:"bytes,2,opt,name=json,proto3" json:"json,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *DynamicValue) Reset()         { *m = DynamicValue{} }
+func (m *DynamicValue) String() string { return proto.CompactTextString(m) }
+func (*DynamicValue) ProtoMessage()    {}
+func (*DynamicValue) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{0}
+}
+func (m *DynamicValue) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_DynamicValue.Unmarshal(m, b)
+}
+func (m *DynamicValue) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_DynamicValue.Marshal(b, m, deterministic)
+}
+func (dst *DynamicValue) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_DynamicValue.Merge(dst, src)
+}
+func (m *DynamicValue) XXX_Size() int {
+        return xxx_messageInfo_DynamicValue.Size(m)
+}
+func (m *DynamicValue) XXX_DiscardUnknown() {
+        xxx_messageInfo_DynamicValue.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_DynamicValue proto.InternalMessageInfo
+
+func (m *DynamicValue) GetMsgpack() []byte {
+        if m != nil {
+                return m.Msgpack
+        }
+        return nil
+}
+
+func (m *DynamicValue) GetJson() []byte {
+        if m != nil {
+                return m.Json
+        }
+        return nil
+}
+
+type Diagnostic struct {
+        Severity             Diagnostic_Severity `protobuf:"varint,1,opt,name=severity,proto3,enum=tfplugin5.Diagnostic_Severity" json:"severity,omitempty"`
+        Summary              string              `protobuf:"bytes,2,opt,name=summary,proto3" json:"summary,omitempty"`
+        Detail               string              `protobuf:"bytes,3,opt,name=detail,proto3" json:"detail,omitempty"`
+        Attribute            *AttributePath      `protobuf:"bytes,4,opt,name=attribute,proto3" json:"attribute,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}            `json:"-"`
+        XXX_unrecognized     []byte              `json:"-"`
+        XXX_sizecache        int32               `json:"-"`
+}
+
+func (m *Diagnostic) Reset()         { *m = Diagnostic{} }
+func (m *Diagnostic) String() string { return proto.CompactTextString(m) }
+func (*Diagnostic) ProtoMessage()    {}
+func (*Diagnostic) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{1}
+}
+func (m *Diagnostic) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Diagnostic.Unmarshal(m, b)
+}
+func (m *Diagnostic) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Diagnostic.Marshal(b, m, deterministic)
+}
+func (dst *Diagnostic) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Diagnostic.Merge(dst, src)
+}
+func (m *Diagnostic) XXX_Size() int {
+        return xxx_messageInfo_Diagnostic.Size(m)
+}
+func (m *Diagnostic) XXX_DiscardUnknown() {
+        xxx_messageInfo_Diagnostic.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Diagnostic proto.InternalMessageInfo
+
+func (m *Diagnostic) GetSeverity() Diagnostic_Severity {
+        if m != nil {
+                return m.Severity
+        }
+        return Diagnostic_INVALID
+}
+
+func (m *Diagnostic) GetSummary() string {
+        if m != nil {
+                return m.Summary
+        }
+        return ""
+}
+
+func (m *Diagnostic) GetDetail() string {
+        if m != nil {
+                return m.Detail
+        }
+        return ""
+}
+
+func (m *Diagnostic) GetAttribute() *AttributePath {
+        if m != nil {
+                return m.Attribute
+        }
+        return nil
+}
+
+type AttributePath struct {
+        Steps                []*AttributePath_Step `protobuf:"bytes,1,rep,name=steps,proto3" json:"steps,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}              `json:"-"`
+        XXX_unrecognized     []byte                `json:"-"`
+        XXX_sizecache        int32                 `json:"-"`
+}
+
+func (m *AttributePath) Reset()         { *m = AttributePath{} }
+func (m *AttributePath) String() string { return proto.CompactTextString(m) }
+func (*AttributePath) ProtoMessage()    {}
+func (*AttributePath) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{2}
+}
+func (m *AttributePath) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_AttributePath.Unmarshal(m, b)
+}
+func (m *AttributePath) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_AttributePath.Marshal(b, m, deterministic)
+}
+func (dst *AttributePath) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_AttributePath.Merge(dst, src)
+}
+func (m *AttributePath) XXX_Size() int {
+        return xxx_messageInfo_AttributePath.Size(m)
+}
+func (m *AttributePath) XXX_DiscardUnknown() {
+        xxx_messageInfo_AttributePath.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_AttributePath proto.InternalMessageInfo
+
+func (m *AttributePath) GetSteps() []*AttributePath_Step {
+        if m != nil {
+                return m.Steps
+        }
+        return nil
+}
+
+type AttributePath_Step struct {
+        // Types that are valid to be assigned to Selector:
+        //      *AttributePath_Step_AttributeName
+        //      *AttributePath_Step_ElementKeyString
+        //      *AttributePath_Step_ElementKeyInt
+        Selector             isAttributePath_Step_Selector `protobuf_oneof:"selector"`
+        XXX_NoUnkeyedLiteral struct{}                      `json:"-"`
+        XXX_unrecognized     []byte                        `json:"-"`
+        XXX_sizecache        int32                         `json:"-"`
+}
+
+func (m *AttributePath_Step) Reset()         { *m = AttributePath_Step{} }
+func (m *AttributePath_Step) String() string { return proto.CompactTextString(m) }
+func (*AttributePath_Step) ProtoMessage()    {}
+func (*AttributePath_Step) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{2, 0}
+}
+func (m *AttributePath_Step) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_AttributePath_Step.Unmarshal(m, b)
+}
+func (m *AttributePath_Step) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_AttributePath_Step.Marshal(b, m, deterministic)
+}
+func (dst *AttributePath_Step) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_AttributePath_Step.Merge(dst, src)
+}
+func (m *AttributePath_Step) XXX_Size() int {
+        return xxx_messageInfo_AttributePath_Step.Size(m)
+}
+func (m *AttributePath_Step) XXX_DiscardUnknown() {
+        xxx_messageInfo_AttributePath_Step.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_AttributePath_Step proto.InternalMessageInfo
+
+type isAttributePath_Step_Selector interface {
+        isAttributePath_Step_Selector()
+}
+
+type AttributePath_Step_AttributeName struct {
+        AttributeName string `protobuf:"bytes,1,opt,name=attribute_name,json=attributeName,proto3,oneof"`
+}
+
+type AttributePath_Step_ElementKeyString struct {
+        ElementKeyString string `protobuf:"bytes,2,opt,name=element_key_string,json=elementKeyString,proto3,oneof"`
+}
+
+type AttributePath_Step_ElementKeyInt struct {
+        ElementKeyInt int64 `protobuf:"varint,3,opt,name=element_key_int,json=elementKeyInt,proto3,oneof"`
+}
+
+func (*AttributePath_Step_AttributeName) isAttributePath_Step_Selector() {}
+
+func (*AttributePath_Step_ElementKeyString) isAttributePath_Step_Selector() {}
+
+func (*AttributePath_Step_ElementKeyInt) isAttributePath_Step_Selector() {}
+
+func (m *AttributePath_Step) GetSelector() isAttributePath_Step_Selector {
+        if m != nil {
+                return m.Selector
+        }
+        return nil
+}
+
+func (m *AttributePath_Step) GetAttributeName() string {
+        if x, ok := m.GetSelector().(*AttributePath_Step_AttributeName); ok {
+                return x.AttributeName
+        }
+        return ""
+}
+
+func (m *AttributePath_Step) GetElementKeyString() string {
+        if x, ok := m.GetSelector().(*AttributePath_Step_ElementKeyString); ok {
+                return x.ElementKeyString
+        }
+        return ""
+}
+
+func (m *AttributePath_Step) GetElementKeyInt() int64 {
+        if x, ok := m.GetSelector().(*AttributePath_Step_ElementKeyInt); ok {
+                return x.ElementKeyInt
+        }
+        return 0
+}
+
+// XXX_OneofFuncs is for the internal use of the proto package.
+func (*AttributePath_Step) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
+        return _AttributePath_Step_OneofMarshaler, _AttributePath_Step_OneofUnmarshaler, _AttributePath_Step_OneofSizer, []interface{}{
+                (*AttributePath_Step_AttributeName)(nil),
+                (*AttributePath_Step_ElementKeyString)(nil),
+                (*AttributePath_Step_ElementKeyInt)(nil),
+        }
+}
+
+func _AttributePath_Step_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
+        m := msg.(*AttributePath_Step)
+        // selector
+        switch x := m.Selector.(type) {
+        case *AttributePath_Step_AttributeName:
+                b.EncodeVarint(1<<3 | proto.WireBytes)
+                b.EncodeStringBytes(x.AttributeName)
+        case *AttributePath_Step_ElementKeyString:
+                b.EncodeVarint(2<<3 | proto.WireBytes)
+                b.EncodeStringBytes(x.ElementKeyString)
+        case *AttributePath_Step_ElementKeyInt:
+                b.EncodeVarint(3<<3 | proto.WireVarint)
+                b.EncodeVarint(uint64(x.ElementKeyInt))
+        case nil:
+        default:
+                return fmt.Errorf("AttributePath_Step.Selector has unexpected type %T", x)
+        }
+        return nil
+}
+
+func _AttributePath_Step_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
+        m := msg.(*AttributePath_Step)
+        switch tag {
+        case 1: // selector.attribute_name
+                if wire != proto.WireBytes {
+                        return true, proto.ErrInternalBadWireType
+                }
+                x, err := b.DecodeStringBytes()
+                m.Selector = &AttributePath_Step_AttributeName{x}
+                return true, err
+        case 2: // selector.element_key_string
+                if wire != proto.WireBytes {
+                        return true, proto.ErrInternalBadWireType
+                }
+                x, err := b.DecodeStringBytes()
+                m.Selector = &AttributePath_Step_ElementKeyString{x}
+                return true, err
+        case 3: // selector.element_key_int
+                if wire != proto.WireVarint {
+                        return true, proto.ErrInternalBadWireType
+                }
+                x, err := b.DecodeVarint()
+                m.Selector = &AttributePath_Step_ElementKeyInt{int64(x)}
+                return true, err
+        default:
+                return false, nil
+        }
+}
+
+func _AttributePath_Step_OneofSizer(msg proto.Message) (n int) {
+        m := msg.(*AttributePath_Step)
+        // selector
+        switch x := m.Selector.(type) {
+        case *AttributePath_Step_AttributeName:
+                n += 1 // tag and wire
+                n += proto.SizeVarint(uint64(len(x.AttributeName)))
+                n += len(x.AttributeName)
+        case *AttributePath_Step_ElementKeyString:
+                n += 1 // tag and wire
+                n += proto.SizeVarint(uint64(len(x.ElementKeyString)))
+                n += len(x.ElementKeyString)
+        case *AttributePath_Step_ElementKeyInt:
+                n += 1 // tag and wire
+                n += proto.SizeVarint(uint64(x.ElementKeyInt))
+        case nil:
+        default:
+                panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
+        }
+        return n
+}
+
+type Stop struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Stop) Reset()         { *m = Stop{} }
+func (m *Stop) String() string { return proto.CompactTextString(m) }
+func (*Stop) ProtoMessage()    {}
+func (*Stop) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{3}
+}
+func (m *Stop) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Stop.Unmarshal(m, b)
+}
+func (m *Stop) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Stop.Marshal(b, m, deterministic)
+}
+func (dst *Stop) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Stop.Merge(dst, src)
+}
+func (m *Stop) XXX_Size() int {
+        return xxx_messageInfo_Stop.Size(m)
+}
+func (m *Stop) XXX_DiscardUnknown() {
+        xxx_messageInfo_Stop.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Stop proto.InternalMessageInfo
+
+type Stop_Request struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Stop_Request) Reset()         { *m = Stop_Request{} }
+func (m *Stop_Request) String() string { return proto.CompactTextString(m) }
+func (*Stop_Request) ProtoMessage()    {}
+func (*Stop_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{3, 0}
+}
+func (m *Stop_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Stop_Request.Unmarshal(m, b)
+}
+func (m *Stop_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Stop_Request.Marshal(b, m, deterministic)
+}
+func (dst *Stop_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Stop_Request.Merge(dst, src)
+}
+func (m *Stop_Request) XXX_Size() int {
+        return xxx_messageInfo_Stop_Request.Size(m)
+}
+func (m *Stop_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_Stop_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Stop_Request proto.InternalMessageInfo
+
+type Stop_Response struct {
+        Error                string   `protobuf:"bytes,1,opt,name=Error,proto3" json:"Error,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Stop_Response) Reset()         { *m = Stop_Response{} }
+func (m *Stop_Response) String() string { return proto.CompactTextString(m) }
+func (*Stop_Response) ProtoMessage()    {}
+func (*Stop_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{3, 1}
+}
+func (m *Stop_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Stop_Response.Unmarshal(m, b)
+}
+func (m *Stop_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Stop_Response.Marshal(b, m, deterministic)
+}
+func (dst *Stop_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Stop_Response.Merge(dst, src)
+}
+func (m *Stop_Response) XXX_Size() int {
+        return xxx_messageInfo_Stop_Response.Size(m)
+}
+func (m *Stop_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_Stop_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Stop_Response proto.InternalMessageInfo
+
+func (m *Stop_Response) GetError() string {
+        if m != nil {
+                return m.Error
+        }
+        return ""
+}
+
+// RawState holds the stored state for a resource to be upgraded by the
+// provider. It can be in one of two formats, the current json encoded format
+// in bytes, or the legacy flatmap format as a map of strings.
+type RawState struct {
+        Json                 []byte            `protobuf:"bytes,1,opt,name=json,proto3" json:"json,omitempty"`
+        Flatmap              map[string]string `protobuf:"bytes,2,rep,name=flatmap,proto3" json:"flatmap,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+        XXX_NoUnkeyedLiteral struct{}          `json:"-"`
+        XXX_unrecognized     []byte            `json:"-"`
+        XXX_sizecache        int32             `json:"-"`
+}
+
+func (m *RawState) Reset()         { *m = RawState{} }
+func (m *RawState) String() string { return proto.CompactTextString(m) }
+func (*RawState) ProtoMessage()    {}
+func (*RawState) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{4}
+}
+func (m *RawState) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_RawState.Unmarshal(m, b)
+}
+func (m *RawState) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_RawState.Marshal(b, m, deterministic)
+}
+func (dst *RawState) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_RawState.Merge(dst, src)
+}
+func (m *RawState) XXX_Size() int {
+        return xxx_messageInfo_RawState.Size(m)
+}
+func (m *RawState) XXX_DiscardUnknown() {
+        xxx_messageInfo_RawState.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_RawState proto.InternalMessageInfo
+
+func (m *RawState) GetJson() []byte {
+        if m != nil {
+                return m.Json
+        }
+        return nil
+}
+
+func (m *RawState) GetFlatmap() map[string]string {
+        if m != nil {
+                return m.Flatmap
+        }
+        return nil
+}
+
+// Schema is the configuration schema for a Resource, Provider, or Provisioner.
+type Schema struct {
+        // The version of the schema.
+        // Schemas are versioned, so that providers can upgrade a saved resource
+        // state when the schema is changed.
+        Version int64 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
+        // Block is the top level configuration block for this schema.
+        Block                *Schema_Block `protobuf:"bytes,2,opt,name=block,proto3" json:"block,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *Schema) Reset()         { *m = Schema{} }
+func (m *Schema) String() string { return proto.CompactTextString(m) }
+func (*Schema) ProtoMessage()    {}
+func (*Schema) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{5}
+}
+func (m *Schema) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Schema.Unmarshal(m, b)
+}
+func (m *Schema) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Schema.Marshal(b, m, deterministic)
+}
+func (dst *Schema) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Schema.Merge(dst, src)
+}
+func (m *Schema) XXX_Size() int {
+        return xxx_messageInfo_Schema.Size(m)
+}
+func (m *Schema) XXX_DiscardUnknown() {
+        xxx_messageInfo_Schema.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Schema proto.InternalMessageInfo
+
+func (m *Schema) GetVersion() int64 {
+        if m != nil {
+                return m.Version
+        }
+        return 0
+}
+
+func (m *Schema) GetBlock() *Schema_Block {
+        if m != nil {
+                return m.Block
+        }
+        return nil
+}
+
+type Schema_Block struct {
+        Version              int64                 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
+        Attributes           []*Schema_Attribute   `protobuf:"bytes,2,rep,name=attributes,proto3" json:"attributes,omitempty"`
+        BlockTypes           []*Schema_NestedBlock `protobuf:"bytes,3,rep,name=block_types,json=blockTypes,proto3" json:"block_types,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}              `json:"-"`
+        XXX_unrecognized     []byte                `json:"-"`
+        XXX_sizecache        int32                 `json:"-"`
+}
+
+func (m *Schema_Block) Reset()         { *m = Schema_Block{} }
+func (m *Schema_Block) String() string { return proto.CompactTextString(m) }
+func (*Schema_Block) ProtoMessage()    {}
+func (*Schema_Block) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{5, 0}
+}
+func (m *Schema_Block) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Schema_Block.Unmarshal(m, b)
+}
+func (m *Schema_Block) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Schema_Block.Marshal(b, m, deterministic)
+}
+func (dst *Schema_Block) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Schema_Block.Merge(dst, src)
+}
+func (m *Schema_Block) XXX_Size() int {
+        return xxx_messageInfo_Schema_Block.Size(m)
+}
+func (m *Schema_Block) XXX_DiscardUnknown() {
+        xxx_messageInfo_Schema_Block.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Schema_Block proto.InternalMessageInfo
+
+func (m *Schema_Block) GetVersion() int64 {
+        if m != nil {
+                return m.Version
+        }
+        return 0
+}
+
+func (m *Schema_Block) GetAttributes() []*Schema_Attribute {
+        if m != nil {
+                return m.Attributes
+        }
+        return nil
+}
+
+func (m *Schema_Block) GetBlockTypes() []*Schema_NestedBlock {
+        if m != nil {
+                return m.BlockTypes
+        }
+        return nil
+}
+
+type Schema_Attribute struct {
+        Name                 string   `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+        Type                 []byte   `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"`
+        Description          string   `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
+        Required             bool     `protobuf:"varint,4,opt,name=required,proto3" json:"required,omitempty"`
+        Optional             bool     `protobuf:"varint,5,opt,name=optional,proto3" json:"optional,omitempty"`
+        Computed             bool     `protobuf:"varint,6,opt,name=computed,proto3" json:"computed,omitempty"`
+        Sensitive            bool     `protobuf:"varint,7,opt,name=sensitive,proto3" json:"sensitive,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Schema_Attribute) Reset()         { *m = Schema_Attribute{} }
+func (m *Schema_Attribute) String() string { return proto.CompactTextString(m) }
+func (*Schema_Attribute) ProtoMessage()    {}
+func (*Schema_Attribute) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{5, 1}
+}
+func (m *Schema_Attribute) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Schema_Attribute.Unmarshal(m, b)
+}
+func (m *Schema_Attribute) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Schema_Attribute.Marshal(b, m, deterministic)
+}
+func (dst *Schema_Attribute) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Schema_Attribute.Merge(dst, src)
+}
+func (m *Schema_Attribute) XXX_Size() int {
+        return xxx_messageInfo_Schema_Attribute.Size(m)
+}
+func (m *Schema_Attribute) XXX_DiscardUnknown() {
+        xxx_messageInfo_Schema_Attribute.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Schema_Attribute proto.InternalMessageInfo
+
+func (m *Schema_Attribute) GetName() string {
+        if m != nil {
+                return m.Name
+        }
+        return ""
+}
+
+func (m *Schema_Attribute) GetType() []byte {
+        if m != nil {
+                return m.Type
+        }
+        return nil
+}
+
+func (m *Schema_Attribute) GetDescription() string {
+        if m != nil {
+                return m.Description
+        }
+        return ""
+}
+
+func (m *Schema_Attribute) GetRequired() bool {
+        if m != nil {
+                return m.Required
+        }
+        return false
+}
+
+func (m *Schema_Attribute) GetOptional() bool {
+        if m != nil {
+                return m.Optional
+        }
+        return false
+}
+
+func (m *Schema_Attribute) GetComputed() bool {
+        if m != nil {
+                return m.Computed
+        }
+        return false
+}
+
+func (m *Schema_Attribute) GetSensitive() bool {
+        if m != nil {
+                return m.Sensitive
+        }
+        return false
+}
+
+type Schema_NestedBlock struct {
+        TypeName             string                         `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        Block                *Schema_Block                  `protobuf:"bytes,2,opt,name=block,proto3" json:"block,omitempty"`
+        Nesting              Schema_NestedBlock_NestingMode `protobuf:"varint,3,opt,name=nesting,proto3,enum=tfplugin5.Schema_NestedBlock_NestingMode" json:"nesting,omitempty"`
+        MinItems             int64                          `protobuf:"varint,4,opt,name=min_items,json=minItems,proto3" json:"min_items,omitempty"`
+        MaxItems             int64                          `protobuf:"varint,5,opt,name=max_items,json=maxItems,proto3" json:"max_items,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}                       `json:"-"`
+        XXX_unrecognized     []byte                         `json:"-"`
+        XXX_sizecache        int32                          `json:"-"`
+}
+
+func (m *Schema_NestedBlock) Reset()         { *m = Schema_NestedBlock{} }
+func (m *Schema_NestedBlock) String() string { return proto.CompactTextString(m) }
+func (*Schema_NestedBlock) ProtoMessage()    {}
+func (*Schema_NestedBlock) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{5, 2}
+}
+func (m *Schema_NestedBlock) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Schema_NestedBlock.Unmarshal(m, b)
+}
+func (m *Schema_NestedBlock) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Schema_NestedBlock.Marshal(b, m, deterministic)
+}
+func (dst *Schema_NestedBlock) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Schema_NestedBlock.Merge(dst, src)
+}
+func (m *Schema_NestedBlock) XXX_Size() int {
+        return xxx_messageInfo_Schema_NestedBlock.Size(m)
+}
+func (m *Schema_NestedBlock) XXX_DiscardUnknown() {
+        xxx_messageInfo_Schema_NestedBlock.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Schema_NestedBlock proto.InternalMessageInfo
+
+func (m *Schema_NestedBlock) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *Schema_NestedBlock) GetBlock() *Schema_Block {
+        if m != nil {
+                return m.Block
+        }
+        return nil
+}
+
+func (m *Schema_NestedBlock) GetNesting() Schema_NestedBlock_NestingMode {
+        if m != nil {
+                return m.Nesting
+        }
+        return Schema_NestedBlock_INVALID
+}
+
+func (m *Schema_NestedBlock) GetMinItems() int64 {
+        if m != nil {
+                return m.MinItems
+        }
+        return 0
+}
+
+func (m *Schema_NestedBlock) GetMaxItems() int64 {
+        if m != nil {
+                return m.MaxItems
+        }
+        return 0
+}
+
+type GetProviderSchema struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *GetProviderSchema) Reset()         { *m = GetProviderSchema{} }
+func (m *GetProviderSchema) String() string { return proto.CompactTextString(m) }
+func (*GetProviderSchema) ProtoMessage()    {}
+func (*GetProviderSchema) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{6}
+}
+func (m *GetProviderSchema) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_GetProviderSchema.Unmarshal(m, b)
+}
+func (m *GetProviderSchema) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_GetProviderSchema.Marshal(b, m, deterministic)
+}
+func (dst *GetProviderSchema) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_GetProviderSchema.Merge(dst, src)
+}
+func (m *GetProviderSchema) XXX_Size() int {
+        return xxx_messageInfo_GetProviderSchema.Size(m)
+}
+func (m *GetProviderSchema) XXX_DiscardUnknown() {
+        xxx_messageInfo_GetProviderSchema.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GetProviderSchema proto.InternalMessageInfo
+
+type GetProviderSchema_Request struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *GetProviderSchema_Request) Reset()         { *m = GetProviderSchema_Request{} }
+func (m *GetProviderSchema_Request) String() string { return proto.CompactTextString(m) }
+func (*GetProviderSchema_Request) ProtoMessage()    {}
+func (*GetProviderSchema_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{6, 0}
+}
+func (m *GetProviderSchema_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_GetProviderSchema_Request.Unmarshal(m, b)
+}
+func (m *GetProviderSchema_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_GetProviderSchema_Request.Marshal(b, m, deterministic)
+}
+func (dst *GetProviderSchema_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_GetProviderSchema_Request.Merge(dst, src)
+}
+func (m *GetProviderSchema_Request) XXX_Size() int {
+        return xxx_messageInfo_GetProviderSchema_Request.Size(m)
+}
+func (m *GetProviderSchema_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_GetProviderSchema_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GetProviderSchema_Request proto.InternalMessageInfo
+
+type GetProviderSchema_Response struct {
+        Provider             *Schema            `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
+        ResourceSchemas      map[string]*Schema `protobuf:"bytes,2,rep,name=resource_schemas,json=resourceSchemas,proto3" json:"resource_schemas,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+        DataSourceSchemas    map[string]*Schema `protobuf:"bytes,3,rep,name=data_source_schemas,json=dataSourceSchemas,proto3" json:"data_source_schemas,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+        Diagnostics          []*Diagnostic      `protobuf:"bytes,4,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}           `json:"-"`
+        XXX_unrecognized     []byte             `json:"-"`
+        XXX_sizecache        int32              `json:"-"`
+}
+
+func (m *GetProviderSchema_Response) Reset()         { *m = GetProviderSchema_Response{} }
+func (m *GetProviderSchema_Response) String() string { return proto.CompactTextString(m) }
+func (*GetProviderSchema_Response) ProtoMessage()    {}
+func (*GetProviderSchema_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{6, 1}
+}
+func (m *GetProviderSchema_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_GetProviderSchema_Response.Unmarshal(m, b)
+}
+func (m *GetProviderSchema_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_GetProviderSchema_Response.Marshal(b, m, deterministic)
+}
+func (dst *GetProviderSchema_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_GetProviderSchema_Response.Merge(dst, src)
+}
+func (m *GetProviderSchema_Response) XXX_Size() int {
+        return xxx_messageInfo_GetProviderSchema_Response.Size(m)
+}
+func (m *GetProviderSchema_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_GetProviderSchema_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GetProviderSchema_Response proto.InternalMessageInfo
+
+func (m *GetProviderSchema_Response) GetProvider() *Schema {
+        if m != nil {
+                return m.Provider
+        }
+        return nil
+}
+
+func (m *GetProviderSchema_Response) GetResourceSchemas() map[string]*Schema {
+        if m != nil {
+                return m.ResourceSchemas
+        }
+        return nil
+}
+
+func (m *GetProviderSchema_Response) GetDataSourceSchemas() map[string]*Schema {
+        if m != nil {
+                return m.DataSourceSchemas
+        }
+        return nil
+}
+
+func (m *GetProviderSchema_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type PrepareProviderConfig struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *PrepareProviderConfig) Reset()         { *m = PrepareProviderConfig{} }
+func (m *PrepareProviderConfig) String() string { return proto.CompactTextString(m) }
+func (*PrepareProviderConfig) ProtoMessage()    {}
+func (*PrepareProviderConfig) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{7}
+}
+func (m *PrepareProviderConfig) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_PrepareProviderConfig.Unmarshal(m, b)
+}
+func (m *PrepareProviderConfig) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_PrepareProviderConfig.Marshal(b, m, deterministic)
+}
+func (dst *PrepareProviderConfig) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_PrepareProviderConfig.Merge(dst, src)
+}
+func (m *PrepareProviderConfig) XXX_Size() int {
+        return xxx_messageInfo_PrepareProviderConfig.Size(m)
+}
+func (m *PrepareProviderConfig) XXX_DiscardUnknown() {
+        xxx_messageInfo_PrepareProviderConfig.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PrepareProviderConfig proto.InternalMessageInfo
+
+type PrepareProviderConfig_Request struct {
+        Config               *DynamicValue `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *PrepareProviderConfig_Request) Reset()         { *m = PrepareProviderConfig_Request{} }
+func (m *PrepareProviderConfig_Request) String() string { return proto.CompactTextString(m) }
+func (*PrepareProviderConfig_Request) ProtoMessage()    {}
+func (*PrepareProviderConfig_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{7, 0}
+}
+func (m *PrepareProviderConfig_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_PrepareProviderConfig_Request.Unmarshal(m, b)
+}
+func (m *PrepareProviderConfig_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_PrepareProviderConfig_Request.Marshal(b, m, deterministic)
+}
+func (dst *PrepareProviderConfig_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_PrepareProviderConfig_Request.Merge(dst, src)
+}
+func (m *PrepareProviderConfig_Request) XXX_Size() int {
+        return xxx_messageInfo_PrepareProviderConfig_Request.Size(m)
+}
+func (m *PrepareProviderConfig_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_PrepareProviderConfig_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PrepareProviderConfig_Request proto.InternalMessageInfo
+
+func (m *PrepareProviderConfig_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+type PrepareProviderConfig_Response struct {
+        PreparedConfig       *DynamicValue `protobuf:"bytes,1,opt,name=prepared_config,json=preparedConfig,proto3" json:"prepared_config,omitempty"`
+        Diagnostics          []*Diagnostic `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *PrepareProviderConfig_Response) Reset()         { *m = PrepareProviderConfig_Response{} }
+func (m *PrepareProviderConfig_Response) String() string { return proto.CompactTextString(m) }
+func (*PrepareProviderConfig_Response) ProtoMessage()    {}
+func (*PrepareProviderConfig_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{7, 1}
+}
+func (m *PrepareProviderConfig_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_PrepareProviderConfig_Response.Unmarshal(m, b)
+}
+func (m *PrepareProviderConfig_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_PrepareProviderConfig_Response.Marshal(b, m, deterministic)
+}
+func (dst *PrepareProviderConfig_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_PrepareProviderConfig_Response.Merge(dst, src)
+}
+func (m *PrepareProviderConfig_Response) XXX_Size() int {
+        return xxx_messageInfo_PrepareProviderConfig_Response.Size(m)
+}
+func (m *PrepareProviderConfig_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_PrepareProviderConfig_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PrepareProviderConfig_Response proto.InternalMessageInfo
+
+func (m *PrepareProviderConfig_Response) GetPreparedConfig() *DynamicValue {
+        if m != nil {
+                return m.PreparedConfig
+        }
+        return nil
+}
+
+func (m *PrepareProviderConfig_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type UpgradeResourceState struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *UpgradeResourceState) Reset()         { *m = UpgradeResourceState{} }
+func (m *UpgradeResourceState) String() string { return proto.CompactTextString(m) }
+func (*UpgradeResourceState) ProtoMessage()    {}
+func (*UpgradeResourceState) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{8}
+}
+func (m *UpgradeResourceState) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_UpgradeResourceState.Unmarshal(m, b)
+}
+func (m *UpgradeResourceState) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_UpgradeResourceState.Marshal(b, m, deterministic)
+}
+func (dst *UpgradeResourceState) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_UpgradeResourceState.Merge(dst, src)
+}
+func (m *UpgradeResourceState) XXX_Size() int {
+        return xxx_messageInfo_UpgradeResourceState.Size(m)
+}
+func (m *UpgradeResourceState) XXX_DiscardUnknown() {
+        xxx_messageInfo_UpgradeResourceState.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_UpgradeResourceState proto.InternalMessageInfo
+
+type UpgradeResourceState_Request struct {
+        TypeName string `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        // version is the schema_version number recorded in the state file
+        Version int64 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
+        // raw_state is the raw states as stored for the resource.  Core does
+        // not have access to the schema of prior_version, so it's the
+        // provider's responsibility to interpret this value using the
+        // appropriate older schema. The raw_state will be the json encoded
+        // state, or a legacy flat-mapped format.
+        RawState             *RawState `protobuf:"bytes,3,opt,name=raw_state,json=rawState,proto3" json:"raw_state,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}  `json:"-"`
+        XXX_unrecognized     []byte    `json:"-"`
+        XXX_sizecache        int32     `json:"-"`
+}
+
+func (m *UpgradeResourceState_Request) Reset()         { *m = UpgradeResourceState_Request{} }
+func (m *UpgradeResourceState_Request) String() string { return proto.CompactTextString(m) }
+func (*UpgradeResourceState_Request) ProtoMessage()    {}
+func (*UpgradeResourceState_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{8, 0}
+}
+func (m *UpgradeResourceState_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_UpgradeResourceState_Request.Unmarshal(m, b)
+}
+func (m *UpgradeResourceState_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_UpgradeResourceState_Request.Marshal(b, m, deterministic)
+}
+func (dst *UpgradeResourceState_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_UpgradeResourceState_Request.Merge(dst, src)
+}
+func (m *UpgradeResourceState_Request) XXX_Size() int {
+        return xxx_messageInfo_UpgradeResourceState_Request.Size(m)
+}
+func (m *UpgradeResourceState_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_UpgradeResourceState_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_UpgradeResourceState_Request proto.InternalMessageInfo
+
+func (m *UpgradeResourceState_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *UpgradeResourceState_Request) GetVersion() int64 {
+        if m != nil {
+                return m.Version
+        }
+        return 0
+}
+
+func (m *UpgradeResourceState_Request) GetRawState() *RawState {
+        if m != nil {
+                return m.RawState
+        }
+        return nil
+}
+
+type UpgradeResourceState_Response struct {
+        // new_state is a msgpack-encoded data structure that, when interpreted with
+        // the _current_ schema for this resource type, is functionally equivalent to
+        // that which was given in prior_state_raw.
+        UpgradedState *DynamicValue `protobuf:"bytes,1,opt,name=upgraded_state,json=upgradedState,proto3" json:"upgraded_state,omitempty"`
+        // diagnostics describes any errors encountered during migration that could not
+        // be safely resolved, and warnings about any possibly-risky assumptions made
+        // in the upgrade process.
+        Diagnostics          []*Diagnostic `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *UpgradeResourceState_Response) Reset()         { *m = UpgradeResourceState_Response{} }
+func (m *UpgradeResourceState_Response) String() string { return proto.CompactTextString(m) }
+func (*UpgradeResourceState_Response) ProtoMessage()    {}
+func (*UpgradeResourceState_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{8, 1}
+}
+func (m *UpgradeResourceState_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_UpgradeResourceState_Response.Unmarshal(m, b)
+}
+func (m *UpgradeResourceState_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_UpgradeResourceState_Response.Marshal(b, m, deterministic)
+}
+func (dst *UpgradeResourceState_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_UpgradeResourceState_Response.Merge(dst, src)
+}
+func (m *UpgradeResourceState_Response) XXX_Size() int {
+        return xxx_messageInfo_UpgradeResourceState_Response.Size(m)
+}
+func (m *UpgradeResourceState_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_UpgradeResourceState_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_UpgradeResourceState_Response proto.InternalMessageInfo
+
+func (m *UpgradeResourceState_Response) GetUpgradedState() *DynamicValue {
+        if m != nil {
+                return m.UpgradedState
+        }
+        return nil
+}
+
+func (m *UpgradeResourceState_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type ValidateResourceTypeConfig struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ValidateResourceTypeConfig) Reset()         { *m = ValidateResourceTypeConfig{} }
+func (m *ValidateResourceTypeConfig) String() string { return proto.CompactTextString(m) }
+func (*ValidateResourceTypeConfig) ProtoMessage()    {}
+func (*ValidateResourceTypeConfig) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{9}
+}
+func (m *ValidateResourceTypeConfig) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateResourceTypeConfig.Unmarshal(m, b)
+}
+func (m *ValidateResourceTypeConfig) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateResourceTypeConfig.Marshal(b, m, deterministic)
+}
+func (dst *ValidateResourceTypeConfig) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateResourceTypeConfig.Merge(dst, src)
+}
+func (m *ValidateResourceTypeConfig) XXX_Size() int {
+        return xxx_messageInfo_ValidateResourceTypeConfig.Size(m)
+}
+func (m *ValidateResourceTypeConfig) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateResourceTypeConfig.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateResourceTypeConfig proto.InternalMessageInfo
+
+type ValidateResourceTypeConfig_Request struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        Config               *DynamicValue `protobuf:"bytes,2,opt,name=config,proto3" json:"config,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ValidateResourceTypeConfig_Request) Reset()         { *m = ValidateResourceTypeConfig_Request{} }
+func (m *ValidateResourceTypeConfig_Request) String() string { return proto.CompactTextString(m) }
+func (*ValidateResourceTypeConfig_Request) ProtoMessage()    {}
+func (*ValidateResourceTypeConfig_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{9, 0}
+}
+func (m *ValidateResourceTypeConfig_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateResourceTypeConfig_Request.Unmarshal(m, b)
+}
+func (m *ValidateResourceTypeConfig_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateResourceTypeConfig_Request.Marshal(b, m, deterministic)
+}
+func (dst *ValidateResourceTypeConfig_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateResourceTypeConfig_Request.Merge(dst, src)
+}
+func (m *ValidateResourceTypeConfig_Request) XXX_Size() int {
+        return xxx_messageInfo_ValidateResourceTypeConfig_Request.Size(m)
+}
+func (m *ValidateResourceTypeConfig_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateResourceTypeConfig_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateResourceTypeConfig_Request proto.InternalMessageInfo
+
+func (m *ValidateResourceTypeConfig_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ValidateResourceTypeConfig_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+type ValidateResourceTypeConfig_Response struct {
+        Diagnostics          []*Diagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ValidateResourceTypeConfig_Response) Reset()         { *m = ValidateResourceTypeConfig_Response{} }
+func (m *ValidateResourceTypeConfig_Response) String() string { return proto.CompactTextString(m) }
+func (*ValidateResourceTypeConfig_Response) ProtoMessage()    {}
+func (*ValidateResourceTypeConfig_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{9, 1}
+}
+func (m *ValidateResourceTypeConfig_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateResourceTypeConfig_Response.Unmarshal(m, b)
+}
+func (m *ValidateResourceTypeConfig_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateResourceTypeConfig_Response.Marshal(b, m, deterministic)
+}
+func (dst *ValidateResourceTypeConfig_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateResourceTypeConfig_Response.Merge(dst, src)
+}
+func (m *ValidateResourceTypeConfig_Response) XXX_Size() int {
+        return xxx_messageInfo_ValidateResourceTypeConfig_Response.Size(m)
+}
+func (m *ValidateResourceTypeConfig_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateResourceTypeConfig_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateResourceTypeConfig_Response proto.InternalMessageInfo
+
+func (m *ValidateResourceTypeConfig_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type ValidateDataSourceConfig struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ValidateDataSourceConfig) Reset()         { *m = ValidateDataSourceConfig{} }
+func (m *ValidateDataSourceConfig) String() string { return proto.CompactTextString(m) }
+func (*ValidateDataSourceConfig) ProtoMessage()    {}
+func (*ValidateDataSourceConfig) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{10}
+}
+func (m *ValidateDataSourceConfig) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateDataSourceConfig.Unmarshal(m, b)
+}
+func (m *ValidateDataSourceConfig) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateDataSourceConfig.Marshal(b, m, deterministic)
+}
+func (dst *ValidateDataSourceConfig) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateDataSourceConfig.Merge(dst, src)
+}
+func (m *ValidateDataSourceConfig) XXX_Size() int {
+        return xxx_messageInfo_ValidateDataSourceConfig.Size(m)
+}
+func (m *ValidateDataSourceConfig) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateDataSourceConfig.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateDataSourceConfig proto.InternalMessageInfo
+
+type ValidateDataSourceConfig_Request struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        Config               *DynamicValue `protobuf:"bytes,2,opt,name=config,proto3" json:"config,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ValidateDataSourceConfig_Request) Reset()         { *m = ValidateDataSourceConfig_Request{} }
+func (m *ValidateDataSourceConfig_Request) String() string { return proto.CompactTextString(m) }
+func (*ValidateDataSourceConfig_Request) ProtoMessage()    {}
+func (*ValidateDataSourceConfig_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{10, 0}
+}
+func (m *ValidateDataSourceConfig_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateDataSourceConfig_Request.Unmarshal(m, b)
+}
+func (m *ValidateDataSourceConfig_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateDataSourceConfig_Request.Marshal(b, m, deterministic)
+}
+func (dst *ValidateDataSourceConfig_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateDataSourceConfig_Request.Merge(dst, src)
+}
+func (m *ValidateDataSourceConfig_Request) XXX_Size() int {
+        return xxx_messageInfo_ValidateDataSourceConfig_Request.Size(m)
+}
+func (m *ValidateDataSourceConfig_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateDataSourceConfig_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateDataSourceConfig_Request proto.InternalMessageInfo
+
+func (m *ValidateDataSourceConfig_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ValidateDataSourceConfig_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+type ValidateDataSourceConfig_Response struct {
+        Diagnostics          []*Diagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ValidateDataSourceConfig_Response) Reset()         { *m = ValidateDataSourceConfig_Response{} }
+func (m *ValidateDataSourceConfig_Response) String() string { return proto.CompactTextString(m) }
+func (*ValidateDataSourceConfig_Response) ProtoMessage()    {}
+func (*ValidateDataSourceConfig_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{10, 1}
+}
+func (m *ValidateDataSourceConfig_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateDataSourceConfig_Response.Unmarshal(m, b)
+}
+func (m *ValidateDataSourceConfig_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateDataSourceConfig_Response.Marshal(b, m, deterministic)
+}
+func (dst *ValidateDataSourceConfig_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateDataSourceConfig_Response.Merge(dst, src)
+}
+func (m *ValidateDataSourceConfig_Response) XXX_Size() int {
+        return xxx_messageInfo_ValidateDataSourceConfig_Response.Size(m)
+}
+func (m *ValidateDataSourceConfig_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateDataSourceConfig_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateDataSourceConfig_Response proto.InternalMessageInfo
+
+func (m *ValidateDataSourceConfig_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type Configure struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Configure) Reset()         { *m = Configure{} }
+func (m *Configure) String() string { return proto.CompactTextString(m) }
+func (*Configure) ProtoMessage()    {}
+func (*Configure) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{11}
+}
+func (m *Configure) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Configure.Unmarshal(m, b)
+}
+func (m *Configure) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Configure.Marshal(b, m, deterministic)
+}
+func (dst *Configure) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Configure.Merge(dst, src)
+}
+func (m *Configure) XXX_Size() int {
+        return xxx_messageInfo_Configure.Size(m)
+}
+func (m *Configure) XXX_DiscardUnknown() {
+        xxx_messageInfo_Configure.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Configure proto.InternalMessageInfo
+
+type Configure_Request struct {
+        TerraformVersion     string        `protobuf:"bytes,1,opt,name=terraform_version,json=terraformVersion,proto3" json:"terraform_version,omitempty"`
+        Config               *DynamicValue `protobuf:"bytes,2,opt,name=config,proto3" json:"config,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *Configure_Request) Reset()         { *m = Configure_Request{} }
+func (m *Configure_Request) String() string { return proto.CompactTextString(m) }
+func (*Configure_Request) ProtoMessage()    {}
+func (*Configure_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{11, 0}
+}
+func (m *Configure_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Configure_Request.Unmarshal(m, b)
+}
+func (m *Configure_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Configure_Request.Marshal(b, m, deterministic)
+}
+func (dst *Configure_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Configure_Request.Merge(dst, src)
+}
+func (m *Configure_Request) XXX_Size() int {
+        return xxx_messageInfo_Configure_Request.Size(m)
+}
+func (m *Configure_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_Configure_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Configure_Request proto.InternalMessageInfo
+
+func (m *Configure_Request) GetTerraformVersion() string {
+        if m != nil {
+                return m.TerraformVersion
+        }
+        return ""
+}
+
+func (m *Configure_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+type Configure_Response struct {
+        Diagnostics          []*Diagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *Configure_Response) Reset()         { *m = Configure_Response{} }
+func (m *Configure_Response) String() string { return proto.CompactTextString(m) }
+func (*Configure_Response) ProtoMessage()    {}
+func (*Configure_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{11, 1}
+}
+func (m *Configure_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Configure_Response.Unmarshal(m, b)
+}
+func (m *Configure_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Configure_Response.Marshal(b, m, deterministic)
+}
+func (dst *Configure_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Configure_Response.Merge(dst, src)
+}
+func (m *Configure_Response) XXX_Size() int {
+        return xxx_messageInfo_Configure_Response.Size(m)
+}
+func (m *Configure_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_Configure_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Configure_Response proto.InternalMessageInfo
+
+func (m *Configure_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type ReadResource struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ReadResource) Reset()         { *m = ReadResource{} }
+func (m *ReadResource) String() string { return proto.CompactTextString(m) }
+func (*ReadResource) ProtoMessage()    {}
+func (*ReadResource) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{12}
+}
+func (m *ReadResource) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ReadResource.Unmarshal(m, b)
+}
+func (m *ReadResource) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ReadResource.Marshal(b, m, deterministic)
+}
+func (dst *ReadResource) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ReadResource.Merge(dst, src)
+}
+func (m *ReadResource) XXX_Size() int {
+        return xxx_messageInfo_ReadResource.Size(m)
+}
+func (m *ReadResource) XXX_DiscardUnknown() {
+        xxx_messageInfo_ReadResource.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ReadResource proto.InternalMessageInfo
+
+type ReadResource_Request struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        CurrentState         *DynamicValue `protobuf:"bytes,2,opt,name=current_state,json=currentState,proto3" json:"current_state,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ReadResource_Request) Reset()         { *m = ReadResource_Request{} }
+func (m *ReadResource_Request) String() string { return proto.CompactTextString(m) }
+func (*ReadResource_Request) ProtoMessage()    {}
+func (*ReadResource_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{12, 0}
+}
+func (m *ReadResource_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ReadResource_Request.Unmarshal(m, b)
+}
+func (m *ReadResource_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ReadResource_Request.Marshal(b, m, deterministic)
+}
+func (dst *ReadResource_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ReadResource_Request.Merge(dst, src)
+}
+func (m *ReadResource_Request) XXX_Size() int {
+        return xxx_messageInfo_ReadResource_Request.Size(m)
+}
+func (m *ReadResource_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ReadResource_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ReadResource_Request proto.InternalMessageInfo
+
+func (m *ReadResource_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ReadResource_Request) GetCurrentState() *DynamicValue {
+        if m != nil {
+                return m.CurrentState
+        }
+        return nil
+}
+
+type ReadResource_Response struct {
+        NewState             *DynamicValue `protobuf:"bytes,1,opt,name=new_state,json=newState,proto3" json:"new_state,omitempty"`
+        Diagnostics          []*Diagnostic `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ReadResource_Response) Reset()         { *m = ReadResource_Response{} }
+func (m *ReadResource_Response) String() string { return proto.CompactTextString(m) }
+func (*ReadResource_Response) ProtoMessage()    {}
+func (*ReadResource_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{12, 1}
+}
+func (m *ReadResource_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ReadResource_Response.Unmarshal(m, b)
+}
+func (m *ReadResource_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ReadResource_Response.Marshal(b, m, deterministic)
+}
+func (dst *ReadResource_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ReadResource_Response.Merge(dst, src)
+}
+func (m *ReadResource_Response) XXX_Size() int {
+        return xxx_messageInfo_ReadResource_Response.Size(m)
+}
+func (m *ReadResource_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ReadResource_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ReadResource_Response proto.InternalMessageInfo
+
+func (m *ReadResource_Response) GetNewState() *DynamicValue {
+        if m != nil {
+                return m.NewState
+        }
+        return nil
+}
+
+func (m *ReadResource_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type PlanResourceChange struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *PlanResourceChange) Reset()         { *m = PlanResourceChange{} }
+func (m *PlanResourceChange) String() string { return proto.CompactTextString(m) }
+func (*PlanResourceChange) ProtoMessage()    {}
+func (*PlanResourceChange) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{13}
+}
+func (m *PlanResourceChange) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_PlanResourceChange.Unmarshal(m, b)
+}
+func (m *PlanResourceChange) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_PlanResourceChange.Marshal(b, m, deterministic)
+}
+func (dst *PlanResourceChange) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_PlanResourceChange.Merge(dst, src)
+}
+func (m *PlanResourceChange) XXX_Size() int {
+        return xxx_messageInfo_PlanResourceChange.Size(m)
+}
+func (m *PlanResourceChange) XXX_DiscardUnknown() {
+        xxx_messageInfo_PlanResourceChange.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PlanResourceChange proto.InternalMessageInfo
+
+type PlanResourceChange_Request struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        PriorState           *DynamicValue `protobuf:"bytes,2,opt,name=prior_state,json=priorState,proto3" json:"prior_state,omitempty"`
+        ProposedNewState     *DynamicValue `protobuf:"bytes,3,opt,name=proposed_new_state,json=proposedNewState,proto3" json:"proposed_new_state,omitempty"`
+        Config               *DynamicValue `protobuf:"bytes,4,opt,name=config,proto3" json:"config,omitempty"`
+        PriorPrivate         []byte        `protobuf:"bytes,5,opt,name=prior_private,json=priorPrivate,proto3" json:"prior_private,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *PlanResourceChange_Request) Reset()         { *m = PlanResourceChange_Request{} }
+func (m *PlanResourceChange_Request) String() string { return proto.CompactTextString(m) }
+func (*PlanResourceChange_Request) ProtoMessage()    {}
+func (*PlanResourceChange_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{13, 0}
+}
+func (m *PlanResourceChange_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_PlanResourceChange_Request.Unmarshal(m, b)
+}
+func (m *PlanResourceChange_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_PlanResourceChange_Request.Marshal(b, m, deterministic)
+}
+func (dst *PlanResourceChange_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_PlanResourceChange_Request.Merge(dst, src)
+}
+func (m *PlanResourceChange_Request) XXX_Size() int {
+        return xxx_messageInfo_PlanResourceChange_Request.Size(m)
+}
+func (m *PlanResourceChange_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_PlanResourceChange_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PlanResourceChange_Request proto.InternalMessageInfo
+
+func (m *PlanResourceChange_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *PlanResourceChange_Request) GetPriorState() *DynamicValue {
+        if m != nil {
+                return m.PriorState
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Request) GetProposedNewState() *DynamicValue {
+        if m != nil {
+                return m.ProposedNewState
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Request) GetPriorPrivate() []byte {
+        if m != nil {
+                return m.PriorPrivate
+        }
+        return nil
+}
+
+type PlanResourceChange_Response struct {
+        PlannedState    *DynamicValue    `protobuf:"bytes,1,opt,name=planned_state,json=plannedState,proto3" json:"planned_state,omitempty"`
+        RequiresReplace []*AttributePath `protobuf:"bytes,2,rep,name=requires_replace,json=requiresReplace,proto3" json:"requires_replace,omitempty"`
+        PlannedPrivate  []byte           `protobuf:"bytes,3,opt,name=planned_private,json=plannedPrivate,proto3" json:"planned_private,omitempty"`
+        Diagnostics     []*Diagnostic    `protobuf:"bytes,4,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        // This may be set only by the helper/schema "SDK" in the main Terraform
+        // repository, to request that Terraform Core >=0.12 permit additional
+        // inconsistencies that can result from the legacy SDK type system
+        // and its imprecise mapping to the >=0.12 type system.
+        // The change in behavior implied by this flag makes sense only for the
+        // specific details of the legacy SDK type system, and are not a general
+        // mechanism to avoid proper type handling in providers.
+        //
+        //     ====              DO NOT USE THIS              ====
+        //     ==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
+        //     ====              DO NOT USE THIS              ====
+        LegacyTypeSystem     bool     `protobuf:"varint,5,opt,name=legacy_type_system,json=legacyTypeSystem,proto3" json:"legacy_type_system,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *PlanResourceChange_Response) Reset()         { *m = PlanResourceChange_Response{} }
+func (m *PlanResourceChange_Response) String() string { return proto.CompactTextString(m) }
+func (*PlanResourceChange_Response) ProtoMessage()    {}
+func (*PlanResourceChange_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{13, 1}
+}
+func (m *PlanResourceChange_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_PlanResourceChange_Response.Unmarshal(m, b)
+}
+func (m *PlanResourceChange_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_PlanResourceChange_Response.Marshal(b, m, deterministic)
+}
+func (dst *PlanResourceChange_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_PlanResourceChange_Response.Merge(dst, src)
+}
+func (m *PlanResourceChange_Response) XXX_Size() int {
+        return xxx_messageInfo_PlanResourceChange_Response.Size(m)
+}
+func (m *PlanResourceChange_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_PlanResourceChange_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PlanResourceChange_Response proto.InternalMessageInfo
+
+func (m *PlanResourceChange_Response) GetPlannedState() *DynamicValue {
+        if m != nil {
+                return m.PlannedState
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Response) GetRequiresReplace() []*AttributePath {
+        if m != nil {
+                return m.RequiresReplace
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Response) GetPlannedPrivate() []byte {
+        if m != nil {
+                return m.PlannedPrivate
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Response) GetLegacyTypeSystem() bool {
+        if m != nil {
+                return m.LegacyTypeSystem
+        }
+        return false
+}
+
+type ApplyResourceChange struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ApplyResourceChange) Reset()         { *m = ApplyResourceChange{} }
+func (m *ApplyResourceChange) String() string { return proto.CompactTextString(m) }
+func (*ApplyResourceChange) ProtoMessage()    {}
+func (*ApplyResourceChange) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{14}
+}
+func (m *ApplyResourceChange) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ApplyResourceChange.Unmarshal(m, b)
+}
+func (m *ApplyResourceChange) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ApplyResourceChange.Marshal(b, m, deterministic)
+}
+func (dst *ApplyResourceChange) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ApplyResourceChange.Merge(dst, src)
+}
+func (m *ApplyResourceChange) XXX_Size() int {
+        return xxx_messageInfo_ApplyResourceChange.Size(m)
+}
+func (m *ApplyResourceChange) XXX_DiscardUnknown() {
+        xxx_messageInfo_ApplyResourceChange.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ApplyResourceChange proto.InternalMessageInfo
+
+type ApplyResourceChange_Request struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        PriorState           *DynamicValue `protobuf:"bytes,2,opt,name=prior_state,json=priorState,proto3" json:"prior_state,omitempty"`
+        PlannedState         *DynamicValue `protobuf:"bytes,3,opt,name=planned_state,json=plannedState,proto3" json:"planned_state,omitempty"`
+        Config               *DynamicValue `protobuf:"bytes,4,opt,name=config,proto3" json:"config,omitempty"`
+        PlannedPrivate       []byte        `protobuf:"bytes,5,opt,name=planned_private,json=plannedPrivate,proto3" json:"planned_private,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ApplyResourceChange_Request) Reset()         { *m = ApplyResourceChange_Request{} }
+func (m *ApplyResourceChange_Request) String() string { return proto.CompactTextString(m) }
+func (*ApplyResourceChange_Request) ProtoMessage()    {}
+func (*ApplyResourceChange_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{14, 0}
+}
+func (m *ApplyResourceChange_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ApplyResourceChange_Request.Unmarshal(m, b)
+}
+func (m *ApplyResourceChange_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ApplyResourceChange_Request.Marshal(b, m, deterministic)
+}
+func (dst *ApplyResourceChange_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ApplyResourceChange_Request.Merge(dst, src)
+}
+func (m *ApplyResourceChange_Request) XXX_Size() int {
+        return xxx_messageInfo_ApplyResourceChange_Request.Size(m)
+}
+func (m *ApplyResourceChange_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ApplyResourceChange_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ApplyResourceChange_Request proto.InternalMessageInfo
+
+func (m *ApplyResourceChange_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ApplyResourceChange_Request) GetPriorState() *DynamicValue {
+        if m != nil {
+                return m.PriorState
+        }
+        return nil
+}
+
+func (m *ApplyResourceChange_Request) GetPlannedState() *DynamicValue {
+        if m != nil {
+                return m.PlannedState
+        }
+        return nil
+}
+
+func (m *ApplyResourceChange_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+func (m *ApplyResourceChange_Request) GetPlannedPrivate() []byte {
+        if m != nil {
+                return m.PlannedPrivate
+        }
+        return nil
+}
+
+type ApplyResourceChange_Response struct {
+        NewState    *DynamicValue `protobuf:"bytes,1,opt,name=new_state,json=newState,proto3" json:"new_state,omitempty"`
+        Private     []byte        `protobuf:"bytes,2,opt,name=private,proto3" json:"private,omitempty"`
+        Diagnostics []*Diagnostic `protobuf:"bytes,3,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        // This may be set only by the helper/schema "SDK" in the main Terraform
+        // repository, to request that Terraform Core >=0.12 permit additional
+        // inconsistencies that can result from the legacy SDK type system
+        // and its imprecise mapping to the >=0.12 type system.
+        // The change in behavior implied by this flag makes sense only for the
+        // specific details of the legacy SDK type system, and are not a general
+        // mechanism to avoid proper type handling in providers.
+        //
+        //     ====              DO NOT USE THIS              ====
+        //     ==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
+        //     ====              DO NOT USE THIS              ====
+        LegacyTypeSystem     bool     `protobuf:"varint,4,opt,name=legacy_type_system,json=legacyTypeSystem,proto3" json:"legacy_type_system,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ApplyResourceChange_Response) Reset()         { *m = ApplyResourceChange_Response{} }
+func (m *ApplyResourceChange_Response) String() string { return proto.CompactTextString(m) }
+func (*ApplyResourceChange_Response) ProtoMessage()    {}
+func (*ApplyResourceChange_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{14, 1}
+}
+func (m *ApplyResourceChange_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ApplyResourceChange_Response.Unmarshal(m, b)
+}
+func (m *ApplyResourceChange_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ApplyResourceChange_Response.Marshal(b, m, deterministic)
+}
+func (dst *ApplyResourceChange_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ApplyResourceChange_Response.Merge(dst, src)
+}
+func (m *ApplyResourceChange_Response) XXX_Size() int {
+        return xxx_messageInfo_ApplyResourceChange_Response.Size(m)
+}
+func (m *ApplyResourceChange_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ApplyResourceChange_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ApplyResourceChange_Response proto.InternalMessageInfo
+
+func (m *ApplyResourceChange_Response) GetNewState() *DynamicValue {
+        if m != nil {
+                return m.NewState
+        }
+        return nil
+}
+
+func (m *ApplyResourceChange_Response) GetPrivate() []byte {
+        if m != nil {
+                return m.Private
+        }
+        return nil
+}
+
+func (m *ApplyResourceChange_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+func (m *ApplyResourceChange_Response) GetLegacyTypeSystem() bool {
+        if m != nil {
+                return m.LegacyTypeSystem
+        }
+        return false
+}
+
+type ImportResourceState struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ImportResourceState) Reset()         { *m = ImportResourceState{} }
+func (m *ImportResourceState) String() string { return proto.CompactTextString(m) }
+func (*ImportResourceState) ProtoMessage()    {}
+func (*ImportResourceState) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{15}
+}
+func (m *ImportResourceState) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ImportResourceState.Unmarshal(m, b)
+}
+func (m *ImportResourceState) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ImportResourceState.Marshal(b, m, deterministic)
+}
+func (dst *ImportResourceState) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ImportResourceState.Merge(dst, src)
+}
+func (m *ImportResourceState) XXX_Size() int {
+        return xxx_messageInfo_ImportResourceState.Size(m)
+}
+func (m *ImportResourceState) XXX_DiscardUnknown() {
+        xxx_messageInfo_ImportResourceState.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ImportResourceState proto.InternalMessageInfo
+
+type ImportResourceState_Request struct {
+        TypeName             string   `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        Id                   string   `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ImportResourceState_Request) Reset()         { *m = ImportResourceState_Request{} }
+func (m *ImportResourceState_Request) String() string { return proto.CompactTextString(m) }
+func (*ImportResourceState_Request) ProtoMessage()    {}
+func (*ImportResourceState_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{15, 0}
+}
+func (m *ImportResourceState_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ImportResourceState_Request.Unmarshal(m, b)
+}
+func (m *ImportResourceState_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ImportResourceState_Request.Marshal(b, m, deterministic)
+}
+func (dst *ImportResourceState_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ImportResourceState_Request.Merge(dst, src)
+}
+func (m *ImportResourceState_Request) XXX_Size() int {
+        return xxx_messageInfo_ImportResourceState_Request.Size(m)
+}
+func (m *ImportResourceState_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ImportResourceState_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ImportResourceState_Request proto.InternalMessageInfo
+
+func (m *ImportResourceState_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ImportResourceState_Request) GetId() string {
+        if m != nil {
+                return m.Id
+        }
+        return ""
+}
+
+type ImportResourceState_ImportedResource struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        State                *DynamicValue `protobuf:"bytes,2,opt,name=state,proto3" json:"state,omitempty"`
+        Private              []byte        `protobuf:"bytes,3,opt,name=private,proto3" json:"private,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ImportResourceState_ImportedResource) Reset()         { *m = ImportResourceState_ImportedResource{} }
+func (m *ImportResourceState_ImportedResource) String() string { return proto.CompactTextString(m) }
+func (*ImportResourceState_ImportedResource) ProtoMessage()    {}
+func (*ImportResourceState_ImportedResource) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{15, 1}
+}
+func (m *ImportResourceState_ImportedResource) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ImportResourceState_ImportedResource.Unmarshal(m, b)
+}
+func (m *ImportResourceState_ImportedResource) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ImportResourceState_ImportedResource.Marshal(b, m, deterministic)
+}
+func (dst *ImportResourceState_ImportedResource) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ImportResourceState_ImportedResource.Merge(dst, src)
+}
+func (m *ImportResourceState_ImportedResource) XXX_Size() int {
+        return xxx_messageInfo_ImportResourceState_ImportedResource.Size(m)
+}
+func (m *ImportResourceState_ImportedResource) XXX_DiscardUnknown() {
+        xxx_messageInfo_ImportResourceState_ImportedResource.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ImportResourceState_ImportedResource proto.InternalMessageInfo
+
+func (m *ImportResourceState_ImportedResource) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ImportResourceState_ImportedResource) GetState() *DynamicValue {
+        if m != nil {
+                return m.State
+        }
+        return nil
+}
+
+func (m *ImportResourceState_ImportedResource) GetPrivate() []byte {
+        if m != nil {
+                return m.Private
+        }
+        return nil
+}
+
+type ImportResourceState_Response struct {
+        ImportedResources    []*ImportResourceState_ImportedResource `protobuf:"bytes,1,rep,name=imported_resources,json=importedResources,proto3" json:"imported_resources,omitempty"`
+        Diagnostics          []*Diagnostic                           `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}                                `json:"-"`
+        XXX_unrecognized     []byte                                  `json:"-"`
+        XXX_sizecache        int32                                   `json:"-"`
+}
+
+func (m *ImportResourceState_Response) Reset()         { *m = ImportResourceState_Response{} }
+func (m *ImportResourceState_Response) String() string { return proto.CompactTextString(m) }
+func (*ImportResourceState_Response) ProtoMessage()    {}
+func (*ImportResourceState_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{15, 2}
+}
+func (m *ImportResourceState_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ImportResourceState_Response.Unmarshal(m, b)
+}
+func (m *ImportResourceState_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ImportResourceState_Response.Marshal(b, m, deterministic)
+}
+func (dst *ImportResourceState_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ImportResourceState_Response.Merge(dst, src)
+}
+func (m *ImportResourceState_Response) XXX_Size() int {
+        return xxx_messageInfo_ImportResourceState_Response.Size(m)
+}
+func (m *ImportResourceState_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ImportResourceState_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ImportResourceState_Response proto.InternalMessageInfo
+
+func (m *ImportResourceState_Response) GetImportedResources() []*ImportResourceState_ImportedResource {
+        if m != nil {
+                return m.ImportedResources
+        }
+        return nil
+}
+
+func (m *ImportResourceState_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type ReadDataSource struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ReadDataSource) Reset()         { *m = ReadDataSource{} }
+func (m *ReadDataSource) String() string { return proto.CompactTextString(m) }
+func (*ReadDataSource) ProtoMessage()    {}
+func (*ReadDataSource) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{16}
+}
+func (m *ReadDataSource) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ReadDataSource.Unmarshal(m, b)
+}
+func (m *ReadDataSource) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ReadDataSource.Marshal(b, m, deterministic)
+}
+func (dst *ReadDataSource) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ReadDataSource.Merge(dst, src)
+}
+func (m *ReadDataSource) XXX_Size() int {
+        return xxx_messageInfo_ReadDataSource.Size(m)
+}
+func (m *ReadDataSource) XXX_DiscardUnknown() {
+        xxx_messageInfo_ReadDataSource.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ReadDataSource proto.InternalMessageInfo
+
+type ReadDataSource_Request struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        Config               *DynamicValue `protobuf:"bytes,2,opt,name=config,proto3" json:"config,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ReadDataSource_Request) Reset()         { *m = ReadDataSource_Request{} }
+func (m *ReadDataSource_Request) String() string { return proto.CompactTextString(m) }
+func (*ReadDataSource_Request) ProtoMessage()    {}
+func (*ReadDataSource_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{16, 0}
+}
+func (m *ReadDataSource_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ReadDataSource_Request.Unmarshal(m, b)
+}
+func (m *ReadDataSource_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ReadDataSource_Request.Marshal(b, m, deterministic)
+}
+func (dst *ReadDataSource_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ReadDataSource_Request.Merge(dst, src)
+}
+func (m *ReadDataSource_Request) XXX_Size() int {
+        return xxx_messageInfo_ReadDataSource_Request.Size(m)
+}
+func (m *ReadDataSource_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ReadDataSource_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ReadDataSource_Request proto.InternalMessageInfo
+
+func (m *ReadDataSource_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ReadDataSource_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+type ReadDataSource_Response struct {
+        State                *DynamicValue `protobuf:"bytes,1,opt,name=state,proto3" json:"state,omitempty"`
+        Diagnostics          []*Diagnostic `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ReadDataSource_Response) Reset()         { *m = ReadDataSource_Response{} }
+func (m *ReadDataSource_Response) String() string { return proto.CompactTextString(m) }
+func (*ReadDataSource_Response) ProtoMessage()    {}
+func (*ReadDataSource_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{16, 1}
+}
+func (m *ReadDataSource_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ReadDataSource_Response.Unmarshal(m, b)
+}
+func (m *ReadDataSource_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ReadDataSource_Response.Marshal(b, m, deterministic)
+}
+func (dst *ReadDataSource_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ReadDataSource_Response.Merge(dst, src)
+}
+func (m *ReadDataSource_Response) XXX_Size() int {
+        return xxx_messageInfo_ReadDataSource_Response.Size(m)
+}
+func (m *ReadDataSource_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ReadDataSource_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ReadDataSource_Response proto.InternalMessageInfo
+
+func (m *ReadDataSource_Response) GetState() *DynamicValue {
+        if m != nil {
+                return m.State
+        }
+        return nil
+}
+
+func (m *ReadDataSource_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type GetProvisionerSchema struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *GetProvisionerSchema) Reset()         { *m = GetProvisionerSchema{} }
+func (m *GetProvisionerSchema) String() string { return proto.CompactTextString(m) }
+func (*GetProvisionerSchema) ProtoMessage()    {}
+func (*GetProvisionerSchema) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{17}
+}
+func (m *GetProvisionerSchema) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_GetProvisionerSchema.Unmarshal(m, b)
+}
+func (m *GetProvisionerSchema) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_GetProvisionerSchema.Marshal(b, m, deterministic)
+}
+func (dst *GetProvisionerSchema) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_GetProvisionerSchema.Merge(dst, src)
+}
+func (m *GetProvisionerSchema) XXX_Size() int {
+        return xxx_messageInfo_GetProvisionerSchema.Size(m)
+}
+func (m *GetProvisionerSchema) XXX_DiscardUnknown() {
+        xxx_messageInfo_GetProvisionerSchema.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GetProvisionerSchema proto.InternalMessageInfo
+
+type GetProvisionerSchema_Request struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *GetProvisionerSchema_Request) Reset()         { *m = GetProvisionerSchema_Request{} }
+func (m *GetProvisionerSchema_Request) String() string { return proto.CompactTextString(m) }
+func (*GetProvisionerSchema_Request) ProtoMessage()    {}
+func (*GetProvisionerSchema_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{17, 0}
+}
+func (m *GetProvisionerSchema_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_GetProvisionerSchema_Request.Unmarshal(m, b)
+}
+func (m *GetProvisionerSchema_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_GetProvisionerSchema_Request.Marshal(b, m, deterministic)
+}
+func (dst *GetProvisionerSchema_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_GetProvisionerSchema_Request.Merge(dst, src)
+}
+func (m *GetProvisionerSchema_Request) XXX_Size() int {
+        return xxx_messageInfo_GetProvisionerSchema_Request.Size(m)
+}
+func (m *GetProvisionerSchema_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_GetProvisionerSchema_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GetProvisionerSchema_Request proto.InternalMessageInfo
+
+type GetProvisionerSchema_Response struct {
+        Provisioner          *Schema       `protobuf:"bytes,1,opt,name=provisioner,proto3" json:"provisioner,omitempty"`
+        Diagnostics          []*Diagnostic `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *GetProvisionerSchema_Response) Reset()         { *m = GetProvisionerSchema_Response{} }
+func (m *GetProvisionerSchema_Response) String() string { return proto.CompactTextString(m) }
+func (*GetProvisionerSchema_Response) ProtoMessage()    {}
+func (*GetProvisionerSchema_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{17, 1}
+}
+func (m *GetProvisionerSchema_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_GetProvisionerSchema_Response.Unmarshal(m, b)
+}
+func (m *GetProvisionerSchema_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_GetProvisionerSchema_Response.Marshal(b, m, deterministic)
+}
+func (dst *GetProvisionerSchema_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_GetProvisionerSchema_Response.Merge(dst, src)
+}
+func (m *GetProvisionerSchema_Response) XXX_Size() int {
+        return xxx_messageInfo_GetProvisionerSchema_Response.Size(m)
+}
+func (m *GetProvisionerSchema_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_GetProvisionerSchema_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GetProvisionerSchema_Response proto.InternalMessageInfo
+
+func (m *GetProvisionerSchema_Response) GetProvisioner() *Schema {
+        if m != nil {
+                return m.Provisioner
+        }
+        return nil
+}
+
+func (m *GetProvisionerSchema_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type ValidateProvisionerConfig struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ValidateProvisionerConfig) Reset()         { *m = ValidateProvisionerConfig{} }
+func (m *ValidateProvisionerConfig) String() string { return proto.CompactTextString(m) }
+func (*ValidateProvisionerConfig) ProtoMessage()    {}
+func (*ValidateProvisionerConfig) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{18}
+}
+func (m *ValidateProvisionerConfig) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateProvisionerConfig.Unmarshal(m, b)
+}
+func (m *ValidateProvisionerConfig) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateProvisionerConfig.Marshal(b, m, deterministic)
+}
+func (dst *ValidateProvisionerConfig) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateProvisionerConfig.Merge(dst, src)
+}
+func (m *ValidateProvisionerConfig) XXX_Size() int {
+        return xxx_messageInfo_ValidateProvisionerConfig.Size(m)
+}
+func (m *ValidateProvisionerConfig) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateProvisionerConfig.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateProvisionerConfig proto.InternalMessageInfo
+
+type ValidateProvisionerConfig_Request struct {
+        Config               *DynamicValue `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ValidateProvisionerConfig_Request) Reset()         { *m = ValidateProvisionerConfig_Request{} }
+func (m *ValidateProvisionerConfig_Request) String() string { return proto.CompactTextString(m) }
+func (*ValidateProvisionerConfig_Request) ProtoMessage()    {}
+func (*ValidateProvisionerConfig_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{18, 0}
+}
+func (m *ValidateProvisionerConfig_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateProvisionerConfig_Request.Unmarshal(m, b)
+}
+func (m *ValidateProvisionerConfig_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateProvisionerConfig_Request.Marshal(b, m, deterministic)
+}
+func (dst *ValidateProvisionerConfig_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateProvisionerConfig_Request.Merge(dst, src)
+}
+func (m *ValidateProvisionerConfig_Request) XXX_Size() int {
+        return xxx_messageInfo_ValidateProvisionerConfig_Request.Size(m)
+}
+func (m *ValidateProvisionerConfig_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateProvisionerConfig_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateProvisionerConfig_Request proto.InternalMessageInfo
+
+func (m *ValidateProvisionerConfig_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+type ValidateProvisionerConfig_Response struct {
+        Diagnostics          []*Diagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ValidateProvisionerConfig_Response) Reset()         { *m = ValidateProvisionerConfig_Response{} }
+func (m *ValidateProvisionerConfig_Response) String() string { return proto.CompactTextString(m) }
+func (*ValidateProvisionerConfig_Response) ProtoMessage()    {}
+func (*ValidateProvisionerConfig_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{18, 1}
+}
+func (m *ValidateProvisionerConfig_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateProvisionerConfig_Response.Unmarshal(m, b)
+}
+func (m *ValidateProvisionerConfig_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateProvisionerConfig_Response.Marshal(b, m, deterministic)
+}
+func (dst *ValidateProvisionerConfig_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateProvisionerConfig_Response.Merge(dst, src)
+}
+func (m *ValidateProvisionerConfig_Response) XXX_Size() int {
+        return xxx_messageInfo_ValidateProvisionerConfig_Response.Size(m)
+}
+func (m *ValidateProvisionerConfig_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateProvisionerConfig_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateProvisionerConfig_Response proto.InternalMessageInfo
+
+func (m *ValidateProvisionerConfig_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type ProvisionResource struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ProvisionResource) Reset()         { *m = ProvisionResource{} }
+func (m *ProvisionResource) String() string { return proto.CompactTextString(m) }
+func (*ProvisionResource) ProtoMessage()    {}
+func (*ProvisionResource) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{19}
+}
+func (m *ProvisionResource) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ProvisionResource.Unmarshal(m, b)
+}
+func (m *ProvisionResource) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ProvisionResource.Marshal(b, m, deterministic)
+}
+func (dst *ProvisionResource) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ProvisionResource.Merge(dst, src)
+}
+func (m *ProvisionResource) XXX_Size() int {
+        return xxx_messageInfo_ProvisionResource.Size(m)
+}
+func (m *ProvisionResource) XXX_DiscardUnknown() {
+        xxx_messageInfo_ProvisionResource.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ProvisionResource proto.InternalMessageInfo
+
+type ProvisionResource_Request struct {
+        Config               *DynamicValue `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
+        Connection           *DynamicValue `protobuf:"bytes,2,opt,name=connection,proto3" json:"connection,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ProvisionResource_Request) Reset()         { *m = ProvisionResource_Request{} }
+func (m *ProvisionResource_Request) String() string { return proto.CompactTextString(m) }
+func (*ProvisionResource_Request) ProtoMessage()    {}
+func (*ProvisionResource_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{19, 0}
+}
+func (m *ProvisionResource_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ProvisionResource_Request.Unmarshal(m, b)
+}
+func (m *ProvisionResource_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ProvisionResource_Request.Marshal(b, m, deterministic)
+}
+func (dst *ProvisionResource_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ProvisionResource_Request.Merge(dst, src)
+}
+func (m *ProvisionResource_Request) XXX_Size() int {
+        return xxx_messageInfo_ProvisionResource_Request.Size(m)
+}
+func (m *ProvisionResource_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ProvisionResource_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ProvisionResource_Request proto.InternalMessageInfo
+
+func (m *ProvisionResource_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+func (m *ProvisionResource_Request) GetConnection() *DynamicValue {
+        if m != nil {
+                return m.Connection
+        }
+        return nil
+}
+
+type ProvisionResource_Response struct {
+        Output               string        `protobuf:"bytes,1,opt,name=output,proto3" json:"output,omitempty"`
+        Diagnostics          []*Diagnostic `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ProvisionResource_Response) Reset()         { *m = ProvisionResource_Response{} }
+func (m *ProvisionResource_Response) String() string { return proto.CompactTextString(m) }
+func (*ProvisionResource_Response) ProtoMessage()    {}
+func (*ProvisionResource_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{19, 1}
+}
+func (m *ProvisionResource_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ProvisionResource_Response.Unmarshal(m, b)
+}
+func (m *ProvisionResource_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ProvisionResource_Response.Marshal(b, m, deterministic)
+}
+func (dst *ProvisionResource_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ProvisionResource_Response.Merge(dst, src)
+}
+func (m *ProvisionResource_Response) XXX_Size() int {
+        return xxx_messageInfo_ProvisionResource_Response.Size(m)
+}
+func (m *ProvisionResource_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ProvisionResource_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ProvisionResource_Response proto.InternalMessageInfo
+
+func (m *ProvisionResource_Response) GetOutput() string {
+        if m != nil {
+                return m.Output
+        }
+        return ""
+}
+
+func (m *ProvisionResource_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+func init() {
+        proto.RegisterType((*DynamicValue)(nil), "tfplugin5.DynamicValue")
+        proto.RegisterType((*Diagnostic)(nil), "tfplugin5.Diagnostic")
+        proto.RegisterType((*AttributePath)(nil), "tfplugin5.AttributePath")
+        proto.RegisterType((*AttributePath_Step)(nil), "tfplugin5.AttributePath.Step")
+        proto.RegisterType((*Stop)(nil), "tfplugin5.Stop")
+        proto.RegisterType((*Stop_Request)(nil), "tfplugin5.Stop.Request")
+        proto.RegisterType((*Stop_Response)(nil), "tfplugin5.Stop.Response")
+        proto.RegisterType((*RawState)(nil), "tfplugin5.RawState")
+        proto.RegisterMapType((map[string]string)(nil), "tfplugin5.RawState.FlatmapEntry")
+        proto.RegisterType((*Schema)(nil), "tfplugin5.Schema")
+        proto.RegisterType((*Schema_Block)(nil), "tfplugin5.Schema.Block")
+        proto.RegisterType((*Schema_Attribute)(nil), "tfplugin5.Schema.Attribute")
+        proto.RegisterType((*Schema_NestedBlock)(nil), "tfplugin5.Schema.NestedBlock")
+        proto.RegisterType((*GetProviderSchema)(nil), "tfplugin5.GetProviderSchema")
+        proto.RegisterType((*GetProviderSchema_Request)(nil), "tfplugin5.GetProviderSchema.Request")
+        proto.RegisterType((*GetProviderSchema_Response)(nil), "tfplugin5.GetProviderSchema.Response")
+        proto.RegisterMapType((map[string]*Schema)(nil), "tfplugin5.GetProviderSchema.Response.DataSourceSchemasEntry")
+        proto.RegisterMapType((map[string]*Schema)(nil), "tfplugin5.GetProviderSchema.Response.ResourceSchemasEntry")
+        proto.RegisterType((*PrepareProviderConfig)(nil), "tfplugin5.PrepareProviderConfig")
+        proto.RegisterType((*PrepareProviderConfig_Request)(nil), "tfplugin5.PrepareProviderConfig.Request")
+        proto.RegisterType((*PrepareProviderConfig_Response)(nil), "tfplugin5.PrepareProviderConfig.Response")
+        proto.RegisterType((*UpgradeResourceState)(nil), "tfplugin5.UpgradeResourceState")
+        proto.RegisterType((*UpgradeResourceState_Request)(nil), "tfplugin5.UpgradeResourceState.Request")
+        proto.RegisterType((*UpgradeResourceState_Response)(nil), "tfplugin5.UpgradeResourceState.Response")
+        proto.RegisterType((*ValidateResourceTypeConfig)(nil), "tfplugin5.ValidateResourceTypeConfig")
+        proto.RegisterType((*ValidateResourceTypeConfig_Request)(nil), "tfplugin5.ValidateResourceTypeConfig.Request")
+        proto.RegisterType((*ValidateResourceTypeConfig_Response)(nil), "tfplugin5.ValidateResourceTypeConfig.Response")
+        proto.RegisterType((*ValidateDataSourceConfig)(nil), "tfplugin5.ValidateDataSourceConfig")
+        proto.RegisterType((*ValidateDataSourceConfig_Request)(nil), "tfplugin5.ValidateDataSourceConfig.Request")
+        proto.RegisterType((*ValidateDataSourceConfig_Response)(nil), "tfplugin5.ValidateDataSourceConfig.Response")
+        proto.RegisterType((*Configure)(nil), "tfplugin5.Configure")
+        proto.RegisterType((*Configure_Request)(nil), "tfplugin5.Configure.Request")
+        proto.RegisterType((*Configure_Response)(nil), "tfplugin5.Configure.Response")
+        proto.RegisterType((*ReadResource)(nil), "tfplugin5.ReadResource")
+        proto.RegisterType((*ReadResource_Request)(nil), "tfplugin5.ReadResource.Request")
+        proto.RegisterType((*ReadResource_Response)(nil), "tfplugin5.ReadResource.Response")
+        proto.RegisterType((*PlanResourceChange)(nil), "tfplugin5.PlanResourceChange")
+        proto.RegisterType((*PlanResourceChange_Request)(nil), "tfplugin5.PlanResourceChange.Request")
+        proto.RegisterType((*PlanResourceChange_Response)(nil), "tfplugin5.PlanResourceChange.Response")
+        proto.RegisterType((*ApplyResourceChange)(nil), "tfplugin5.ApplyResourceChange")
+        proto.RegisterType((*ApplyResourceChange_Request)(nil), "tfplugin5.ApplyResourceChange.Request")
+        proto.RegisterType((*ApplyResourceChange_Response)(nil), "tfplugin5.ApplyResourceChange.Response")
+        proto.RegisterType((*ImportResourceState)(nil), "tfplugin5.ImportResourceState")
+        proto.RegisterType((*ImportResourceState_Request)(nil), "tfplugin5.ImportResourceState.Request")
+        proto.RegisterType((*ImportResourceState_ImportedResource)(nil), "tfplugin5.ImportResourceState.ImportedResource")
+        proto.RegisterType((*ImportResourceState_Response)(nil), "tfplugin5.ImportResourceState.Response")
+        proto.RegisterType((*ReadDataSource)(nil), "tfplugin5.ReadDataSource")
+        proto.RegisterType((*ReadDataSource_Request)(nil), "tfplugin5.ReadDataSource.Request")
+        proto.RegisterType((*ReadDataSource_Response)(nil), "tfplugin5.ReadDataSource.Response")
+        proto.RegisterType((*GetProvisionerSchema)(nil), "tfplugin5.GetProvisionerSchema")
+        proto.RegisterType((*GetProvisionerSchema_Request)(nil), "tfplugin5.GetProvisionerSchema.Request")
+        proto.RegisterType((*GetProvisionerSchema_Response)(nil), "tfplugin5.GetProvisionerSchema.Response")
+        proto.RegisterType((*ValidateProvisionerConfig)(nil), "tfplugin5.ValidateProvisionerConfig")
+        proto.RegisterType((*ValidateProvisionerConfig_Request)(nil), "tfplugin5.ValidateProvisionerConfig.Request")
+        proto.RegisterType((*ValidateProvisionerConfig_Response)(nil), "tfplugin5.ValidateProvisionerConfig.Response")
+        proto.RegisterType((*ProvisionResource)(nil), "tfplugin5.ProvisionResource")
+        proto.RegisterType((*ProvisionResource_Request)(nil), "tfplugin5.ProvisionResource.Request")
+        proto.RegisterType((*ProvisionResource_Response)(nil), "tfplugin5.ProvisionResource.Response")
+        proto.RegisterEnum("tfplugin5.Diagnostic_Severity", Diagnostic_Severity_name, Diagnostic_Severity_value)
+        proto.RegisterEnum("tfplugin5.Schema_NestedBlock_NestingMode", Schema_NestedBlock_NestingMode_name, Schema_NestedBlock_NestingMode_value)
+}
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ context.Context
+var _ grpc.ClientConn
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+const _ = grpc.SupportPackageIsVersion4
+
+// ProviderClient is the client API for Provider service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
+type ProviderClient interface {
+        // ////// Information about what a provider supports/expects
+        GetSchema(ctx context.Context, in *GetProviderSchema_Request, opts ...grpc.CallOption) (*GetProviderSchema_Response, error)
+        PrepareProviderConfig(ctx context.Context, in *PrepareProviderConfig_Request, opts ...grpc.CallOption) (*PrepareProviderConfig_Response, error)
+        ValidateResourceTypeConfig(ctx context.Context, in *ValidateResourceTypeConfig_Request, opts ...grpc.CallOption) (*ValidateResourceTypeConfig_Response, error)
+        ValidateDataSourceConfig(ctx context.Context, in *ValidateDataSourceConfig_Request, opts ...grpc.CallOption) (*ValidateDataSourceConfig_Response, error)
+        UpgradeResourceState(ctx context.Context, in *UpgradeResourceState_Request, opts ...grpc.CallOption) (*UpgradeResourceState_Response, error)
+        // ////// One-time initialization, called before other functions below
+        Configure(ctx context.Context, in *Configure_Request, opts ...grpc.CallOption) (*Configure_Response, error)
+        // ////// Managed Resource Lifecycle
+        ReadResource(ctx context.Context, in *ReadResource_Request, opts ...grpc.CallOption) (*ReadResource_Response, error)
+        PlanResourceChange(ctx context.Context, in *PlanResourceChange_Request, opts ...grpc.CallOption) (*PlanResourceChange_Response, error)
+        ApplyResourceChange(ctx context.Context, in *ApplyResourceChange_Request, opts ...grpc.CallOption) (*ApplyResourceChange_Response, error)
+        ImportResourceState(ctx context.Context, in *ImportResourceState_Request, opts ...grpc.CallOption) (*ImportResourceState_Response, error)
+        ReadDataSource(ctx context.Context, in *ReadDataSource_Request, opts ...grpc.CallOption) (*ReadDataSource_Response, error)
+        // ////// Graceful Shutdown
+        Stop(ctx context.Context, in *Stop_Request, opts ...grpc.CallOption) (*Stop_Response, error)
+}
+
+type providerClient struct {
+        cc *grpc.ClientConn
+}
+
+func NewProviderClient(cc *grpc.ClientConn) ProviderClient {
+        return &providerClient{cc}
+}
+
+func (c *providerClient) GetSchema(ctx context.Context, in *GetProviderSchema_Request, opts ...grpc.CallOption) (*GetProviderSchema_Response, error) {
+        out := new(GetProviderSchema_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/GetSchema", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) PrepareProviderConfig(ctx context.Context, in *PrepareProviderConfig_Request, opts ...grpc.CallOption) (*PrepareProviderConfig_Response, error) {
+        out := new(PrepareProviderConfig_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/PrepareProviderConfig", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) ValidateResourceTypeConfig(ctx context.Context, in *ValidateResourceTypeConfig_Request, opts ...grpc.CallOption) (*ValidateResourceTypeConfig_Response, error) {
+        out := new(ValidateResourceTypeConfig_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ValidateResourceTypeConfig", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) ValidateDataSourceConfig(ctx context.Context, in *ValidateDataSourceConfig_Request, opts ...grpc.CallOption) (*ValidateDataSourceConfig_Response, error) {
+        out := new(ValidateDataSourceConfig_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ValidateDataSourceConfig", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) UpgradeResourceState(ctx context.Context, in *UpgradeResourceState_Request, opts ...grpc.CallOption) (*UpgradeResourceState_Response, error) {
+        out := new(UpgradeResourceState_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/UpgradeResourceState", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) Configure(ctx context.Context, in *Configure_Request, opts ...grpc.CallOption) (*Configure_Response, error) {
+        out := new(Configure_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/Configure", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) ReadResource(ctx context.Context, in *ReadResource_Request, opts ...grpc.CallOption) (*ReadResource_Response, error) {
+        out := new(ReadResource_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ReadResource", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) PlanResourceChange(ctx context.Context, in *PlanResourceChange_Request, opts ...grpc.CallOption) (*PlanResourceChange_Response, error) {
+        out := new(PlanResourceChange_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/PlanResourceChange", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) ApplyResourceChange(ctx context.Context, in *ApplyResourceChange_Request, opts ...grpc.CallOption) (*ApplyResourceChange_Response, error) {
+        out := new(ApplyResourceChange_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ApplyResourceChange", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) ImportResourceState(ctx context.Context, in *ImportResourceState_Request, opts ...grpc.CallOption) (*ImportResourceState_Response, error) {
+        out := new(ImportResourceState_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ImportResourceState", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) ReadDataSource(ctx context.Context, in *ReadDataSource_Request, opts ...grpc.CallOption) (*ReadDataSource_Response, error) {
+        out := new(ReadDataSource_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ReadDataSource", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) Stop(ctx context.Context, in *Stop_Request, opts ...grpc.CallOption) (*Stop_Response, error) {
+        out := new(Stop_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/Stop", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+// ProviderServer is the server API for Provider service.
+type ProviderServer interface {
+        // ////// Information about what a provider supports/expects
+        GetSchema(context.Context, *GetProviderSchema_Request) (*GetProviderSchema_Response, error)
+        PrepareProviderConfig(context.Context, *PrepareProviderConfig_Request) (*PrepareProviderConfig_Response, error)
+        ValidateResourceTypeConfig(context.Context, *ValidateResourceTypeConfig_Request) (*ValidateResourceTypeConfig_Response, error)
+        ValidateDataSourceConfig(context.Context, *ValidateDataSourceConfig_Request) (*ValidateDataSourceConfig_Response, error)
+        UpgradeResourceState(context.Context, *UpgradeResourceState_Request) (*UpgradeResourceState_Response, error)
+        // ////// One-time initialization, called before other functions below
+        Configure(context.Context, *Configure_Request) (*Configure_Response, error)
+        // ////// Managed Resource Lifecycle
+        ReadResource(context.Context, *ReadResource_Request) (*ReadResource_Response, error)
+        PlanResourceChange(context.Context, *PlanResourceChange_Request) (*PlanResourceChange_Response, error)
+        ApplyResourceChange(context.Context, *ApplyResourceChange_Request) (*ApplyResourceChange_Response, error)
+        ImportResourceState(context.Context, *ImportResourceState_Request) (*ImportResourceState_Response, error)
+        ReadDataSource(context.Context, *ReadDataSource_Request) (*ReadDataSource_Response, error)
+        // ////// Graceful Shutdown
+        Stop(context.Context, *Stop_Request) (*Stop_Response, error)
+}
+
+func RegisterProviderServer(s *grpc.Server, srv ProviderServer) {
+        s.RegisterService(&_Provider_serviceDesc, srv)
+}
+
+func _Provider_GetSchema_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(GetProviderSchema_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).GetSchema(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/GetSchema",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).GetSchema(ctx, req.(*GetProviderSchema_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_PrepareProviderConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(PrepareProviderConfig_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).PrepareProviderConfig(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/PrepareProviderConfig",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).PrepareProviderConfig(ctx, req.(*PrepareProviderConfig_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_ValidateResourceTypeConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ValidateResourceTypeConfig_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).ValidateResourceTypeConfig(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/ValidateResourceTypeConfig",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).ValidateResourceTypeConfig(ctx, req.(*ValidateResourceTypeConfig_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_ValidateDataSourceConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ValidateDataSourceConfig_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).ValidateDataSourceConfig(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/ValidateDataSourceConfig",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).ValidateDataSourceConfig(ctx, req.(*ValidateDataSourceConfig_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_UpgradeResourceState_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(UpgradeResourceState_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).UpgradeResourceState(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/UpgradeResourceState",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).UpgradeResourceState(ctx, req.(*UpgradeResourceState_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_Configure_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(Configure_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).Configure(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/Configure",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).Configure(ctx, req.(*Configure_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_ReadResource_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ReadResource_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).ReadResource(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/ReadResource",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).ReadResource(ctx, req.(*ReadResource_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_PlanResourceChange_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(PlanResourceChange_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).PlanResourceChange(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/PlanResourceChange",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).PlanResourceChange(ctx, req.(*PlanResourceChange_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_ApplyResourceChange_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ApplyResourceChange_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).ApplyResourceChange(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/ApplyResourceChange",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).ApplyResourceChange(ctx, req.(*ApplyResourceChange_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_ImportResourceState_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ImportResourceState_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).ImportResourceState(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/ImportResourceState",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).ImportResourceState(ctx, req.(*ImportResourceState_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_ReadDataSource_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ReadDataSource_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).ReadDataSource(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/ReadDataSource",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).ReadDataSource(ctx, req.(*ReadDataSource_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_Stop_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(Stop_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).Stop(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/Stop",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).Stop(ctx, req.(*Stop_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+var _Provider_serviceDesc = grpc.ServiceDesc{
+        ServiceName: "tfplugin5.Provider",
+        HandlerType: (*ProviderServer)(nil),
+        Methods: []grpc.MethodDesc{
+                {
+                        MethodName: "GetSchema",
+                        Handler:    _Provider_GetSchema_Handler,
+                },
+                {
+                        MethodName: "PrepareProviderConfig",
+                        Handler:    _Provider_PrepareProviderConfig_Handler,
+                },
+                {
+                        MethodName: "ValidateResourceTypeConfig",
+                        Handler:    _Provider_ValidateResourceTypeConfig_Handler,
+                },
+                {
+                        MethodName: "ValidateDataSourceConfig",
+                        Handler:    _Provider_ValidateDataSourceConfig_Handler,
+                },
+                {
+                        MethodName: "UpgradeResourceState",
+                        Handler:    _Provider_UpgradeResourceState_Handler,
+                },
+                {
+                        MethodName: "Configure",
+                        Handler:    _Provider_Configure_Handler,
+                },
+                {
+                        MethodName: "ReadResource",
+                        Handler:    _Provider_ReadResource_Handler,
+                },
+                {
+                        MethodName: "PlanResourceChange",
+                        Handler:    _Provider_PlanResourceChange_Handler,
+                },
+                {
+                        MethodName: "ApplyResourceChange",
+                        Handler:    _Provider_ApplyResourceChange_Handler,
+                },
+                {
+                        MethodName: "ImportResourceState",
+                        Handler:    _Provider_ImportResourceState_Handler,
+                },
+                {
+                        MethodName: "ReadDataSource",
+                        Handler:    _Provider_ReadDataSource_Handler,
+                },
+                {
+                        MethodName: "Stop",
+                        Handler:    _Provider_Stop_Handler,
+                },
+        },
+        Streams:  []grpc.StreamDesc{},
+        Metadata: "tfplugin5.proto",
+}
+
+// ProvisionerClient is the client API for Provisioner service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
+type ProvisionerClient interface {
+        GetSchema(ctx context.Context, in *GetProvisionerSchema_Request, opts ...grpc.CallOption) (*GetProvisionerSchema_Response, error)
+        ValidateProvisionerConfig(ctx context.Context, in *ValidateProvisionerConfig_Request, opts ...grpc.CallOption) (*ValidateProvisionerConfig_Response, error)
+        ProvisionResource(ctx context.Context, in *ProvisionResource_Request, opts ...grpc.CallOption) (Provisioner_ProvisionResourceClient, error)
+        Stop(ctx context.Context, in *Stop_Request, opts ...grpc.CallOption) (*Stop_Response, error)
+}
+
+type provisionerClient struct {
+        cc *grpc.ClientConn
+}
+
+func NewProvisionerClient(cc *grpc.ClientConn) ProvisionerClient {
+        return &provisionerClient{cc}
+}
+
+func (c *provisionerClient) GetSchema(ctx context.Context, in *GetProvisionerSchema_Request, opts ...grpc.CallOption) (*GetProvisionerSchema_Response, error) {
+        out := new(GetProvisionerSchema_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provisioner/GetSchema", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *provisionerClient) ValidateProvisionerConfig(ctx context.Context, in *ValidateProvisionerConfig_Request, opts ...grpc.CallOption) (*ValidateProvisionerConfig_Response, error) {
+        out := new(ValidateProvisionerConfig_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provisioner/ValidateProvisionerConfig", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *provisionerClient) ProvisionResource(ctx context.Context, in *ProvisionResource_Request, opts ...grpc.CallOption) (Provisioner_ProvisionResourceClient, error) {
+        stream, err := c.cc.NewStream(ctx, &_Provisioner_serviceDesc.Streams[0], "/tfplugin5.Provisioner/ProvisionResource", opts...)
+        if err != nil {
+                return nil, err
+        }
+        x := &provisionerProvisionResourceClient{stream}
+        if err := x.ClientStream.SendMsg(in); err != nil {
+                return nil, err
+        }
+        if err := x.ClientStream.CloseSend(); err != nil {
+                return nil, err
+        }
+        return x, nil
+}
+
+type Provisioner_ProvisionResourceClient interface {
+        Recv() (*ProvisionResource_Response, error)
+        grpc.ClientStream
+}
+
+type provisionerProvisionResourceClient struct {
+        grpc.ClientStream
+}
+
+func (x *provisionerProvisionResourceClient) Recv() (*ProvisionResource_Response, error) {
+        m := new(ProvisionResource_Response)
+        if err := x.ClientStream.RecvMsg(m); err != nil {
+                return nil, err
+        }
+        return m, nil
+}
+
+func (c *provisionerClient) Stop(ctx context.Context, in *Stop_Request, opts ...grpc.CallOption) (*Stop_Response, error) {
+        out := new(Stop_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provisioner/Stop", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+// ProvisionerServer is the server API for Provisioner service.
+type ProvisionerServer interface {
+        GetSchema(context.Context, *GetProvisionerSchema_Request) (*GetProvisionerSchema_Response, error)
+        ValidateProvisionerConfig(context.Context, *ValidateProvisionerConfig_Request) (*ValidateProvisionerConfig_Response, error)
+        ProvisionResource(*ProvisionResource_Request, Provisioner_ProvisionResourceServer) error
+        Stop(context.Context, *Stop_Request) (*Stop_Response, error)
+}
+
+func RegisterProvisionerServer(s *grpc.Server, srv ProvisionerServer) {
+        s.RegisterService(&_Provisioner_serviceDesc, srv)
+}
+
+func _Provisioner_GetSchema_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(GetProvisionerSchema_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProvisionerServer).GetSchema(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provisioner/GetSchema",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProvisionerServer).GetSchema(ctx, req.(*GetProvisionerSchema_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provisioner_ValidateProvisionerConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ValidateProvisionerConfig_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProvisionerServer).ValidateProvisionerConfig(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provisioner/ValidateProvisionerConfig",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProvisionerServer).ValidateProvisionerConfig(ctx, req.(*ValidateProvisionerConfig_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provisioner_ProvisionResource_Handler(srv interface{}, stream grpc.ServerStream) error {
+        m := new(ProvisionResource_Request)
+        if err := stream.RecvMsg(m); err != nil {
+                return err
+        }
+        return srv.(ProvisionerServer).ProvisionResource(m, &provisionerProvisionResourceServer{stream})
+}
+
+type Provisioner_ProvisionResourceServer interface {
+        Send(*ProvisionResource_Response) error
+        grpc.ServerStream
+}
+
+type provisionerProvisionResourceServer struct {
+        grpc.ServerStream
+}
+
+func (x *provisionerProvisionResourceServer) Send(m *ProvisionResource_Response) error {
+        return x.ServerStream.SendMsg(m)
+}
+
+func _Provisioner_Stop_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(Stop_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProvisionerServer).Stop(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provisioner/Stop",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProvisionerServer).Stop(ctx, req.(*Stop_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+var _Provisioner_serviceDesc = grpc.ServiceDesc{
+        ServiceName: "tfplugin5.Provisioner",
+        HandlerType: (*ProvisionerServer)(nil),
+        Methods: []grpc.MethodDesc{
+                {
+                        MethodName: "GetSchema",
+                        Handler:    _Provisioner_GetSchema_Handler,
+                },
+                {
+                        MethodName: "ValidateProvisionerConfig",
+                        Handler:    _Provisioner_ValidateProvisionerConfig_Handler,
+                },
+                {
+                        MethodName: "Stop",
+                        Handler:    _Provisioner_Stop_Handler,
+                },
+        },
+        Streams: []grpc.StreamDesc{
+                {
+                        StreamName:    "ProvisionResource",
+                        Handler:       _Provisioner_ProvisionResource_Handler,
+                        ServerStreams: true,
+                },
+        },
+        Metadata: "tfplugin5.proto",
+}
+
+func init() { proto.RegisterFile("tfplugin5.proto", fileDescriptor_tfplugin5_56820f4fb67360c5) }
+
+var fileDescriptor_tfplugin5_56820f4fb67360c5 = []byte{
+        // 1876 bytes of a gzipped FileDescriptorProto
+        0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xd4, 0x59, 0xcd, 0x6f, 0x23, 0x49,
+        0x15, 0x9f, 0x76, 0xdb, 0x89, 0xfd, 0x9c, 0x0f, 0xa7, 0x66, 0x76, 0x30, 0xbd, 0xbb, 0x10, 0xcc,
+        0x47, 0xb2, 0xda, 0x1d, 0xcf, 0x2a, 0x03, 0xbb, 0x4b, 0x18, 0xad, 0xc8, 0x66, 0x42, 0x26, 0x62,
+        0x26, 0x1b, 0xca, 0xf3, 0x81, 0x84, 0xb4, 0x56, 0x8d, 0xbb, 0xe2, 0x69, 0xc6, 0xee, 0xee, 0xad,
+        0x2e, 0x67, 0x62, 0x71, 0x44, 0x70, 0xe6, 0xc2, 0x87, 0xc4, 0xc7, 0x85, 0x03, 0xff, 0x00, 0x07,
+        0xe0, 0xc6, 0x89, 0x7f, 0x80, 0x1b, 0x70, 0x42, 0x70, 0x43, 0x1c, 0xe1, 0x82, 0x84, 0xea, 0xab,
+        0xbb, 0x6c, 0xb7, 0x93, 0x9e, 0x64, 0x57, 0x88, 0x5b, 0x57, 0xbd, 0x5f, 0xbd, 0xf7, 0xab, 0xf7,
+        0x5e, 0xbd, 0x57, 0x65, 0xc3, 0x2a, 0x3f, 0x8e, 0x07, 0xa3, 0x7e, 0x10, 0x7e, 0xa9, 0x1d, 0xb3,
+        0x88, 0x47, 0xa8, 0x96, 0x4e, 0xb4, 0x6e, 0xc3, 0xd2, 0x9d, 0x71, 0x48, 0x86, 0x41, 0xef, 0x11,
+        0x19, 0x8c, 0x28, 0x6a, 0xc2, 0xe2, 0x30, 0xe9, 0xc7, 0xa4, 0xf7, 0xac, 0xe9, 0xac, 0x3b, 0x9b,
+        0x4b, 0xd8, 0x0c, 0x11, 0x82, 0xf2, 0xb7, 0x93, 0x28, 0x6c, 0x96, 0xe4, 0xb4, 0xfc, 0x6e, 0xfd,
+        0xd5, 0x01, 0xb8, 0x13, 0x90, 0x7e, 0x18, 0x25, 0x3c, 0xe8, 0xa1, 0x6d, 0xa8, 0x26, 0xf4, 0x84,
+        0xb2, 0x80, 0x8f, 0xe5, 0xea, 0x95, 0xad, 0x4f, 0xb5, 0x33, 0xdb, 0x19, 0xb0, 0xdd, 0xd1, 0x28,
+        0x9c, 0xe2, 0x85, 0xe1, 0x64, 0x34, 0x1c, 0x12, 0x36, 0x96, 0x16, 0x6a, 0xd8, 0x0c, 0xd1, 0x75,
+        0x58, 0xf0, 0x29, 0x27, 0xc1, 0xa0, 0xe9, 0x4a, 0x81, 0x1e, 0xa1, 0xb7, 0xa0, 0x46, 0x38, 0x67,
+        0xc1, 0x93, 0x11, 0xa7, 0xcd, 0xf2, 0xba, 0xb3, 0x59, 0xdf, 0x6a, 0x5a, 0xe6, 0x76, 0x8c, 0xec,
+        0x88, 0xf0, 0xa7, 0x38, 0x83, 0xb6, 0x6e, 0x42, 0xd5, 0xd8, 0x47, 0x75, 0x58, 0x3c, 0x38, 0x7c,
+        0xb4, 0x73, 0xef, 0xe0, 0x4e, 0xe3, 0x0a, 0xaa, 0x41, 0x65, 0x0f, 0xe3, 0xf7, 0x71, 0xc3, 0x11,
+        0xf3, 0x8f, 0x77, 0xf0, 0xe1, 0xc1, 0xe1, 0x7e, 0xa3, 0xd4, 0xfa, 0xb3, 0x03, 0xcb, 0x13, 0xda,
+        0xd0, 0x2d, 0xa8, 0x24, 0x9c, 0xc6, 0x49, 0xd3, 0x59, 0x77, 0x37, 0xeb, 0x5b, 0xaf, 0xce, 0x33,
+        0xdb, 0xee, 0x70, 0x1a, 0x63, 0x85, 0xf5, 0x7e, 0xe8, 0x40, 0x59, 0x8c, 0xd1, 0x06, 0xac, 0xa4,
+        0x6c, 0xba, 0x21, 0x19, 0x52, 0xe9, 0xac, 0xda, 0xdd, 0x2b, 0x78, 0x39, 0x9d, 0x3f, 0x24, 0x43,
+        0x8a, 0xda, 0x80, 0xe8, 0x80, 0x0e, 0x69, 0xc8, 0xbb, 0xcf, 0xe8, 0xb8, 0x9b, 0x70, 0x16, 0x84,
+        0x7d, 0xe5, 0x9e, 0xbb, 0x57, 0x70, 0x43, 0xcb, 0xbe, 0x4e, 0xc7, 0x1d, 0x29, 0x41, 0x9b, 0xb0,
+        0x6a, 0xe3, 0x83, 0x90, 0x4b, 0x97, 0xb9, 0x42, 0x73, 0x06, 0x3e, 0x08, 0xf9, 0x7b, 0x20, 0x22,
+        0x35, 0xa0, 0x3d, 0x1e, 0xb1, 0xd6, 0x2d, 0x41, 0x2b, 0x8a, 0xbd, 0x1a, 0x2c, 0x62, 0xfa, 0xe1,
+        0x88, 0x26, 0xdc, 0x5b, 0x87, 0x2a, 0xa6, 0x49, 0x1c, 0x85, 0x09, 0x45, 0xd7, 0xa0, 0xb2, 0xc7,
+        0x58, 0xc4, 0x14, 0x49, 0xac, 0x06, 0xad, 0x1f, 0x39, 0x50, 0xc5, 0xe4, 0x79, 0x87, 0x13, 0x4e,
+        0xd3, 0xd4, 0x70, 0xb2, 0xd4, 0x40, 0xdb, 0xb0, 0x78, 0x3c, 0x20, 0x7c, 0x48, 0xe2, 0x66, 0x49,
+        0x3a, 0x69, 0xdd, 0x72, 0x92, 0x59, 0xd9, 0xfe, 0x9a, 0x82, 0xec, 0x85, 0x9c, 0x8d, 0xb1, 0x59,
+        0xe0, 0x6d, 0xc3, 0x92, 0x2d, 0x40, 0x0d, 0x70, 0x9f, 0xd1, 0xb1, 0x26, 0x20, 0x3e, 0x05, 0xa9,
+        0x13, 0x91, 0xaf, 0x3a, 0x57, 0xd4, 0x60, 0xbb, 0xf4, 0x8e, 0xd3, 0xfa, 0x7b, 0x05, 0x16, 0x3a,
+        0xbd, 0xa7, 0x74, 0x48, 0x44, 0x4a, 0x9d, 0x50, 0x96, 0x04, 0x9a, 0x99, 0x8b, 0xcd, 0x10, 0xdd,
+        0x80, 0xca, 0x93, 0x41, 0xd4, 0x7b, 0x26, 0x97, 0xd7, 0xb7, 0x3e, 0x61, 0x51, 0x53, 0x6b, 0xdb,
+        0xef, 0x09, 0x31, 0x56, 0x28, 0xef, 0x17, 0x0e, 0x54, 0xe4, 0xc4, 0x19, 0x2a, 0xbf, 0x02, 0x90,
+        0x06, 0x2f, 0xd1, 0x5b, 0x7e, 0x79, 0x56, 0x6f, 0x9a, 0x1e, 0xd8, 0x82, 0xa3, 0x77, 0xa1, 0x2e,
+        0x2d, 0x75, 0xf9, 0x38, 0xa6, 0x49, 0xd3, 0x9d, 0xc9, 0x2a, 0xbd, 0xfa, 0x90, 0x26, 0x9c, 0xfa,
+        0x8a, 0x1b, 0xc8, 0x15, 0x0f, 0xc4, 0x02, 0xef, 0x0f, 0x0e, 0xd4, 0x52, 0xcd, 0x22, 0x1c, 0x59,
+        0x56, 0x61, 0xf9, 0x2d, 0xe6, 0x84, 0x6e, 0x73, 0x7a, 0xc5, 0x37, 0x5a, 0x87, 0xba, 0x4f, 0x93,
+        0x1e, 0x0b, 0x62, 0x2e, 0x36, 0xa4, 0x4e, 0x97, 0x3d, 0x85, 0x3c, 0xa8, 0x32, 0xfa, 0xe1, 0x28,
+        0x60, 0xd4, 0x97, 0x27, 0xac, 0x8a, 0xd3, 0xb1, 0x90, 0x45, 0x12, 0x45, 0x06, 0xcd, 0x8a, 0x92,
+        0x99, 0xb1, 0x90, 0xf5, 0xa2, 0x61, 0x3c, 0xe2, 0xd4, 0x6f, 0x2e, 0x28, 0x99, 0x19, 0xa3, 0x57,
+        0xa0, 0x96, 0xd0, 0x30, 0x09, 0x78, 0x70, 0x42, 0x9b, 0x8b, 0x52, 0x98, 0x4d, 0x78, 0xbf, 0x2a,
+        0x41, 0xdd, 0xda, 0x25, 0x7a, 0x19, 0x6a, 0x82, 0xab, 0x75, 0x4c, 0x70, 0x55, 0x4c, 0xc8, 0xf3,
+        0xf1, 0x62, 0x61, 0x44, 0xbb, 0xb0, 0x18, 0xd2, 0x84, 0x8b, 0x33, 0xe4, 0xca, 0xea, 0xf4, 0xda,
+        0x99, 0x1e, 0x96, 0xdf, 0x41, 0xd8, 0xbf, 0x1f, 0xf9, 0x14, 0x9b, 0x95, 0x82, 0xd0, 0x30, 0x08,
+        0xbb, 0x01, 0xa7, 0xc3, 0x44, 0xfa, 0xc4, 0xc5, 0xd5, 0x61, 0x10, 0x1e, 0x88, 0xb1, 0x14, 0x92,
+        0x53, 0x2d, 0xac, 0x68, 0x21, 0x39, 0x95, 0xc2, 0xd6, 0x7d, 0xb5, 0x33, 0xad, 0x71, 0xb2, 0xf4,
+        0x00, 0x2c, 0x74, 0x0e, 0x0e, 0xf7, 0xef, 0xed, 0x35, 0x1c, 0x54, 0x85, 0xf2, 0xbd, 0x83, 0xce,
+        0x83, 0x46, 0x09, 0x2d, 0x82, 0xdb, 0xd9, 0x7b, 0xd0, 0x70, 0xc5, 0xc7, 0xfd, 0x9d, 0xa3, 0x46,
+        0x59, 0x94, 0xa8, 0x7d, 0xfc, 0xfe, 0xc3, 0xa3, 0x46, 0xa5, 0xf5, 0x93, 0x32, 0xac, 0xed, 0x53,
+        0x7e, 0xc4, 0xa2, 0x93, 0xc0, 0xa7, 0x4c, 0xf1, 0xb7, 0x0f, 0xf1, 0xbf, 0x5c, 0xeb, 0x14, 0xdf,
+        0x80, 0x6a, 0xac, 0x91, 0xd2, 0x8d, 0xf5, 0xad, 0xb5, 0x99, 0xcd, 0xe3, 0x14, 0x82, 0x28, 0x34,
+        0x18, 0x4d, 0xa2, 0x11, 0xeb, 0xd1, 0x6e, 0x22, 0x85, 0x26, 0xa7, 0xb7, 0xad, 0x65, 0x33, 0xe6,
+        0xdb, 0xc6, 0x9e, 0xf8, 0x90, 0xab, 0xd5, 0x7c, 0xa2, 0x0e, 0xf8, 0x2a, 0x9b, 0x9c, 0x45, 0x03,
+        0xb8, 0xea, 0x13, 0x4e, 0xba, 0x53, 0x96, 0x54, 0xfe, 0xdf, 0x2e, 0x66, 0xe9, 0x0e, 0xe1, 0xa4,
+        0x33, 0x6b, 0x6b, 0xcd, 0x9f, 0x9e, 0x47, 0x6f, 0x43, 0xdd, 0x4f, 0x7b, 0x90, 0x08, 0x9e, 0xb0,
+        0xf2, 0x52, 0x6e, 0x87, 0xc2, 0x36, 0xd2, 0x7b, 0x08, 0xd7, 0xf2, 0xf6, 0x93, 0x53, 0x97, 0x36,
+        0xec, 0xba, 0x94, 0xeb, 0xe3, 0xac, 0x54, 0x79, 0x8f, 0xe1, 0x7a, 0x3e, 0xf9, 0x4b, 0x2a, 0x6e,
+        0xfd, 0xc9, 0x81, 0x97, 0x8e, 0x18, 0x8d, 0x09, 0xa3, 0xc6, 0x6b, 0xbb, 0x51, 0x78, 0x1c, 0xf4,
+        0xbd, 0xed, 0x34, 0x3d, 0xd0, 0x4d, 0x58, 0xe8, 0xc9, 0x49, 0x9d, 0x0f, 0xf6, 0xe9, 0xb1, 0xaf,
+        0x04, 0x58, 0xc3, 0xbc, 0xef, 0x39, 0x56, 0x3e, 0x7d, 0x15, 0x56, 0x63, 0x65, 0xc1, 0xef, 0x16,
+        0x53, 0xb3, 0x62, 0xf0, 0x8a, 0xca, 0x74, 0x34, 0x4a, 0x45, 0xa3, 0xd1, 0xfa, 0x41, 0x09, 0xae,
+        0x3d, 0x8c, 0xfb, 0x8c, 0xf8, 0x34, 0x8d, 0x8a, 0x68, 0x26, 0x1e, 0xcb, 0x36, 0x77, 0x66, 0xd9,
+        0xb0, 0x8a, 0x78, 0x69, 0xb2, 0x88, 0xbf, 0x09, 0x35, 0x46, 0x9e, 0x77, 0x13, 0xa1, 0x4e, 0xd6,
+        0x88, 0xfa, 0xd6, 0xd5, 0x9c, 0xb6, 0x85, 0xab, 0x4c, 0x7f, 0x79, 0xdf, 0xb5, 0x9d, 0xf2, 0x2e,
+        0xac, 0x8c, 0x14, 0x31, 0x5f, 0xeb, 0x38, 0xc7, 0x27, 0xcb, 0x06, 0xae, 0xfa, 0xe8, 0x85, 0x5d,
+        0xf2, 0x3b, 0x07, 0xbc, 0x47, 0x64, 0x10, 0xf8, 0x82, 0x9c, 0xf6, 0x89, 0xe8, 0x0c, 0x3a, 0xea,
+        0x8f, 0x0b, 0x3a, 0x26, 0x4b, 0x89, 0x52, 0xb1, 0x94, 0xd8, 0xb5, 0x36, 0x3f, 0x45, 0xde, 0x29,
+        0x4c, 0xfe, 0x37, 0x0e, 0x34, 0x0d, 0xf9, 0xec, 0x3c, 0xfc, 0x5f, 0x50, 0xff, 0xad, 0x03, 0x35,
+        0x45, 0x74, 0xc4, 0xa8, 0xd7, 0xcf, 0xb8, 0xbe, 0x0e, 0x6b, 0x9c, 0x32, 0x46, 0x8e, 0x23, 0x36,
+        0xec, 0xda, 0x37, 0x86, 0x1a, 0x6e, 0xa4, 0x82, 0x47, 0x3a, 0xeb, 0xfe, 0x37, 0xdc, 0xff, 0xe9,
+        0xc0, 0x12, 0xa6, 0xc4, 0x37, 0xf9, 0xe2, 0xf9, 0x05, 0x5d, 0x7d, 0x1b, 0x96, 0x7b, 0x23, 0xc6,
+        0xc4, 0x2d, 0x53, 0x25, 0xf9, 0x39, 0xac, 0x97, 0x34, 0x5a, 0x1d, 0x98, 0xb1, 0xc5, 0xfd, 0x8b,
+        0x50, 0x0b, 0xe9, 0xf3, 0x62, 0x47, 0xa5, 0x1a, 0xd2, 0xe7, 0x97, 0x3c, 0x25, 0xbf, 0x2e, 0x03,
+        0x3a, 0x1a, 0x90, 0xd0, 0xec, 0x78, 0xf7, 0x29, 0x09, 0xfb, 0xd4, 0xfb, 0x8f, 0x53, 0x70, 0xe3,
+        0xef, 0x40, 0x3d, 0x66, 0x41, 0xc4, 0x8a, 0x6d, 0x1b, 0x24, 0x56, 0x51, 0xde, 0x03, 0x14, 0xb3,
+        0x28, 0x8e, 0x12, 0xea, 0x77, 0xb3, 0x1d, 0xbb, 0x67, 0x2b, 0x68, 0x98, 0x25, 0x87, 0x66, 0xe7,
+        0x59, 0xa2, 0x94, 0x0b, 0x25, 0x0a, 0xfa, 0x2c, 0x2c, 0x2b, 0xc6, 0x31, 0x0b, 0x4e, 0x84, 0xc9,
+        0x8a, 0xbc, 0xfe, 0x2d, 0xc9, 0xc9, 0x23, 0x35, 0xe7, 0xfd, 0xbc, 0x64, 0x85, 0xe4, 0x36, 0x2c,
+        0xc7, 0x03, 0x12, 0x86, 0x45, 0x2b, 0xd8, 0x92, 0x46, 0x2b, 0x82, 0xbb, 0xe2, 0xda, 0x20, 0xef,
+        0x87, 0x49, 0x97, 0xd1, 0x78, 0x40, 0x7a, 0x54, 0xc7, 0x67, 0xfe, 0xcb, 0x6c, 0xd5, 0xac, 0xc0,
+        0x6a, 0x01, 0xda, 0x80, 0x55, 0x43, 0xc1, 0xd0, 0x76, 0x25, 0xed, 0x15, 0x3d, 0xad, 0x89, 0x5f,
+        0xb8, 0x9f, 0xa3, 0x37, 0x00, 0x0d, 0x68, 0x9f, 0xf4, 0xc6, 0xf2, 0xbe, 0xdd, 0x4d, 0xc6, 0x09,
+        0xa7, 0x43, 0x7d, 0x89, 0x6d, 0x28, 0x89, 0xa8, 0x9e, 0x1d, 0x39, 0xdf, 0xfa, 0xa3, 0x0b, 0x57,
+        0x77, 0xe2, 0x78, 0x30, 0x9e, 0xca, 0x9b, 0x7f, 0x7f, 0xfc, 0x79, 0x33, 0x13, 0x0d, 0xf7, 0x45,
+        0xa2, 0xf1, 0xc2, 0xe9, 0x92, 0xe3, 0xf9, 0x4a, 0x9e, 0xe7, 0xbd, 0xdf, 0x3b, 0x97, 0x3e, 0xc5,
+        0x4d, 0x58, 0x34, 0x36, 0xd4, 0x9b, 0xc4, 0x0c, 0xa7, 0xc3, 0xea, 0x5e, 0x32, 0xac, 0xe5, 0x39,
+        0x61, 0xfd, 0x47, 0x09, 0xae, 0x1e, 0x0c, 0xe3, 0x88, 0xf1, 0xc9, 0x5b, 0xc4, 0x5b, 0x05, 0xa3,
+        0xba, 0x02, 0xa5, 0xc0, 0xd7, 0xef, 0xcf, 0x52, 0xe0, 0x7b, 0xa7, 0xd0, 0x50, 0xea, 0x68, 0x5a,
+        0x52, 0xcf, 0x7d, 0xbd, 0x14, 0x4a, 0x08, 0x85, 0xb2, 0x1d, 0xe6, 0x4e, 0x38, 0xcc, 0xfb, 0xa5,
+        0x1d, 0x8d, 0x0f, 0x00, 0x05, 0x9a, 0x46, 0xd7, 0x5c, 0xb7, 0x4d, 0x5b, 0xb8, 0x69, 0x99, 0xc8,
+        0xd9, 0x7a, 0x7b, 0x9a, 0x3f, 0x5e, 0x0b, 0xa6, 0x66, 0x92, 0x8b, 0x57, 0xdf, 0xbf, 0x38, 0xb0,
+        0x22, 0xfa, 0x4d, 0xd6, 0xe2, 0x3f, 0xbe, 0xe6, 0xce, 0x26, 0x5e, 0x3e, 0x95, 0x42, 0xa9, 0xa9,
+        0xdd, 0x7c, 0xe1, 0xfd, 0xfd, 0xd4, 0x81, 0x6b, 0xe6, 0x99, 0x22, 0xda, 0x7a, 0xde, 0x93, 0xec,
+        0xd4, 0xe2, 0x75, 0x4b, 0x54, 0x85, 0x14, 0x3b, 0xff, 0x51, 0x66, 0xa3, 0x2e, 0xce, 0xee, 0x67,
+        0x0e, 0x7c, 0xd2, 0x5c, 0xb2, 0x2c, 0x8a, 0x1f, 0xc1, 0xb3, 0xe0, 0x23, 0xb9, 0x8c, 0xfc, 0xcd,
+        0x81, 0xb5, 0x94, 0x56, 0x7a, 0x23, 0x49, 0x2e, 0x4e, 0x0b, 0xbd, 0x0d, 0xd0, 0x8b, 0xc2, 0x90,
+        0xf6, 0xb8, 0xb9, 0xe7, 0x9f, 0x55, 0x73, 0x33, 0xa8, 0xf7, 0x2d, 0x6b, 0x3f, 0xd7, 0x61, 0x21,
+        0x1a, 0xf1, 0x78, 0xc4, 0x75, 0x4a, 0xea, 0xd1, 0x85, 0xc3, 0xb0, 0xf5, 0xe3, 0x1a, 0x54, 0xcd,
+        0x93, 0x0c, 0x7d, 0x13, 0x6a, 0xfb, 0x94, 0xeb, 0x1f, 0xab, 0x3e, 0x77, 0xce, 0x6b, 0x57, 0x25,
+        0xd0, 0xe7, 0x0b, 0xbd, 0x89, 0xd1, 0x60, 0xce, 0xfb, 0x0f, 0x6d, 0x5a, 0xeb, 0x73, 0x11, 0xa9,
+        0xa5, 0xd7, 0x0a, 0x20, 0xb5, 0xb5, 0xef, 0x9c, 0xf5, 0xf8, 0x40, 0x37, 0x2c, 0x45, 0xf3, 0x61,
+        0xa9, 0xdd, 0x76, 0x51, 0xb8, 0x36, 0x3e, 0x9a, 0xff, 0x78, 0x40, 0xaf, 0xe7, 0xe8, 0x9a, 0x06,
+        0xa5, 0x86, 0xdf, 0x28, 0x06, 0xd6, 0x66, 0x83, 0xfc, 0x37, 0x28, 0xda, 0xb0, 0xb4, 0xe4, 0x01,
+        0x52, 0x73, 0x9b, 0xe7, 0x03, 0xb5, 0xa9, 0xbb, 0xd6, 0x1b, 0x03, 0xbd, 0x62, 0x2d, 0x4b, 0x67,
+        0x53, 0xa5, 0xaf, 0xce, 0x91, 0x6a, 0x4d, 0xdf, 0x98, 0xbc, 0xf1, 0xa3, 0x4f, 0xdb, 0x6f, 0x5b,
+        0x4b, 0x90, 0xea, 0x5b, 0x9f, 0x0f, 0xd0, 0x2a, 0x7b, 0x79, 0x57, 0x6a, 0x64, 0xa7, 0xe9, 0xac,
+        0x38, 0x55, 0xff, 0x85, 0xf3, 0x60, 0xda, 0xc8, 0x71, 0xee, 0x05, 0x0c, 0xd9, 0xcb, 0x73, 0xe4,
+        0xa9, 0x99, 0x8d, 0x73, 0x71, 0x99, 0x9d, 0x9c, 0xb6, 0x38, 0x61, 0x27, 0xaf, 0x6d, 0xe6, 0xd9,
+        0xc9, 0xc7, 0x69, 0x3b, 0x8f, 0xa7, 0x3b, 0x21, 0xfa, 0xcc, 0x94, 0xa3, 0x33, 0x51, 0xaa, 0xbd,
+        0x75, 0x16, 0x44, 0x2b, 0xfe, 0xb2, 0xfa, 0x29, 0x1f, 0x4d, 0xfc, 0x12, 0xca, 0xa3, 0x38, 0x55,
+        0xd2, 0x9c, 0x15, 0xa8, 0xa5, 0x5b, 0xdf, 0x77, 0xa1, 0x6e, 0x35, 0x06, 0xf4, 0x81, 0x5d, 0x9c,
+        0x36, 0x72, 0xca, 0x8e, 0xdd, 0xe3, 0x72, 0xb3, 0x7a, 0x0e, 0x50, 0x53, 0x3d, 0x3d, 0xa3, 0x1f,
+        0xa1, 0xbc, 0xb3, 0x38, 0x83, 0x4a, 0x8d, 0xde, 0x28, 0x88, 0xd6, 0x96, 0x9f, 0xe4, 0xb4, 0x9a,
+        0x89, 0xf2, 0x3b, 0x23, 0xcd, 0x2d, 0xbf, 0x79, 0x28, 0x65, 0xe1, 0x4d, 0xe7, 0x12, 0x81, 0x78,
+        0xb2, 0x20, 0xff, 0xa3, 0xbb, 0xf5, 0xdf, 0x00, 0x00, 0x00, 0xff, 0xff, 0xc8, 0x16, 0x0b, 0x32,
+        0xb6, 0x1b, 0x00, 0x00,
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/tfplugin5/tfplugin5.proto b/vendor/github.com/hashicorp/terraform/internal/tfplugin5/tfplugin5.proto
new file mode 100644
index 0000000..370faf7
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/tfplugin5/tfplugin5.proto
@@ -0,0 +1,351 @@
+// Terraform Plugin RPC protocol version 5.0
+//
+// This file defines version 5.0 of the RPC protocol. To implement a plugin
+// against this protocol, copy this definition into your own codebase and
+// use protoc to generate stubs for your target language.
+//
+// This file will be updated in-place in the source Terraform repository for
+// any minor versions of protocol 5, but later minor versions will always be
+// backwards compatible. Breaking changes, if any are required, will come
+// in a subsequent major version with its own separate proto definition.
+//
+// Note that only the proto files included in a release tag of Terraform are
+// official protocol releases. Proto files taken from other commits may include
+// incomplete changes or features that did not make it into a final release.
+// In all reasonable cases, plugin developers should take the proto file from
+// the tag of the most recent release of Terraform, and not from the master
+// branch or any other development branch.
+//
+syntax = "proto3";
+
+package tfplugin5;
+
+// DynamicValue is an opaque encoding of terraform data, with the field name
+// indicating the encoding scheme used.
+message DynamicValue {
+    bytes msgpack = 1;
+    bytes json = 2;
+}
+
+message Diagnostic {
+    enum Severity {
+        INVALID = 0;
+        ERROR = 1;
+        WARNING = 2;
+    }
+    Severity severity = 1;
+    string summary = 2;
+    string detail = 3;
+    AttributePath attribute = 4;
+}
+
+message AttributePath {
+    message Step {
+        oneof selector {
+            // Set "attribute_name" to represent looking up an attribute
+            // in the current object value.
+            string attribute_name = 1;
+            // Set "element_key_*" to represent looking up an element in
+            // an indexable collection type.
+            string element_key_string = 2;
+            int64 element_key_int = 3;
+        }
+    }
+    repeated Step steps = 1;
+}
+
+message Stop {
+    message Request {
+    }
+    message Response {
+                string Error = 1;
+    }
+}
+
+// RawState holds the stored state for a resource to be upgraded by the
+// provider. It can be in one of two formats, the current json encoded format
+// in bytes, or the legacy flatmap format as a map of strings.
+message RawState {
+    bytes json = 1;
+    map<string, string> flatmap = 2;
+}
+
+// Schema is the configuration schema for a Resource, Provider, or Provisioner.
+message Schema {
+    message Block {
+        int64 version = 1;
+        repeated Attribute attributes = 2;
+        repeated NestedBlock block_types = 3;
+    }
+
+    message Attribute {
+        string name = 1;
+        bytes type = 2;
+        string description = 3;
+        bool required = 4;
+        bool optional = 5;
+        bool computed = 6;
+        bool sensitive = 7;
+    }
+
+    message NestedBlock {
+        enum NestingMode {
+            INVALID = 0;
+            SINGLE = 1;
+            LIST = 2;
+            SET = 3;
+            MAP = 4;
+            GROUP = 5;
+        }
+
+        string type_name = 1;
+        Block block = 2;
+        NestingMode nesting = 3;
+        int64 min_items = 4;
+        int64 max_items = 5;
+    }
+
+    // The version of the schema.
+    // Schemas are versioned, so that providers can upgrade a saved resource
+    // state when the schema is changed. 
+    int64 version = 1;
+
+    // Block is the top level configuration block for this schema.
+    Block block = 2;
+}
+
+service Provider {
+    //////// Information about what a provider supports/expects
+    rpc GetSchema(GetProviderSchema.Request) returns (GetProviderSchema.Response);
+    rpc PrepareProviderConfig(PrepareProviderConfig.Request) returns (PrepareProviderConfig.Response);
+    rpc ValidateResourceTypeConfig(ValidateResourceTypeConfig.Request) returns (ValidateResourceTypeConfig.Response);
+    rpc ValidateDataSourceConfig(ValidateDataSourceConfig.Request) returns (ValidateDataSourceConfig.Response);
+    rpc UpgradeResourceState(UpgradeResourceState.Request) returns (UpgradeResourceState.Response);
+
+    //////// One-time initialization, called before other functions below
+    rpc Configure(Configure.Request) returns (Configure.Response);
+
+    //////// Managed Resource Lifecycle
+    rpc ReadResource(ReadResource.Request) returns (ReadResource.Response);
+    rpc PlanResourceChange(PlanResourceChange.Request) returns (PlanResourceChange.Response);
+    rpc ApplyResourceChange(ApplyResourceChange.Request) returns (ApplyResourceChange.Response);
+    rpc ImportResourceState(ImportResourceState.Request) returns (ImportResourceState.Response);
+
+    rpc ReadDataSource(ReadDataSource.Request) returns (ReadDataSource.Response);
+
+    //////// Graceful Shutdown
+    rpc Stop(Stop.Request) returns (Stop.Response);
+}
+
+message GetProviderSchema {
+    message Request {
+    }
+    message Response {
+        Schema provider = 1;
+        map<string, Schema> resource_schemas = 2;
+        map<string, Schema> data_source_schemas = 3;
+        repeated Diagnostic diagnostics = 4;
+    }
+}
+
+message PrepareProviderConfig {
+    message Request {
+        DynamicValue config = 1;
+    }
+    message Response {
+        DynamicValue prepared_config = 1;
+        repeated Diagnostic diagnostics = 2;
+    }
+}
+
+message UpgradeResourceState {
+    message Request {
+        string type_name = 1;
+
+        // version is the schema_version number recorded in the state file
+        int64 version = 2;
+
+        // raw_state is the raw states as stored for the resource.  Core does
+        // not have access to the schema of prior_version, so it's the
+        // provider's responsibility to interpret this value using the
+        // appropriate older schema. The raw_state will be the json encoded
+        // state, or a legacy flat-mapped format.
+        RawState raw_state = 3;
+    }
+    message Response {
+        // new_state is a msgpack-encoded data structure that, when interpreted with
+        // the _current_ schema for this resource type, is functionally equivalent to
+        // that which was given in prior_state_raw.
+        DynamicValue upgraded_state = 1;
+
+        // diagnostics describes any errors encountered during migration that could not
+        // be safely resolved, and warnings about any possibly-risky assumptions made
+        // in the upgrade process.
+        repeated Diagnostic diagnostics = 2;
+    }
+}
+
+message ValidateResourceTypeConfig {
+    message Request {
+        string type_name = 1;
+        DynamicValue config = 2;
+    }
+    message Response {
+        repeated Diagnostic diagnostics = 1;
+    }
+}
+
+message ValidateDataSourceConfig {
+    message Request {
+        string type_name = 1;
+        DynamicValue config = 2;
+    }
+    message Response {
+        repeated Diagnostic diagnostics = 1;
+    }
+}
+
+message Configure {
+    message Request {
+        string terraform_version = 1;
+        DynamicValue config = 2;
+    }
+    message Response {
+        repeated Diagnostic diagnostics = 1;
+    }
+}
+
+message ReadResource {
+    message Request {
+        string type_name = 1;
+        DynamicValue current_state = 2;
+    }
+    message Response {
+        DynamicValue new_state = 1;
+        repeated Diagnostic diagnostics = 2;
+    }
+}
+
+message PlanResourceChange {
+    message Request {
+        string type_name = 1;
+        DynamicValue prior_state = 2;
+        DynamicValue proposed_new_state = 3;
+        DynamicValue config = 4;
+        bytes prior_private = 5; 
+    }
+
+    message Response {
+        DynamicValue planned_state = 1;
+        repeated AttributePath requires_replace = 2;
+        bytes planned_private = 3; 
+        repeated Diagnostic diagnostics = 4;
+
+
+        // This may be set only by the helper/schema "SDK" in the main Terraform
+        // repository, to request that Terraform Core >=0.12 permit additional
+        // inconsistencies that can result from the legacy SDK type system
+        // and its imprecise mapping to the >=0.12 type system.
+        // The change in behavior implied by this flag makes sense only for the
+        // specific details of the legacy SDK type system, and are not a general
+        // mechanism to avoid proper type handling in providers.
+        //
+        //     ====              DO NOT USE THIS              ====
+        //     ==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
+        //     ====              DO NOT USE THIS              ====
+        bool legacy_type_system = 5;
+    }
+}
+
+message ApplyResourceChange {
+    message Request {
+        string type_name = 1;
+        DynamicValue prior_state = 2;
+        DynamicValue planned_state = 3;
+        DynamicValue config = 4;
+        bytes planned_private = 5; 
+    }
+    message Response {
+        DynamicValue new_state = 1;
+        bytes private = 2; 
+        repeated Diagnostic diagnostics = 3;
+
+        // This may be set only by the helper/schema "SDK" in the main Terraform
+        // repository, to request that Terraform Core >=0.12 permit additional
+        // inconsistencies that can result from the legacy SDK type system
+        // and its imprecise mapping to the >=0.12 type system.
+        // The change in behavior implied by this flag makes sense only for the
+        // specific details of the legacy SDK type system, and are not a general
+        // mechanism to avoid proper type handling in providers.
+        //
+        //     ====              DO NOT USE THIS              ====
+        //     ==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
+        //     ====              DO NOT USE THIS              ====
+        bool legacy_type_system = 4;
+    }
+}
+
+message ImportResourceState {
+    message Request {
+        string type_name = 1;
+        string id = 2;
+    }
+
+    message ImportedResource {
+        string type_name = 1;
+        DynamicValue state = 2;
+        bytes private = 3;
+    }
+
+    message Response {
+        repeated ImportedResource imported_resources = 1;
+        repeated Diagnostic diagnostics = 2;
+    }
+}
+
+message ReadDataSource {
+    message Request {
+        string type_name = 1;
+        DynamicValue config = 2;
+    }
+    message Response {
+        DynamicValue state = 1;
+        repeated Diagnostic diagnostics = 2;
+    }
+}
+
+service Provisioner {
+    rpc GetSchema(GetProvisionerSchema.Request) returns (GetProvisionerSchema.Response);
+    rpc ValidateProvisionerConfig(ValidateProvisionerConfig.Request) returns (ValidateProvisionerConfig.Response);
+    rpc ProvisionResource(ProvisionResource.Request) returns (stream ProvisionResource.Response);
+    rpc Stop(Stop.Request) returns (Stop.Response);
+}
+
+message GetProvisionerSchema {
+    message Request {
+    }
+    message Response {
+        Schema provisioner = 1;
+        repeated Diagnostic diagnostics = 2;
+    }
+}
+
+message ValidateProvisionerConfig {
+    message Request {
+        DynamicValue config = 1;
+    }
+    message Response {
+        repeated Diagnostic diagnostics = 1;
+    }
+}
+
+message ProvisionResource {
+    message Request {
+        DynamicValue config = 1;
+        DynamicValue connection = 2;
+    }
+    message Response {
+        string output  = 1;
+        repeated Diagnostic diagnostics = 2;
+    }   
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/blocktoattr/doc.go b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/doc.go
new file mode 100644
index 0000000..8f89909
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/doc.go
@@ -0,0 +1,5 @@
+// Package blocktoattr includes some helper functions that can perform
+// preprocessing on a HCL body where a configschema.Block schema is available
+// in order to allow list and set attributes defined in the schema to be
+// optionally written by the user as block syntax.
+package blocktoattr
diff --git a/vendor/github.com/hashicorp/terraform/lang/blocktoattr/fixup.go b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/fixup.go
new file mode 100644
index 0000000..d8c2e77
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/fixup.go
@@ -0,0 +1,187 @@
+package blocktoattr
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// FixUpBlockAttrs takes a raw HCL body and adds some additional normalization
+// functionality to allow attributes that are specified as having list or set
+// type in the schema to be written with HCL block syntax as multiple nested
+// blocks with the attribute name as the block type.
+//
+// This partially restores some of the block/attribute confusion from HCL 1
+// so that existing patterns that depended on that confusion can continue to
+// be used in the short term while we settle on a longer-term strategy.
+//
+// Most of the fixup work is actually done when the returned body is
+// subsequently decoded, so while FixUpBlockAttrs always succeeds, the eventual
+// decode of the body might not, if the content of the body is so ambiguous
+// that there's no safe way to map it to the schema.
+func FixUpBlockAttrs(body hcl.Body, schema *configschema.Block) hcl.Body {
+        // The schema should never be nil, but in practice it seems to be sometimes
+        // in the presence of poorly-configured test mocks, so we'll be robust
+        // by synthesizing an empty one.
+        if schema == nil {
+                schema = &configschema.Block{}
+        }
+
+        return &fixupBody{
+                original: body,
+                schema:   schema,
+                names:    ambiguousNames(schema),
+        }
+}
+
+type fixupBody struct {
+        original hcl.Body
+        schema   *configschema.Block
+        names    map[string]struct{}
+}
+
+// Content decodes content from the body. The given schema must be the lower-level
+// representation of the same schema that was previously passed to FixUpBlockAttrs,
+// or else the result is undefined.
+func (b *fixupBody) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) {
+        schema = b.effectiveSchema(schema)
+        content, diags := b.original.Content(schema)
+        return b.fixupContent(content), diags
+}
+
+func (b *fixupBody) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) {
+        schema = b.effectiveSchema(schema)
+        content, remain, diags := b.original.PartialContent(schema)
+        remain = &fixupBody{
+                original: remain,
+                schema:   b.schema,
+                names:    b.names,
+        }
+        return b.fixupContent(content), remain, diags
+}
+
+func (b *fixupBody) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
+        // FixUpBlockAttrs is not intended to be used in situations where we'd use
+        // JustAttributes, so we just pass this through verbatim to complete our
+        // implementation of hcl.Body.
+        return b.original.JustAttributes()
+}
+
+func (b *fixupBody) MissingItemRange() hcl.Range {
+        return b.original.MissingItemRange()
+}
+
+// effectiveSchema produces a derived *hcl.BodySchema by sniffing the body's
+// content to determine whether the author has used attribute or block syntax
+// for each of the ambigious attributes where both are permitted.
+//
+// The resulting schema will always contain all of the same names that are
+// in the given schema, but some attribute schemas may instead be replaced by
+// block header schemas.
+func (b *fixupBody) effectiveSchema(given *hcl.BodySchema) *hcl.BodySchema {
+        return effectiveSchema(given, b.original, b.names, true)
+}
+
+func (b *fixupBody) fixupContent(content *hcl.BodyContent) *hcl.BodyContent {
+        var ret hcl.BodyContent
+        ret.Attributes = make(hcl.Attributes)
+        for name, attr := range content.Attributes {
+                ret.Attributes[name] = attr
+        }
+        blockAttrVals := make(map[string][]*hcl.Block)
+        for _, block := range content.Blocks {
+                if _, exists := b.names[block.Type]; exists {
+                        // If we get here then we've found a block type whose instances need
+                        // to be re-interpreted as a list-of-objects attribute. We'll gather
+                        // those up and fix them up below.
+                        blockAttrVals[block.Type] = append(blockAttrVals[block.Type], block)
+                        continue
+                }
+
+                // We need to now re-wrap our inner body so it will be subject to the
+                // same attribute-as-block fixup when recursively decoded.
+                retBlock := *block // shallow copy
+                if blockS, ok := b.schema.BlockTypes[block.Type]; ok {
+                        // Would be weird if not ok, but we'll allow it for robustness; body just won't be fixed up, then
+                        retBlock.Body = FixUpBlockAttrs(retBlock.Body, &blockS.Block)
+                }
+
+                ret.Blocks = append(ret.Blocks, &retBlock)
+        }
+        // No we'll install synthetic attributes for each of our fixups. We can't
+        // do this exactly because HCL's information model expects an attribute
+        // to be a single decl but we have multiple separate blocks. We'll
+        // approximate things, then, by using only our first block for the source
+        // location information. (We are guaranteed at least one by the above logic.)
+        for name, blocks := range blockAttrVals {
+                ret.Attributes[name] = &hcl.Attribute{
+                        Name: name,
+                        Expr: &fixupBlocksExpr{
+                                blocks: blocks,
+                                ety:    b.schema.Attributes[name].Type.ElementType(),
+                        },
+
+                        Range:     blocks[0].DefRange,
+                        NameRange: blocks[0].TypeRange,
+                }
+        }
+        return &ret
+}
+
+type fixupBlocksExpr struct {
+        blocks hcl.Blocks
+        ety    cty.Type
+}
+
+func (e *fixupBlocksExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        // In order to produce a suitable value for our expression we need to
+        // now decode the whole descendent block structure under each of our block
+        // bodies.
+        //
+        // That requires us to do something rather strange: we must construct a
+        // synthetic block type schema derived from the element type of the
+        // attribute, thus inverting our usual direction of lowering a schema
+        // into an implied type. Because a type is less detailed than a schema,
+        // the result is imprecise and in particular will just consider all
+        // the attributes to be optional and let the provider eventually decide
+        // whether to return errors if they turn out to be null when required.
+        schema := SchemaForCtyElementType(e.ety) // this schema's ImpliedType will match e.ety
+        spec := schema.DecoderSpec()
+
+        vals := make([]cty.Value, len(e.blocks))
+        var diags hcl.Diagnostics
+        for i, block := range e.blocks {
+                body := FixUpBlockAttrs(block.Body, schema)
+                val, blockDiags := hcldec.Decode(body, spec, ctx)
+                diags = append(diags, blockDiags...)
+                if val == cty.NilVal {
+                        val = cty.UnknownVal(e.ety)
+                }
+                vals[i] = val
+        }
+        if len(vals) == 0 {
+                return cty.ListValEmpty(e.ety), diags
+        }
+        return cty.ListVal(vals), diags
+}
+
+func (e *fixupBlocksExpr) Variables() []hcl.Traversal {
+        var ret []hcl.Traversal
+        schema := SchemaForCtyElementType(e.ety)
+        spec := schema.DecoderSpec()
+        for _, block := range e.blocks {
+                ret = append(ret, hcldec.Variables(block.Body, spec)...)
+        }
+        return ret
+}
+
+func (e *fixupBlocksExpr) Range() hcl.Range {
+        // This is not really an appropriate range for the expression but it's
+        // the best we can do from here.
+        return e.blocks[0].DefRange
+}
+
+func (e *fixupBlocksExpr) StartRange() hcl.Range {
+        return e.blocks[0].DefRange
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/blocktoattr/schema.go b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/schema.go
new file mode 100644
index 0000000..2f2463a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/schema.go
@@ -0,0 +1,145 @@
+package blocktoattr
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+func ambiguousNames(schema *configschema.Block) map[string]struct{} {
+        if schema == nil {
+                return nil
+        }
+        ambiguousNames := make(map[string]struct{})
+        for name, attrS := range schema.Attributes {
+                aty := attrS.Type
+                if (aty.IsListType() || aty.IsSetType()) && aty.ElementType().IsObjectType() {
+                        ambiguousNames[name] = struct{}{}
+                }
+        }
+        return ambiguousNames
+}
+
+func effectiveSchema(given *hcl.BodySchema, body hcl.Body, ambiguousNames map[string]struct{}, dynamicExpanded bool) *hcl.BodySchema {
+        ret := &hcl.BodySchema{}
+
+        appearsAsBlock := make(map[string]struct{})
+        {
+                // We'll construct some throwaway schemas here just to probe for
+                // whether each of our ambiguous names seems to be being used as
+                // an attribute or a block. We need to check both because in JSON
+                // syntax we rely on the schema to decide between attribute or block
+                // interpretation and so JSON will always answer yes to both of
+                // these questions and we want to prefer the attribute interpretation
+                // in that case.
+                var probeSchema hcl.BodySchema
+
+                for name := range ambiguousNames {
+                        probeSchema = hcl.BodySchema{
+                                Attributes: []hcl.AttributeSchema{
+                                        {
+                                                Name: name,
+                                        },
+                                },
+                        }
+                        content, _, _ := body.PartialContent(&probeSchema)
+                        if _, exists := content.Attributes[name]; exists {
+                                // Can decode as an attribute, so we'll go with that.
+                                continue
+                        }
+                        probeSchema = hcl.BodySchema{
+                                Blocks: []hcl.BlockHeaderSchema{
+                                        {
+                                                Type: name,
+                                        },
+                                },
+                        }
+                        content, _, _ = body.PartialContent(&probeSchema)
+                        if len(content.Blocks) > 0 {
+                                // No attribute present and at least one block present, so
+                                // we'll need to rewrite this one as a block for a successful
+                                // result.
+                                appearsAsBlock[name] = struct{}{}
+                        }
+                }
+                if !dynamicExpanded {
+                        // If we're deciding for a context where dynamic blocks haven't
+                        // been expanded yet then we need to probe for those too.
+                        probeSchema = hcl.BodySchema{
+                                Blocks: []hcl.BlockHeaderSchema{
+                                        {
+                                                Type:       "dynamic",
+                                                LabelNames: []string{"type"},
+                                        },
+                                },
+                        }
+                        content, _, _ := body.PartialContent(&probeSchema)
+                        for _, block := range content.Blocks {
+                                if _, exists := ambiguousNames[block.Labels[0]]; exists {
+                                        appearsAsBlock[block.Labels[0]] = struct{}{}
+                                }
+                        }
+                }
+        }
+
+        for _, attrS := range given.Attributes {
+                if _, exists := appearsAsBlock[attrS.Name]; exists {
+                        ret.Blocks = append(ret.Blocks, hcl.BlockHeaderSchema{
+                                Type: attrS.Name,
+                        })
+                } else {
+                        ret.Attributes = append(ret.Attributes, attrS)
+                }
+        }
+
+        // Anything that is specified as a block type in the input schema remains
+        // that way by just passing through verbatim.
+        ret.Blocks = append(ret.Blocks, given.Blocks...)
+
+        return ret
+}
+
+// SchemaForCtyElementType converts a cty object type into an
+// approximately-equivalent configschema.Block representing the element of
+// a list or set. If the given type is not an object type then this
+// function will panic.
+func SchemaForCtyElementType(ty cty.Type) *configschema.Block {
+        atys := ty.AttributeTypes()
+        ret := &configschema.Block{
+                Attributes: make(map[string]*configschema.Attribute, len(atys)),
+        }
+        for name, aty := range atys {
+                ret.Attributes[name] = &configschema.Attribute{
+                        Type:     aty,
+                        Optional: true,
+                }
+        }
+        return ret
+}
+
+// SchemaForCtyContainerType converts a cty list-of-object or set-of-object type
+// into an approximately-equivalent configschema.NestedBlock. If the given type
+// is not of the expected kind then this function will panic.
+func SchemaForCtyContainerType(ty cty.Type) *configschema.NestedBlock {
+        var nesting configschema.NestingMode
+        switch {
+        case ty.IsListType():
+                nesting = configschema.NestingList
+        case ty.IsSetType():
+                nesting = configschema.NestingSet
+        default:
+                panic("unsuitable type")
+        }
+        nested := SchemaForCtyElementType(ty.ElementType())
+        return &configschema.NestedBlock{
+                Nesting: nesting,
+                Block:   *nested,
+        }
+}
+
+// TypeCanBeBlocks returns true if the given type is a list-of-object or
+// set-of-object type, and would thus be subject to the blocktoattr fixup
+// if used as an attribute type.
+func TypeCanBeBlocks(ty cty.Type) bool {
+        return (ty.IsListType() || ty.IsSetType()) && ty.ElementType().IsObjectType()
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/blocktoattr/variables.go b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/variables.go
new file mode 100644
index 0000000..e123b8a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/variables.go
@@ -0,0 +1,43 @@
+package blocktoattr
+
+import (
+        "github.com/hashicorp/hcl2/ext/dynblock"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/hashicorp/terraform/configs/configschema"
+)
+
+// ExpandedVariables finds all of the global variables referenced in the
+// given body with the given schema while taking into account the possibilities
+// both of "dynamic" blocks being expanded and the possibility of certain
+// attributes being written instead as nested blocks as allowed by the
+// FixUpBlockAttrs function.
+//
+// This function exists to allow variables to be analyzed prior to dynamic
+// block expansion while also dealing with the fact that dynamic block expansion
+// might in turn produce nested blocks that are subject to FixUpBlockAttrs.
+//
+// This is intended as a drop-in replacement for dynblock.VariablesHCLDec,
+// which is itself a drop-in replacement for hcldec.Variables.
+func ExpandedVariables(body hcl.Body, schema *configschema.Block) []hcl.Traversal {
+        rootNode := dynblock.WalkVariables(body)
+        return walkVariables(rootNode, body, schema)
+}
+
+func walkVariables(node dynblock.WalkVariablesNode, body hcl.Body, schema *configschema.Block) []hcl.Traversal {
+        givenRawSchema := hcldec.ImpliedSchema(schema.DecoderSpec())
+        ambiguousNames := ambiguousNames(schema)
+        effectiveRawSchema := effectiveSchema(givenRawSchema, body, ambiguousNames, false)
+        vars, children := node.Visit(effectiveRawSchema)
+
+        for _, child := range children {
+                if blockS, exists := schema.BlockTypes[child.BlockTypeName]; exists {
+                        vars = append(vars, walkVariables(child.Node, child.Body(), &blockS.Block)...)
+                } else if attrS, exists := schema.Attributes[child.BlockTypeName]; exists {
+                        synthSchema := SchemaForCtyElementType(attrS.Type.ElementType())
+                        vars = append(vars, walkVariables(child.Node, child.Body(), synthSchema)...)
+                }
+        }
+
+        return vars
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/data.go b/vendor/github.com/hashicorp/terraform/lang/data.go
new file mode 100644
index 0000000..80313d6
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/data.go
@@ -0,0 +1,33 @@
+package lang
+
+import (
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Data is an interface whose implementations can provide cty.Value
+// representations of objects identified by referenceable addresses from
+// the addrs package.
+//
+// This interface will grow each time a new type of reference is added, and so
+// implementations outside of the Terraform codebases are not advised.
+//
+// Each method returns a suitable value and optionally some diagnostics. If the
+// returned diagnostics contains errors then the type of the returned value is
+// used to construct an unknown value of the same type which is then used in
+// place of the requested object so that type checking can still proceed. In
+// cases where it's not possible to even determine a suitable result type,
+// cty.DynamicVal is returned along with errors describing the problem.
+type Data interface {
+        StaticValidateReferences(refs []*addrs.Reference, self addrs.Referenceable) tfdiags.Diagnostics
+
+        GetCountAttr(addrs.CountAttr, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetResourceInstance(addrs.ResourceInstance, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetLocalValue(addrs.LocalValue, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetModuleInstance(addrs.ModuleCallInstance, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetModuleInstanceOutput(addrs.ModuleCallOutput, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetPathAttr(addrs.PathAttr, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetTerraformAttr(addrs.TerraformAttr, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetInputVariable(addrs.InputVariable, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/doc.go b/vendor/github.com/hashicorp/terraform/lang/doc.go
new file mode 100644
index 0000000..af5c5ca
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/doc.go
@@ -0,0 +1,5 @@
+// Package lang deals with the runtime aspects of Terraform's configuration
+// language, with concerns such as expression evaluation. It is closely related
+// to sibling package "configs", which is responsible for configuration
+// parsing and static validation.
+package lang
diff --git a/vendor/github.com/hashicorp/terraform/lang/eval.go b/vendor/github.com/hashicorp/terraform/lang/eval.go
new file mode 100644
index 0000000..a3fb363
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/eval.go
@@ -0,0 +1,477 @@
+package lang
+
+import (
+        "fmt"
+        "log"
+        "strconv"
+
+        "github.com/hashicorp/hcl2/ext/dynblock"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang/blocktoattr"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+)
+
+// ExpandBlock expands any "dynamic" blocks present in the given body. The
+// result is a body with those blocks expanded, ready to be evaluated with
+// EvalBlock.
+//
+// If the returned diagnostics contains errors then the result may be
+// incomplete or invalid.
+func (s *Scope) ExpandBlock(body hcl.Body, schema *configschema.Block) (hcl.Body, tfdiags.Diagnostics) {
+        spec := schema.DecoderSpec()
+
+        traversals := dynblock.ExpandVariablesHCLDec(body, spec)
+        refs, diags := References(traversals)
+
+        ctx, ctxDiags := s.EvalContext(refs)
+        diags = diags.Append(ctxDiags)
+
+        return dynblock.Expand(body, ctx), diags
+}
+
+// EvalBlock evaluates the given body using the given block schema and returns
+// a cty object value representing its contents. The type of the result conforms
+// to the implied type of the given schema.
+//
+// This function does not automatically expand "dynamic" blocks within the
+// body. If that is desired, first call the ExpandBlock method to obtain
+// an expanded body to pass to this method.
+//
+// If the returned diagnostics contains errors then the result may be
+// incomplete or invalid.
+func (s *Scope) EvalBlock(body hcl.Body, schema *configschema.Block) (cty.Value, tfdiags.Diagnostics) {
+        spec := schema.DecoderSpec()
+
+        refs, diags := ReferencesInBlock(body, schema)
+
+        ctx, ctxDiags := s.EvalContext(refs)
+        diags = diags.Append(ctxDiags)
+        if diags.HasErrors() {
+                // We'll stop early if we found problems in the references, because
+                // it's likely evaluation will produce redundant copies of the same errors.
+                return cty.UnknownVal(schema.ImpliedType()), diags
+        }
+
+        // HACK: In order to remain compatible with some assumptions made in
+        // Terraform v0.11 and earlier about the approximate equivalence of
+        // attribute vs. block syntax, we do a just-in-time fixup here to allow
+        // any attribute in the schema that has a list-of-objects or set-of-objects
+        // kind to potentially be populated instead by one or more nested blocks
+        // whose type is the attribute name.
+        body = blocktoattr.FixUpBlockAttrs(body, schema)
+
+        val, evalDiags := hcldec.Decode(body, spec, ctx)
+        diags = diags.Append(evalDiags)
+
+        return val, diags
+}
+
+// EvalExpr evaluates a single expression in the receiving context and returns
+// the resulting value. The value will be converted to the given type before
+// it is returned if possible, or else an error diagnostic will be produced
+// describing the conversion error.
+//
+// Pass an expected type of cty.DynamicPseudoType to skip automatic conversion
+// and just obtain the returned value directly.
+//
+// If the returned diagnostics contains errors then the result may be
+// incomplete, but will always be of the requested type.
+func (s *Scope) EvalExpr(expr hcl.Expression, wantType cty.Type) (cty.Value, tfdiags.Diagnostics) {
+        refs, diags := ReferencesInExpr(expr)
+
+        ctx, ctxDiags := s.EvalContext(refs)
+        diags = diags.Append(ctxDiags)
+        if diags.HasErrors() {
+                // We'll stop early if we found problems in the references, because
+                // it's likely evaluation will produce redundant copies of the same errors.
+                return cty.UnknownVal(wantType), diags
+        }
+
+        val, evalDiags := expr.Value(ctx)
+        diags = diags.Append(evalDiags)
+
+        if wantType != cty.DynamicPseudoType {
+                var convErr error
+                val, convErr = convert.Convert(val, wantType)
+                if convErr != nil {
+                        val = cty.UnknownVal(wantType)
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Incorrect value type",
+                                Detail:   fmt.Sprintf("Invalid expression value: %s.", tfdiags.FormatError(convErr)),
+                                Subject:  expr.Range().Ptr(),
+                        })
+                }
+        }
+
+        return val, diags
+}
+
+// EvalReference evaluates the given reference in the receiving scope and
+// returns the resulting value. The value will be converted to the given type before
+// it is returned if possible, or else an error diagnostic will be produced
+// describing the conversion error.
+//
+// Pass an expected type of cty.DynamicPseudoType to skip automatic conversion
+// and just obtain the returned value directly.
+//
+// If the returned diagnostics contains errors then the result may be
+// incomplete, but will always be of the requested type.
+func (s *Scope) EvalReference(ref *addrs.Reference, wantType cty.Type) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // We cheat a bit here and just build an EvalContext for our requested
+        // reference with the "self" address overridden, and then pull the "self"
+        // result out of it to return.
+        ctx, ctxDiags := s.evalContext([]*addrs.Reference{ref}, ref.Subject)
+        diags = diags.Append(ctxDiags)
+        val := ctx.Variables["self"]
+        if val == cty.NilVal {
+                val = cty.DynamicVal
+        }
+
+        var convErr error
+        val, convErr = convert.Convert(val, wantType)
+        if convErr != nil {
+                val = cty.UnknownVal(wantType)
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Incorrect value type",
+                        Detail:   fmt.Sprintf("Invalid expression value: %s.", tfdiags.FormatError(convErr)),
+                        Subject:  ref.SourceRange.ToHCL().Ptr(),
+                })
+        }
+
+        return val, diags
+}
+
+// EvalContext constructs a HCL expression evaluation context whose variable
+// scope contains sufficient values to satisfy the given set of references.
+//
+// Most callers should prefer to use the evaluation helper methods that
+// this type offers, but this is here for less common situations where the
+// caller will handle the evaluation calls itself.
+func (s *Scope) EvalContext(refs []*addrs.Reference) (*hcl.EvalContext, tfdiags.Diagnostics) {
+        return s.evalContext(refs, s.SelfAddr)
+}
+
+func (s *Scope) evalContext(refs []*addrs.Reference, selfAddr addrs.Referenceable) (*hcl.EvalContext, tfdiags.Diagnostics) {
+        if s == nil {
+                panic("attempt to construct EvalContext for nil Scope")
+        }
+
+        var diags tfdiags.Diagnostics
+        vals := make(map[string]cty.Value)
+        funcs := s.Functions()
+        ctx := &hcl.EvalContext{
+                Variables: vals,
+                Functions: funcs,
+        }
+
+        if len(refs) == 0 {
+                // Easy path for common case where there are no references at all.
+                return ctx, diags
+        }
+
+        // First we'll do static validation of the references. This catches things
+        // early that might otherwise not get caught due to unknown values being
+        // present in the scope during planning.
+        if staticDiags := s.Data.StaticValidateReferences(refs, selfAddr); staticDiags.HasErrors() {
+                diags = diags.Append(staticDiags)
+                return ctx, diags
+        }
+
+        // The reference set we are given has not been de-duped, and so there can
+        // be redundant requests in it for two reasons:
+        //  - The same item is referenced multiple times
+        //  - Both an item and that item's container are separately referenced.
+        // We will still visit every reference here and ask our data source for
+        // it, since that allows us to gather a full set of any errors and
+        // warnings, but once we've gathered all the data we'll then skip anything
+        // that's redundant in the process of populating our values map.
+        dataResources := map[string]map[string]map[addrs.InstanceKey]cty.Value{}
+        managedResources := map[string]map[string]map[addrs.InstanceKey]cty.Value{}
+        wholeModules := map[string]map[addrs.InstanceKey]cty.Value{}
+        moduleOutputs := map[string]map[addrs.InstanceKey]map[string]cty.Value{}
+        inputVariables := map[string]cty.Value{}
+        localValues := map[string]cty.Value{}
+        pathAttrs := map[string]cty.Value{}
+        terraformAttrs := map[string]cty.Value{}
+        countAttrs := map[string]cty.Value{}
+        var self cty.Value
+
+        for _, ref := range refs {
+                rng := ref.SourceRange
+                isSelf := false
+
+                rawSubj := ref.Subject
+                if rawSubj == addrs.Self {
+                        if selfAddr == nil {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  `Invalid "self" reference`,
+                                        // This detail message mentions some current practice that
+                                        // this codepath doesn't really "know about". If the "self"
+                                        // object starts being supported in more contexts later then
+                                        // we'll need to adjust this message.
+                                        Detail:  `The "self" object is not available in this context. This object can be used only in resource provisioner and connection blocks.`,
+                                        Subject: ref.SourceRange.ToHCL().Ptr(),
+                                })
+                                continue
+                        }
+
+                        // Treat "self" as an alias for the configured self address.
+                        rawSubj = selfAddr
+                        isSelf = true
+
+                        if rawSubj == addrs.Self {
+                                // Programming error: the self address cannot alias itself.
+                                panic("scope SelfAddr attempting to alias itself")
+                        }
+                }
+
+                // This type switch must cover all of the "Referenceable" implementations
+                // in package addrs.
+                switch subj := rawSubj.(type) {
+
+                case addrs.ResourceInstance:
+                        var into map[string]map[string]map[addrs.InstanceKey]cty.Value
+                        switch subj.Resource.Mode {
+                        case addrs.ManagedResourceMode:
+                                into = managedResources
+                        case addrs.DataResourceMode:
+                                into = dataResources
+                        default:
+                                panic(fmt.Errorf("unsupported ResourceMode %s", subj.Resource.Mode))
+                        }
+
+                        val, valDiags := normalizeRefValue(s.Data.GetResourceInstance(subj, rng))
+                        diags = diags.Append(valDiags)
+
+                        r := subj.Resource
+                        if into[r.Type] == nil {
+                                into[r.Type] = make(map[string]map[addrs.InstanceKey]cty.Value)
+                        }
+                        if into[r.Type][r.Name] == nil {
+                                into[r.Type][r.Name] = make(map[addrs.InstanceKey]cty.Value)
+                        }
+                        into[r.Type][r.Name][subj.Key] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.ModuleCallInstance:
+                        val, valDiags := normalizeRefValue(s.Data.GetModuleInstance(subj, rng))
+                        diags = diags.Append(valDiags)
+
+                        if wholeModules[subj.Call.Name] == nil {
+                                wholeModules[subj.Call.Name] = make(map[addrs.InstanceKey]cty.Value)
+                        }
+                        wholeModules[subj.Call.Name][subj.Key] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.ModuleCallOutput:
+                        val, valDiags := normalizeRefValue(s.Data.GetModuleInstanceOutput(subj, rng))
+                        diags = diags.Append(valDiags)
+
+                        callName := subj.Call.Call.Name
+                        callKey := subj.Call.Key
+                        if moduleOutputs[callName] == nil {
+                                moduleOutputs[callName] = make(map[addrs.InstanceKey]map[string]cty.Value)
+                        }
+                        if moduleOutputs[callName][callKey] == nil {
+                                moduleOutputs[callName][callKey] = make(map[string]cty.Value)
+                        }
+                        moduleOutputs[callName][callKey][subj.Name] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.InputVariable:
+                        val, valDiags := normalizeRefValue(s.Data.GetInputVariable(subj, rng))
+                        diags = diags.Append(valDiags)
+                        inputVariables[subj.Name] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.LocalValue:
+                        val, valDiags := normalizeRefValue(s.Data.GetLocalValue(subj, rng))
+                        diags = diags.Append(valDiags)
+                        localValues[subj.Name] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.PathAttr:
+                        val, valDiags := normalizeRefValue(s.Data.GetPathAttr(subj, rng))
+                        diags = diags.Append(valDiags)
+                        pathAttrs[subj.Name] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.TerraformAttr:
+                        val, valDiags := normalizeRefValue(s.Data.GetTerraformAttr(subj, rng))
+                        diags = diags.Append(valDiags)
+                        terraformAttrs[subj.Name] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.CountAttr:
+                        val, valDiags := normalizeRefValue(s.Data.GetCountAttr(subj, rng))
+                        diags = diags.Append(valDiags)
+                        countAttrs[subj.Name] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                default:
+                        // Should never happen
+                        panic(fmt.Errorf("Scope.buildEvalContext cannot handle address type %T", rawSubj))
+                }
+        }
+
+        for k, v := range buildResourceObjects(managedResources) {
+                vals[k] = v
+        }
+        vals["data"] = cty.ObjectVal(buildResourceObjects(dataResources))
+        vals["module"] = cty.ObjectVal(buildModuleObjects(wholeModules, moduleOutputs))
+        vals["var"] = cty.ObjectVal(inputVariables)
+        vals["local"] = cty.ObjectVal(localValues)
+        vals["path"] = cty.ObjectVal(pathAttrs)
+        vals["terraform"] = cty.ObjectVal(terraformAttrs)
+        vals["count"] = cty.ObjectVal(countAttrs)
+        if self != cty.NilVal {
+                vals["self"] = self
+        }
+
+        return ctx, diags
+}
+
+func buildResourceObjects(resources map[string]map[string]map[addrs.InstanceKey]cty.Value) map[string]cty.Value {
+        vals := make(map[string]cty.Value)
+        for typeName, names := range resources {
+                nameVals := make(map[string]cty.Value)
+                for name, keys := range names {
+                        nameVals[name] = buildInstanceObjects(keys)
+                }
+                vals[typeName] = cty.ObjectVal(nameVals)
+        }
+        return vals
+}
+
+func buildModuleObjects(wholeModules map[string]map[addrs.InstanceKey]cty.Value, moduleOutputs map[string]map[addrs.InstanceKey]map[string]cty.Value) map[string]cty.Value {
+        vals := make(map[string]cty.Value)
+
+        for name, keys := range wholeModules {
+                vals[name] = buildInstanceObjects(keys)
+        }
+
+        for name, keys := range moduleOutputs {
+                if _, exists := wholeModules[name]; exists {
+                        // If we also have a whole module value for this name then we'll
+                        // skip this since the individual outputs are embedded in that result.
+                        continue
+                }
+
+                // The shape of this collection isn't compatible with buildInstanceObjects,
+                // but rather than replicating most of the buildInstanceObjects logic
+                // here we'll instead first transform the structure to be what that
+                // function expects and then use it. This is a little wasteful, but
+                // we do not expect this these maps to be large and so the extra work
+                // here should not hurt too much.
+                flattened := make(map[addrs.InstanceKey]cty.Value, len(keys))
+                for k, vals := range keys {
+                        flattened[k] = cty.ObjectVal(vals)
+                }
+                vals[name] = buildInstanceObjects(flattened)
+        }
+
+        return vals
+}
+
+func buildInstanceObjects(keys map[addrs.InstanceKey]cty.Value) cty.Value {
+        if val, exists := keys[addrs.NoKey]; exists {
+                // If present, a "no key" value supersedes all other values,
+                // since they should be embedded inside it.
+                return val
+        }
+
+        // If we only have individual values then we need to construct
+        // either a list or a map, depending on what sort of keys we
+        // have.
+        haveInt := false
+        haveString := false
+        maxInt := 0
+
+        for k := range keys {
+                switch tk := k.(type) {
+                case addrs.IntKey:
+                        haveInt = true
+                        if int(tk) > maxInt {
+                                maxInt = int(tk)
+                        }
+                case addrs.StringKey:
+                        haveString = true
+                }
+        }
+
+        // We should either have ints or strings and not both, but
+        // if we have both then we'll prefer strings and let the
+        // language interpreter try to convert the int keys into
+        // strings in a map.
+        switch {
+        case haveString:
+                vals := make(map[string]cty.Value)
+                for k, v := range keys {
+                        switch tk := k.(type) {
+                        case addrs.StringKey:
+                                vals[string(tk)] = v
+                        case addrs.IntKey:
+                                sk := strconv.Itoa(int(tk))
+                                vals[sk] = v
+                        }
+                }
+                return cty.ObjectVal(vals)
+        case haveInt:
+                // We'll make a tuple that is long enough for our maximum
+                // index value. It doesn't matter if we end up shorter than
+                // the number of instances because if length(...) were
+                // being evaluated we would've got a NoKey reference and
+                // thus not ended up in this codepath at all.
+                vals := make([]cty.Value, maxInt+1)
+                for i := range vals {
+                        if v, exists := keys[addrs.IntKey(i)]; exists {
+                                vals[i] = v
+                        } else {
+                                // Just a placeholder, since nothing will access this anyway
+                                vals[i] = cty.DynamicVal
+                        }
+                }
+                return cty.TupleVal(vals)
+        default:
+                // Should never happen because there are no other key types.
+                log.Printf("[ERROR] strange makeInstanceObjects call with no supported key types")
+                return cty.EmptyObjectVal
+        }
+}
+
+func normalizeRefValue(val cty.Value, diags tfdiags.Diagnostics) (cty.Value, tfdiags.Diagnostics) {
+        if diags.HasErrors() {
+                // If there are errors then we will force an unknown result so that
+                // we can still evaluate and catch type errors but we'll avoid
+                // producing redundant re-statements of the same errors we've already
+                // dealt with here.
+                return cty.UnknownVal(val.Type()), diags
+        }
+        return val, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/cidr.go b/vendor/github.com/hashicorp/terraform/lang/funcs/cidr.go
new file mode 100644
index 0000000..6ce8aa9
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/cidr.go
@@ -0,0 +1,129 @@
+package funcs
+
+import (
+        "fmt"
+        "net"
+
+        "github.com/apparentlymart/go-cidr/cidr"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+// CidrHostFunc contructs a function that calculates a full host IP address
+// within a given IP network address prefix.
+var CidrHostFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "prefix",
+                        Type: cty.String,
+                },
+                {
+                        Name: "hostnum",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var hostNum int
+                if err := gocty.FromCtyValue(args[1], &hostNum); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                _, network, err := net.ParseCIDR(args[0].AsString())
+                if err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("invalid CIDR expression: %s", err)
+                }
+
+                ip, err := cidr.Host(network, hostNum)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                return cty.StringVal(ip.String()), nil
+        },
+})
+
+// CidrNetmaskFunc contructs a function that converts an IPv4 address prefix given
+// in CIDR notation into a subnet mask address.
+var CidrNetmaskFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "prefix",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                _, network, err := net.ParseCIDR(args[0].AsString())
+                if err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("invalid CIDR expression: %s", err)
+                }
+
+                return cty.StringVal(net.IP(network.Mask).String()), nil
+        },
+})
+
+// CidrSubnetFunc contructs a function that calculates a subnet address within
+// a given IP network address prefix.
+var CidrSubnetFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "prefix",
+                        Type: cty.String,
+                },
+                {
+                        Name: "newbits",
+                        Type: cty.Number,
+                },
+                {
+                        Name: "netnum",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var newbits int
+                if err := gocty.FromCtyValue(args[1], &newbits); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                var netnum int
+                if err := gocty.FromCtyValue(args[2], &netnum); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                _, network, err := net.ParseCIDR(args[0].AsString())
+                if err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("invalid CIDR expression: %s", err)
+                }
+
+                // For portability with 32-bit systems where the subnet number
+                // will be a 32-bit int, we only allow extension of 32 bits in
+                // one call even if we're running on a 64-bit machine.
+                // (Of course, this is significant only for IPv6.)
+                if newbits > 32 {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("may not extend prefix by more than 32 bits")
+                }
+
+                newNetwork, err := cidr.Subnet(network, newbits, netnum)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                return cty.StringVal(newNetwork.String()), nil
+        },
+})
+
+// CidrHost calculates a full host IP address within a given IP network address prefix.
+func CidrHost(prefix, hostnum cty.Value) (cty.Value, error) {
+        return CidrHostFunc.Call([]cty.Value{prefix, hostnum})
+}
+
+// CidrNetmask converts an IPv4 address prefix given in CIDR notation into a subnet mask address.
+func CidrNetmask(prefix cty.Value) (cty.Value, error) {
+        return CidrNetmaskFunc.Call([]cty.Value{prefix})
+}
+
+// CidrSubnet calculates a subnet address within a given IP network address prefix.
+func CidrSubnet(prefix, newbits, netnum cty.Value) (cty.Value, error) {
+        return CidrSubnetFunc.Call([]cty.Value{prefix, newbits, netnum})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/collection.go b/vendor/github.com/hashicorp/terraform/lang/funcs/collection.go
new file mode 100644
index 0000000..71b7a84
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/collection.go
@@ -0,0 +1,1511 @@
+package funcs
+
+import (
+        "errors"
+        "fmt"
+        "sort"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/function"
+        "github.com/zclconf/go-cty/cty/function/stdlib"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+var ElementFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.DynamicPseudoType,
+                },
+                {
+                        Name: "index",
+                        Type: cty.Number,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                list := args[0]
+                listTy := list.Type()
+                switch {
+                case listTy.IsListType():
+                        return listTy.ElementType(), nil
+                case listTy.IsTupleType():
+                        if !args[1].IsKnown() {
+                                // If the index isn't known yet then we can't predict the
+                                // result type since each tuple element can have its own type.
+                                return cty.DynamicPseudoType, nil
+                        }
+
+                        etys := listTy.TupleElementTypes()
+                        var index int
+                        err := gocty.FromCtyValue(args[1], &index)
+                        if err != nil {
+                                // e.g. fractional number where whole number is required
+                                return cty.DynamicPseudoType, fmt.Errorf("invalid index: %s", err)
+                        }
+                        if len(etys) == 0 {
+                                return cty.DynamicPseudoType, errors.New("cannot use element function with an empty list")
+                        }
+                        index = index % len(etys)
+                        return etys[index], nil
+                default:
+                        return cty.DynamicPseudoType, fmt.Errorf("cannot read elements from %s", listTy.FriendlyName())
+                }
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                var index int
+                err := gocty.FromCtyValue(args[1], &index)
+                if err != nil {
+                        // can't happen because we checked this in the Type function above
+                        return cty.DynamicVal, fmt.Errorf("invalid index: %s", err)
+                }
+
+                if !args[0].IsKnown() {
+                        return cty.UnknownVal(retType), nil
+                }
+
+                l := args[0].LengthInt()
+                if l == 0 {
+                        return cty.DynamicVal, errors.New("cannot use element function with an empty list")
+                }
+                index = index % l
+
+                // We did all the necessary type checks in the type function above,
+                // so this is guaranteed not to fail.
+                return args[0].Index(cty.NumberIntVal(int64(index))), nil
+        },
+})
+
+var LengthFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name:             "value",
+                        Type:             cty.DynamicPseudoType,
+                        AllowDynamicType: true,
+                        AllowUnknown:     true,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                collTy := args[0].Type()
+                switch {
+                case collTy == cty.String || collTy.IsTupleType() || collTy.IsObjectType() || collTy.IsListType() || collTy.IsMapType() || collTy.IsSetType() || collTy == cty.DynamicPseudoType:
+                        return cty.Number, nil
+                default:
+                        return cty.Number, errors.New("argument must be a string, a collection type, or a structural type")
+                }
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                coll := args[0]
+                collTy := args[0].Type()
+                switch {
+                case collTy == cty.DynamicPseudoType:
+                        return cty.UnknownVal(cty.Number), nil
+                case collTy.IsTupleType():
+                        l := len(collTy.TupleElementTypes())
+                        return cty.NumberIntVal(int64(l)), nil
+                case collTy.IsObjectType():
+                        l := len(collTy.AttributeTypes())
+                        return cty.NumberIntVal(int64(l)), nil
+                case collTy == cty.String:
+                        // We'll delegate to the cty stdlib strlen function here, because
+                        // it deals with all of the complexities of tokenizing unicode
+                        // grapheme clusters.
+                        return stdlib.Strlen(coll)
+                case collTy.IsListType() || collTy.IsSetType() || collTy.IsMapType():
+                        return coll.Length(), nil
+                default:
+                        // Should never happen, because of the checks in our Type func above
+                        return cty.UnknownVal(cty.Number), errors.New("impossible value type for length(...)")
+                }
+        },
+})
+
+// CoalesceFunc constructs a function that takes any number of arguments and
+// returns the first one that isn't empty. This function was copied from go-cty
+// stdlib and modified so that it returns the first *non-empty* non-null element
+// from a sequence, instead of merely the first non-null.
+var CoalesceFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        VarParam: &function.Parameter{
+                Name:             "vals",
+                Type:             cty.DynamicPseudoType,
+                AllowUnknown:     true,
+                AllowDynamicType: true,
+                AllowNull:        true,
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                argTypes := make([]cty.Type, len(args))
+                for i, val := range args {
+                        argTypes[i] = val.Type()
+                }
+                retType, _ := convert.UnifyUnsafe(argTypes)
+                if retType == cty.NilType {
+                        return cty.NilType, errors.New("all arguments must have the same type")
+                }
+                return retType, nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                for _, argVal := range args {
+                        // We already know this will succeed because of the checks in our Type func above
+                        argVal, _ = convert.Convert(argVal, retType)
+                        if !argVal.IsKnown() {
+                                return cty.UnknownVal(retType), nil
+                        }
+                        if argVal.IsNull() {
+                                continue
+                        }
+                        if retType == cty.String && argVal.RawEquals(cty.StringVal("")) {
+                                continue
+                        }
+
+                        return argVal, nil
+                }
+                return cty.NilVal, errors.New("no non-null, non-empty-string arguments")
+        },
+})
+
+// CoalesceListFunc constructs a function that takes any number of list arguments
+// and returns the first one that isn't empty.
+var CoalesceListFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        VarParam: &function.Parameter{
+                Name:             "vals",
+                Type:             cty.DynamicPseudoType,
+                AllowUnknown:     true,
+                AllowDynamicType: true,
+                AllowNull:        true,
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                if len(args) == 0 {
+                        return cty.NilType, errors.New("at least one argument is required")
+                }
+
+                argTypes := make([]cty.Type, len(args))
+
+                for i, arg := range args {
+                        // if any argument is unknown, we can't be certain know which type we will return
+                        if !arg.IsKnown() {
+                                return cty.DynamicPseudoType, nil
+                        }
+                        ty := arg.Type()
+
+                        if !ty.IsListType() && !ty.IsTupleType() {
+                                return cty.NilType, errors.New("coalescelist arguments must be lists or tuples")
+                        }
+
+                        argTypes[i] = arg.Type()
+                }
+
+                last := argTypes[0]
+                // If there are mixed types, we have to return a dynamic type.
+                for _, next := range argTypes[1:] {
+                        if !next.Equals(last) {
+                                return cty.DynamicPseudoType, nil
+                        }
+                }
+
+                return last, nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                for _, arg := range args {
+                        if !arg.IsKnown() {
+                                // If we run into an unknown list at some point, we can't
+                                // predict the final result yet. (If there's a known, non-empty
+                                // arg before this then we won't get here.)
+                                return cty.UnknownVal(retType), nil
+                        }
+
+                        if arg.LengthInt() > 0 {
+                                return arg, nil
+                        }
+                }
+
+                return cty.NilVal, errors.New("no non-null arguments")
+        },
+})
+
+// CompactFunc constructs a function that takes a list of strings and returns a new list
+// with any empty string elements removed.
+var CompactFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.List(cty.String),
+                },
+        },
+        Type: function.StaticReturnType(cty.List(cty.String)),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                listVal := args[0]
+                if !listVal.IsWhollyKnown() {
+                        // If some of the element values aren't known yet then we
+                        // can't yet return a compacted list
+                        return cty.UnknownVal(retType), nil
+                }
+
+                var outputList []cty.Value
+
+                for it := listVal.ElementIterator(); it.Next(); {
+                        _, v := it.Element()
+                        if v.AsString() == "" {
+                                continue
+                        }
+                        outputList = append(outputList, v)
+                }
+
+                if len(outputList) == 0 {
+                        return cty.ListValEmpty(cty.String), nil
+                }
+
+                return cty.ListVal(outputList), nil
+        },
+})
+
+// ContainsFunc constructs a function that determines whether a given list or
+// set contains a given single value as one of its elements.
+var ContainsFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.DynamicPseudoType,
+                },
+                {
+                        Name: "value",
+                        Type: cty.DynamicPseudoType,
+                },
+        },
+        Type: function.StaticReturnType(cty.Bool),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                arg := args[0]
+                ty := arg.Type()
+
+                if !ty.IsListType() && !ty.IsTupleType() && !ty.IsSetType() {
+                        return cty.NilVal, errors.New("argument must be list, tuple, or set")
+                }
+
+                _, err = Index(cty.TupleVal(arg.AsValueSlice()), args[1])
+                if err != nil {
+                        return cty.False, nil
+                }
+
+                return cty.True, nil
+        },
+})
+
+// IndexFunc constructs a function that finds the element index for a given value in a list.
+var IndexFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.DynamicPseudoType,
+                },
+                {
+                        Name: "value",
+                        Type: cty.DynamicPseudoType,
+                },
+        },
+        Type: function.StaticReturnType(cty.Number),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                if !(args[0].Type().IsListType() || args[0].Type().IsTupleType()) {
+                        return cty.NilVal, errors.New("argument must be a list or tuple")
+                }
+
+                if !args[0].IsKnown() {
+                        return cty.UnknownVal(cty.Number), nil
+                }
+
+                if args[0].LengthInt() == 0 { // Easy path
+                        return cty.NilVal, errors.New("cannot search an empty list")
+                }
+
+                for it := args[0].ElementIterator(); it.Next(); {
+                        i, v := it.Element()
+                        eq, err := stdlib.Equal(v, args[1])
+                        if err != nil {
+                                return cty.NilVal, err
+                        }
+                        if !eq.IsKnown() {
+                                return cty.UnknownVal(cty.Number), nil
+                        }
+                        if eq.True() {
+                                return i, nil
+                        }
+                }
+                return cty.NilVal, errors.New("item not found")
+
+        },
+})
+
+// DistinctFunc constructs a function that takes a list and returns a new list
+// with any duplicate elements removed.
+var DistinctFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.List(cty.DynamicPseudoType),
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                return args[0].Type(), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                listVal := args[0]
+
+                if !listVal.IsWhollyKnown() {
+                        return cty.UnknownVal(retType), nil
+                }
+                var list []cty.Value
+
+                for it := listVal.ElementIterator(); it.Next(); {
+                        _, v := it.Element()
+                        list, err = appendIfMissing(list, v)
+                        if err != nil {
+                                return cty.NilVal, err
+                        }
+                }
+
+                return cty.ListVal(list), nil
+        },
+})
+
+// ChunklistFunc constructs a function that splits a single list into fixed-size chunks,
+// returning a list of lists.
+var ChunklistFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.List(cty.DynamicPseudoType),
+                },
+                {
+                        Name: "size",
+                        Type: cty.Number,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                return cty.List(args[0].Type()), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                listVal := args[0]
+                if !listVal.IsKnown() {
+                        return cty.UnknownVal(retType), nil
+                }
+
+                var size int
+                err = gocty.FromCtyValue(args[1], &size)
+                if err != nil {
+                        return cty.NilVal, fmt.Errorf("invalid index: %s", err)
+                }
+
+                if size < 0 {
+                        return cty.NilVal, errors.New("the size argument must be positive")
+                }
+
+                output := make([]cty.Value, 0)
+
+                // if size is 0, returns a list made of the initial list
+                if size == 0 {
+                        output = append(output, listVal)
+                        return cty.ListVal(output), nil
+                }
+
+                chunk := make([]cty.Value, 0)
+
+                l := args[0].LengthInt()
+                i := 0
+
+                for it := listVal.ElementIterator(); it.Next(); {
+                        _, v := it.Element()
+                        chunk = append(chunk, v)
+
+                        // Chunk when index isn't 0, or when reaching the values's length
+                        if (i+1)%size == 0 || (i+1) == l {
+                                output = append(output, cty.ListVal(chunk))
+                                chunk = make([]cty.Value, 0)
+                        }
+                        i++
+                }
+
+                return cty.ListVal(output), nil
+        },
+})
+
+// FlattenFunc constructs a function that takes a list and replaces any elements
+// that are lists with a flattened sequence of the list contents.
+var FlattenFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.DynamicPseudoType,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                if !args[0].IsWhollyKnown() {
+                        return cty.DynamicPseudoType, nil
+                }
+
+                argTy := args[0].Type()
+                if !argTy.IsListType() && !argTy.IsSetType() && !argTy.IsTupleType() {
+                        return cty.NilType, errors.New("can only flatten lists, sets and tuples")
+                }
+
+                retVal, known := flattener(args[0])
+                if !known {
+                        return cty.DynamicPseudoType, nil
+                }
+
+                tys := make([]cty.Type, len(retVal))
+                for i, ty := range retVal {
+                        tys[i] = ty.Type()
+                }
+                return cty.Tuple(tys), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                inputList := args[0]
+                if inputList.LengthInt() == 0 {
+                        return cty.EmptyTupleVal, nil
+                }
+
+                out, known := flattener(inputList)
+                if !known {
+                        return cty.UnknownVal(retType), nil
+                }
+
+                return cty.TupleVal(out), nil
+        },
+})
+
+// Flatten until it's not a cty.List, and return whether the value is known.
+// We can flatten lists with unknown values, as long as they are not
+// lists themselves.
+func flattener(flattenList cty.Value) ([]cty.Value, bool) {
+        out := make([]cty.Value, 0)
+        for it := flattenList.ElementIterator(); it.Next(); {
+                _, val := it.Element()
+                if val.Type().IsListType() || val.Type().IsSetType() || val.Type().IsTupleType() {
+                        if !val.IsKnown() {
+                                return out, false
+                        }
+
+                        res, known := flattener(val)
+                        if !known {
+                                return res, known
+                        }
+                        out = append(out, res...)
+                } else {
+                        out = append(out, val)
+                }
+        }
+        return out, true
+}
+
+// KeysFunc constructs a function that takes a map and returns a sorted list of the map keys.
+var KeysFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name:         "inputMap",
+                        Type:         cty.DynamicPseudoType,
+                        AllowUnknown: true,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                ty := args[0].Type()
+                switch {
+                case ty.IsMapType():
+                        return cty.List(cty.String), nil
+                case ty.IsObjectType():
+                        atys := ty.AttributeTypes()
+                        if len(atys) == 0 {
+                                return cty.EmptyTuple, nil
+                        }
+                        // All of our result elements will be strings, and atys just
+                        // decides how many there are.
+                        etys := make([]cty.Type, len(atys))
+                        for i := range etys {
+                                etys[i] = cty.String
+                        }
+                        return cty.Tuple(etys), nil
+                default:
+                        return cty.DynamicPseudoType, function.NewArgErrorf(0, "must have map or object type")
+                }
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                m := args[0]
+                var keys []cty.Value
+
+                switch {
+                case m.Type().IsObjectType():
+                        // In this case we allow unknown values so we must work only with
+                        // the attribute _types_, not with the value itself.
+                        var names []string
+                        for name := range m.Type().AttributeTypes() {
+                                names = append(names, name)
+                        }
+                        sort.Strings(names) // same ordering guaranteed by cty's ElementIterator
+                        if len(names) == 0 {
+                                return cty.EmptyTupleVal, nil
+                        }
+                        keys = make([]cty.Value, len(names))
+                        for i, name := range names {
+                                keys[i] = cty.StringVal(name)
+                        }
+                        return cty.TupleVal(keys), nil
+                default:
+                        if !m.IsKnown() {
+                                return cty.UnknownVal(retType), nil
+                        }
+
+                        // cty guarantees that ElementIterator will iterate in lexicographical
+                        // order by key.
+                        for it := args[0].ElementIterator(); it.Next(); {
+                                k, _ := it.Element()
+                                keys = append(keys, k)
+                        }
+                        if len(keys) == 0 {
+                                return cty.ListValEmpty(cty.String), nil
+                        }
+                        return cty.ListVal(keys), nil
+                }
+        },
+})
+
+// ListFunc constructs a function that takes an arbitrary number of arguments
+// and returns a list containing those values in the same order.
+//
+// This function is deprecated in Terraform v0.12
+var ListFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        VarParam: &function.Parameter{
+                Name:             "vals",
+                Type:             cty.DynamicPseudoType,
+                AllowUnknown:     true,
+                AllowDynamicType: true,
+                AllowNull:        true,
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                if len(args) == 0 {
+                        return cty.NilType, errors.New("at least one argument is required")
+                }
+
+                argTypes := make([]cty.Type, len(args))
+
+                for i, arg := range args {
+                        argTypes[i] = arg.Type()
+                }
+
+                retType, _ := convert.UnifyUnsafe(argTypes)
+                if retType == cty.NilType {
+                        return cty.NilType, errors.New("all arguments must have the same type")
+                }
+
+                return cty.List(retType), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                newList := make([]cty.Value, 0, len(args))
+
+                for _, arg := range args {
+                        // We already know this will succeed because of the checks in our Type func above
+                        arg, _ = convert.Convert(arg, retType.ElementType())
+                        newList = append(newList, arg)
+                }
+
+                return cty.ListVal(newList), nil
+        },
+})
+
+// LookupFunc constructs a function that performs dynamic lookups of map types.
+var LookupFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "inputMap",
+                        Type: cty.DynamicPseudoType,
+                },
+                {
+                        Name: "key",
+                        Type: cty.String,
+                },
+        },
+        VarParam: &function.Parameter{
+                Name:             "default",
+                Type:             cty.DynamicPseudoType,
+                AllowUnknown:     true,
+                AllowDynamicType: true,
+                AllowNull:        true,
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                if len(args) < 1 || len(args) > 3 {
+                        return cty.NilType, fmt.Errorf("lookup() takes two or three arguments, got %d", len(args))
+                }
+
+                ty := args[0].Type()
+
+                switch {
+                case ty.IsObjectType():
+                        if !args[1].IsKnown() {
+                                return cty.DynamicPseudoType, nil
+                        }
+
+                        key := args[1].AsString()
+                        if ty.HasAttribute(key) {
+                                return args[0].GetAttr(key).Type(), nil
+                        } else if len(args) == 3 {
+                                // if the key isn't found but a default is provided,
+                                // return the default type
+                                return args[2].Type(), nil
+                        }
+                        return cty.DynamicPseudoType, function.NewArgErrorf(0, "the given object has no attribute %q", key)
+                case ty.IsMapType():
+                        return ty.ElementType(), nil
+                default:
+                        return cty.NilType, function.NewArgErrorf(0, "lookup() requires a map as the first argument")
+                }
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var defaultVal cty.Value
+                defaultValueSet := false
+
+                if len(args) == 3 {
+                        defaultVal = args[2]
+                        defaultValueSet = true
+                }
+
+                mapVar := args[0]
+                lookupKey := args[1].AsString()
+
+                if !mapVar.IsWhollyKnown() {
+                        return cty.UnknownVal(retType), nil
+                }
+
+                if mapVar.Type().IsObjectType() {
+                        if mapVar.Type().HasAttribute(lookupKey) {
+                                return mapVar.GetAttr(lookupKey), nil
+                        }
+                } else if mapVar.HasIndex(cty.StringVal(lookupKey)) == cty.True {
+                        v := mapVar.Index(cty.StringVal(lookupKey))
+                        if ty := v.Type(); !ty.Equals(cty.NilType) {
+                                switch {
+                                case ty.Equals(cty.String):
+                                        return cty.StringVal(v.AsString()), nil
+                                case ty.Equals(cty.Number):
+                                        return cty.NumberVal(v.AsBigFloat()), nil
+                                default:
+                                        return cty.NilVal, errors.New("lookup() can only be used with flat lists")
+                                }
+                        }
+                }
+
+                if defaultValueSet {
+                        defaultVal, err = convert.Convert(defaultVal, retType)
+                        if err != nil {
+                                return cty.NilVal, err
+                        }
+                        return defaultVal, nil
+                }
+
+                return cty.UnknownVal(cty.DynamicPseudoType), fmt.Errorf(
+                        "lookup failed to find '%s'", lookupKey)
+        },
+})
+
+// MapFunc constructs a function that takes an even number of arguments and
+// returns a map whose elements are constructed from consecutive pairs of arguments.
+//
+// This function is deprecated in Terraform v0.12
+var MapFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        VarParam: &function.Parameter{
+                Name:             "vals",
+                Type:             cty.DynamicPseudoType,
+                AllowUnknown:     true,
+                AllowDynamicType: true,
+                AllowNull:        true,
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                if len(args) < 2 || len(args)%2 != 0 {
+                        return cty.NilType, fmt.Errorf("map requires an even number of two or more arguments, got %d", len(args))
+                }
+
+                argTypes := make([]cty.Type, len(args)/2)
+                index := 0
+
+                for i := 0; i < len(args); i += 2 {
+                        argTypes[index] = args[i+1].Type()
+                        index++
+                }
+
+                valType, _ := convert.UnifyUnsafe(argTypes)
+                if valType == cty.NilType {
+                        return cty.NilType, errors.New("all arguments must have the same type")
+                }
+
+                return cty.Map(valType), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                for _, arg := range args {
+                        if !arg.IsWhollyKnown() {
+                                return cty.UnknownVal(retType), nil
+                        }
+                }
+
+                outputMap := make(map[string]cty.Value)
+
+                for i := 0; i < len(args); i += 2 {
+
+                        key := args[i].AsString()
+
+                        err := gocty.FromCtyValue(args[i], &key)
+                        if err != nil {
+                                return cty.NilVal, err
+                        }
+
+                        val := args[i+1]
+
+                        var variable cty.Value
+                        err = gocty.FromCtyValue(val, &variable)
+                        if err != nil {
+                                return cty.NilVal, err
+                        }
+
+                        // We already know this will succeed because of the checks in our Type func above
+                        variable, _ = convert.Convert(variable, retType.ElementType())
+
+                        // Check for duplicate keys
+                        if _, ok := outputMap[key]; ok {
+                                return cty.NilVal, fmt.Errorf("argument %d is a duplicate key: %q", i+1, key)
+                        }
+                        outputMap[key] = variable
+                }
+
+                return cty.MapVal(outputMap), nil
+        },
+})
+
+// MatchkeysFunc constructs a function that constructs a new list by taking a
+// subset of elements from one list whose indexes match the corresponding
+// indexes of values in another list.
+var MatchkeysFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "values",
+                        Type: cty.List(cty.DynamicPseudoType),
+                },
+                {
+                        Name: "keys",
+                        Type: cty.List(cty.DynamicPseudoType),
+                },
+                {
+                        Name: "searchset",
+                        Type: cty.List(cty.DynamicPseudoType),
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                if !args[1].Type().Equals(args[2].Type()) {
+                        return cty.NilType, errors.New("lists must be of the same type")
+                }
+
+                return args[0].Type(), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                if !args[0].IsKnown() {
+                        return cty.UnknownVal(cty.List(retType.ElementType())), nil
+                }
+
+                if args[0].LengthInt() != args[1].LengthInt() {
+                        return cty.ListValEmpty(retType.ElementType()), errors.New("length of keys and values should be equal")
+                }
+
+                output := make([]cty.Value, 0)
+
+                values := args[0]
+                keys := args[1]
+                searchset := args[2]
+
+                // if searchset is empty, return an empty list.
+                if searchset.LengthInt() == 0 {
+                        return cty.ListValEmpty(retType.ElementType()), nil
+                }
+
+                if !values.IsWhollyKnown() || !keys.IsWhollyKnown() {
+                        return cty.UnknownVal(retType), nil
+                }
+
+                i := 0
+                for it := keys.ElementIterator(); it.Next(); {
+                        _, key := it.Element()
+                        for iter := searchset.ElementIterator(); iter.Next(); {
+                                _, search := iter.Element()
+                                eq, err := stdlib.Equal(key, search)
+                                if err != nil {
+                                        return cty.NilVal, err
+                                }
+                                if !eq.IsKnown() {
+                                        return cty.ListValEmpty(retType.ElementType()), nil
+                                }
+                                if eq.True() {
+                                        v := values.Index(cty.NumberIntVal(int64(i)))
+                                        output = append(output, v)
+                                        break
+                                }
+                        }
+                        i++
+                }
+
+                // if we haven't matched any key, then output is an empty list.
+                if len(output) == 0 {
+                        return cty.ListValEmpty(retType.ElementType()), nil
+                }
+                return cty.ListVal(output), nil
+        },
+})
+
+// MergeFunc constructs a function that takes an arbitrary number of maps and
+// returns a single map that contains a merged set of elements from all of the maps.
+//
+// If more than one given map defines the same key then the one that is later in
+// the argument sequence takes precedence.
+var MergeFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        VarParam: &function.Parameter{
+                Name:             "maps",
+                Type:             cty.DynamicPseudoType,
+                AllowDynamicType: true,
+                AllowNull:        true,
+        },
+        Type: function.StaticReturnType(cty.DynamicPseudoType),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                outputMap := make(map[string]cty.Value)
+
+                for _, arg := range args {
+                        if !arg.IsWhollyKnown() {
+                                return cty.UnknownVal(retType), nil
+                        }
+                        if !arg.Type().IsObjectType() && !arg.Type().IsMapType() {
+                                return cty.NilVal, fmt.Errorf("arguments must be maps or objects, got %#v", arg.Type().FriendlyName())
+                        }
+                        for it := arg.ElementIterator(); it.Next(); {
+                                k, v := it.Element()
+                                outputMap[k.AsString()] = v
+                        }
+                }
+                return cty.ObjectVal(outputMap), nil
+        },
+})
+
+// ReverseFunc takes a sequence and produces a new sequence of the same length
+// with all of the same elements as the given sequence but in reverse order.
+var ReverseFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.DynamicPseudoType,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                argTy := args[0].Type()
+                switch {
+                case argTy.IsTupleType():
+                        argTys := argTy.TupleElementTypes()
+                        retTys := make([]cty.Type, len(argTys))
+                        for i, ty := range argTys {
+                                retTys[len(retTys)-i-1] = ty
+                        }
+                        return cty.Tuple(retTys), nil
+                case argTy.IsListType(), argTy.IsSetType(): // We accept sets here to mimic the usual behavior of auto-converting to list
+                        return cty.List(argTy.ElementType()), nil
+                default:
+                        return cty.NilType, function.NewArgErrorf(0, "can only reverse list or tuple values, not %s", argTy.FriendlyName())
+                }
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                in := args[0].AsValueSlice()
+                outVals := make([]cty.Value, len(in))
+                for i, v := range in {
+                        outVals[len(outVals)-i-1] = v
+                }
+                switch {
+                case retType.IsTupleType():
+                        return cty.TupleVal(outVals), nil
+                default:
+                        if len(outVals) == 0 {
+                                return cty.ListValEmpty(retType.ElementType()), nil
+                        }
+                        return cty.ListVal(outVals), nil
+                }
+        },
+})
+
+// SetProductFunc calculates the cartesian product of two or more sets or
+// sequences. If the arguments are all lists then the result is a list of tuples,
+// preserving the ordering of all of the input lists. Otherwise the result is a
+// set of tuples.
+var SetProductFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        VarParam: &function.Parameter{
+                Name: "sets",
+                Type: cty.DynamicPseudoType,
+        },
+        Type: func(args []cty.Value) (retType cty.Type, err error) {
+                if len(args) < 2 {
+                        return cty.NilType, errors.New("at least two arguments are required")
+                }
+
+                listCount := 0
+                elemTys := make([]cty.Type, len(args))
+                for i, arg := range args {
+                        aty := arg.Type()
+                        switch {
+                        case aty.IsSetType():
+                                elemTys[i] = aty.ElementType()
+                        case aty.IsListType():
+                                elemTys[i] = aty.ElementType()
+                                listCount++
+                        case aty.IsTupleType():
+                                // We can accept a tuple type only if there's some common type
+                                // that all of its elements can be converted to.
+                                allEtys := aty.TupleElementTypes()
+                                if len(allEtys) == 0 {
+                                        elemTys[i] = cty.DynamicPseudoType
+                                        listCount++
+                                        break
+                                }
+                                ety, _ := convert.UnifyUnsafe(allEtys)
+                                if ety == cty.NilType {
+                                        return cty.NilType, function.NewArgErrorf(i, "all elements must be of the same type")
+                                }
+                                elemTys[i] = ety
+                                listCount++
+                        default:
+                                return cty.NilType, function.NewArgErrorf(i, "a set or a list is required")
+                        }
+                }
+
+                if listCount == len(args) {
+                        return cty.List(cty.Tuple(elemTys)), nil
+                }
+                return cty.Set(cty.Tuple(elemTys)), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                ety := retType.ElementType()
+
+                total := 1
+                for _, arg := range args {
+                        // Because of our type checking function, we are guaranteed that
+                        // all of the arguments are known, non-null values of types that
+                        // support LengthInt.
+                        total *= arg.LengthInt()
+                }
+
+                if total == 0 {
+                        // If any of the arguments was an empty collection then our result
+                        // is also an empty collection, which we'll short-circuit here.
+                        if retType.IsListType() {
+                                return cty.ListValEmpty(ety), nil
+                        }
+                        return cty.SetValEmpty(ety), nil
+                }
+
+                subEtys := ety.TupleElementTypes()
+                product := make([][]cty.Value, total)
+
+                b := make([]cty.Value, total*len(args))
+                n := make([]int, len(args))
+                s := 0
+                argVals := make([][]cty.Value, len(args))
+                for i, arg := range args {
+                        argVals[i] = arg.AsValueSlice()
+                }
+
+                for i := range product {
+                        e := s + len(args)
+                        pi := b[s:e]
+                        product[i] = pi
+                        s = e
+
+                        for j, n := range n {
+                                val := argVals[j][n]
+                                ty := subEtys[j]
+                                if !val.Type().Equals(ty) {
+                                        var err error
+                                        val, err = convert.Convert(val, ty)
+                                        if err != nil {
+                                                // Should never happen since we checked this in our
+                                                // type-checking function.
+                                                return cty.NilVal, fmt.Errorf("failed to convert argVals[%d][%d] to %s; this is a bug in Terraform", j, n, ty.FriendlyName())
+                                        }
+                                }
+                                pi[j] = val
+                        }
+
+                        for j := len(n) - 1; j >= 0; j-- {
+                                n[j]++
+                                if n[j] < len(argVals[j]) {
+                                        break
+                                }
+                                n[j] = 0
+                        }
+                }
+
+                productVals := make([]cty.Value, total)
+                for i, vals := range product {
+                        productVals[i] = cty.TupleVal(vals)
+                }
+
+                if retType.IsListType() {
+                        return cty.ListVal(productVals), nil
+                }
+                return cty.SetVal(productVals), nil
+        },
+})
+
+// SliceFunc constructs a function that extracts some consecutive elements
+// from within a list.
+var SliceFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.DynamicPseudoType,
+                },
+                {
+                        Name: "start_index",
+                        Type: cty.Number,
+                },
+                {
+                        Name: "end_index",
+                        Type: cty.Number,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                arg := args[0]
+                argTy := arg.Type()
+
+                if argTy.IsSetType() {
+                        return cty.NilType, function.NewArgErrorf(0, "cannot slice a set, because its elements do not have indices; use the tolist function to force conversion to list if the ordering of the result is not important")
+                }
+                if !argTy.IsListType() && !argTy.IsTupleType() {
+                        return cty.NilType, function.NewArgErrorf(0, "must be a list or tuple value")
+                }
+
+                startIndex, endIndex, idxsKnown, err := sliceIndexes(args)
+                if err != nil {
+                        return cty.NilType, err
+                }
+
+                if argTy.IsListType() {
+                        return argTy, nil
+                }
+
+                if !idxsKnown {
+                        // If we don't know our start/end indices then we can't predict
+                        // the result type if we're planning to return a tuple.
+                        return cty.DynamicPseudoType, nil
+                }
+                return cty.Tuple(argTy.TupleElementTypes()[startIndex:endIndex]), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                inputList := args[0]
+
+                if retType == cty.DynamicPseudoType {
+                        return cty.DynamicVal, nil
+                }
+
+                // we ignore idxsKnown return value here because the indices are always
+                // known here, or else the call would've short-circuited.
+                startIndex, endIndex, _, err := sliceIndexes(args)
+                if err != nil {
+                        return cty.NilVal, err
+                }
+
+                if endIndex-startIndex == 0 {
+                        if retType.IsTupleType() {
+                                return cty.EmptyTupleVal, nil
+                        }
+                        return cty.ListValEmpty(retType.ElementType()), nil
+                }
+
+                outputList := inputList.AsValueSlice()[startIndex:endIndex]
+
+                if retType.IsTupleType() {
+                        return cty.TupleVal(outputList), nil
+                }
+
+                return cty.ListVal(outputList), nil
+        },
+})
+
+func sliceIndexes(args []cty.Value) (int, int, bool, error) {
+        var startIndex, endIndex, length int
+        var startKnown, endKnown, lengthKnown bool
+
+        if args[0].Type().IsTupleType() || args[0].IsKnown() { // if it's a tuple then we always know the length by the type, but lists must be known
+                length = args[0].LengthInt()
+                lengthKnown = true
+        }
+
+        if args[1].IsKnown() {
+                if err := gocty.FromCtyValue(args[1], &startIndex); err != nil {
+                        return 0, 0, false, function.NewArgErrorf(1, "invalid start index: %s", err)
+                }
+                if startIndex < 0 {
+                        return 0, 0, false, function.NewArgErrorf(1, "start index must not be less than zero")
+                }
+                if lengthKnown && startIndex > length {
+                        return 0, 0, false, function.NewArgErrorf(1, "start index must not be greater than the length of the list")
+                }
+                startKnown = true
+        }
+        if args[2].IsKnown() {
+                if err := gocty.FromCtyValue(args[2], &endIndex); err != nil {
+                        return 0, 0, false, function.NewArgErrorf(2, "invalid end index: %s", err)
+                }
+                if endIndex < 0 {
+                        return 0, 0, false, function.NewArgErrorf(2, "end index must not be less than zero")
+                }
+                if lengthKnown && endIndex > length {
+                        return 0, 0, false, function.NewArgErrorf(2, "end index must not be greater than the length of the list")
+                }
+                endKnown = true
+        }
+        if startKnown && endKnown {
+                if startIndex > endIndex {
+                        return 0, 0, false, function.NewArgErrorf(1, "start index must not be greater than end index")
+                }
+        }
+        return startIndex, endIndex, startKnown && endKnown, nil
+}
+
+// TransposeFunc contructs a function that takes a map of lists of strings and
+// TransposeFunc constructs a function that takes a map of lists of strings and
+// swaps the keys and values to produce a new map of lists of strings.
+var TransposeFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "values",
+                        Type: cty.Map(cty.List(cty.String)),
+                },
+        },
+        Type: function.StaticReturnType(cty.Map(cty.List(cty.String))),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                inputMap := args[0]
+                if !inputMap.IsWhollyKnown() {
+                        return cty.UnknownVal(retType), nil
+                }
+
+                outputMap := make(map[string]cty.Value)
+                tmpMap := make(map[string][]string)
+
+                for it := inputMap.ElementIterator(); it.Next(); {
+                        inKey, inVal := it.Element()
+                        for iter := inVal.ElementIterator(); iter.Next(); {
+                                _, val := iter.Element()
+                                if !val.Type().Equals(cty.String) {
+                                        return cty.MapValEmpty(cty.List(cty.String)), errors.New("input must be a map of lists of strings")
+                                }
+
+                                outKey := val.AsString()
+                                if _, ok := tmpMap[outKey]; !ok {
+                                        tmpMap[outKey] = make([]string, 0)
+                                }
+                                outVal := tmpMap[outKey]
+                                outVal = append(outVal, inKey.AsString())
+                                sort.Strings(outVal)
+                                tmpMap[outKey] = outVal
+                        }
+                }
+
+                for outKey, outVal := range tmpMap {
+                        values := make([]cty.Value, 0)
+                        for _, v := range outVal {
+                                values = append(values, cty.StringVal(v))
+                        }
+                        outputMap[outKey] = cty.ListVal(values)
+                }
+
+                return cty.MapVal(outputMap), nil
+        },
+})
+
+// ValuesFunc constructs a function that returns a list of the map values,
+// in the order of the sorted keys.
+var ValuesFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "values",
+                        Type: cty.DynamicPseudoType,
+                },
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                ty := args[0].Type()
+                if ty.IsMapType() {
+                        return cty.List(ty.ElementType()), nil
+                } else if ty.IsObjectType() {
+                        // The result is a tuple type with all of the same types as our
+                        // object type's attributes, sorted in lexicographical order by the
+                        // keys. (This matches the sort order guaranteed by ElementIterator
+                        // on a cty object value.)
+                        atys := ty.AttributeTypes()
+                        if len(atys) == 0 {
+                                return cty.EmptyTuple, nil
+                        }
+                        attrNames := make([]string, 0, len(atys))
+                        for name := range atys {
+                                attrNames = append(attrNames, name)
+                        }
+                        sort.Strings(attrNames)
+
+                        tys := make([]cty.Type, len(attrNames))
+                        for i, name := range attrNames {
+                                tys[i] = atys[name]
+                        }
+                        return cty.Tuple(tys), nil
+                }
+                return cty.NilType, errors.New("values() requires a map as the first argument")
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                mapVar := args[0]
+
+                // We can just iterate the map/object value here because cty guarantees
+                // that these types always iterate in key lexicographical order.
+                var values []cty.Value
+                for it := mapVar.ElementIterator(); it.Next(); {
+                        _, val := it.Element()
+                        values = append(values, val)
+                }
+
+                if retType.IsTupleType() {
+                        return cty.TupleVal(values), nil
+                }
+                if len(values) == 0 {
+                        return cty.ListValEmpty(retType.ElementType()), nil
+                }
+                return cty.ListVal(values), nil
+        },
+})
+
+// ZipmapFunc constructs a function that constructs a map from a list of keys
+// and a corresponding list of values.
+var ZipmapFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "keys",
+                        Type: cty.List(cty.String),
+                },
+                {
+                        Name: "values",
+                        Type: cty.DynamicPseudoType,
+                },
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                keys := args[0]
+                values := args[1]
+                valuesTy := values.Type()
+
+                switch {
+                case valuesTy.IsListType():
+                        return cty.Map(values.Type().ElementType()), nil
+                case valuesTy.IsTupleType():
+                        if !keys.IsWhollyKnown() {
+                                // Since zipmap with a tuple produces an object, we need to know
+                                // all of the key names before we can predict our result type.
+                                return cty.DynamicPseudoType, nil
+                        }
+
+                        keysRaw := keys.AsValueSlice()
+                        valueTypesRaw := valuesTy.TupleElementTypes()
+                        if len(keysRaw) != len(valueTypesRaw) {
+                                return cty.NilType, fmt.Errorf("number of keys (%d) does not match number of values (%d)", len(keysRaw), len(valueTypesRaw))
+                        }
+                        atys := make(map[string]cty.Type, len(valueTypesRaw))
+                        for i, keyVal := range keysRaw {
+                                if keyVal.IsNull() {
+                                        return cty.NilType, fmt.Errorf("keys list has null value at index %d", i)
+                                }
+                                key := keyVal.AsString()
+                                atys[key] = valueTypesRaw[i]
+                        }
+                        return cty.Object(atys), nil
+
+                default:
+                        return cty.NilType, errors.New("values argument must be a list or tuple value")
+                }
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                keys := args[0]
+                values := args[1]
+
+                if !keys.IsWhollyKnown() {
+                        // Unknown map keys and object attributes are not supported, so
+                        // our entire result must be unknown in this case.
+                        return cty.UnknownVal(retType), nil
+                }
+
+                // both keys and values are guaranteed to be shallowly-known here,
+                // because our declared params above don't allow unknown or null values.
+                if keys.LengthInt() != values.LengthInt() {
+                        return cty.NilVal, fmt.Errorf("number of keys (%d) does not match number of values (%d)", keys.LengthInt(), values.LengthInt())
+                }
+
+                output := make(map[string]cty.Value)
+
+                i := 0
+                for it := keys.ElementIterator(); it.Next(); {
+                        _, v := it.Element()
+                        val := values.Index(cty.NumberIntVal(int64(i)))
+                        output[v.AsString()] = val
+                        i++
+                }
+
+                switch {
+                case retType.IsMapType():
+                        if len(output) == 0 {
+                                return cty.MapValEmpty(retType.ElementType()), nil
+                        }
+                        return cty.MapVal(output), nil
+                case retType.IsObjectType():
+                        return cty.ObjectVal(output), nil
+                default:
+                        // Should never happen because the type-check function should've
+                        // caught any other case.
+                        return cty.NilVal, fmt.Errorf("internally selected incorrect result type %s (this is a bug)", retType.FriendlyName())
+                }
+        },
+})
+
+// helper function to add an element to a list, if it does not already exist
+func appendIfMissing(slice []cty.Value, element cty.Value) ([]cty.Value, error) {
+        for _, ele := range slice {
+                eq, err := stdlib.Equal(ele, element)
+                if err != nil {
+                        return slice, err
+                }
+                if eq.True() {
+                        return slice, nil
+                }
+        }
+        return append(slice, element), nil
+}
+
+// Element returns a single element from a given list at the given index. If
+// index is greater than the length of the list then it is wrapped modulo
+// the list length.
+func Element(list, index cty.Value) (cty.Value, error) {
+        return ElementFunc.Call([]cty.Value{list, index})
+}
+
+// Length returns the number of elements in the given collection or number of
+// Unicode characters in the given string.
+func Length(collection cty.Value) (cty.Value, error) {
+        return LengthFunc.Call([]cty.Value{collection})
+}
+
+// Coalesce takes any number of arguments and returns the first one that isn't empty.
+func Coalesce(args ...cty.Value) (cty.Value, error) {
+        return CoalesceFunc.Call(args)
+}
+
+// CoalesceList takes any number of list arguments and returns the first one that isn't empty.
+func CoalesceList(args ...cty.Value) (cty.Value, error) {
+        return CoalesceListFunc.Call(args)
+}
+
+// Compact takes a list of strings and returns a new list
+// with any empty string elements removed.
+func Compact(list cty.Value) (cty.Value, error) {
+        return CompactFunc.Call([]cty.Value{list})
+}
+
+// Contains determines whether a given list contains a given single value
+// as one of its elements.
+func Contains(list, value cty.Value) (cty.Value, error) {
+        return ContainsFunc.Call([]cty.Value{list, value})
+}
+
+// Index finds the element index for a given value in a list.
+func Index(list, value cty.Value) (cty.Value, error) {
+        return IndexFunc.Call([]cty.Value{list, value})
+}
+
+// Distinct takes a list and returns a new list with any duplicate elements removed.
+func Distinct(list cty.Value) (cty.Value, error) {
+        return DistinctFunc.Call([]cty.Value{list})
+}
+
+// Chunklist splits a single list into fixed-size chunks, returning a list of lists.
+func Chunklist(list, size cty.Value) (cty.Value, error) {
+        return ChunklistFunc.Call([]cty.Value{list, size})
+}
+
+// Flatten takes a list and replaces any elements that are lists with a flattened
+// sequence of the list contents.
+func Flatten(list cty.Value) (cty.Value, error) {
+        return FlattenFunc.Call([]cty.Value{list})
+}
+
+// Keys takes a map and returns a sorted list of the map keys.
+func Keys(inputMap cty.Value) (cty.Value, error) {
+        return KeysFunc.Call([]cty.Value{inputMap})
+}
+
+// List takes any number of list arguments and returns a list containing those
+//  values in the same order.
+func List(args ...cty.Value) (cty.Value, error) {
+        return ListFunc.Call(args)
+}
+
+// Lookup performs a dynamic lookup into a map.
+// There are two required arguments, map and key, plus an optional default,
+// which is a value to return if no key is found in map.
+func Lookup(args ...cty.Value) (cty.Value, error) {
+        return LookupFunc.Call(args)
+}
+
+// Map takes an even number of arguments and returns a map whose elements are constructed
+// from consecutive pairs of arguments.
+func Map(args ...cty.Value) (cty.Value, error) {
+        return MapFunc.Call(args)
+}
+
+// Matchkeys constructs a new list by taking a subset of elements from one list
+// whose indexes match the corresponding indexes of values in another list.
+func Matchkeys(values, keys, searchset cty.Value) (cty.Value, error) {
+        return MatchkeysFunc.Call([]cty.Value{values, keys, searchset})
+}
+
+// Merge takes an arbitrary number of maps and returns a single map that contains
+// a merged set of elements from all of the maps.
+//
+// If more than one given map defines the same key then the one that is later in
+// the argument sequence takes precedence.
+func Merge(maps ...cty.Value) (cty.Value, error) {
+        return MergeFunc.Call(maps)
+}
+
+// Reverse takes a sequence and produces a new sequence of the same length
+// with all of the same elements as the given sequence but in reverse order.
+func Reverse(list cty.Value) (cty.Value, error) {
+        return ReverseFunc.Call([]cty.Value{list})
+}
+
+// SetProduct computes the cartesian product of sets or sequences.
+func SetProduct(sets ...cty.Value) (cty.Value, error) {
+        return SetProductFunc.Call(sets)
+}
+
+// Slice extracts some consecutive elements from within a list.
+func Slice(list, start, end cty.Value) (cty.Value, error) {
+        return SliceFunc.Call([]cty.Value{list, start, end})
+}
+
+// Transpose takes a map of lists of strings and swaps the keys and values to
+// produce a new map of lists of strings.
+func Transpose(values cty.Value) (cty.Value, error) {
+        return TransposeFunc.Call([]cty.Value{values})
+}
+
+// Values returns a list of the map values, in the order of the sorted keys.
+// This function only works on flat maps.
+func Values(values cty.Value) (cty.Value, error) {
+        return ValuesFunc.Call([]cty.Value{values})
+}
+
+// Zipmap constructs a map from a list of keys and a corresponding list of values.
+func Zipmap(keys, values cty.Value) (cty.Value, error) {
+        return ZipmapFunc.Call([]cty.Value{keys, values})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/conversion.go b/vendor/github.com/hashicorp/terraform/lang/funcs/conversion.go
new file mode 100644
index 0000000..83f8597
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/conversion.go
@@ -0,0 +1,87 @@
+package funcs
+
+import (
+        "strconv"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/function"
+)
+
+// MakeToFunc constructs a "to..." function, like "tostring", which converts
+// its argument to a specific type or type kind.
+//
+// The given type wantTy can be any type constraint that cty's "convert" package
+// would accept. In particular, this means that you can pass
+// cty.List(cty.DynamicPseudoType) to mean "list of any single type", which
+// will then cause cty to attempt to unify all of the element types when given
+// a tuple.
+func MakeToFunc(wantTy cty.Type) function.Function {
+        return function.New(&function.Spec{
+                Params: []function.Parameter{
+                        {
+                                Name: "v",
+                                // We use DynamicPseudoType rather than wantTy here so that
+                                // all values will pass through the function API verbatim and
+                                // we can handle the conversion logic within the Type and
+                                // Impl functions. This allows us to customize the error
+                                // messages to be more appropriate for an explicit type
+                                // conversion, whereas the cty function system produces
+                                // messages aimed at _implicit_ type conversions.
+                                Type:      cty.DynamicPseudoType,
+                                AllowNull: true,
+                        },
+                },
+                Type: func(args []cty.Value) (cty.Type, error) {
+                        gotTy := args[0].Type()
+                        if gotTy.Equals(wantTy) {
+                                return wantTy, nil
+                        }
+                        conv := convert.GetConversionUnsafe(args[0].Type(), wantTy)
+                        if conv == nil {
+                                // We'll use some specialized errors for some trickier cases,
+                                // but most we can handle in a simple way.
+                                switch {
+                                case gotTy.IsTupleType() && wantTy.IsTupleType():
+                                        return cty.NilType, function.NewArgErrorf(0, "incompatible tuple type for conversion: %s", convert.MismatchMessage(gotTy, wantTy))
+                                case gotTy.IsObjectType() && wantTy.IsObjectType():
+                                        return cty.NilType, function.NewArgErrorf(0, "incompatible object type for conversion: %s", convert.MismatchMessage(gotTy, wantTy))
+                                default:
+                                        return cty.NilType, function.NewArgErrorf(0, "cannot convert %s to %s", gotTy.FriendlyName(), wantTy.FriendlyNameForConstraint())
+                                }
+                        }
+                        // If a conversion is available then everything is fine.
+                        return wantTy, nil
+                },
+                Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                        // We didn't set "AllowUnknown" on our argument, so it is guaranteed
+                        // to be known here but may still be null.
+                        ret, err := convert.Convert(args[0], retType)
+                        if err != nil {
+                                // Because we used GetConversionUnsafe above, conversion can
+                                // still potentially fail in here. For example, if the user
+                                // asks to convert the string "a" to bool then we'll
+                                // optimistically permit it during type checking but fail here
+                                // once we note that the value isn't either "true" or "false".
+                                gotTy := args[0].Type()
+                                switch {
+                                case gotTy == cty.String && wantTy == cty.Bool:
+                                        what := "string"
+                                        if !args[0].IsNull() {
+                                                what = strconv.Quote(args[0].AsString())
+                                        }
+                                        return cty.NilVal, function.NewArgErrorf(0, `cannot convert %s to bool; only the strings "true" or "false" are allowed`, what)
+                                case gotTy == cty.String && wantTy == cty.Number:
+                                        what := "string"
+                                        if !args[0].IsNull() {
+                                                what = strconv.Quote(args[0].AsString())
+                                        }
+                                        return cty.NilVal, function.NewArgErrorf(0, `cannot convert %s to number; given string must be a decimal representation of a number`, what)
+                                default:
+                                        return cty.NilVal, function.NewArgErrorf(0, "cannot convert %s to %s", gotTy.FriendlyName(), wantTy.FriendlyNameForConstraint())
+                                }
+                        }
+                        return ret, nil
+                },
+        })
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/crypto.go b/vendor/github.com/hashicorp/terraform/lang/funcs/crypto.go
new file mode 100644
index 0000000..5cb4bc5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/crypto.go
@@ -0,0 +1,285 @@
+package funcs
+
+import (
+        "crypto/md5"
+        "crypto/rsa"
+        "crypto/sha1"
+        "crypto/sha256"
+        "crypto/sha512"
+        "crypto/x509"
+        "encoding/base64"
+        "encoding/hex"
+        "encoding/pem"
+        "fmt"
+        "hash"
+
+        uuid "github.com/hashicorp/go-uuid"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+        "github.com/zclconf/go-cty/cty/gocty"
+        "golang.org/x/crypto/bcrypt"
+)
+
+var UUIDFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        Type:   function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                result, err := uuid.GenerateUUID()
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                return cty.StringVal(result), nil
+        },
+})
+
+// Base64Sha256Func constructs a function that computes the SHA256 hash of a given string
+// and encodes it with Base64.
+var Base64Sha256Func = makeStringHashFunction(sha256.New, base64.StdEncoding.EncodeToString)
+
+// MakeFileBase64Sha256Func constructs a function that is like Base64Sha256Func but reads the
+// contents of a file rather than hashing a given literal string.
+func MakeFileBase64Sha256Func(baseDir string) function.Function {
+        return makeFileHashFunction(baseDir, sha256.New, base64.StdEncoding.EncodeToString)
+}
+
+// Base64Sha512Func constructs a function that computes the SHA256 hash of a given string
+// and encodes it with Base64.
+var Base64Sha512Func = makeStringHashFunction(sha512.New, base64.StdEncoding.EncodeToString)
+
+// MakeFileBase64Sha512Func constructs a function that is like Base64Sha512Func but reads the
+// contents of a file rather than hashing a given literal string.
+func MakeFileBase64Sha512Func(baseDir string) function.Function {
+        return makeFileHashFunction(baseDir, sha512.New, base64.StdEncoding.EncodeToString)
+}
+
+// BcryptFunc constructs a function that computes a hash of the given string using the Blowfish cipher.
+var BcryptFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        VarParam: &function.Parameter{
+                Name: "cost",
+                Type: cty.Number,
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                defaultCost := 10
+
+                if len(args) > 1 {
+                        var val int
+                        if err := gocty.FromCtyValue(args[1], &val); err != nil {
+                                return cty.UnknownVal(cty.String), err
+                        }
+                        defaultCost = val
+                }
+
+                if len(args) > 2 {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("bcrypt() takes no more than two arguments")
+                }
+
+                input := args[0].AsString()
+                out, err := bcrypt.GenerateFromPassword([]byte(input), defaultCost)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("error occured generating password %s", err.Error())
+                }
+
+                return cty.StringVal(string(out)), nil
+        },
+})
+
+// Md5Func constructs a function that computes the MD5 hash of a given string and encodes it with hexadecimal digits.
+var Md5Func = makeStringHashFunction(md5.New, hex.EncodeToString)
+
+// MakeFileMd5Func constructs a function that is like Md5Func but reads the
+// contents of a file rather than hashing a given literal string.
+func MakeFileMd5Func(baseDir string) function.Function {
+        return makeFileHashFunction(baseDir, md5.New, hex.EncodeToString)
+}
+
+// RsaDecryptFunc constructs a function that decrypts an RSA-encrypted ciphertext.
+var RsaDecryptFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "ciphertext",
+                        Type: cty.String,
+                },
+                {
+                        Name: "privatekey",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                s := args[0].AsString()
+                key := args[1].AsString()
+
+                b, err := base64.StdEncoding.DecodeString(s)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("failed to decode input %q: cipher text must be base64-encoded", s)
+                }
+
+                block, _ := pem.Decode([]byte(key))
+                if block == nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("failed to parse key: no key found")
+                }
+                if block.Headers["Proc-Type"] == "4,ENCRYPTED" {
+                        return cty.UnknownVal(cty.String), fmt.Errorf(
+                                "failed to parse key: password protected keys are not supported. Please decrypt the key prior to use",
+                        )
+                }
+
+                x509Key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                out, err := rsa.DecryptPKCS1v15(nil, x509Key, b)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                return cty.StringVal(string(out)), nil
+        },
+})
+
+// Sha1Func contructs a function that computes the SHA1 hash of a given string
+// and encodes it with hexadecimal digits.
+var Sha1Func = makeStringHashFunction(sha1.New, hex.EncodeToString)
+
+// MakeFileSha1Func constructs a function that is like Sha1Func but reads the
+// contents of a file rather than hashing a given literal string.
+func MakeFileSha1Func(baseDir string) function.Function {
+        return makeFileHashFunction(baseDir, sha1.New, hex.EncodeToString)
+}
+
+// Sha256Func contructs a function that computes the SHA256 hash of a given string
+// and encodes it with hexadecimal digits.
+var Sha256Func = makeStringHashFunction(sha256.New, hex.EncodeToString)
+
+// MakeFileSha256Func constructs a function that is like Sha256Func but reads the
+// contents of a file rather than hashing a given literal string.
+func MakeFileSha256Func(baseDir string) function.Function {
+        return makeFileHashFunction(baseDir, sha256.New, hex.EncodeToString)
+}
+
+// Sha512Func contructs a function that computes the SHA512 hash of a given string
+// and encodes it with hexadecimal digits.
+var Sha512Func = makeStringHashFunction(sha512.New, hex.EncodeToString)
+
+// MakeFileSha512Func constructs a function that is like Sha512Func but reads the
+// contents of a file rather than hashing a given literal string.
+func MakeFileSha512Func(baseDir string) function.Function {
+        return makeFileHashFunction(baseDir, sha512.New, hex.EncodeToString)
+}
+
+func makeStringHashFunction(hf func() hash.Hash, enc func([]byte) string) function.Function {
+        return function.New(&function.Spec{
+                Params: []function.Parameter{
+                        {
+                                Name: "str",
+                                Type: cty.String,
+                        },
+                },
+                Type: function.StaticReturnType(cty.String),
+                Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                        s := args[0].AsString()
+                        h := hf()
+                        h.Write([]byte(s))
+                        rv := enc(h.Sum(nil))
+                        return cty.StringVal(rv), nil
+                },
+        })
+}
+
+func makeFileHashFunction(baseDir string, hf func() hash.Hash, enc func([]byte) string) function.Function {
+        return function.New(&function.Spec{
+                Params: []function.Parameter{
+                        {
+                                Name: "path",
+                                Type: cty.String,
+                        },
+                },
+                Type: function.StaticReturnType(cty.String),
+                Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                        path := args[0].AsString()
+                        src, err := readFileBytes(baseDir, path)
+                        if err != nil {
+                                return cty.UnknownVal(cty.String), err
+                        }
+
+                        h := hf()
+                        h.Write(src)
+                        rv := enc(h.Sum(nil))
+                        return cty.StringVal(rv), nil
+                },
+        })
+}
+
+// UUID generates and returns a Type-4 UUID in the standard hexadecimal string
+// format.
+//
+// This is not a pure function: it will generate a different result for each
+// call. It must therefore be registered as an impure function in the function
+// table in the "lang" package.
+func UUID() (cty.Value, error) {
+        return UUIDFunc.Call(nil)
+}
+
+// Base64Sha256 computes the SHA256 hash of a given string and encodes it with
+// Base64.
+//
+// The given string is first encoded as UTF-8 and then the SHA256 algorithm is applied
+// as defined in RFC 4634. The raw hash is then encoded with Base64 before returning.
+// Terraform uses the "standard" Base64 alphabet as defined in RFC 4648 section 4.
+func Base64Sha256(str cty.Value) (cty.Value, error) {
+        return Base64Sha256Func.Call([]cty.Value{str})
+}
+
+// Base64Sha512 computes the SHA512 hash of a given string and encodes it with
+// Base64.
+//
+// The given string is first encoded as UTF-8 and then the SHA256 algorithm is applied
+// as defined in RFC 4634. The raw hash is then encoded with Base64 before returning.
+// Terraform uses the "standard" Base64  alphabet as defined in RFC 4648 section 4
+func Base64Sha512(str cty.Value) (cty.Value, error) {
+        return Base64Sha512Func.Call([]cty.Value{str})
+}
+
+// Bcrypt computes a hash of the given string using the Blowfish cipher,
+// returning a string in the Modular Crypt Format
+// usually expected in the shadow password file on many Unix systems.
+func Bcrypt(str cty.Value, cost ...cty.Value) (cty.Value, error) {
+        args := make([]cty.Value, len(cost)+1)
+        args[0] = str
+        copy(args[1:], cost)
+        return BcryptFunc.Call(args)
+}
+
+// Md5 computes the MD5 hash of a given string and encodes it with hexadecimal digits.
+func Md5(str cty.Value) (cty.Value, error) {
+        return Md5Func.Call([]cty.Value{str})
+}
+
+// RsaDecrypt decrypts an RSA-encrypted ciphertext, returning the corresponding
+// cleartext.
+func RsaDecrypt(ciphertext, privatekey cty.Value) (cty.Value, error) {
+        return RsaDecryptFunc.Call([]cty.Value{ciphertext, privatekey})
+}
+
+// Sha1 computes the SHA1 hash of a given string and encodes it with hexadecimal digits.
+func Sha1(str cty.Value) (cty.Value, error) {
+        return Sha1Func.Call([]cty.Value{str})
+}
+
+// Sha256 computes the SHA256 hash of a given string and encodes it with hexadecimal digits.
+func Sha256(str cty.Value) (cty.Value, error) {
+        return Sha256Func.Call([]cty.Value{str})
+}
+
+// Sha512 computes the SHA512 hash of a given string and encodes it with hexadecimal digits.
+func Sha512(str cty.Value) (cty.Value, error) {
+        return Sha512Func.Call([]cty.Value{str})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/datetime.go b/vendor/github.com/hashicorp/terraform/lang/funcs/datetime.go
new file mode 100644
index 0000000..5dae198
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/datetime.go
@@ -0,0 +1,70 @@
+package funcs
+
+import (
+        "time"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+)
+
+// TimestampFunc constructs a function that returns a string representation of the current date and time.
+var TimestampFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        Type:   function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                return cty.StringVal(time.Now().UTC().Format(time.RFC3339)), nil
+        },
+})
+
+// TimeAddFunc constructs a function that adds a duration to a timestamp, returning a new timestamp.
+var TimeAddFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "timestamp",
+                        Type: cty.String,
+                },
+                {
+                        Name: "duration",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                ts, err := time.Parse(time.RFC3339, args[0].AsString())
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                duration, err := time.ParseDuration(args[1].AsString())
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                return cty.StringVal(ts.Add(duration).Format(time.RFC3339)), nil
+        },
+})
+
+// Timestamp returns a string representation of the current date and time.
+//
+// In the Terraform language, timestamps are conventionally represented as
+// strings using RFC 3339 "Date and Time format" syntax, and so timestamp
+// returns a string in this format.
+func Timestamp() (cty.Value, error) {
+        return TimestampFunc.Call([]cty.Value{})
+}
+
+// TimeAdd adds a duration to a timestamp, returning a new timestamp.
+//
+// In the Terraform language, timestamps are conventionally represented as
+// strings using RFC 3339 "Date and Time format" syntax. Timeadd requires
+// the timestamp argument to be a string conforming to this syntax.
+//
+// `duration` is a string representation of a time difference, consisting of
+// sequences of number and unit pairs, like `"1.5h"` or `1h30m`. The accepted
+// units are `ns`, `us` (or `µs`), `"ms"`, `"s"`, `"m"`, and `"h"`. The first
+// number may be negative to indicate a negative duration, like `"-2h5m"`.
+//
+// The result is a string, also in RFC 3339 format, representing the result
+// of adding the given direction to the given timestamp.
+func TimeAdd(timestamp cty.Value, duration cty.Value) (cty.Value, error) {
+        return TimeAddFunc.Call([]cty.Value{timestamp, duration})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/encoding.go b/vendor/github.com/hashicorp/terraform/lang/funcs/encoding.go
new file mode 100644
index 0000000..af93f08
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/encoding.go
@@ -0,0 +1,140 @@
+package funcs
+
+import (
+        "bytes"
+        "compress/gzip"
+        "encoding/base64"
+        "fmt"
+        "log"
+        "net/url"
+        "unicode/utf8"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+)
+
+// Base64DecodeFunc constructs a function that decodes a string containing a base64 sequence.
+var Base64DecodeFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                s := args[0].AsString()
+                sDec, err := base64.StdEncoding.DecodeString(s)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("failed to decode base64 data '%s'", s)
+                }
+                if !utf8.Valid([]byte(sDec)) {
+                        log.Printf("[DEBUG] the result of decoding the the provided string is not valid UTF-8: %s", sDec)
+                        return cty.UnknownVal(cty.String), fmt.Errorf("the result of decoding the the provided string is not valid UTF-8")
+                }
+                return cty.StringVal(string(sDec)), nil
+        },
+})
+
+// Base64EncodeFunc constructs a function that encodes a string to a base64 sequence.
+var Base64EncodeFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                return cty.StringVal(base64.StdEncoding.EncodeToString([]byte(args[0].AsString()))), nil
+        },
+})
+
+// Base64GzipFunc constructs a function that compresses a string with gzip and then encodes the result in
+// Base64 encoding.
+var Base64GzipFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                s := args[0].AsString()
+
+                var b bytes.Buffer
+                gz := gzip.NewWriter(&b)
+                if _, err := gz.Write([]byte(s)); err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("failed to write gzip raw data: '%s'", s)
+                }
+                if err := gz.Flush(); err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("failed to flush gzip writer: '%s'", s)
+                }
+                if err := gz.Close(); err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("failed to close gzip writer: '%s'", s)
+                }
+                return cty.StringVal(base64.StdEncoding.EncodeToString(b.Bytes())), nil
+        },
+})
+
+// URLEncodeFunc constructs a function that applies URL encoding to a given string.
+var URLEncodeFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                return cty.StringVal(url.QueryEscape(args[0].AsString())), nil
+        },
+})
+
+// Base64Decode decodes a string containing a base64 sequence.
+//
+// Terraform uses the "standard" Base64 alphabet as defined in RFC 4648 section 4.
+//
+// Strings in the Terraform language are sequences of unicode characters rather
+// than bytes, so this function will also interpret the resulting bytes as
+// UTF-8. If the bytes after Base64 decoding are _not_ valid UTF-8, this function
+// produces an error.
+func Base64Decode(str cty.Value) (cty.Value, error) {
+        return Base64DecodeFunc.Call([]cty.Value{str})
+}
+
+// Base64Encode applies Base64 encoding to a string.
+//
+// Terraform uses the "standard" Base64 alphabet as defined in RFC 4648 section 4.
+//
+// Strings in the Terraform language are sequences of unicode characters rather
+// than bytes, so this function will first encode the characters from the string
+// as UTF-8, and then apply Base64 encoding to the result.
+func Base64Encode(str cty.Value) (cty.Value, error) {
+        return Base64EncodeFunc.Call([]cty.Value{str})
+}
+
+// Base64Gzip compresses a string with gzip and then encodes the result in
+// Base64 encoding.
+//
+// Terraform uses the "standard" Base64 alphabet as defined in RFC 4648 section 4.
+//
+// Strings in the Terraform language are sequences of unicode characters rather
+// than bytes, so this function will first encode the characters from the string
+// as UTF-8, then apply gzip compression, and then finally apply Base64 encoding.
+func Base64Gzip(str cty.Value) (cty.Value, error) {
+        return Base64GzipFunc.Call([]cty.Value{str})
+}
+
+// URLEncode applies URL encoding to a given string.
+//
+// This function identifies characters in the given string that would have a
+// special meaning when included as a query string argument in a URL and
+// escapes them using RFC 3986 "percent encoding".
+//
+// If the given string contains non-ASCII characters, these are first encoded as
+// UTF-8 and then percent encoding is applied separately to each UTF-8 byte.
+func URLEncode(str cty.Value) (cty.Value, error) {
+        return URLEncodeFunc.Call([]cty.Value{str})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/filesystem.go b/vendor/github.com/hashicorp/terraform/lang/funcs/filesystem.go
new file mode 100644
index 0000000..7dfc905
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/filesystem.go
@@ -0,0 +1,345 @@
+package funcs
+
+import (
+        "encoding/base64"
+        "fmt"
+        "io/ioutil"
+        "os"
+        "path/filepath"
+        "unicode/utf8"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        homedir "github.com/mitchellh/go-homedir"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+)
+
+// MakeFileFunc constructs a function that takes a file path and returns the
+// contents of that file, either directly as a string (where valid UTF-8 is
+// required) or as a string containing base64 bytes.
+func MakeFileFunc(baseDir string, encBase64 bool) function.Function {
+        return function.New(&function.Spec{
+                Params: []function.Parameter{
+                        {
+                                Name: "path",
+                                Type: cty.String,
+                        },
+                },
+                Type: function.StaticReturnType(cty.String),
+                Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                        path := args[0].AsString()
+                        src, err := readFileBytes(baseDir, path)
+                        if err != nil {
+                                return cty.UnknownVal(cty.String), err
+                        }
+
+                        switch {
+                        case encBase64:
+                                enc := base64.StdEncoding.EncodeToString(src)
+                                return cty.StringVal(enc), nil
+                        default:
+                                if !utf8.Valid(src) {
+                                        return cty.UnknownVal(cty.String), fmt.Errorf("contents of %s are not valid UTF-8; use the filebase64 function to obtain the Base64 encoded contents or the other file functions (e.g. filemd5, filesha256) to obtain file hashing results instead", path)
+                                }
+                                return cty.StringVal(string(src)), nil
+                        }
+                },
+        })
+}
+
+// MakeTemplateFileFunc constructs a function that takes a file path and
+// an arbitrary object of named values and attempts to render the referenced
+// file as a template using HCL template syntax.
+//
+// The template itself may recursively call other functions so a callback
+// must be provided to get access to those functions. The template cannot,
+// however, access any variables defined in the scope: it is restricted only to
+// those variables provided in the second function argument, to ensure that all
+// dependencies on other graph nodes can be seen before executing this function.
+//
+// As a special exception, a referenced template file may not recursively call
+// the templatefile function, since that would risk the same file being
+// included into itself indefinitely.
+func MakeTemplateFileFunc(baseDir string, funcsCb func() map[string]function.Function) function.Function {
+
+        params := []function.Parameter{
+                {
+                        Name: "path",
+                        Type: cty.String,
+                },
+                {
+                        Name: "vars",
+                        Type: cty.DynamicPseudoType,
+                },
+        }
+
+        loadTmpl := func(fn string) (hcl.Expression, error) {
+                // We re-use File here to ensure the same filename interpretation
+                // as it does, along with its other safety checks.
+                tmplVal, err := File(baseDir, cty.StringVal(fn))
+                if err != nil {
+                        return nil, err
+                }
+
+                expr, diags := hclsyntax.ParseTemplate([]byte(tmplVal.AsString()), fn, hcl.Pos{Line: 1, Column: 1})
+                if diags.HasErrors() {
+                        return nil, diags
+                }
+
+                return expr, nil
+        }
+
+        renderTmpl := func(expr hcl.Expression, varsVal cty.Value) (cty.Value, error) {
+                if varsTy := varsVal.Type(); !(varsTy.IsMapType() || varsTy.IsObjectType()) {
+                        return cty.DynamicVal, function.NewArgErrorf(1, "invalid vars value: must be a map") // or an object, but we don't strongly distinguish these most of the time
+                }
+
+                ctx := &hcl.EvalContext{
+                        Variables: varsVal.AsValueMap(),
+                }
+
+                // We'll pre-check references in the template here so we can give a
+                // more specialized error message than HCL would by default, so it's
+                // clearer that this problem is coming from a templatefile call.
+                for _, traversal := range expr.Variables() {
+                        root := traversal.RootName()
+                        if _, ok := ctx.Variables[root]; !ok {
+                                return cty.DynamicVal, function.NewArgErrorf(1, "vars map does not contain key %q, referenced at %s", root, traversal[0].SourceRange())
+                        }
+                }
+
+                givenFuncs := funcsCb() // this callback indirection is to avoid chicken/egg problems
+                funcs := make(map[string]function.Function, len(givenFuncs))
+                for name, fn := range givenFuncs {
+                        if name == "templatefile" {
+                                // We stub this one out to prevent recursive calls.
+                                funcs[name] = function.New(&function.Spec{
+                                        Params: params,
+                                        Type: func(args []cty.Value) (cty.Type, error) {
+                                                return cty.NilType, fmt.Errorf("cannot recursively call templatefile from inside templatefile call")
+                                        },
+                                })
+                                continue
+                        }
+                        funcs[name] = fn
+                }
+                ctx.Functions = funcs
+
+                val, diags := expr.Value(ctx)
+                if diags.HasErrors() {
+                        return cty.DynamicVal, diags
+                }
+                return val, nil
+        }
+
+        return function.New(&function.Spec{
+                Params: params,
+                Type: func(args []cty.Value) (cty.Type, error) {
+                        if !(args[0].IsKnown() && args[1].IsKnown()) {
+                                return cty.DynamicPseudoType, nil
+                        }
+
+                        // We'll render our template now to see what result type it produces.
+                        // A template consisting only of a single interpolation an potentially
+                        // return any type.
+                        expr, err := loadTmpl(args[0].AsString())
+                        if err != nil {
+                                return cty.DynamicPseudoType, err
+                        }
+
+                        // This is safe even if args[1] contains unknowns because the HCL
+                        // template renderer itself knows how to short-circuit those.
+                        val, err := renderTmpl(expr, args[1])
+                        return val.Type(), err
+                },
+                Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                        expr, err := loadTmpl(args[0].AsString())
+                        if err != nil {
+                                return cty.DynamicVal, err
+                        }
+                        return renderTmpl(expr, args[1])
+                },
+        })
+
+}
+
+// MakeFileExistsFunc constructs a function that takes a path
+// and determines whether a file exists at that path
+func MakeFileExistsFunc(baseDir string) function.Function {
+        return function.New(&function.Spec{
+                Params: []function.Parameter{
+                        {
+                                Name: "path",
+                                Type: cty.String,
+                        },
+                },
+                Type: function.StaticReturnType(cty.Bool),
+                Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                        path := args[0].AsString()
+                        path, err := homedir.Expand(path)
+                        if err != nil {
+                                return cty.UnknownVal(cty.Bool), fmt.Errorf("failed to expand ~: %s", err)
+                        }
+
+                        if !filepath.IsAbs(path) {
+                                path = filepath.Join(baseDir, path)
+                        }
+
+                        // Ensure that the path is canonical for the host OS
+                        path = filepath.Clean(path)
+
+                        fi, err := os.Stat(path)
+                        if err != nil {
+                                if os.IsNotExist(err) {
+                                        return cty.False, nil
+                                }
+                                return cty.UnknownVal(cty.Bool), fmt.Errorf("failed to stat %s", path)
+                        }
+
+                        if fi.Mode().IsRegular() {
+                                return cty.True, nil
+                        }
+
+                        return cty.False, fmt.Errorf("%s is not a regular file, but %q",
+                                path, fi.Mode().String())
+                },
+        })
+}
+
+// BasenameFunc constructs a function that takes a string containing a filesystem path
+// and removes all except the last portion from it.
+var BasenameFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "path",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                return cty.StringVal(filepath.Base(args[0].AsString())), nil
+        },
+})
+
+// DirnameFunc constructs a function that takes a string containing a filesystem path
+// and removes the last portion from it.
+var DirnameFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "path",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                return cty.StringVal(filepath.Dir(args[0].AsString())), nil
+        },
+})
+
+// PathExpandFunc constructs a function that expands a leading ~ character to the current user's home directory.
+var PathExpandFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "path",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+
+                homePath, err := homedir.Expand(args[0].AsString())
+                return cty.StringVal(homePath), err
+        },
+})
+
+func readFileBytes(baseDir, path string) ([]byte, error) {
+        path, err := homedir.Expand(path)
+        if err != nil {
+                return nil, fmt.Errorf("failed to expand ~: %s", err)
+        }
+
+        if !filepath.IsAbs(path) {
+                path = filepath.Join(baseDir, path)
+        }
+
+        // Ensure that the path is canonical for the host OS
+        path = filepath.Clean(path)
+
+        src, err := ioutil.ReadFile(path)
+        if err != nil {
+                // ReadFile does not return Terraform-user-friendly error
+                // messages, so we'll provide our own.
+                if os.IsNotExist(err) {
+                        return nil, fmt.Errorf("no file exists at %s", path)
+                }
+                return nil, fmt.Errorf("failed to read %s", path)
+        }
+
+        return src, nil
+}
+
+// File reads the contents of the file at the given path.
+//
+// The file must contain valid UTF-8 bytes, or this function will return an error.
+//
+// The underlying function implementation works relative to a particular base
+// directory, so this wrapper takes a base directory string and uses it to
+// construct the underlying function before calling it.
+func File(baseDir string, path cty.Value) (cty.Value, error) {
+        fn := MakeFileFunc(baseDir, false)
+        return fn.Call([]cty.Value{path})
+}
+
+// FileExists determines whether a file exists at the given path.
+//
+// The underlying function implementation works relative to a particular base
+// directory, so this wrapper takes a base directory string and uses it to
+// construct the underlying function before calling it.
+func FileExists(baseDir string, path cty.Value) (cty.Value, error) {
+        fn := MakeFileExistsFunc(baseDir)
+        return fn.Call([]cty.Value{path})
+}
+
+// FileBase64 reads the contents of the file at the given path.
+//
+// The bytes from the file are encoded as base64 before returning.
+//
+// The underlying function implementation works relative to a particular base
+// directory, so this wrapper takes a base directory string and uses it to
+// construct the underlying function before calling it.
+func FileBase64(baseDir string, path cty.Value) (cty.Value, error) {
+        fn := MakeFileFunc(baseDir, true)
+        return fn.Call([]cty.Value{path})
+}
+
+// Basename takes a string containing a filesystem path and removes all except the last portion from it.
+//
+// The underlying function implementation works only with the path string and does not access the filesystem itself.
+// It is therefore unable to take into account filesystem features such as symlinks.
+//
+// If the path is empty then the result is ".", representing the current working directory.
+func Basename(path cty.Value) (cty.Value, error) {
+        return BasenameFunc.Call([]cty.Value{path})
+}
+
+// Dirname takes a string containing a filesystem path and removes the last portion from it.
+//
+// The underlying function implementation works only with the path string and does not access the filesystem itself.
+// It is therefore unable to take into account filesystem features such as symlinks.
+//
+// If the path is empty then the result is ".", representing the current working directory.
+func Dirname(path cty.Value) (cty.Value, error) {
+        return DirnameFunc.Call([]cty.Value{path})
+}
+
+// Pathexpand takes a string that might begin with a `~` segment, and if so it replaces that segment with
+// the current user's home directory path.
+//
+// The underlying function implementation works only with the path string and does not access the filesystem itself.
+// It is therefore unable to take into account filesystem features such as symlinks.
+//
+// If the leading segment in the path is not `~` then the given path is returned unmodified.
+func Pathexpand(path cty.Value) (cty.Value, error) {
+        return PathExpandFunc.Call([]cty.Value{path})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/number.go b/vendor/github.com/hashicorp/terraform/lang/funcs/number.go
new file mode 100644
index 0000000..15cfe71
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/number.go
@@ -0,0 +1,155 @@
+package funcs
+
+import (
+        "math"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+// CeilFunc contructs a function that returns the closest whole number greater
+// than or equal to the given value.
+var CeilFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "num",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.Number),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var val float64
+                if err := gocty.FromCtyValue(args[0], &val); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                return cty.NumberIntVal(int64(math.Ceil(val))), nil
+        },
+})
+
+// FloorFunc contructs a function that returns the closest whole number lesser
+// than or equal to the given value.
+var FloorFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "num",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.Number),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var val float64
+                if err := gocty.FromCtyValue(args[0], &val); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                return cty.NumberIntVal(int64(math.Floor(val))), nil
+        },
+})
+
+// LogFunc contructs a function that returns the logarithm of a given number in a given base.
+var LogFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "num",
+                        Type: cty.Number,
+                },
+                {
+                        Name: "base",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.Number),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var num float64
+                if err := gocty.FromCtyValue(args[0], &num); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                var base float64
+                if err := gocty.FromCtyValue(args[1], &base); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                return cty.NumberFloatVal(math.Log(num) / math.Log(base)), nil
+        },
+})
+
+// PowFunc contructs a function that returns the logarithm of a given number in a given base.
+var PowFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "num",
+                        Type: cty.Number,
+                },
+                {
+                        Name: "power",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.Number),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var num float64
+                if err := gocty.FromCtyValue(args[0], &num); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                var power float64
+                if err := gocty.FromCtyValue(args[1], &power); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                return cty.NumberFloatVal(math.Pow(num, power)), nil
+        },
+})
+
+// SignumFunc contructs a function that returns the closest whole number greater
+// than or equal to the given value.
+var SignumFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "num",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.Number),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var num int
+                if err := gocty.FromCtyValue(args[0], &num); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                switch {
+                case num < 0:
+                        return cty.NumberIntVal(-1), nil
+                case num > 0:
+                        return cty.NumberIntVal(+1), nil
+                default:
+                        return cty.NumberIntVal(0), nil
+                }
+        },
+})
+
+// Ceil returns the closest whole number greater than or equal to the given value.
+func Ceil(num cty.Value) (cty.Value, error) {
+        return CeilFunc.Call([]cty.Value{num})
+}
+
+// Floor returns the closest whole number lesser than or equal to the given value.
+func Floor(num cty.Value) (cty.Value, error) {
+        return FloorFunc.Call([]cty.Value{num})
+}
+
+// Log returns returns the logarithm of a given number in a given base.
+func Log(num, base cty.Value) (cty.Value, error) {
+        return LogFunc.Call([]cty.Value{num, base})
+}
+
+// Pow returns the logarithm of a given number in a given base.
+func Pow(num, power cty.Value) (cty.Value, error) {
+        return PowFunc.Call([]cty.Value{num, power})
+}
+
+// Signum determines the sign of a number, returning a number between -1 and
+// 1 to represent the sign.
+func Signum(num cty.Value) (cty.Value, error) {
+        return SignumFunc.Call([]cty.Value{num})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/string.go b/vendor/github.com/hashicorp/terraform/lang/funcs/string.go
new file mode 100644
index 0000000..c9ddf19
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/string.go
@@ -0,0 +1,280 @@
+package funcs
+
+import (
+        "fmt"
+        "regexp"
+        "sort"
+        "strings"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+var JoinFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "separator",
+                        Type: cty.String,
+                },
+        },
+        VarParam: &function.Parameter{
+                Name: "lists",
+                Type: cty.List(cty.String),
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                sep := args[0].AsString()
+                listVals := args[1:]
+                if len(listVals) < 1 {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("at least one list is required")
+                }
+
+                l := 0
+                for _, list := range listVals {
+                        if !list.IsWhollyKnown() {
+                                return cty.UnknownVal(cty.String), nil
+                        }
+                        l += list.LengthInt()
+                }
+
+                items := make([]string, 0, l)
+                for ai, list := range listVals {
+                        ei := 0
+                        for it := list.ElementIterator(); it.Next(); {
+                                _, val := it.Element()
+                                if val.IsNull() {
+                                        if len(listVals) > 1 {
+                                                return cty.UnknownVal(cty.String), function.NewArgErrorf(ai+1, "element %d of list %d is null; cannot concatenate null values", ei, ai+1)
+                                        }
+                                        return cty.UnknownVal(cty.String), function.NewArgErrorf(ai+1, "element %d is null; cannot concatenate null values", ei)
+                                }
+                                items = append(items, val.AsString())
+                                ei++
+                        }
+                }
+
+                return cty.StringVal(strings.Join(items, sep)), nil
+        },
+})
+
+var SortFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.List(cty.String),
+                },
+        },
+        Type: function.StaticReturnType(cty.List(cty.String)),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                listVal := args[0]
+
+                if !listVal.IsWhollyKnown() {
+                        // If some of the element values aren't known yet then we
+                        // can't yet preduct the order of the result.
+                        return cty.UnknownVal(retType), nil
+                }
+                if listVal.LengthInt() == 0 { // Easy path
+                        return listVal, nil
+                }
+
+                list := make([]string, 0, listVal.LengthInt())
+                for it := listVal.ElementIterator(); it.Next(); {
+                        iv, v := it.Element()
+                        if v.IsNull() {
+                                return cty.UnknownVal(retType), fmt.Errorf("given list element %s is null; a null string cannot be sorted", iv.AsBigFloat().String())
+                        }
+                        list = append(list, v.AsString())
+                }
+
+                sort.Strings(list)
+                retVals := make([]cty.Value, len(list))
+                for i, s := range list {
+                        retVals[i] = cty.StringVal(s)
+                }
+                return cty.ListVal(retVals), nil
+        },
+})
+
+var SplitFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "separator",
+                        Type: cty.String,
+                },
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.List(cty.String)),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                sep := args[0].AsString()
+                str := args[1].AsString()
+                elems := strings.Split(str, sep)
+                elemVals := make([]cty.Value, len(elems))
+                for i, s := range elems {
+                        elemVals[i] = cty.StringVal(s)
+                }
+                if len(elemVals) == 0 {
+                        return cty.ListValEmpty(cty.String), nil
+                }
+                return cty.ListVal(elemVals), nil
+        },
+})
+
+// ChompFunc constructions a function that removes newline characters at the end of a string.
+var ChompFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                newlines := regexp.MustCompile(`(?:\r\n?|\n)*\z`)
+                return cty.StringVal(newlines.ReplaceAllString(args[0].AsString(), "")), nil
+        },
+})
+
+// IndentFunc constructions a function that adds a given number of spaces to the
+// beginnings of all but the first line in a given multi-line string.
+var IndentFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "spaces",
+                        Type: cty.Number,
+                },
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var spaces int
+                if err := gocty.FromCtyValue(args[0], &spaces); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                data := args[1].AsString()
+                pad := strings.Repeat(" ", spaces)
+                return cty.StringVal(strings.Replace(data, "\n", "\n"+pad, -1)), nil
+        },
+})
+
+// ReplaceFunc constructions a function that searches a given string for another
+// given substring, and replaces each occurence with a given replacement string.
+var ReplaceFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+                {
+                        Name: "substr",
+                        Type: cty.String,
+                },
+                {
+                        Name: "replace",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                str := args[0].AsString()
+                substr := args[1].AsString()
+                replace := args[2].AsString()
+
+                // We search/replace using a regexp if the string is surrounded
+                // in forward slashes.
+                if len(substr) > 1 && substr[0] == '/' && substr[len(substr)-1] == '/' {
+                        re, err := regexp.Compile(substr[1 : len(substr)-1])
+                        if err != nil {
+                                return cty.UnknownVal(cty.String), err
+                        }
+
+                        return cty.StringVal(re.ReplaceAllString(str, replace)), nil
+                }
+
+                return cty.StringVal(strings.Replace(str, substr, replace, -1)), nil
+        },
+})
+
+// TitleFunc constructions a function that converts the first letter of each word
+// in the given string to uppercase.
+var TitleFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                return cty.StringVal(strings.Title(args[0].AsString())), nil
+        },
+})
+
+// TrimSpaceFunc constructions a function that removes any space characters from
+// the start and end of the given string.
+var TrimSpaceFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                return cty.StringVal(strings.TrimSpace(args[0].AsString())), nil
+        },
+})
+
+// Join concatenates together the string elements of one or more lists with a
+// given separator.
+func Join(sep cty.Value, lists ...cty.Value) (cty.Value, error) {
+        args := make([]cty.Value, len(lists)+1)
+        args[0] = sep
+        copy(args[1:], lists)
+        return JoinFunc.Call(args)
+}
+
+// Sort re-orders the elements of a given list of strings so that they are
+// in ascending lexicographical order.
+func Sort(list cty.Value) (cty.Value, error) {
+        return SortFunc.Call([]cty.Value{list})
+}
+
+// Split divides a given string by a given separator, returning a list of
+// strings containing the characters between the separator sequences.
+func Split(sep, str cty.Value) (cty.Value, error) {
+        return SplitFunc.Call([]cty.Value{sep, str})
+}
+
+// Chomp removes newline characters at the end of a string.
+func Chomp(str cty.Value) (cty.Value, error) {
+        return ChompFunc.Call([]cty.Value{str})
+}
+
+// Indent adds a given number of spaces to the beginnings of all but the first
+// line in a given multi-line string.
+func Indent(spaces, str cty.Value) (cty.Value, error) {
+        return IndentFunc.Call([]cty.Value{spaces, str})
+}
+
+// Replace searches a given string for another given substring,
+// and replaces all occurences with a given replacement string.
+func Replace(str, substr, replace cty.Value) (cty.Value, error) {
+        return ReplaceFunc.Call([]cty.Value{str, substr, replace})
+}
+
+// Title converts the first letter of each word in the given string to uppercase.
+func Title(str cty.Value) (cty.Value, error) {
+        return TitleFunc.Call([]cty.Value{str})
+}
+
+// TrimSpace removes any space characters from the start and end of the given string.
+func TrimSpace(str cty.Value) (cty.Value, error) {
+        return TrimSpaceFunc.Call([]cty.Value{str})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/functions.go b/vendor/github.com/hashicorp/terraform/lang/functions.go
new file mode 100644
index 0000000..2c7b548
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/functions.go
@@ -0,0 +1,147 @@
+package lang
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+        "github.com/zclconf/go-cty/cty/function/stdlib"
+
+        "github.com/hashicorp/terraform/lang/funcs"
+)
+
+var impureFunctions = []string{
+        "bcrypt",
+        "timestamp",
+        "uuid",
+}
+
+// Functions returns the set of functions that should be used to when evaluating
+// expressions in the receiving scope.
+func (s *Scope) Functions() map[string]function.Function {
+        s.funcsLock.Lock()
+        if s.funcs == nil {
+                // Some of our functions are just directly the cty stdlib functions.
+                // Others are implemented in the subdirectory "funcs" here in this
+                // repository. New functions should generally start out their lives
+                // in the "funcs" directory and potentially graduate to cty stdlib
+                // later if the functionality seems to be something domain-agnostic
+                // that would be useful to all applications using cty functions.
+
+                s.funcs = map[string]function.Function{
+                        "abs":              stdlib.AbsoluteFunc,
+                        "basename":         funcs.BasenameFunc,
+                        "base64decode":     funcs.Base64DecodeFunc,
+                        "base64encode":     funcs.Base64EncodeFunc,
+                        "base64gzip":       funcs.Base64GzipFunc,
+                        "base64sha256":     funcs.Base64Sha256Func,
+                        "base64sha512":     funcs.Base64Sha512Func,
+                        "bcrypt":           funcs.BcryptFunc,
+                        "ceil":             funcs.CeilFunc,
+                        "chomp":            funcs.ChompFunc,
+                        "cidrhost":         funcs.CidrHostFunc,
+                        "cidrnetmask":      funcs.CidrNetmaskFunc,
+                        "cidrsubnet":       funcs.CidrSubnetFunc,
+                        "coalesce":         funcs.CoalesceFunc,
+                        "coalescelist":     funcs.CoalesceListFunc,
+                        "compact":          funcs.CompactFunc,
+                        "concat":           stdlib.ConcatFunc,
+                        "contains":         funcs.ContainsFunc,
+                        "csvdecode":        stdlib.CSVDecodeFunc,
+                        "dirname":          funcs.DirnameFunc,
+                        "distinct":         funcs.DistinctFunc,
+                        "element":          funcs.ElementFunc,
+                        "chunklist":        funcs.ChunklistFunc,
+                        "file":             funcs.MakeFileFunc(s.BaseDir, false),
+                        "fileexists":       funcs.MakeFileExistsFunc(s.BaseDir),
+                        "filebase64":       funcs.MakeFileFunc(s.BaseDir, true),
+                        "filebase64sha256": funcs.MakeFileBase64Sha256Func(s.BaseDir),
+                        "filebase64sha512": funcs.MakeFileBase64Sha512Func(s.BaseDir),
+                        "filemd5":          funcs.MakeFileMd5Func(s.BaseDir),
+                        "filesha1":         funcs.MakeFileSha1Func(s.BaseDir),
+                        "filesha256":       funcs.MakeFileSha256Func(s.BaseDir),
+                        "filesha512":       funcs.MakeFileSha512Func(s.BaseDir),
+                        "flatten":          funcs.FlattenFunc,
+                        "floor":            funcs.FloorFunc,
+                        "format":           stdlib.FormatFunc,
+                        "formatdate":       stdlib.FormatDateFunc,
+                        "formatlist":       stdlib.FormatListFunc,
+                        "indent":           funcs.IndentFunc,
+                        "index":            funcs.IndexFunc,
+                        "join":             funcs.JoinFunc,
+                        "jsondecode":       stdlib.JSONDecodeFunc,
+                        "jsonencode":       stdlib.JSONEncodeFunc,
+                        "keys":             funcs.KeysFunc,
+                        "length":           funcs.LengthFunc,
+                        "list":             funcs.ListFunc,
+                        "log":              funcs.LogFunc,
+                        "lookup":           funcs.LookupFunc,
+                        "lower":            stdlib.LowerFunc,
+                        "map":              funcs.MapFunc,
+                        "matchkeys":        funcs.MatchkeysFunc,
+                        "max":              stdlib.MaxFunc,
+                        "md5":              funcs.Md5Func,
+                        "merge":            funcs.MergeFunc,
+                        "min":              stdlib.MinFunc,
+                        "pathexpand":       funcs.PathExpandFunc,
+                        "pow":              funcs.PowFunc,
+                        "replace":          funcs.ReplaceFunc,
+                        "reverse":          funcs.ReverseFunc,
+                        "rsadecrypt":       funcs.RsaDecryptFunc,
+                        "setintersection":  stdlib.SetIntersectionFunc,
+                        "setproduct":       funcs.SetProductFunc,
+                        "setunion":         stdlib.SetUnionFunc,
+                        "sha1":             funcs.Sha1Func,
+                        "sha256":           funcs.Sha256Func,
+                        "sha512":           funcs.Sha512Func,
+                        "signum":           funcs.SignumFunc,
+                        "slice":            funcs.SliceFunc,
+                        "sort":             funcs.SortFunc,
+                        "split":            funcs.SplitFunc,
+                        "strrev":           stdlib.ReverseFunc,
+                        "substr":           stdlib.SubstrFunc,
+                        "timestamp":        funcs.TimestampFunc,
+                        "timeadd":          funcs.TimeAddFunc,
+                        "title":            funcs.TitleFunc,
+                        "tostring":         funcs.MakeToFunc(cty.String),
+                        "tonumber":         funcs.MakeToFunc(cty.Number),
+                        "tobool":           funcs.MakeToFunc(cty.Bool),
+                        "toset":            funcs.MakeToFunc(cty.Set(cty.DynamicPseudoType)),
+                        "tolist":           funcs.MakeToFunc(cty.List(cty.DynamicPseudoType)),
+                        "tomap":            funcs.MakeToFunc(cty.Map(cty.DynamicPseudoType)),
+                        "transpose":        funcs.TransposeFunc,
+                        "trimspace":        funcs.TrimSpaceFunc,
+                        "upper":            stdlib.UpperFunc,
+                        "urlencode":        funcs.URLEncodeFunc,
+                        "uuid":             funcs.UUIDFunc,
+                        "values":           funcs.ValuesFunc,
+                        "zipmap":           funcs.ZipmapFunc,
+                }
+
+                s.funcs["templatefile"] = funcs.MakeTemplateFileFunc(s.BaseDir, func() map[string]function.Function {
+                        // The templatefile function prevents recursive calls to itself
+                        // by copying this map and overwriting the "templatefile" entry.
+                        return s.funcs
+                })
+
+                if s.PureOnly {
+                        // Force our few impure functions to return unknown so that we
+                        // can defer evaluating them until a later pass.
+                        for _, name := range impureFunctions {
+                                s.funcs[name] = function.Unpredictable(s.funcs[name])
+                        }
+                }
+        }
+        s.funcsLock.Unlock()
+
+        return s.funcs
+}
+
+var unimplFunc = function.New(&function.Spec{
+        Type: func([]cty.Value) (cty.Type, error) {
+                return cty.DynamicPseudoType, fmt.Errorf("function not yet implemented")
+        },
+        Impl: func([]cty.Value, cty.Type) (cty.Value, error) {
+                return cty.DynamicVal, fmt.Errorf("function not yet implemented")
+        },
+})
diff --git a/vendor/github.com/hashicorp/terraform/lang/references.go b/vendor/github.com/hashicorp/terraform/lang/references.go
new file mode 100644
index 0000000..d688477
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/references.go
@@ -0,0 +1,81 @@
+package lang
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang/blocktoattr"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// References finds all of the references in the given set of traversals,
+// returning diagnostics if any of the traversals cannot be interpreted as a
+// reference.
+//
+// This function does not do any de-duplication of references, since references
+// have source location information embedded in them and so any invalid
+// references that are duplicated should have errors reported for each
+// occurence.
+//
+// If the returned diagnostics contains errors then the result may be
+// incomplete or invalid. Otherwise, the returned slice has one reference per
+// given traversal, though it is not guaranteed that the references will
+// appear in the same order as the given traversals.
+func References(traversals []hcl.Traversal) ([]*addrs.Reference, tfdiags.Diagnostics) {
+        if len(traversals) == 0 {
+                return nil, nil
+        }
+
+        var diags tfdiags.Diagnostics
+        refs := make([]*addrs.Reference, 0, len(traversals))
+
+        for _, traversal := range traversals {
+                ref, refDiags := addrs.ParseRef(traversal)
+                diags = diags.Append(refDiags)
+                if ref == nil {
+                        continue
+                }
+                refs = append(refs, ref)
+        }
+
+        return refs, diags
+}
+
+// ReferencesInBlock is a helper wrapper around References that first searches
+// the given body for traversals, before converting those traversals to
+// references.
+//
+// A block schema must be provided so that this function can determine where in
+// the body variables are expected.
+func ReferencesInBlock(body hcl.Body, schema *configschema.Block) ([]*addrs.Reference, tfdiags.Diagnostics) {
+        if body == nil {
+                return nil, nil
+        }
+
+        // We use blocktoattr.ExpandedVariables instead of hcldec.Variables or
+        // dynblock.VariablesHCLDec here because when we evaluate a block we'll
+        // first apply the dynamic block extension and _then_ the blocktoattr
+        // transform, and so blocktoattr.ExpandedVariables takes into account
+        // both of those transforms when it analyzes the body to ensure we find
+        // all of the references as if they'd already moved into their final
+        // locations, even though we can't expand dynamic blocks yet until we
+        // already know which variables are required.
+        //
+        // The set of cases we want to detect here is covered by the tests for
+        // the plan graph builder in the main 'terraform' package, since it's
+        // in a better position to test this due to having mock providers etc
+        // available.
+        traversals := blocktoattr.ExpandedVariables(body, schema)
+        return References(traversals)
+}
+
+// ReferencesInExpr is a helper wrapper around References that first searches
+// the given expression for traversals, before converting those traversals
+// to references.
+func ReferencesInExpr(expr hcl.Expression) ([]*addrs.Reference, tfdiags.Diagnostics) {
+        if expr == nil {
+                return nil, nil
+        }
+        traversals := expr.Variables()
+        return References(traversals)
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/scope.go b/vendor/github.com/hashicorp/terraform/lang/scope.go
new file mode 100644
index 0000000..98fca6b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/scope.go
@@ -0,0 +1,34 @@
+package lang
+
+import (
+        "sync"
+
+        "github.com/zclconf/go-cty/cty/function"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Scope is the main type in this package, allowing dynamic evaluation of
+// blocks and expressions based on some contextual information that informs
+// which variables and functions will be available.
+type Scope struct {
+        // Data is used to resolve references in expressions.
+        Data Data
+
+        // SelfAddr is the address that the "self" object should be an alias of,
+        // or nil if the "self" object should not be available at all.
+        SelfAddr addrs.Referenceable
+
+        // BaseDir is the base directory used by any interpolation functions that
+        // accept filesystem paths as arguments.
+        BaseDir string
+
+        // PureOnly can be set to true to request that any non-pure functions
+        // produce unknown value results rather than actually executing. This is
+        // important during a plan phase to avoid generating results that could
+        // then differ during apply.
+        PureOnly bool
+
+        funcs     map[string]function.Function
+        funcsLock sync.Mutex
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/action.go b/vendor/github.com/hashicorp/terraform/plans/action.go
new file mode 100644
index 0000000..c3e6a32
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/action.go
@@ -0,0 +1,22 @@
+package plans
+
+type Action rune
+
+const (
+        NoOp             Action = 0
+        Create           Action = '+'
+        Read             Action = '←'
+        Update           Action = '~'
+        DeleteThenCreate Action = '∓'
+        CreateThenDelete Action = '±'
+        Delete           Action = '-'
+)
+
+//go:generate stringer -type Action
+
+// IsReplace returns true if the action is one of the two actions that
+// represents replacing an existing object with a new object:
+// DeleteThenCreate or CreateThenDelete.
+func (a Action) IsReplace() bool {
+        return a == DeleteThenCreate || a == CreateThenDelete
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/action_string.go b/vendor/github.com/hashicorp/terraform/plans/action_string.go
new file mode 100644
index 0000000..be43ab1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/action_string.go
@@ -0,0 +1,49 @@
+// Code generated by "stringer -type Action"; DO NOT EDIT.
+
+package plans
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[NoOp-0]
+        _ = x[Create-43]
+        _ = x[Read-8592]
+        _ = x[Update-126]
+        _ = x[DeleteThenCreate-8723]
+        _ = x[CreateThenDelete-177]
+        _ = x[Delete-45]
+}
+
+const (
+        _Action_name_0 = "NoOp"
+        _Action_name_1 = "Create"
+        _Action_name_2 = "Delete"
+        _Action_name_3 = "Update"
+        _Action_name_4 = "CreateThenDelete"
+        _Action_name_5 = "Read"
+        _Action_name_6 = "DeleteThenCreate"
+)
+
+func (i Action) String() string {
+        switch {
+        case i == 0:
+                return _Action_name_0
+        case i == 43:
+                return _Action_name_1
+        case i == 45:
+                return _Action_name_2
+        case i == 126:
+                return _Action_name_3
+        case i == 177:
+                return _Action_name_4
+        case i == 8592:
+                return _Action_name_5
+        case i == 8723:
+                return _Action_name_6
+        default:
+                return "Action(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/changes.go b/vendor/github.com/hashicorp/terraform/plans/changes.go
new file mode 100644
index 0000000..d7e0dcd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/changes.go
@@ -0,0 +1,308 @@
+package plans
+
+import (
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Changes describes various actions that Terraform will attempt to take if
+// the corresponding plan is applied.
+//
+// A Changes object can be rendered into a visual diff (by the caller, using
+// code in another package) for display to the user.
+type Changes struct {
+        // Resources tracks planned changes to resource instance objects.
+        Resources []*ResourceInstanceChangeSrc
+
+        // Outputs tracks planned changes output values.
+        //
+        // Note that although an in-memory plan contains planned changes for
+        // outputs throughout the configuration, a plan serialized
+        // to disk retains only the root outputs because they are
+        // externally-visible, while other outputs are implementation details and
+        // can be easily re-calculated during the apply phase. Therefore only root
+        // module outputs will survive a round-trip through a plan file.
+        Outputs []*OutputChangeSrc
+}
+
+// NewChanges returns a valid Changes object that describes no changes.
+func NewChanges() *Changes {
+        return &Changes{}
+}
+
+func (c *Changes) Empty() bool {
+        for _, res := range c.Resources {
+                if res.Action != NoOp {
+                        return false
+                }
+        }
+        return true
+}
+
+// ResourceInstance returns the planned change for the current object of the
+// resource instance of the given address, if any. Returns nil if no change is
+// planned.
+func (c *Changes) ResourceInstance(addr addrs.AbsResourceInstance) *ResourceInstanceChangeSrc {
+        addrStr := addr.String()
+        for _, rc := range c.Resources {
+                if rc.Addr.String() == addrStr && rc.DeposedKey == states.NotDeposed {
+                        return rc
+                }
+        }
+
+        return nil
+}
+
+// ResourceInstanceDeposed returns the plan change of a deposed object of
+// the resource instance of the given address, if any. Returns nil if no change
+// is planned.
+func (c *Changes) ResourceInstanceDeposed(addr addrs.AbsResourceInstance, key states.DeposedKey) *ResourceInstanceChangeSrc {
+        addrStr := addr.String()
+        for _, rc := range c.Resources {
+                if rc.Addr.String() == addrStr && rc.DeposedKey == key {
+                        return rc
+                }
+        }
+
+        return nil
+}
+
+// OutputValue returns the planned change for the output value with the
+//  given address, if any. Returns nil if no change is planned.
+func (c *Changes) OutputValue(addr addrs.AbsOutputValue) *OutputChangeSrc {
+        addrStr := addr.String()
+        for _, oc := range c.Outputs {
+                if oc.Addr.String() == addrStr {
+                        return oc
+                }
+        }
+
+        return nil
+}
+
+// SyncWrapper returns a wrapper object around the receiver that can be used
+// to make certain changes to the receiver in a concurrency-safe way, as long
+// as all callers share the same wrapper object.
+func (c *Changes) SyncWrapper() *ChangesSync {
+        return &ChangesSync{
+                changes: c,
+        }
+}
+
+// ResourceInstanceChange describes a change to a particular resource instance
+// object.
+type ResourceInstanceChange struct {
+        // Addr is the absolute address of the resource instance that the change
+        // will apply to.
+        Addr addrs.AbsResourceInstance
+
+        // DeposedKey is the identifier for a deposed object associated with the
+        // given instance, or states.NotDeposed if this change applies to the
+        // current object.
+        //
+        // A Replace change for a resource with create_before_destroy set will
+        // create a new DeposedKey temporarily during replacement. In that case,
+        // DeposedKey in the plan is always states.NotDeposed, representing that
+        // the current object is being replaced with the deposed.
+        DeposedKey states.DeposedKey
+
+        // Provider is the address of the provider configuration that was used
+        // to plan this change, and thus the configuration that must also be
+        // used to apply it.
+        ProviderAddr addrs.AbsProviderConfig
+
+        // Change is an embedded description of the change.
+        Change
+
+        // RequiredReplace is a set of paths that caused the change action to be
+        // Replace rather than Update. Always nil if the change action is not
+        // Replace.
+        //
+        // This is retained only for UI-plan-rendering purposes and so it does not
+        // currently survive a round-trip through a saved plan file.
+        RequiredReplace cty.PathSet
+
+        // Private allows a provider to stash any extra data that is opaque to
+        // Terraform that relates to this change. Terraform will save this
+        // byte-for-byte and return it to the provider in the apply call.
+        Private []byte
+}
+
+// Encode produces a variant of the reciever that has its change values
+// serialized so it can be written to a plan file. Pass the implied type of the
+// corresponding resource type schema for correct operation.
+func (rc *ResourceInstanceChange) Encode(ty cty.Type) (*ResourceInstanceChangeSrc, error) {
+        cs, err := rc.Change.Encode(ty)
+        if err != nil {
+                return nil, err
+        }
+        return &ResourceInstanceChangeSrc{
+                Addr:            rc.Addr,
+                DeposedKey:      rc.DeposedKey,
+                ProviderAddr:    rc.ProviderAddr,
+                ChangeSrc:       *cs,
+                RequiredReplace: rc.RequiredReplace,
+                Private:         rc.Private,
+        }, err
+}
+
+// Simplify will, where possible, produce a change with a simpler action than
+// the receiever given a flag indicating whether the caller is dealing with
+// a normal apply or a destroy. This flag deals with the fact that Terraform
+// Core uses a specialized graph node type for destroying; only that
+// specialized node should set "destroying" to true.
+//
+// The following table shows the simplification behavior:
+//
+//     Action    Destroying?   New Action
+//     --------+-------------+-----------
+//     Create    true          NoOp
+//     Delete    false         NoOp
+//     Replace   true          Delete
+//     Replace   false         Create
+//
+// For any combination not in the above table, the Simplify just returns the
+// receiver as-is.
+func (rc *ResourceInstanceChange) Simplify(destroying bool) *ResourceInstanceChange {
+        if destroying {
+                switch rc.Action {
+                case Delete:
+                        // We'll fall out and just return rc verbatim, then.
+                case CreateThenDelete, DeleteThenCreate:
+                        return &ResourceInstanceChange{
+                                Addr:         rc.Addr,
+                                DeposedKey:   rc.DeposedKey,
+                                Private:      rc.Private,
+                                ProviderAddr: rc.ProviderAddr,
+                                Change: Change{
+                                        Action: Delete,
+                                        Before: rc.Before,
+                                        After:  cty.NullVal(rc.Before.Type()),
+                                },
+                        }
+                default:
+                        return &ResourceInstanceChange{
+                                Addr:         rc.Addr,
+                                DeposedKey:   rc.DeposedKey,
+                                Private:      rc.Private,
+                                ProviderAddr: rc.ProviderAddr,
+                                Change: Change{
+                                        Action: NoOp,
+                                        Before: rc.Before,
+                                        After:  rc.Before,
+                                },
+                        }
+                }
+        } else {
+                switch rc.Action {
+                case Delete:
+                        return &ResourceInstanceChange{
+                                Addr:         rc.Addr,
+                                DeposedKey:   rc.DeposedKey,
+                                Private:      rc.Private,
+                                ProviderAddr: rc.ProviderAddr,
+                                Change: Change{
+                                        Action: NoOp,
+                                        Before: rc.Before,
+                                        After:  rc.Before,
+                                },
+                        }
+                case CreateThenDelete, DeleteThenCreate:
+                        return &ResourceInstanceChange{
+                                Addr:         rc.Addr,
+                                DeposedKey:   rc.DeposedKey,
+                                Private:      rc.Private,
+                                ProviderAddr: rc.ProviderAddr,
+                                Change: Change{
+                                        Action: Create,
+                                        Before: cty.NullVal(rc.After.Type()),
+                                        After:  rc.After,
+                                },
+                        }
+                }
+        }
+
+        // If we fall out here then our change is already simple enough.
+        return rc
+}
+
+// OutputChange describes a change to an output value.
+type OutputChange struct {
+        // Addr is the absolute address of the output value that the change
+        // will apply to.
+        Addr addrs.AbsOutputValue
+
+        // Change is an embedded description of the change.
+        //
+        // For output value changes, the type constraint for the DynamicValue
+        // instances is always cty.DynamicPseudoType.
+        Change
+
+        // Sensitive, if true, indicates that either the old or new value in the
+        // change is sensitive and so a rendered version of the plan in the UI
+        // should elide the actual values while still indicating the action of the
+        // change.
+        Sensitive bool
+}
+
+// Encode produces a variant of the reciever that has its change values
+// serialized so it can be written to a plan file.
+func (oc *OutputChange) Encode() (*OutputChangeSrc, error) {
+        cs, err := oc.Change.Encode(cty.DynamicPseudoType)
+        if err != nil {
+                return nil, err
+        }
+        return &OutputChangeSrc{
+                Addr:      oc.Addr,
+                ChangeSrc: *cs,
+                Sensitive: oc.Sensitive,
+        }, err
+}
+
+// Change describes a single change with a given action.
+type Change struct {
+        // Action defines what kind of change is being made.
+        Action Action
+
+        // Interpretation of Before and After depend on Action:
+        //
+        //     NoOp     Before and After are the same, unchanged value
+        //     Create   Before is nil, and After is the expected value after create.
+        //     Read     Before is any prior value (nil if no prior), and After is the
+        //              value that was or will be read.
+        //     Update   Before is the value prior to update, and After is the expected
+        //              value after update.
+        //     Replace  As with Update.
+        //     Delete   Before is the value prior to delete, and After is always nil.
+        //
+        // Unknown values may appear anywhere within the Before and After values,
+        // either as the values themselves or as nested elements within known
+        // collections/structures.
+        Before, After cty.Value
+}
+
+// Encode produces a variant of the reciever that has its change values
+// serialized so it can be written to a plan file. Pass the type constraint
+// that the values are expected to conform to; to properly decode the values
+// later an identical type constraint must be provided at that time.
+//
+// Where a Change is embedded in some other struct, it's generally better
+// to call the corresponding Encode method of that struct rather than working
+// directly with its embedded Change.
+func (c *Change) Encode(ty cty.Type) (*ChangeSrc, error) {
+        beforeDV, err := NewDynamicValue(c.Before, ty)
+        if err != nil {
+                return nil, err
+        }
+        afterDV, err := NewDynamicValue(c.After, ty)
+        if err != nil {
+                return nil, err
+        }
+
+        return &ChangeSrc{
+                Action: c.Action,
+                Before: beforeDV,
+                After:  afterDV,
+        }, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/changes_src.go b/vendor/github.com/hashicorp/terraform/plans/changes_src.go
new file mode 100644
index 0000000..90153ea
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/changes_src.go
@@ -0,0 +1,190 @@
+package plans
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// ResourceInstanceChangeSrc is a not-yet-decoded ResourceInstanceChange.
+// Pass the associated resource type's schema type to method Decode to
+// obtain a ResourceInstancChange.
+type ResourceInstanceChangeSrc struct {
+        // Addr is the absolute address of the resource instance that the change
+        // will apply to.
+        Addr addrs.AbsResourceInstance
+
+        // DeposedKey is the identifier for a deposed object associated with the
+        // given instance, or states.NotDeposed if this change applies to the
+        // current object.
+        //
+        // A Replace change for a resource with create_before_destroy set will
+        // create a new DeposedKey temporarily during replacement. In that case,
+        // DeposedKey in the plan is always states.NotDeposed, representing that
+        // the current object is being replaced with the deposed.
+        DeposedKey states.DeposedKey
+
+        // Provider is the address of the provider configuration that was used
+        // to plan this change, and thus the configuration that must also be
+        // used to apply it.
+        ProviderAddr addrs.AbsProviderConfig
+
+        // ChangeSrc is an embedded description of the not-yet-decoded change.
+        ChangeSrc
+
+        // RequiredReplace is a set of paths that caused the change action to be
+        // Replace rather than Update. Always nil if the change action is not
+        // Replace.
+        //
+        // This is retained only for UI-plan-rendering purposes and so it does not
+        // currently survive a round-trip through a saved plan file.
+        RequiredReplace cty.PathSet
+
+        // Private allows a provider to stash any extra data that is opaque to
+        // Terraform that relates to this change. Terraform will save this
+        // byte-for-byte and return it to the provider in the apply call.
+        Private []byte
+}
+
+// Decode unmarshals the raw representation of the instance object being
+// changed. Pass the implied type of the corresponding resource type schema
+// for correct operation.
+func (rcs *ResourceInstanceChangeSrc) Decode(ty cty.Type) (*ResourceInstanceChange, error) {
+        change, err := rcs.ChangeSrc.Decode(ty)
+        if err != nil {
+                return nil, err
+        }
+        return &ResourceInstanceChange{
+                Addr:            rcs.Addr,
+                DeposedKey:      rcs.DeposedKey,
+                ProviderAddr:    rcs.ProviderAddr,
+                Change:          *change,
+                RequiredReplace: rcs.RequiredReplace,
+                Private:         rcs.Private,
+        }, nil
+}
+
+// DeepCopy creates a copy of the receiver where any pointers to nested mutable
+// values are also copied, thus ensuring that future mutations of the receiver
+// will not affect the copy.
+//
+// Some types used within a resource change are immutable by convention even
+// though the Go language allows them to be mutated, such as the types from
+// the addrs package. These are _not_ copied by this method, under the
+// assumption that callers will behave themselves.
+func (rcs *ResourceInstanceChangeSrc) DeepCopy() *ResourceInstanceChangeSrc {
+        if rcs == nil {
+                return nil
+        }
+        ret := *rcs
+
+        ret.RequiredReplace = cty.NewPathSet(ret.RequiredReplace.List()...)
+
+        if len(ret.Private) != 0 {
+                private := make([]byte, len(ret.Private))
+                copy(private, ret.Private)
+                ret.Private = private
+        }
+
+        ret.ChangeSrc.Before = ret.ChangeSrc.Before.Copy()
+        ret.ChangeSrc.After = ret.ChangeSrc.After.Copy()
+
+        return &ret
+}
+
+// OutputChangeSrc describes a change to an output value.
+type OutputChangeSrc struct {
+        // Addr is the absolute address of the output value that the change
+        // will apply to.
+        Addr addrs.AbsOutputValue
+
+        // ChangeSrc is an embedded description of the not-yet-decoded change.
+        //
+        // For output value changes, the type constraint for the DynamicValue
+        // instances is always cty.DynamicPseudoType.
+        ChangeSrc
+
+        // Sensitive, if true, indicates that either the old or new value in the
+        // change is sensitive and so a rendered version of the plan in the UI
+        // should elide the actual values while still indicating the action of the
+        // change.
+        Sensitive bool
+}
+
+// Decode unmarshals the raw representation of the output value being
+// changed.
+func (ocs *OutputChangeSrc) Decode() (*OutputChange, error) {
+        change, err := ocs.ChangeSrc.Decode(cty.DynamicPseudoType)
+        if err != nil {
+                return nil, err
+        }
+        return &OutputChange{
+                Addr:      ocs.Addr,
+                Change:    *change,
+                Sensitive: ocs.Sensitive,
+        }, nil
+}
+
+// DeepCopy creates a copy of the receiver where any pointers to nested mutable
+// values are also copied, thus ensuring that future mutations of the receiver
+// will not affect the copy.
+//
+// Some types used within a resource change are immutable by convention even
+// though the Go language allows them to be mutated, such as the types from
+// the addrs package. These are _not_ copied by this method, under the
+// assumption that callers will behave themselves.
+func (ocs *OutputChangeSrc) DeepCopy() *OutputChangeSrc {
+        if ocs == nil {
+                return nil
+        }
+        ret := *ocs
+
+        ret.ChangeSrc.Before = ret.ChangeSrc.Before.Copy()
+        ret.ChangeSrc.After = ret.ChangeSrc.After.Copy()
+
+        return &ret
+}
+
+// ChangeSrc is a not-yet-decoded Change.
+type ChangeSrc struct {
+        // Action defines what kind of change is being made.
+        Action Action
+
+        // Before and After correspond to the fields of the same name in Change,
+        // but have not yet been decoded from the serialized value used for
+        // storage.
+        Before, After DynamicValue
+}
+
+// Decode unmarshals the raw representations of the before and after values
+// to produce a Change object. Pass the type constraint that the result must
+// conform to.
+//
+// Where a ChangeSrc is embedded in some other struct, it's generally better
+// to call the corresponding Decode method of that struct rather than working
+// directly with its embedded Change.
+func (cs *ChangeSrc) Decode(ty cty.Type) (*Change, error) {
+        var err error
+        before := cty.NullVal(ty)
+        after := cty.NullVal(ty)
+
+        if len(cs.Before) > 0 {
+                before, err = cs.Before.Decode(ty)
+                if err != nil {
+                        return nil, fmt.Errorf("error decoding 'before' value: %s", err)
+                }
+        }
+        if len(cs.After) > 0 {
+                after, err = cs.After.Decode(ty)
+                if err != nil {
+                        return nil, fmt.Errorf("error decoding 'after' value: %s", err)
+                }
+        }
+        return &Change{
+                Action: cs.Action,
+                Before: before,
+                After:  after,
+        }, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/changes_state.go b/vendor/github.com/hashicorp/terraform/plans/changes_state.go
new file mode 100644
index 0000000..543e6c2
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/changes_state.go
@@ -0,0 +1,15 @@
+package plans
+
+import (
+        "github.com/hashicorp/terraform/states"
+)
+
+// PlannedState merges the set of changes described by the receiver into the
+// given prior state to produce the planned result state.
+//
+// The result is an approximation of the state as it would exist after
+// applying these changes, omitting any values that cannot be determined until
+// the changes are actually applied.
+func (c *Changes) PlannedState(prior *states.State) (*states.State, error) {
+        panic("Changes.PlannedState not yet implemented")
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/changes_sync.go b/vendor/github.com/hashicorp/terraform/plans/changes_sync.go
new file mode 100644
index 0000000..6b4ff98
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/changes_sync.go
@@ -0,0 +1,144 @@
+package plans
+
+import (
+        "fmt"
+        "sync"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+)
+
+// ChangesSync is a wrapper around a Changes that provides a concurrency-safe
+// interface to insert new changes and retrieve copies of existing changes.
+//
+// Each ChangesSync is independent of all others, so all concurrent writers
+// to a particular Changes must share a single ChangesSync. Behavior is
+// undefined if any other caller makes changes to the underlying Changes
+// object or its nested objects concurrently with any of the methods of a
+// particular ChangesSync.
+type ChangesSync struct {
+        lock    sync.Mutex
+        changes *Changes
+}
+
+// AppendResourceInstanceChange records the given resource instance change in
+// the set of planned resource changes.
+//
+// The caller must ensure that there are no concurrent writes to the given
+// change while this method is running, but it is safe to resume mutating
+// it after this method returns without affecting the saved change.
+func (cs *ChangesSync) AppendResourceInstanceChange(changeSrc *ResourceInstanceChangeSrc) {
+        if cs == nil {
+                panic("AppendResourceInstanceChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        s := changeSrc.DeepCopy()
+        cs.changes.Resources = append(cs.changes.Resources, s)
+}
+
+// GetResourceInstanceChange searches the set of resource instance changes for
+// one matching the given address and generation, returning it if it exists.
+//
+// If no such change exists, nil is returned.
+//
+// The returned object is a deep copy of the change recorded in the plan, so
+// callers may mutate it although it's generally better (less confusing) to
+// treat planned changes as immutable after they've been initially constructed.
+func (cs *ChangesSync) GetResourceInstanceChange(addr addrs.AbsResourceInstance, gen states.Generation) *ResourceInstanceChangeSrc {
+        if cs == nil {
+                panic("GetResourceInstanceChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        if gen == states.CurrentGen {
+                return cs.changes.ResourceInstance(addr).DeepCopy()
+        }
+        if dk, ok := gen.(states.DeposedKey); ok {
+                return cs.changes.ResourceInstanceDeposed(addr, dk).DeepCopy()
+        }
+        panic(fmt.Sprintf("unsupported generation value %#v", gen))
+}
+
+// RemoveResourceInstanceChange searches the set of resource instance changes
+// for one matching the given address and generation, and removes it from the
+// set if it exists.
+func (cs *ChangesSync) RemoveResourceInstanceChange(addr addrs.AbsResourceInstance, gen states.Generation) {
+        if cs == nil {
+                panic("RemoveResourceInstanceChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        dk := states.NotDeposed
+        if realDK, ok := gen.(states.DeposedKey); ok {
+                dk = realDK
+        }
+
+        addrStr := addr.String()
+        for i, r := range cs.changes.Resources {
+                if r.Addr.String() != addrStr || r.DeposedKey != dk {
+                        continue
+                }
+                copy(cs.changes.Resources[i:], cs.changes.Resources[i+1:])
+                cs.changes.Resources = cs.changes.Resources[:len(cs.changes.Resources)-1]
+                return
+        }
+}
+
+// AppendOutputChange records the given output value change in the set of
+// planned value changes.
+//
+// The caller must ensure that there are no concurrent writes to the given
+// change while this method is running, but it is safe to resume mutating
+// it after this method returns without affecting the saved change.
+func (cs *ChangesSync) AppendOutputChange(changeSrc *OutputChangeSrc) {
+        if cs == nil {
+                panic("AppendOutputChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        s := changeSrc.DeepCopy()
+        cs.changes.Outputs = append(cs.changes.Outputs, s)
+}
+
+// GetOutputChange searches the set of output value changes for one matching
+// the given address, returning it if it exists.
+//
+// If no such change exists, nil is returned.
+//
+// The returned object is a deep copy of the change recorded in the plan, so
+// callers may mutate it although it's generally better (less confusing) to
+// treat planned changes as immutable after they've been initially constructed.
+func (cs *ChangesSync) GetOutputChange(addr addrs.AbsOutputValue) *OutputChangeSrc {
+        if cs == nil {
+                panic("GetOutputChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        return cs.changes.OutputValue(addr)
+}
+
+// RemoveOutputChange searches the set of output value changes for one matching
+// the given address, and removes it from the set if it exists.
+func (cs *ChangesSync) RemoveOutputChange(addr addrs.AbsOutputValue) {
+        if cs == nil {
+                panic("RemoveOutputChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        addrStr := addr.String()
+        for i, o := range cs.changes.Outputs {
+                if o.Addr.String() != addrStr {
+                        continue
+                }
+                copy(cs.changes.Outputs[i:], cs.changes.Outputs[i+1:])
+                cs.changes.Outputs = cs.changes.Outputs[:len(cs.changes.Outputs)-1]
+                return
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/doc.go b/vendor/github.com/hashicorp/terraform/plans/doc.go
new file mode 100644
index 0000000..01ca389
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/doc.go
@@ -0,0 +1,5 @@
+// Package plans contains the types that are used to represent Terraform plans.
+//
+// A plan describes a set of changes that Terraform will make to update remote
+// objects to match with changes to the configuration.
+package plans
diff --git a/vendor/github.com/hashicorp/terraform/plans/dynamic_value.go b/vendor/github.com/hashicorp/terraform/plans/dynamic_value.go
new file mode 100644
index 0000000..51fbb24
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/dynamic_value.go
@@ -0,0 +1,96 @@
+package plans
+
+import (
+        "github.com/zclconf/go-cty/cty"
+        ctymsgpack "github.com/zclconf/go-cty/cty/msgpack"
+)
+
+// DynamicValue is the representation in the plan of a value whose type cannot
+// be determined at compile time, such as because it comes from a schema
+// defined in a plugin.
+//
+// This type is used as an indirection so that the overall plan structure can
+// be decoded without schema available, and then the dynamic values accessed
+// at a later time once the appropriate schema has been determined.
+//
+// Internally, DynamicValue is a serialized version of a cty.Value created
+// against a particular type constraint. Callers should not access directly
+// the serialized form, whose format may change in future. Values of this
+// type must always be created by calling NewDynamicValue.
+//
+// The zero value of DynamicValue is nil, and represents the absense of a
+// value within the Go type system. This is distinct from a cty.NullVal
+// result, which represents the absense of a value within the cty type system.
+type DynamicValue []byte
+
+// NewDynamicValue creates a DynamicValue by serializing the given value
+// against the given type constraint. The value must conform to the type
+// constraint, or the result is undefined.
+//
+// If the value to be encoded has no predefined schema (for example, for
+// module output values and input variables), set the type constraint to
+// cty.DynamicPseudoType in order to save type information as part of the
+// value, and then also pass cty.DynamicPseudoType to method Decode to recover
+// the original value.
+//
+// cty.NilVal can be used to represent the absense of a value, but callers
+// must be careful to distinguish values that are absent at the Go layer
+// (cty.NilVal) vs. values that are absent at the cty layer (cty.NullVal
+// results).
+func NewDynamicValue(val cty.Value, ty cty.Type) (DynamicValue, error) {
+        // If we're given cty.NilVal (the zero value of cty.Value, which is
+        // distinct from a typed null value created by cty.NullVal) then we'll
+        // assume the caller is trying to represent the _absense_ of a value,
+        // and so we'll return a nil DynamicValue.
+        if val == cty.NilVal {
+                return DynamicValue(nil), nil
+        }
+
+        // Currently our internal encoding is msgpack, via ctymsgpack.
+        buf, err := ctymsgpack.Marshal(val, ty)
+        if err != nil {
+                return nil, err
+        }
+
+        return DynamicValue(buf), nil
+}
+
+// Decode retrieves the effective value from the receiever by interpreting the
+// serialized form against the given type constraint. For correct results,
+// the type constraint must match (or be consistent with) the one that was
+// used to create the receiver.
+//
+// A nil DynamicValue decodes to cty.NilVal, which is not a valid value and
+// instead represents the absense of a value.
+func (v DynamicValue) Decode(ty cty.Type) (cty.Value, error) {
+        if v == nil {
+                return cty.NilVal, nil
+        }
+
+        return ctymsgpack.Unmarshal([]byte(v), ty)
+}
+
+// ImpliedType returns the type implied by the serialized structure of the
+// receiving value.
+//
+// This will not necessarily be exactly the type that was given when the
+// value was encoded, and in particular must not be used for values that
+// were encoded with their static type given as cty.DynamicPseudoType.
+// It is however safe to use this method for values that were encoded using
+// their runtime type as the conforming type, with the result being
+// semantically equivalent but with all lists and sets represented as tuples,
+// and maps as objects, due to ambiguities of the serialization.
+func (v DynamicValue) ImpliedType() (cty.Type, error) {
+        return ctymsgpack.ImpliedType([]byte(v))
+}
+
+// Copy produces a copy of the receiver with a distinct backing array.
+func (v DynamicValue) Copy() DynamicValue {
+        if v == nil {
+                return nil
+        }
+
+        ret := make(DynamicValue, len(v))
+        copy(ret, v)
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/all_null.go b/vendor/github.com/hashicorp/terraform/plans/objchange/all_null.go
new file mode 100644
index 0000000..18a7e99
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/all_null.go
@@ -0,0 +1,18 @@
+package objchange
+
+import (
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// AllAttributesNull constructs a non-null cty.Value of the object type implied
+// by the given schema that has all of its leaf attributes set to null and all
+// of its nested block collections set to zero-length.
+//
+// This simulates what would result from decoding an empty configuration block
+// with the given schema, except that it does not produce errors
+func AllAttributesNull(schema *configschema.Block) cty.Value {
+        // "All attributes null" happens to be the definition of EmptyValue for
+        // a Block, so we can just delegate to that.
+        return schema.EmptyValue()
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/compatible.go b/vendor/github.com/hashicorp/terraform/plans/objchange/compatible.go
new file mode 100644
index 0000000..8b7ef43
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/compatible.go
@@ -0,0 +1,437 @@
+package objchange
+
+import (
+        "fmt"
+        "strconv"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+)
+
+// AssertObjectCompatible checks whether the given "actual" value is a valid
+// completion of the possibly-partially-unknown "planned" value.
+//
+// This means that any known leaf value in "planned" must be equal to the
+// corresponding value in "actual", and various other similar constraints.
+//
+// Any inconsistencies are reported by returning a non-zero number of errors.
+// These errors are usually (but not necessarily) cty.PathError values
+// referring to a particular nested value within the "actual" value.
+//
+// The two values must have types that conform to the given schema's implied
+// type, or this function will panic.
+func AssertObjectCompatible(schema *configschema.Block, planned, actual cty.Value) []error {
+        return assertObjectCompatible(schema, planned, actual, nil)
+}
+
+func assertObjectCompatible(schema *configschema.Block, planned, actual cty.Value, path cty.Path) []error {
+        var errs []error
+        if planned.IsNull() && !actual.IsNull() {
+                errs = append(errs, path.NewErrorf("was absent, but now present"))
+                return errs
+        }
+        if actual.IsNull() && !planned.IsNull() {
+                errs = append(errs, path.NewErrorf("was present, but now absent"))
+                return errs
+        }
+        if planned.IsNull() {
+                // No further checks possible if both values are null
+                return errs
+        }
+
+        for name, attrS := range schema.Attributes {
+                plannedV := planned.GetAttr(name)
+                actualV := actual.GetAttr(name)
+
+                path := append(path, cty.GetAttrStep{Name: name})
+                moreErrs := assertValueCompatible(plannedV, actualV, path)
+                if attrS.Sensitive {
+                        if len(moreErrs) > 0 {
+                                // Use a vague placeholder message instead, to avoid disclosing
+                                // sensitive information.
+                                errs = append(errs, path.NewErrorf("inconsistent values for sensitive attribute"))
+                        }
+                } else {
+                        errs = append(errs, moreErrs...)
+                }
+        }
+        for name, blockS := range schema.BlockTypes {
+                plannedV := planned.GetAttr(name)
+                actualV := actual.GetAttr(name)
+
+                // As a special case, if there were any blocks whose leaf attributes
+                // are all unknown then we assume (possibly incorrectly) that the
+                // HCL dynamic block extension is in use with an unknown for_each
+                // argument, and so we will do looser validation here that allows
+                // for those blocks to have expanded into a different number of blocks
+                // if the for_each value is now known.
+                maybeUnknownBlocks := couldHaveUnknownBlockPlaceholder(plannedV, blockS, false)
+
+                path := append(path, cty.GetAttrStep{Name: name})
+                switch blockS.Nesting {
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        // If an unknown block placeholder was present then the placeholder
+                        // may have expanded out into zero blocks, which is okay.
+                        if maybeUnknownBlocks && actualV.IsNull() {
+                                continue
+                        }
+                        moreErrs := assertObjectCompatible(&blockS.Block, plannedV, actualV, path)
+                        errs = append(errs, moreErrs...)
+                case configschema.NestingList:
+                        // A NestingList might either be a list or a tuple, depending on
+                        // whether there are dynamically-typed attributes inside. However,
+                        // both support a similar-enough API that we can treat them the
+                        // same for our purposes here.
+                        if !plannedV.IsKnown() || plannedV.IsNull() || actualV.IsNull() {
+                                continue
+                        }
+
+                        if maybeUnknownBlocks {
+                                // When unknown blocks are present the final blocks may be
+                                // at different indices than the planned blocks, so unfortunately
+                                // we can't do our usual checks in this case without generating
+                                // false negatives.
+                                continue
+                        }
+
+                        plannedL := plannedV.LengthInt()
+                        actualL := actualV.LengthInt()
+                        if plannedL != actualL {
+                                errs = append(errs, path.NewErrorf("block count changed from %d to %d", plannedL, actualL))
+                                continue
+                        }
+                        for it := plannedV.ElementIterator(); it.Next(); {
+                                idx, plannedEV := it.Element()
+                                if !actualV.HasIndex(idx).True() {
+                                        continue
+                                }
+                                actualEV := actualV.Index(idx)
+                                moreErrs := assertObjectCompatible(&blockS.Block, plannedEV, actualEV, append(path, cty.IndexStep{Key: idx}))
+                                errs = append(errs, moreErrs...)
+                        }
+                case configschema.NestingMap:
+                        // A NestingMap might either be a map or an object, depending on
+                        // whether there are dynamically-typed attributes inside, but
+                        // that's decided statically and so both values will have the same
+                        // kind.
+                        if plannedV.Type().IsObjectType() {
+                                plannedAtys := plannedV.Type().AttributeTypes()
+                                actualAtys := actualV.Type().AttributeTypes()
+                                for k := range plannedAtys {
+                                        if _, ok := actualAtys[k]; !ok {
+                                                errs = append(errs, path.NewErrorf("block key %q has vanished", k))
+                                                continue
+                                        }
+
+                                        plannedEV := plannedV.GetAttr(k)
+                                        actualEV := actualV.GetAttr(k)
+                                        moreErrs := assertObjectCompatible(&blockS.Block, plannedEV, actualEV, append(path, cty.GetAttrStep{Name: k}))
+                                        errs = append(errs, moreErrs...)
+                                }
+                                if !maybeUnknownBlocks { // new blocks may appear if unknown blocks were present in the plan
+                                        for k := range actualAtys {
+                                                if _, ok := plannedAtys[k]; !ok {
+                                                        errs = append(errs, path.NewErrorf("new block key %q has appeared", k))
+                                                        continue
+                                                }
+                                        }
+                                }
+                        } else {
+                                if !plannedV.IsKnown() || plannedV.IsNull() || actualV.IsNull() {
+                                        continue
+                                }
+                                plannedL := plannedV.LengthInt()
+                                actualL := actualV.LengthInt()
+                                if plannedL != actualL && !maybeUnknownBlocks { // new blocks may appear if unknown blocks were persent in the plan
+                                        errs = append(errs, path.NewErrorf("block count changed from %d to %d", plannedL, actualL))
+                                        continue
+                                }
+                                for it := plannedV.ElementIterator(); it.Next(); {
+                                        idx, plannedEV := it.Element()
+                                        if !actualV.HasIndex(idx).True() {
+                                                continue
+                                        }
+                                        actualEV := actualV.Index(idx)
+                                        moreErrs := assertObjectCompatible(&blockS.Block, plannedEV, actualEV, append(path, cty.IndexStep{Key: idx}))
+                                        errs = append(errs, moreErrs...)
+                                }
+                        }
+                case configschema.NestingSet:
+                        if !plannedV.IsKnown() || !actualV.IsKnown() || plannedV.IsNull() || actualV.IsNull() {
+                                continue
+                        }
+
+                        setErrs := assertSetValuesCompatible(plannedV, actualV, path, func(plannedEV, actualEV cty.Value) bool {
+                                errs := assertObjectCompatible(&blockS.Block, plannedEV, actualEV, append(path, cty.IndexStep{Key: actualEV}))
+                                return len(errs) == 0
+                        })
+                        errs = append(errs, setErrs...)
+
+                        // There can be fewer elements in a set after its elements are all
+                        // known (values that turn out to be equal will coalesce) but the
+                        // number of elements must never get larger.
+                        plannedL := plannedV.LengthInt()
+                        actualL := actualV.LengthInt()
+                        if plannedL < actualL {
+                                errs = append(errs, path.NewErrorf("block set length changed from %d to %d", plannedL, actualL))
+                        }
+                default:
+                        panic(fmt.Sprintf("unsupported nesting mode %s", blockS.Nesting))
+                }
+        }
+        return errs
+}
+
+func assertValueCompatible(planned, actual cty.Value, path cty.Path) []error {
+        // NOTE: We don't normally use the GoString rendering of cty.Value in
+        // user-facing error messages as a rule, but we make an exception
+        // for this function because we expect the user to pass this message on
+        // verbatim to the provider development team and so more detail is better.
+
+        var errs []error
+        if planned.Type() == cty.DynamicPseudoType {
+                // Anything goes, then
+                return errs
+        }
+        if problems := planned.Type().TestConformance(actual.Type()); len(problems) > 0 {
+                errs = append(errs, path.NewErrorf("wrong final value type: %s", convert.MismatchMessage(actual.Type(), planned.Type())))
+                // If the types don't match then we can't do any other comparisons,
+                // so we bail early.
+                return errs
+        }
+
+        if !planned.IsKnown() {
+                // We didn't know what were going to end up with during plan, so
+                // anything goes during apply.
+                return errs
+        }
+
+        if actual.IsNull() {
+                if planned.IsNull() {
+                        return nil
+                }
+                errs = append(errs, path.NewErrorf("was %#v, but now null", planned))
+                return errs
+        }
+        if planned.IsNull() {
+                errs = append(errs, path.NewErrorf("was null, but now %#v", actual))
+                return errs
+        }
+
+        ty := planned.Type()
+        switch {
+
+        case !actual.IsKnown():
+                errs = append(errs, path.NewErrorf("was known, but now unknown"))
+
+        case ty.IsPrimitiveType():
+                if !actual.Equals(planned).True() {
+                        errs = append(errs, path.NewErrorf("was %#v, but now %#v", planned, actual))
+                }
+
+        case ty.IsListType() || ty.IsMapType() || ty.IsTupleType():
+                for it := planned.ElementIterator(); it.Next(); {
+                        k, plannedV := it.Element()
+                        if !actual.HasIndex(k).True() {
+                                errs = append(errs, path.NewErrorf("element %s has vanished", indexStrForErrors(k)))
+                                continue
+                        }
+
+                        actualV := actual.Index(k)
+                        moreErrs := assertValueCompatible(plannedV, actualV, append(path, cty.IndexStep{Key: k}))
+                        errs = append(errs, moreErrs...)
+                }
+
+                for it := actual.ElementIterator(); it.Next(); {
+                        k, _ := it.Element()
+                        if !planned.HasIndex(k).True() {
+                                errs = append(errs, path.NewErrorf("new element %s has appeared", indexStrForErrors(k)))
+                        }
+                }
+
+        case ty.IsObjectType():
+                atys := ty.AttributeTypes()
+                for name := range atys {
+                        // Because we already tested that the two values have the same type,
+                        // we can assume that the same attributes are present in both and
+                        // focus just on testing their values.
+                        plannedV := planned.GetAttr(name)
+                        actualV := actual.GetAttr(name)
+                        moreErrs := assertValueCompatible(plannedV, actualV, append(path, cty.GetAttrStep{Name: name}))
+                        errs = append(errs, moreErrs...)
+                }
+
+        case ty.IsSetType():
+                // We can't really do anything useful for sets here because changing
+                // an unknown element to known changes the identity of the element, and
+                // so we can't correlate them properly. However, we will at least check
+                // to ensure that the number of elements is consistent, along with
+                // the general type-match checks we ran earlier in this function.
+                if planned.IsKnown() && !planned.IsNull() && !actual.IsNull() {
+
+                        setErrs := assertSetValuesCompatible(planned, actual, path, func(plannedV, actualV cty.Value) bool {
+                                errs := assertValueCompatible(plannedV, actualV, append(path, cty.IndexStep{Key: actualV}))
+                                return len(errs) == 0
+                        })
+                        errs = append(errs, setErrs...)
+
+                        // There can be fewer elements in a set after its elements are all
+                        // known (values that turn out to be equal will coalesce) but the
+                        // number of elements must never get larger.
+
+                        plannedL := planned.LengthInt()
+                        actualL := actual.LengthInt()
+                        if plannedL < actualL {
+                                errs = append(errs, path.NewErrorf("length changed from %d to %d", plannedL, actualL))
+                        }
+                }
+        }
+
+        return errs
+}
+
+func indexStrForErrors(v cty.Value) string {
+        switch v.Type() {
+        case cty.Number:
+                return v.AsBigFloat().Text('f', -1)
+        case cty.String:
+                return strconv.Quote(v.AsString())
+        default:
+                // Should be impossible, since no other index types are allowed!
+                return fmt.Sprintf("%#v", v)
+        }
+}
+
+// couldHaveUnknownBlockPlaceholder is a heuristic that recognizes how the
+// HCL dynamic block extension behaves when it's asked to expand a block whose
+// for_each argument is unknown. In such cases, it generates a single placeholder
+// block with all leaf attribute values unknown, and once the for_each
+// expression becomes known the placeholder may be replaced with any number
+// of blocks, so object compatibility checks would need to be more liberal.
+//
+// Set "nested" if testing a block that is nested inside a candidate block
+// placeholder; this changes the interpretation of there being no blocks of
+// a type to allow for there being zero nested blocks.
+func couldHaveUnknownBlockPlaceholder(v cty.Value, blockS *configschema.NestedBlock, nested bool) bool {
+        switch blockS.Nesting {
+        case configschema.NestingSingle, configschema.NestingGroup:
+                if nested && v.IsNull() {
+                        return true // for nested blocks, a single block being unset doesn't disqualify from being an unknown block placeholder
+                }
+                return couldBeUnknownBlockPlaceholderElement(v, &blockS.Block)
+        default:
+                // These situations should be impossible for correct providers, but
+                // we permit the legacy SDK to produce some incorrect outcomes
+                // for compatibility with its existing logic, and so we must be
+                // tolerant here.
+                if !v.IsKnown() {
+                        return true
+                }
+                if v.IsNull() {
+                        return false // treated as if the list were empty, so we would see zero iterations below
+                }
+
+                // For all other nesting modes, our value should be something iterable.
+                for it := v.ElementIterator(); it.Next(); {
+                        _, ev := it.Element()
+                        if couldBeUnknownBlockPlaceholderElement(ev, &blockS.Block) {
+                                return true
+                        }
+                }
+
+                // Our default changes depending on whether we're testing the candidate
+                // block itself or something nested inside of it: zero blocks of a type
+                // can never contain a dynamic block placeholder, but a dynamic block
+                // placeholder might contain zero blocks of one of its own nested block
+                // types, if none were set in the config at all.
+                return nested
+        }
+}
+
+func couldBeUnknownBlockPlaceholderElement(v cty.Value, schema *configschema.Block) bool {
+        if v.IsNull() {
+                return false // null value can never be a placeholder element
+        }
+        if !v.IsKnown() {
+                return true // this should never happen for well-behaved providers, but can happen with the legacy SDK opt-outs
+        }
+        for name := range schema.Attributes {
+                av := v.GetAttr(name)
+
+                // Unknown block placeholders contain only unknown or null attribute
+                // values, depending on whether or not a particular attribute was set
+                // explicitly inside the content block. Note that this is imprecise:
+                // non-placeholders can also match this, so this function can generate
+                // false positives.
+                if av.IsKnown() && !av.IsNull() {
+                        return false
+                }
+        }
+        for name, blockS := range schema.BlockTypes {
+                if !couldHaveUnknownBlockPlaceholder(v.GetAttr(name), blockS, true) {
+                        return false
+                }
+        }
+        return true
+}
+
+// assertSetValuesCompatible checks that each of the elements in a can
+// be correlated with at least one equivalent element in b and vice-versa,
+// using the given correlation function.
+//
+// This allows the number of elements in the sets to change as long as all
+// elements in both sets can be correlated, making this function safe to use
+// with sets that may contain unknown values as long as the unknown case is
+// addressed in some reasonable way in the callback function.
+//
+// The callback always recieves values from set a as its first argument and
+// values from set b in its second argument, so it is safe to use with
+// non-commutative functions.
+//
+// As with assertValueCompatible, we assume that the target audience of error
+// messages here is a provider developer (via a bug report from a user) and so
+// we intentionally violate our usual rule of keeping cty implementation
+// details out of error messages.
+func assertSetValuesCompatible(planned, actual cty.Value, path cty.Path, f func(aVal, bVal cty.Value) bool) []error {
+        a := planned
+        b := actual
+
+        // Our methodology here is a little tricky, to deal with the fact that
+        // it's impossible to directly correlate two non-equal set elements because
+        // they don't have identities separate from their values.
+        // The approach is to count the number of equivalent elements each element
+        // of a has in b and vice-versa, and then return true only if each element
+        // in both sets has at least one equivalent.
+        as := a.AsValueSlice()
+        bs := b.AsValueSlice()
+        aeqs := make([]bool, len(as))
+        beqs := make([]bool, len(bs))
+        for ai, av := range as {
+                for bi, bv := range bs {
+                        if f(av, bv) {
+                                aeqs[ai] = true
+                                beqs[bi] = true
+                        }
+                }
+        }
+
+        var errs []error
+        for i, eq := range aeqs {
+                if !eq {
+                        errs = append(errs, path.NewErrorf("planned set element %#v does not correlate with any element in actual", as[i]))
+                }
+        }
+        if len(errs) > 0 {
+                // Exit early since otherwise we're likely to generate duplicate
+                // error messages from the other perspective in the subsequent loop.
+                return errs
+        }
+        for i, eq := range beqs {
+                if !eq {
+                        errs = append(errs, path.NewErrorf("actual set element %#v does not correlate with any element in plan", bs[i]))
+                }
+        }
+        return errs
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/doc.go b/vendor/github.com/hashicorp/terraform/plans/objchange/doc.go
new file mode 100644
index 0000000..2c18a01
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/doc.go
@@ -0,0 +1,4 @@
+// Package objchange deals with the business logic of taking a prior state
+// value and a config value and producing a proposed new merged value, along
+// with other related rules in this domain.
+package objchange
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/lcs.go b/vendor/github.com/hashicorp/terraform/plans/objchange/lcs.go
new file mode 100644
index 0000000..cbfefdd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/lcs.go
@@ -0,0 +1,104 @@
+package objchange
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// LongestCommonSubsequence finds a sequence of values that are common to both
+// x and y, with the same relative ordering as in both collections. This result
+// is useful as a first step towards computing a diff showing added/removed
+// elements in a sequence.
+//
+// The approached used here is a "naive" one, assuming that both xs and ys will
+// generally be small in most reasonable Terraform configurations. For larger
+// lists the time/space usage may be sub-optimal.
+//
+// A pair of lists may have multiple longest common subsequences. In that
+// case, the one selected by this function is undefined.
+func LongestCommonSubsequence(xs, ys []cty.Value) []cty.Value {
+        if len(xs) == 0 || len(ys) == 0 {
+                return make([]cty.Value, 0)
+        }
+
+        c := make([]int, len(xs)*len(ys))
+        eqs := make([]bool, len(xs)*len(ys))
+        w := len(xs)
+
+        for y := 0; y < len(ys); y++ {
+                for x := 0; x < len(xs); x++ {
+                        eqV := xs[x].Equals(ys[y])
+                        eq := false
+                        if eqV.IsKnown() && eqV.True() {
+                                eq = true
+                                eqs[(w*y)+x] = true // equality tests can be expensive, so cache it
+                        }
+                        if eq {
+                                // Sequence gets one longer than for the cell at top left,
+                                // since we'd append a new item to the sequence here.
+                                if x == 0 || y == 0 {
+                                        c[(w*y)+x] = 1
+                                } else {
+                                        c[(w*y)+x] = c[(w*(y-1))+(x-1)] + 1
+                                }
+                        } else {
+                                // We follow the longest of the sequence above and the sequence
+                                // to the left of us in the matrix.
+                                l := 0
+                                u := 0
+                                if x > 0 {
+                                        l = c[(w*y)+(x-1)]
+                                }
+                                if y > 0 {
+                                        u = c[(w*(y-1))+x]
+                                }
+                                if l > u {
+                                        c[(w*y)+x] = l
+                                } else {
+                                        c[(w*y)+x] = u
+                                }
+                        }
+                }
+        }
+
+        // The bottom right cell tells us how long our longest sequence will be
+        seq := make([]cty.Value, c[len(c)-1])
+
+        // Now we will walk back from the bottom right cell, finding again all
+        // of the equal pairs to construct our sequence.
+        x := len(xs) - 1
+        y := len(ys) - 1
+        i := len(seq) - 1
+
+        for x > -1 && y > -1 {
+                if eqs[(w*y)+x] {
+                        // Add the value to our result list and then walk diagonally
+                        // up and to the left.
+                        seq[i] = xs[x]
+                        x--
+                        y--
+                        i--
+                } else {
+                        // Take the path with the greatest sequence length in the matrix.
+                        l := 0
+                        u := 0
+                        if x > 0 {
+                                l = c[(w*y)+(x-1)]
+                        }
+                        if y > 0 {
+                                u = c[(w*(y-1))+x]
+                        }
+                        if l > u {
+                                x--
+                        } else {
+                                y--
+                        }
+                }
+        }
+
+        if i > -1 {
+                // should never happen if the matrix was constructed properly
+                panic("not enough elements in sequence")
+        }
+
+        return seq
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/normalize_obj.go b/vendor/github.com/hashicorp/terraform/plans/objchange/normalize_obj.go
new file mode 100644
index 0000000..c23f44d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/normalize_obj.go
@@ -0,0 +1,132 @@
+package objchange
+
+import (
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// NormalizeObjectFromLegacySDK takes an object that may have been generated
+// by the legacy Terraform SDK (i.e. returned from a provider with the
+// LegacyTypeSystem opt-out set) and does its best to normalize it for the
+// assumptions we would normally enforce if the provider had not opted out.
+//
+// In particular, this function guarantees that a value representing a nested
+// block will never itself be unknown or null, instead representing that as
+// a non-null value that may contain null/unknown values.
+//
+// The input value must still conform to the implied type of the given schema,
+// or else this function may produce garbage results or panic. This is usually
+// okay because type consistency is enforced when deserializing the value
+// returned from the provider over the RPC wire protocol anyway.
+func NormalizeObjectFromLegacySDK(val cty.Value, schema *configschema.Block) cty.Value {
+        if val == cty.NilVal || val.IsNull() {
+                // This should never happen in reasonable use, but we'll allow it
+                // and normalize to a null of the expected type rather than panicking
+                // below.
+                return cty.NullVal(schema.ImpliedType())
+        }
+
+        vals := make(map[string]cty.Value)
+        for name := range schema.Attributes {
+                // No normalization for attributes, since them being type-conformant
+                // is all that we require.
+                vals[name] = val.GetAttr(name)
+        }
+        for name, blockS := range schema.BlockTypes {
+                lv := val.GetAttr(name)
+
+                // Legacy SDK never generates dynamically-typed attributes and so our
+                // normalization code doesn't deal with them, but we need to make sure
+                // we still pass them through properly so that we don't interfere with
+                // objects generated by other SDKs.
+                if ty := blockS.Block.ImpliedType(); ty.HasDynamicTypes() {
+                        vals[name] = lv
+                        continue
+                }
+
+                switch blockS.Nesting {
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        if lv.IsKnown() {
+                                if lv.IsNull() && blockS.Nesting == configschema.NestingGroup {
+                                        vals[name] = blockS.EmptyValue()
+                                } else {
+                                        vals[name] = NormalizeObjectFromLegacySDK(lv, &blockS.Block)
+                                }
+                        } else {
+                                vals[name] = unknownBlockStub(&blockS.Block)
+                        }
+                case configschema.NestingList:
+                        switch {
+                        case !lv.IsKnown():
+                                vals[name] = cty.ListVal([]cty.Value{unknownBlockStub(&blockS.Block)})
+                        case lv.IsNull() || lv.LengthInt() == 0:
+                                vals[name] = cty.ListValEmpty(blockS.Block.ImpliedType())
+                        default:
+                                subVals := make([]cty.Value, 0, lv.LengthInt())
+                                for it := lv.ElementIterator(); it.Next(); {
+                                        _, subVal := it.Element()
+                                        subVals = append(subVals, NormalizeObjectFromLegacySDK(subVal, &blockS.Block))
+                                }
+                                vals[name] = cty.ListVal(subVals)
+                        }
+                case configschema.NestingSet:
+                        switch {
+                        case !lv.IsKnown():
+                                vals[name] = cty.SetVal([]cty.Value{unknownBlockStub(&blockS.Block)})
+                        case lv.IsNull() || lv.LengthInt() == 0:
+                                vals[name] = cty.SetValEmpty(blockS.Block.ImpliedType())
+                        default:
+                                subVals := make([]cty.Value, 0, lv.LengthInt())
+                                for it := lv.ElementIterator(); it.Next(); {
+                                        _, subVal := it.Element()
+                                        subVals = append(subVals, NormalizeObjectFromLegacySDK(subVal, &blockS.Block))
+                                }
+                                vals[name] = cty.SetVal(subVals)
+                        }
+                default:
+                        // The legacy SDK doesn't support NestingMap, so we just assume
+                        // maps are always okay. (If not, we would've detected and returned
+                        // an error to the user before we got here.)
+                        vals[name] = lv
+                }
+        }
+        return cty.ObjectVal(vals)
+}
+
+// unknownBlockStub constructs an object value that approximates an unknown
+// block by producing a known block object with all of its leaf attribute
+// values set to unknown.
+//
+// Blocks themselves cannot be unknown, so if the legacy SDK tries to return
+// such a thing, we'll use this result instead. This convention mimics how
+// the dynamic block feature deals with being asked to iterate over an unknown
+// value, because our value-checking functions already accept this convention
+// as a special case.
+func unknownBlockStub(schema *configschema.Block) cty.Value {
+        vals := make(map[string]cty.Value)
+        for name, attrS := range schema.Attributes {
+                vals[name] = cty.UnknownVal(attrS.Type)
+        }
+        for name, blockS := range schema.BlockTypes {
+                switch blockS.Nesting {
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        vals[name] = unknownBlockStub(&blockS.Block)
+                case configschema.NestingList:
+                        // In principle we may be expected to produce a tuple value here,
+                        // if there are any dynamically-typed attributes in our nested block,
+                        // but the legacy SDK doesn't support that, so we just assume it'll
+                        // never be necessary to normalize those. (Incorrect usage in any
+                        // other SDK would be caught and returned as an error before we
+                        // get here.)
+                        vals[name] = cty.ListVal([]cty.Value{unknownBlockStub(&blockS.Block)})
+                case configschema.NestingSet:
+                        vals[name] = cty.SetVal([]cty.Value{unknownBlockStub(&blockS.Block)})
+                case configschema.NestingMap:
+                        // A nesting map can never be unknown since we then wouldn't know
+                        // what the keys are. (Legacy SDK doesn't support NestingMap anyway,
+                        // so this should never arise.)
+                        vals[name] = cty.MapValEmpty(blockS.Block.ImpliedType())
+                }
+        }
+        return cty.ObjectVal(vals)
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/objchange.go b/vendor/github.com/hashicorp/terraform/plans/objchange/objchange.go
new file mode 100644
index 0000000..5a8af14
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/objchange.go
@@ -0,0 +1,390 @@
+package objchange
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+)
+
+// ProposedNewObject constructs a proposed new object value by combining the
+// computed attribute values from "prior" with the configured attribute values
+// from "config".
+//
+// Both value must conform to the given schema's implied type, or this function
+// will panic.
+//
+// The prior value must be wholly known, but the config value may be unknown
+// or have nested unknown values.
+//
+// The merging of the two objects includes the attributes of any nested blocks,
+// which will be correlated in a manner appropriate for their nesting mode.
+// Note in particular that the correlation for blocks backed by sets is a
+// heuristic based on matching non-computed attribute values and so it may
+// produce strange results with more "extreme" cases, such as a nested set
+// block where _all_ attributes are computed.
+func ProposedNewObject(schema *configschema.Block, prior, config cty.Value) cty.Value {
+        // If the config and prior are both null, return early here before
+        // populating the prior block. The prevents non-null blocks from appearing
+        // the proposed state value.
+        if config.IsNull() && prior.IsNull() {
+                return prior
+        }
+
+        if prior.IsNull() {
+                // In this case, we will construct a synthetic prior value that is
+                // similar to the result of decoding an empty configuration block,
+                // which simplifies our handling of the top-level attributes/blocks
+                // below by giving us one non-null level of object to pull values from.
+                prior = AllAttributesNull(schema)
+        }
+        return proposedNewObject(schema, prior, config)
+}
+
+// PlannedDataResourceObject is similar to ProposedNewObject but tailored for
+// planning data resources in particular. Specifically, it replaces the values
+// of any Computed attributes not set in the configuration with an unknown
+// value, which serves as a placeholder for a value to be filled in by the
+// provider when the data resource is finally read.
+//
+// Data resources are different because the planning of them is handled
+// entirely within Terraform Core and not subject to customization by the
+// provider. This function is, in effect, producing an equivalent result to
+// passing the ProposedNewObject result into a provider's PlanResourceChange
+// function, assuming a fixed implementation of PlanResourceChange that just
+// fills in unknown values as needed.
+func PlannedDataResourceObject(schema *configschema.Block, config cty.Value) cty.Value {
+        // Our trick here is to run the ProposedNewObject logic with an
+        // entirely-unknown prior value. Because of cty's unknown short-circuit
+        // behavior, any operation on prior returns another unknown, and so
+        // unknown values propagate into all of the parts of the resulting value
+        // that would normally be filled in by preserving the prior state.
+        prior := cty.UnknownVal(schema.ImpliedType())
+        return proposedNewObject(schema, prior, config)
+}
+
+func proposedNewObject(schema *configschema.Block, prior, config cty.Value) cty.Value {
+        if config.IsNull() || !config.IsKnown() {
+                // This is a weird situation, but we'll allow it anyway to free
+                // callers from needing to specifically check for these cases.
+                return prior
+        }
+        if (!prior.Type().IsObjectType()) || (!config.Type().IsObjectType()) {
+                panic("ProposedNewObject only supports object-typed values")
+        }
+
+        // From this point onwards, we can assume that both values are non-null
+        // object types, and that the config value itself is known (though it
+        // may contain nested values that are unknown.)
+
+        newAttrs := map[string]cty.Value{}
+        for name, attr := range schema.Attributes {
+                priorV := prior.GetAttr(name)
+                configV := config.GetAttr(name)
+                var newV cty.Value
+                switch {
+                case attr.Computed && attr.Optional:
+                        // This is the trickiest scenario: we want to keep the prior value
+                        // if the config isn't overriding it. Note that due to some
+                        // ambiguity here, setting an optional+computed attribute from
+                        // config and then later switching the config to null in a
+                        // subsequent change causes the initial config value to be "sticky"
+                        // unless the provider specifically overrides it during its own
+                        // plan customization step.
+                        if configV.IsNull() {
+                                newV = priorV
+                        } else {
+                                newV = configV
+                        }
+                case attr.Computed:
+                        // configV will always be null in this case, by definition.
+                        // priorV may also be null, but that's okay.
+                        newV = priorV
+                default:
+                        // For non-computed attributes, we always take the config value,
+                        // even if it is null. If it's _required_ then null values
+                        // should've been caught during an earlier validation step, and
+                        // so we don't really care about that here.
+                        newV = configV
+                }
+                newAttrs[name] = newV
+        }
+
+        // Merging nested blocks is a little more complex, since we need to
+        // correlate blocks between both objects and then recursively propose
+        // a new object for each. The correlation logic depends on the nesting
+        // mode for each block type.
+        for name, blockType := range schema.BlockTypes {
+                priorV := prior.GetAttr(name)
+                configV := config.GetAttr(name)
+                var newV cty.Value
+                switch blockType.Nesting {
+
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        newV = ProposedNewObject(&blockType.Block, priorV, configV)
+
+                case configschema.NestingList:
+                        // Nested blocks are correlated by index.
+                        configVLen := 0
+                        if configV.IsKnown() && !configV.IsNull() {
+                                configVLen = configV.LengthInt()
+                        }
+                        if configVLen > 0 {
+                                newVals := make([]cty.Value, 0, configVLen)
+                                for it := configV.ElementIterator(); it.Next(); {
+                                        idx, configEV := it.Element()
+                                        if priorV.IsKnown() && (priorV.IsNull() || !priorV.HasIndex(idx).True()) {
+                                                // If there is no corresponding prior element then
+                                                // we just take the config value as-is.
+                                                newVals = append(newVals, configEV)
+                                                continue
+                                        }
+                                        priorEV := priorV.Index(idx)
+
+                                        newEV := ProposedNewObject(&blockType.Block, priorEV, configEV)
+                                        newVals = append(newVals, newEV)
+                                }
+                                // Despite the name, a NestingList might also be a tuple, if
+                                // its nested schema contains dynamically-typed attributes.
+                                if configV.Type().IsTupleType() {
+                                        newV = cty.TupleVal(newVals)
+                                } else {
+                                        newV = cty.ListVal(newVals)
+                                }
+                        } else {
+                                // Despite the name, a NestingList might also be a tuple, if
+                                // its nested schema contains dynamically-typed attributes.
+                                if configV.Type().IsTupleType() {
+                                        newV = cty.EmptyTupleVal
+                                } else {
+                                        newV = cty.ListValEmpty(blockType.ImpliedType())
+                                }
+                        }
+
+                case configschema.NestingMap:
+                        // Despite the name, a NestingMap may produce either a map or
+                        // object value, depending on whether the nested schema contains
+                        // dynamically-typed attributes.
+                        if configV.Type().IsObjectType() {
+                                // Nested blocks are correlated by key.
+                                configVLen := 0
+                                if configV.IsKnown() && !configV.IsNull() {
+                                        configVLen = configV.LengthInt()
+                                }
+                                if configVLen > 0 {
+                                        newVals := make(map[string]cty.Value, configVLen)
+                                        atys := configV.Type().AttributeTypes()
+                                        for name := range atys {
+                                                configEV := configV.GetAttr(name)
+                                                if !priorV.IsKnown() || priorV.IsNull() || !priorV.Type().HasAttribute(name) {
+                                                        // If there is no corresponding prior element then
+                                                        // we just take the config value as-is.
+                                                        newVals[name] = configEV
+                                                        continue
+                                                }
+                                                priorEV := priorV.GetAttr(name)
+
+                                                newEV := ProposedNewObject(&blockType.Block, priorEV, configEV)
+                                                newVals[name] = newEV
+                                        }
+                                        // Although we call the nesting mode "map", we actually use
+                                        // object values so that elements might have different types
+                                        // in case of dynamically-typed attributes.
+                                        newV = cty.ObjectVal(newVals)
+                                } else {
+                                        newV = cty.EmptyObjectVal
+                                }
+                        } else {
+                                configVLen := 0
+                                if configV.IsKnown() && !configV.IsNull() {
+                                        configVLen = configV.LengthInt()
+                                }
+                                if configVLen > 0 {
+                                        newVals := make(map[string]cty.Value, configVLen)
+                                        for it := configV.ElementIterator(); it.Next(); {
+                                                idx, configEV := it.Element()
+                                                k := idx.AsString()
+                                                if priorV.IsKnown() && (priorV.IsNull() || !priorV.HasIndex(idx).True()) {
+                                                        // If there is no corresponding prior element then
+                                                        // we just take the config value as-is.
+                                                        newVals[k] = configEV
+                                                        continue
+                                                }
+                                                priorEV := priorV.Index(idx)
+
+                                                newEV := ProposedNewObject(&blockType.Block, priorEV, configEV)
+                                                newVals[k] = newEV
+                                        }
+                                        newV = cty.MapVal(newVals)
+                                } else {
+                                        newV = cty.MapValEmpty(blockType.ImpliedType())
+                                }
+                        }
+
+                case configschema.NestingSet:
+                        if !configV.Type().IsSetType() {
+                                panic("configschema.NestingSet value is not a set as expected")
+                        }
+
+                        // Nested blocks are correlated by comparing the element values
+                        // after eliminating all of the computed attributes. In practice,
+                        // this means that any config change produces an entirely new
+                        // nested object, and we only propagate prior computed values
+                        // if the non-computed attribute values are identical.
+                        var cmpVals [][2]cty.Value
+                        if priorV.IsKnown() && !priorV.IsNull() {
+                                cmpVals = setElementCompareValues(&blockType.Block, priorV, false)
+                        }
+                        configVLen := 0
+                        if configV.IsKnown() && !configV.IsNull() {
+                                configVLen = configV.LengthInt()
+                        }
+                        if configVLen > 0 {
+                                used := make([]bool, len(cmpVals)) // track used elements in case multiple have the same compare value
+                                newVals := make([]cty.Value, 0, configVLen)
+                                for it := configV.ElementIterator(); it.Next(); {
+                                        _, configEV := it.Element()
+                                        var priorEV cty.Value
+                                        for i, cmp := range cmpVals {
+                                                if used[i] {
+                                                        continue
+                                                }
+                                                if cmp[1].RawEquals(configEV) {
+                                                        priorEV = cmp[0]
+                                                        used[i] = true // we can't use this value on a future iteration
+                                                        break
+                                                }
+                                        }
+                                        if priorEV == cty.NilVal {
+                                                priorEV = cty.NullVal(blockType.ImpliedType())
+                                        }
+
+                                        newEV := ProposedNewObject(&blockType.Block, priorEV, configEV)
+                                        newVals = append(newVals, newEV)
+                                }
+                                newV = cty.SetVal(newVals)
+                        } else {
+                                newV = cty.SetValEmpty(blockType.Block.ImpliedType())
+                        }
+
+                default:
+                        // Should never happen, since the above cases are comprehensive.
+                        panic(fmt.Sprintf("unsupported block nesting mode %s", blockType.Nesting))
+                }
+
+                newAttrs[name] = newV
+        }
+
+        return cty.ObjectVal(newAttrs)
+}
+
+// setElementCompareValues takes a known, non-null value of a cty.Set type and
+// returns a table -- constructed of two-element arrays -- that maps original
+// set element values to corresponding values that have all of the computed
+// values removed, making them suitable for comparison with values obtained
+// from configuration. The element type of the set must conform to the implied
+// type of the given schema, or this function will panic.
+//
+// In the resulting slice, the zeroth element of each array is the original
+// value and the one-indexed element is the corresponding "compare value".
+//
+// This is intended to help correlate prior elements with configured elements
+// in ProposedNewObject. The result is a heuristic rather than an exact science,
+// since e.g. two separate elements may reduce to the same value through this
+// process. The caller must therefore be ready to deal with duplicates.
+func setElementCompareValues(schema *configschema.Block, set cty.Value, isConfig bool) [][2]cty.Value {
+        ret := make([][2]cty.Value, 0, set.LengthInt())
+        for it := set.ElementIterator(); it.Next(); {
+                _, ev := it.Element()
+                ret = append(ret, [2]cty.Value{ev, setElementCompareValue(schema, ev, isConfig)})
+        }
+        return ret
+}
+
+// setElementCompareValue creates a new value that has all of the same
+// non-computed attribute values as the one given but has all computed
+// attribute values forced to null.
+//
+// If isConfig is true then non-null Optional+Computed attribute values will
+// be preserved. Otherwise, they will also be set to null.
+//
+// The input value must conform to the schema's implied type, and the return
+// value is guaranteed to conform to it.
+func setElementCompareValue(schema *configschema.Block, v cty.Value, isConfig bool) cty.Value {
+        if v.IsNull() || !v.IsKnown() {
+                return v
+        }
+
+        attrs := map[string]cty.Value{}
+        for name, attr := range schema.Attributes {
+                switch {
+                case attr.Computed && attr.Optional:
+                        if isConfig {
+                                attrs[name] = v.GetAttr(name)
+                        } else {
+                                attrs[name] = cty.NullVal(attr.Type)
+                        }
+                case attr.Computed:
+                        attrs[name] = cty.NullVal(attr.Type)
+                default:
+                        attrs[name] = v.GetAttr(name)
+                }
+        }
+
+        for name, blockType := range schema.BlockTypes {
+                switch blockType.Nesting {
+
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        attrs[name] = setElementCompareValue(&blockType.Block, v.GetAttr(name), isConfig)
+
+                case configschema.NestingList, configschema.NestingSet:
+                        cv := v.GetAttr(name)
+                        if cv.IsNull() || !cv.IsKnown() {
+                                attrs[name] = cv
+                                continue
+                        }
+                        if l := cv.LengthInt(); l > 0 {
+                                elems := make([]cty.Value, 0, l)
+                                for it := cv.ElementIterator(); it.Next(); {
+                                        _, ev := it.Element()
+                                        elems = append(elems, setElementCompareValue(&blockType.Block, ev, isConfig))
+                                }
+                                if blockType.Nesting == configschema.NestingSet {
+                                        // SetValEmpty would panic if given elements that are not
+                                        // all of the same type, but that's guaranteed not to
+                                        // happen here because our input value was _already_ a
+                                        // set and we've not changed the types of any elements here.
+                                        attrs[name] = cty.SetVal(elems)
+                                } else {
+                                        attrs[name] = cty.TupleVal(elems)
+                                }
+                        } else {
+                                if blockType.Nesting == configschema.NestingSet {
+                                        attrs[name] = cty.SetValEmpty(blockType.Block.ImpliedType())
+                                } else {
+                                        attrs[name] = cty.EmptyTupleVal
+                                }
+                        }
+
+                case configschema.NestingMap:
+                        cv := v.GetAttr(name)
+                        if cv.IsNull() || !cv.IsKnown() {
+                                attrs[name] = cv
+                                continue
+                        }
+                        elems := make(map[string]cty.Value)
+                        for it := cv.ElementIterator(); it.Next(); {
+                                kv, ev := it.Element()
+                                elems[kv.AsString()] = setElementCompareValue(&blockType.Block, ev, isConfig)
+                        }
+                        attrs[name] = cty.ObjectVal(elems)
+
+                default:
+                        // Should never happen, since the above cases are comprehensive.
+                        panic(fmt.Sprintf("unsupported block nesting mode %s", blockType.Nesting))
+                }
+        }
+
+        return cty.ObjectVal(attrs)
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/plan_valid.go b/vendor/github.com/hashicorp/terraform/plans/objchange/plan_valid.go
new file mode 100644
index 0000000..69acb89
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/plan_valid.go
@@ -0,0 +1,267 @@
+package objchange
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+)
+
+// AssertPlanValid checks checks whether a planned new state returned by a
+// provider's PlanResourceChange method is suitable to achieve a change
+// from priorState to config. It returns a slice with nonzero length if
+// any problems are detected. Because problems here indicate bugs in the
+// provider that generated the plannedState, they are written with provider
+// developers as an audience, rather than end-users.
+//
+// All of the given values must have the same type and must conform to the
+// implied type of the given schema, or this function may panic or produce
+// garbage results.
+//
+// During planning, a provider may only make changes to attributes that are
+// null (unset) in the configuration and are marked as "computed" in the
+// resource type schema, in order to insert any default values the provider
+// may know about. If the default value cannot be determined until apply time,
+// the provider can return an unknown value. Providers are forbidden from
+// planning a change that disagrees with any non-null argument in the
+// configuration.
+//
+// As a special exception, providers _are_ allowed to provide attribute values
+// conflicting with configuration if and only if the planned value exactly
+// matches the corresponding attribute value in the prior state. The provider
+// can use this to signal that the new value is functionally equivalent to
+// the old and thus no change is required.
+func AssertPlanValid(schema *configschema.Block, priorState, config, plannedState cty.Value) []error {
+        return assertPlanValid(schema, priorState, config, plannedState, nil)
+}
+
+func assertPlanValid(schema *configschema.Block, priorState, config, plannedState cty.Value, path cty.Path) []error {
+        var errs []error
+        if plannedState.IsNull() && !config.IsNull() {
+                errs = append(errs, path.NewErrorf("planned for absense but config wants existence"))
+                return errs
+        }
+        if config.IsNull() && !plannedState.IsNull() {
+                errs = append(errs, path.NewErrorf("planned for existence but config wants absense"))
+                return errs
+        }
+        if plannedState.IsNull() {
+                // No further checks possible if the planned value is null
+                return errs
+        }
+
+        impTy := schema.ImpliedType()
+
+        for name, attrS := range schema.Attributes {
+                plannedV := plannedState.GetAttr(name)
+                configV := config.GetAttr(name)
+                priorV := cty.NullVal(attrS.Type)
+                if !priorState.IsNull() {
+                        priorV = priorState.GetAttr(name)
+                }
+
+                path := append(path, cty.GetAttrStep{Name: name})
+                moreErrs := assertPlannedValueValid(attrS, priorV, configV, plannedV, path)
+                errs = append(errs, moreErrs...)
+        }
+        for name, blockS := range schema.BlockTypes {
+                path := append(path, cty.GetAttrStep{Name: name})
+                plannedV := plannedState.GetAttr(name)
+                configV := config.GetAttr(name)
+                priorV := cty.NullVal(impTy.AttributeType(name))
+                if !priorState.IsNull() {
+                        priorV = priorState.GetAttr(name)
+                }
+                if plannedV.RawEquals(configV) {
+                        // Easy path: nothing has changed at all
+                        continue
+                }
+                if !plannedV.IsKnown() {
+                        errs = append(errs, path.NewErrorf("attribute representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+                        continue
+                }
+
+                switch blockS.Nesting {
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        moreErrs := assertPlanValid(&blockS.Block, priorV, configV, plannedV, path)
+                        errs = append(errs, moreErrs...)
+                case configschema.NestingList:
+                        // A NestingList might either be a list or a tuple, depending on
+                        // whether there are dynamically-typed attributes inside. However,
+                        // both support a similar-enough API that we can treat them the
+                        // same for our purposes here.
+                        if plannedV.IsNull() {
+                                errs = append(errs, path.NewErrorf("attribute representing a list of nested blocks must be empty to indicate no blocks, not null"))
+                                continue
+                        }
+
+                        plannedL := plannedV.LengthInt()
+                        configL := configV.LengthInt()
+                        if plannedL != configL {
+                                errs = append(errs, path.NewErrorf("block count in plan (%d) disagrees with count in config (%d)", plannedL, configL))
+                                continue
+                        }
+                        for it := plannedV.ElementIterator(); it.Next(); {
+                                idx, plannedEV := it.Element()
+                                path := append(path, cty.IndexStep{Key: idx})
+                                if !plannedEV.IsKnown() {
+                                        errs = append(errs, path.NewErrorf("element representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+                                        continue
+                                }
+                                if !configV.HasIndex(idx).True() {
+                                        continue // should never happen since we checked the lengths above
+                                }
+                                configEV := configV.Index(idx)
+                                priorEV := cty.NullVal(blockS.ImpliedType())
+                                if !priorV.IsNull() && priorV.HasIndex(idx).True() {
+                                        priorEV = priorV.Index(idx)
+                                }
+
+                                moreErrs := assertPlanValid(&blockS.Block, priorEV, configEV, plannedEV, path)
+                                errs = append(errs, moreErrs...)
+                        }
+                case configschema.NestingMap:
+                        if plannedV.IsNull() {
+                                errs = append(errs, path.NewErrorf("attribute representing a map of nested blocks must be empty to indicate no blocks, not null"))
+                                continue
+                        }
+
+                        // A NestingMap might either be a map or an object, depending on
+                        // whether there are dynamically-typed attributes inside, but
+                        // that's decided statically and so all values will have the same
+                        // kind.
+                        if plannedV.Type().IsObjectType() {
+                                plannedAtys := plannedV.Type().AttributeTypes()
+                                configAtys := configV.Type().AttributeTypes()
+                                for k := range plannedAtys {
+                                        if _, ok := configAtys[k]; !ok {
+                                                errs = append(errs, path.NewErrorf("block key %q from plan is not present in config", k))
+                                                continue
+                                        }
+                                        path := append(path, cty.GetAttrStep{Name: k})
+
+                                        plannedEV := plannedV.GetAttr(k)
+                                        if !plannedEV.IsKnown() {
+                                                errs = append(errs, path.NewErrorf("element representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+                                                continue
+                                        }
+                                        configEV := configV.GetAttr(k)
+                                        priorEV := cty.NullVal(blockS.ImpliedType())
+                                        if !priorV.IsNull() && priorV.Type().HasAttribute(k) {
+                                                priorEV = priorV.GetAttr(k)
+                                        }
+                                        moreErrs := assertPlanValid(&blockS.Block, priorEV, configEV, plannedEV, path)
+                                        errs = append(errs, moreErrs...)
+                                }
+                                for k := range configAtys {
+                                        if _, ok := plannedAtys[k]; !ok {
+                                                errs = append(errs, path.NewErrorf("block key %q from config is not present in plan", k))
+                                                continue
+                                        }
+                                }
+                        } else {
+                                plannedL := plannedV.LengthInt()
+                                configL := configV.LengthInt()
+                                if plannedL != configL {
+                                        errs = append(errs, path.NewErrorf("block count in plan (%d) disagrees with count in config (%d)", plannedL, configL))
+                                        continue
+                                }
+                                for it := plannedV.ElementIterator(); it.Next(); {
+                                        idx, plannedEV := it.Element()
+                                        path := append(path, cty.IndexStep{Key: idx})
+                                        if !plannedEV.IsKnown() {
+                                                errs = append(errs, path.NewErrorf("element representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+                                                continue
+                                        }
+                                        k := idx.AsString()
+                                        if !configV.HasIndex(idx).True() {
+                                                errs = append(errs, path.NewErrorf("block key %q from plan is not present in config", k))
+                                                continue
+                                        }
+                                        configEV := configV.Index(idx)
+                                        priorEV := cty.NullVal(blockS.ImpliedType())
+                                        if !priorV.IsNull() && priorV.HasIndex(idx).True() {
+                                                priorEV = priorV.Index(idx)
+                                        }
+                                        moreErrs := assertPlanValid(&blockS.Block, priorEV, configEV, plannedEV, path)
+                                        errs = append(errs, moreErrs...)
+                                }
+                                for it := configV.ElementIterator(); it.Next(); {
+                                        idx, _ := it.Element()
+                                        if !plannedV.HasIndex(idx).True() {
+                                                errs = append(errs, path.NewErrorf("block key %q from config is not present in plan", idx.AsString()))
+                                                continue
+                                        }
+                                }
+                        }
+                case configschema.NestingSet:
+                        if plannedV.IsNull() {
+                                errs = append(errs, path.NewErrorf("attribute representing a set of nested blocks must be empty to indicate no blocks, not null"))
+                                continue
+                        }
+
+                        // Because set elements have no identifier with which to correlate
+                        // them, we can't robustly validate the plan for a nested block
+                        // backed by a set, and so unfortunately we need to just trust the
+                        // provider to do the right thing. :(
+                        //
+                        // (In principle we could correlate elements by matching the
+                        // subset of attributes explicitly set in config, except for the
+                        // special diff suppression rule which allows for there to be a
+                        // planned value that is constructed by mixing part of a prior
+                        // value with part of a config value, creating an entirely new
+                        // element that is not present in either prior nor config.)
+                        for it := plannedV.ElementIterator(); it.Next(); {
+                                idx, plannedEV := it.Element()
+                                path := append(path, cty.IndexStep{Key: idx})
+                                if !plannedEV.IsKnown() {
+                                        errs = append(errs, path.NewErrorf("element representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+                                        continue
+                                }
+                        }
+
+                default:
+                        panic(fmt.Sprintf("unsupported nesting mode %s", blockS.Nesting))
+                }
+        }
+
+        return errs
+}
+
+func assertPlannedValueValid(attrS *configschema.Attribute, priorV, configV, plannedV cty.Value, path cty.Path) []error {
+        var errs []error
+        if plannedV.RawEquals(configV) {
+                // This is the easy path: provider didn't change anything at all.
+                return errs
+        }
+        if plannedV.RawEquals(priorV) && !priorV.IsNull() {
+                // Also pretty easy: there is a prior value and the provider has
+                // returned it unchanged. This indicates that configV and plannedV
+                // are functionally equivalent and so the provider wishes to disregard
+                // the configuration value in favor of the prior.
+                return errs
+        }
+        if attrS.Computed && configV.IsNull() {
+                // The provider is allowed to change the value of any computed
+                // attribute that isn't explicitly set in the config.
+                return errs
+        }
+
+        // If none of the above conditions match, the provider has made an invalid
+        // change to this attribute.
+        if priorV.IsNull() {
+                if attrS.Sensitive {
+                        errs = append(errs, path.NewErrorf("sensitive planned value does not match config value"))
+                } else {
+                        errs = append(errs, path.NewErrorf("planned value %#v does not match config value %#v", plannedV, configV))
+                }
+                return errs
+        }
+        if attrS.Sensitive {
+                errs = append(errs, path.NewErrorf("sensitive planned value does not match config value nor prior value"))
+        } else {
+                errs = append(errs, path.NewErrorf("planned value %#v does not match config value %#v nor prior value %#v", plannedV, configV, priorV))
+        }
+        return errs
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/plan.go b/vendor/github.com/hashicorp/terraform/plans/plan.go
new file mode 100644
index 0000000..5a3e454
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/plan.go
@@ -0,0 +1,92 @@
+package plans
+
+import (
+        "sort"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Plan is the top-level type representing a planned set of changes.
+//
+// A plan is a summary of the set of changes required to move from a current
+// state to a goal state derived from configuration. The described changes
+// are not applied directly, but contain an approximation of the final
+// result that will be completed during apply by resolving any values that
+// cannot be predicted.
+//
+// A plan must always be accompanied by the state and configuration it was
+// built from, since the plan does not itself include all of the information
+// required to make the changes indicated.
+type Plan struct {
+        VariableValues  map[string]DynamicValue
+        Changes         *Changes
+        TargetAddrs     []addrs.Targetable
+        ProviderSHA256s map[string][]byte
+        Backend         Backend
+}
+
+// Backend represents the backend-related configuration and other data as it
+// existed when a plan was created.
+type Backend struct {
+        // Type is the type of backend that the plan will apply against.
+        Type string
+
+        // Config is the configuration of the backend, whose schema is decided by
+        // the backend Type.
+        Config DynamicValue
+
+        // Workspace is the name of the workspace that was active when the plan
+        // was created. It is illegal to apply a plan created for one workspace
+        // to the state of another workspace.
+        // (This constraint is already enforced by the statefile lineage mechanism,
+        // but storing this explicitly allows us to return a better error message
+        // in the situation where the user has the wrong workspace selected.)
+        Workspace string
+}
+
+func NewBackend(typeName string, config cty.Value, configSchema *configschema.Block, workspaceName string) (*Backend, error) {
+        dv, err := NewDynamicValue(config, configSchema.ImpliedType())
+        if err != nil {
+                return nil, err
+        }
+
+        return &Backend{
+                Type:      typeName,
+                Config:    dv,
+                Workspace: workspaceName,
+        }, nil
+}
+
+// ProviderAddrs returns a list of all of the provider configuration addresses
+// referenced throughout the receiving plan.
+//
+// The result is de-duplicated so that each distinct address appears only once.
+func (p *Plan) ProviderAddrs() []addrs.AbsProviderConfig {
+        if p == nil || p.Changes == nil {
+                return nil
+        }
+
+        m := map[string]addrs.AbsProviderConfig{}
+        for _, rc := range p.Changes.Resources {
+                m[rc.ProviderAddr.String()] = rc.ProviderAddr
+        }
+        if len(m) == 0 {
+                return nil
+        }
+
+        // This is mainly just so we'll get stable results for testing purposes.
+        keys := make([]string, 0, len(m))
+        for k := range m {
+                keys = append(keys, k)
+        }
+        sort.Strings(keys)
+
+        ret := make([]addrs.AbsProviderConfig, len(keys))
+        for i, key := range keys {
+                ret[i] = m[key]
+        }
+
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/client.go b/vendor/github.com/hashicorp/terraform/plugin/client.go
index 7e2f4fe..0eab538 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/client.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/client.go
@@ -19,11 +19,13 @@ func ClientConfig(m discovery.PluginMeta) *plugin.ClientConfig {
         })
 
         return &plugin.ClientConfig{
-                Cmd:             exec.Command(m.Path),
-                HandshakeConfig: Handshake,
-                Managed:         true,
-                Plugins:         PluginMap,
-                Logger:          logger,
+                Cmd:              exec.Command(m.Path),
+                HandshakeConfig:  Handshake,
+                VersionedPlugins: VersionedPlugins,
+                Managed:          true,
+                Logger:           logger,
+                AllowedProtocols: []plugin.Protocol{plugin.ProtocolGRPC},
+                AutoMTLS:         true,
         }
 }
 
diff --git a/vendor/github.com/hashicorp/terraform/plugin/convert/diagnostics.go b/vendor/github.com/hashicorp/terraform/plugin/convert/diagnostics.go
new file mode 100644
index 0000000..51cb2fe
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/convert/diagnostics.go
@@ -0,0 +1,132 @@
+package convert
+
+import (
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// WarnsAndErrorsToProto converts the warnings and errors return by the legacy
+// provider to protobuf diagnostics.
+func WarnsAndErrsToProto(warns []string, errs []error) (diags []*proto.Diagnostic) {
+        for _, w := range warns {
+                diags = AppendProtoDiag(diags, w)
+        }
+
+        for _, e := range errs {
+                diags = AppendProtoDiag(diags, e)
+        }
+
+        return diags
+}
+
+// AppendProtoDiag appends a new diagnostic from a warning string or an error.
+// This panics if d is not a string or error.
+func AppendProtoDiag(diags []*proto.Diagnostic, d interface{}) []*proto.Diagnostic {
+        switch d := d.(type) {
+        case cty.PathError:
+                ap := PathToAttributePath(d.Path)
+                diags = append(diags, &proto.Diagnostic{
+                        Severity:  proto.Diagnostic_ERROR,
+                        Summary:   d.Error(),
+                        Attribute: ap,
+                })
+        case error:
+                diags = append(diags, &proto.Diagnostic{
+                        Severity: proto.Diagnostic_ERROR,
+                        Summary:  d.Error(),
+                })
+        case string:
+                diags = append(diags, &proto.Diagnostic{
+                        Severity: proto.Diagnostic_WARNING,
+                        Summary:  d,
+                })
+        case *proto.Diagnostic:
+                diags = append(diags, d)
+        case []*proto.Diagnostic:
+                diags = append(diags, d...)
+        }
+        return diags
+}
+
+// ProtoToDiagnostics converts a list of proto.Diagnostics to a tf.Diagnostics.
+func ProtoToDiagnostics(ds []*proto.Diagnostic) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+        for _, d := range ds {
+                var severity tfdiags.Severity
+
+                switch d.Severity {
+                case proto.Diagnostic_ERROR:
+                        severity = tfdiags.Error
+                case proto.Diagnostic_WARNING:
+                        severity = tfdiags.Warning
+                }
+
+                var newDiag tfdiags.Diagnostic
+
+                // if there's an attribute path, we need to create a AttributeValue diagnostic
+                if d.Attribute != nil {
+                        path := AttributePathToPath(d.Attribute)
+                        newDiag = tfdiags.AttributeValue(severity, d.Summary, d.Detail, path)
+                } else {
+                        newDiag = tfdiags.WholeContainingBody(severity, d.Summary, d.Detail)
+                }
+
+                diags = diags.Append(newDiag)
+        }
+
+        return diags
+}
+
+// AttributePathToPath takes the proto encoded path and converts it to a cty.Path
+func AttributePathToPath(ap *proto.AttributePath) cty.Path {
+        var p cty.Path
+        for _, step := range ap.Steps {
+                switch selector := step.Selector.(type) {
+                case *proto.AttributePath_Step_AttributeName:
+                        p = p.GetAttr(selector.AttributeName)
+                case *proto.AttributePath_Step_ElementKeyString:
+                        p = p.Index(cty.StringVal(selector.ElementKeyString))
+                case *proto.AttributePath_Step_ElementKeyInt:
+                        p = p.Index(cty.NumberIntVal(selector.ElementKeyInt))
+                }
+        }
+        return p
+}
+
+// AttributePathToPath takes a cty.Path and converts it to a proto-encoded path.
+func PathToAttributePath(p cty.Path) *proto.AttributePath {
+        ap := &proto.AttributePath{}
+        for _, step := range p {
+                switch selector := step.(type) {
+                case cty.GetAttrStep:
+                        ap.Steps = append(ap.Steps, &proto.AttributePath_Step{
+                                Selector: &proto.AttributePath_Step_AttributeName{
+                                        AttributeName: selector.Name,
+                                },
+                        })
+                case cty.IndexStep:
+                        key := selector.Key
+                        switch key.Type() {
+                        case cty.String:
+                                ap.Steps = append(ap.Steps, &proto.AttributePath_Step{
+                                        Selector: &proto.AttributePath_Step_ElementKeyString{
+                                                ElementKeyString: key.AsString(),
+                                        },
+                                })
+                        case cty.Number:
+                                v, _ := key.AsBigFloat().Int64()
+                                ap.Steps = append(ap.Steps, &proto.AttributePath_Step{
+                                        Selector: &proto.AttributePath_Step_ElementKeyInt{
+                                                ElementKeyInt: v,
+                                        },
+                                })
+                        default:
+                                // We'll bail early if we encounter anything else, and just
+                                // return the valid prefix.
+                                return ap
+                        }
+                }
+        }
+        return ap
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/convert/schema.go b/vendor/github.com/hashicorp/terraform/plugin/convert/schema.go
new file mode 100644
index 0000000..6a45f54
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/convert/schema.go
@@ -0,0 +1,154 @@
+package convert
+
+import (
+        "encoding/json"
+        "reflect"
+        "sort"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/providers"
+)
+
+// ConfigSchemaToProto takes a *configschema.Block and converts it to a
+// proto.Schema_Block for a grpc response.
+func ConfigSchemaToProto(b *configschema.Block) *proto.Schema_Block {
+        block := &proto.Schema_Block{}
+
+        for _, name := range sortedKeys(b.Attributes) {
+                a := b.Attributes[name]
+                attr := &proto.Schema_Attribute{
+                        Name:        name,
+                        Description: a.Description,
+                        Optional:    a.Optional,
+                        Computed:    a.Computed,
+                        Required:    a.Required,
+                        Sensitive:   a.Sensitive,
+                }
+
+                ty, err := json.Marshal(a.Type)
+                if err != nil {
+                        panic(err)
+                }
+
+                attr.Type = ty
+
+                block.Attributes = append(block.Attributes, attr)
+        }
+
+        for _, name := range sortedKeys(b.BlockTypes) {
+                b := b.BlockTypes[name]
+                block.BlockTypes = append(block.BlockTypes, protoSchemaNestedBlock(name, b))
+        }
+
+        return block
+}
+
+func protoSchemaNestedBlock(name string, b *configschema.NestedBlock) *proto.Schema_NestedBlock {
+        var nesting proto.Schema_NestedBlock_NestingMode
+        switch b.Nesting {
+        case configschema.NestingSingle:
+                nesting = proto.Schema_NestedBlock_SINGLE
+        case configschema.NestingGroup:
+                nesting = proto.Schema_NestedBlock_GROUP
+        case configschema.NestingList:
+                nesting = proto.Schema_NestedBlock_LIST
+        case configschema.NestingSet:
+                nesting = proto.Schema_NestedBlock_SET
+        case configschema.NestingMap:
+                nesting = proto.Schema_NestedBlock_MAP
+        default:
+                nesting = proto.Schema_NestedBlock_INVALID
+        }
+        return &proto.Schema_NestedBlock{
+                TypeName: name,
+                Block:    ConfigSchemaToProto(&b.Block),
+                Nesting:  nesting,
+                MinItems: int64(b.MinItems),
+                MaxItems: int64(b.MaxItems),
+        }
+}
+
+// ProtoToProviderSchema takes a proto.Schema and converts it to a providers.Schema.
+func ProtoToProviderSchema(s *proto.Schema) providers.Schema {
+        return providers.Schema{
+                Version: s.Version,
+                Block:   ProtoToConfigSchema(s.Block),
+        }
+}
+
+// ProtoToConfigSchema takes the GetSchcema_Block from a grpc response and converts it
+// to a terraform *configschema.Block.
+func ProtoToConfigSchema(b *proto.Schema_Block) *configschema.Block {
+        block := &configschema.Block{
+                Attributes: make(map[string]*configschema.Attribute),
+                BlockTypes: make(map[string]*configschema.NestedBlock),
+        }
+
+        for _, a := range b.Attributes {
+                attr := &configschema.Attribute{
+                        Description: a.Description,
+                        Required:    a.Required,
+                        Optional:    a.Optional,
+                        Computed:    a.Computed,
+                        Sensitive:   a.Sensitive,
+                }
+
+                if err := json.Unmarshal(a.Type, &attr.Type); err != nil {
+                        panic(err)
+                }
+
+                block.Attributes[a.Name] = attr
+        }
+
+        for _, b := range b.BlockTypes {
+                block.BlockTypes[b.TypeName] = schemaNestedBlock(b)
+        }
+
+        return block
+}
+
+func schemaNestedBlock(b *proto.Schema_NestedBlock) *configschema.NestedBlock {
+        var nesting configschema.NestingMode
+        switch b.Nesting {
+        case proto.Schema_NestedBlock_SINGLE:
+                nesting = configschema.NestingSingle
+        case proto.Schema_NestedBlock_GROUP:
+                nesting = configschema.NestingGroup
+        case proto.Schema_NestedBlock_LIST:
+                nesting = configschema.NestingList
+        case proto.Schema_NestedBlock_MAP:
+                nesting = configschema.NestingMap
+        case proto.Schema_NestedBlock_SET:
+                nesting = configschema.NestingSet
+        default:
+                // In all other cases we'll leave it as the zero value (invalid) and
+                // let the caller validate it and deal with this.
+        }
+
+        nb := &configschema.NestedBlock{
+                Nesting:  nesting,
+                MinItems: int(b.MinItems),
+                MaxItems: int(b.MaxItems),
+        }
+
+        nested := ProtoToConfigSchema(b.Block)
+        nb.Block = *nested
+        return nb
+}
+
+// sortedKeys returns the lexically sorted keys from the given map. This is
+// used to make schema conversions are deterministic. This panics if map keys
+// are not a string.
+func sortedKeys(m interface{}) []string {
+        v := reflect.ValueOf(m)
+        keys := make([]string, v.Len())
+
+        mapKeys := v.MapKeys()
+        for i, k := range mapKeys {
+                keys[i] = k.Interface().(string)
+        }
+
+        sort.Strings(keys)
+        return keys
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/error.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/error.go
index df855a7..729e970 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/error.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/error.go
@@ -22,9 +22,43 @@ const ErrorNoSuitableVersion = Error("no suitable version is available")
 // version of Terraform.
 const ErrorNoVersionCompatible = Error("no available version is compatible with this version of Terraform")
 
+// ErrorVersionIncompatible indicates that all of the versions within the
+// constraints are not compatible with the current version of Terrafrom, though
+// there does exist a version outside of the constaints that is compatible.
+const ErrorVersionIncompatible = Error("incompatible provider version")
+
 // ErrorNoSuchProvider indicates that no provider exists with a name given
 const ErrorNoSuchProvider = Error("no provider exists with the given name")
 
+// ErrorNoVersionCompatibleWithPlatform indicates that all of the available
+// versions that otherwise met constraints are not compatible with the
+// requested platform
+const ErrorNoVersionCompatibleWithPlatform = Error("no available version is compatible for the requested platform")
+
+// ErrorMissingChecksumVerification indicates that either the provider
+// distribution is missing the SHA256SUMS file or the checksum file does
+// not contain a checksum for the binary plugin
+const ErrorMissingChecksumVerification = Error("unable to verify checksum")
+
+// ErrorChecksumVerification indicates that the current checksum of the
+// provider plugin has changed since the initial release and is not trusted
+// to download
+const ErrorChecksumVerification = Error("unexpected plugin checksum")
+
+// ErrorSignatureVerification indicates that the digital signature for a
+// provider distribution could not be verified for one of the following
+// reasons: missing signature file, missing public key, or the signature
+// was not signed by any known key for the publisher
+const ErrorSignatureVerification = Error("unable to verify signature")
+
+// ErrorServiceUnreachable indicates that the network was unable to connect
+// to the registry service
+const ErrorServiceUnreachable = Error("registry service is unreachable")
+
+// ErrorPublicRegistryUnreachable indicates that the network was unable to connect
+// to the public registry in particular, so we can show a link to the statuspage
+const ErrorPublicRegistryUnreachable = Error("registry service is unreachable, check https://status.hashicorp.com/ for status updates")
+
 func (err Error) Error() string {
         return string(err)
 }
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go
index 815640f..b1d01fb 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go
@@ -13,28 +13,27 @@ import (
         "strconv"
         "strings"
 
-        "golang.org/x/net/html"
-
+        "github.com/hashicorp/errwrap"
         getter "github.com/hashicorp/go-getter"
         multierror "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/terraform/httpclient"
+        "github.com/hashicorp/terraform/registry"
+        "github.com/hashicorp/terraform/registry/regsrc"
+        "github.com/hashicorp/terraform/registry/response"
+        "github.com/hashicorp/terraform/svchost/disco"
+        "github.com/hashicorp/terraform/tfdiags"
+        tfversion "github.com/hashicorp/terraform/version"
         "github.com/mitchellh/cli"
 )
 
-// Releases are located by parsing the html listing from releases.hashicorp.com.
-//
-// The URL for releases follows the pattern:
-//    https://releases.hashicorp.com/terraform-provider-name/<x.y.z>/terraform-provider-name_<x.y.z>_<os>_<arch>.<ext>
-//
-// The plugin protocol version will be saved with the release and returned in
-// the header X-TERRAFORM_PROTOCOL_VERSION.
+// Releases are located by querying the terraform registry.
 
 const protocolVersionHeader = "x-terraform-protocol-version"
 
-var releaseHost = "https://releases.hashicorp.com"
-
 var httpClient *http.Client
 
+var errVersionNotFound = errors.New("version not found")
+
 func init() {
         httpClient = httpclient.New()
 
@@ -50,7 +49,7 @@ func init() {
 // An Installer maintains a local cache of plugins by downloading plugins
 // from an online repository.
 type Installer interface {
-        Get(name string, req Constraints) (PluginMeta, error)
+        Get(name string, req Constraints) (PluginMeta, tfdiags.Diagnostics, error)
         PurgeUnused(used map[string]PluginMeta) (removed PluginMetaSet, err error)
 }
 
@@ -79,6 +78,13 @@ type ProviderInstaller struct {
         SkipVerify bool
 
         Ui cli.Ui // Ui for output
+
+        // Services is a required *disco.Disco, which may have services and
+        // credentials pre-loaded.
+        Services *disco.Disco
+
+        // registry client
+        registry *registry.Client
 }
 
 // Get is part of an implementation of type Installer, and attempts to download
@@ -100,96 +106,170 @@ type ProviderInstaller struct {
 // are produced under the assumption that if presented to the user they will
 // be presented alongside context about what is being installed, and thus the
 // error messages do not redundantly include such information.
-func (i *ProviderInstaller) Get(provider string, req Constraints) (PluginMeta, error) {
-        versions, err := i.listProviderVersions(provider)
+func (i *ProviderInstaller) Get(provider string, req Constraints) (PluginMeta, tfdiags.Diagnostics, error) {
+        var diags tfdiags.Diagnostics
+
+        // a little bit of initialization.
+        if i.OS == "" {
+                i.OS = runtime.GOOS
+        }
+        if i.Arch == "" {
+                i.Arch = runtime.GOARCH
+        }
+        if i.registry == nil {
+                i.registry = registry.NewClient(i.Services, nil)
+        }
+
+        // get a full listing of versions for the requested provider
+        allVersions, err := i.listProviderVersions(provider)
+
         // TODO: return multiple errors
         if err != nil {
-                return PluginMeta{}, err
+                log.Printf("[DEBUG] %s", err)
+                if registry.IsServiceUnreachable(err) {
+                        registryHost, err := i.hostname()
+                        if err == nil && registryHost == regsrc.PublicRegistryHost.Raw {
+                                return PluginMeta{}, diags, ErrorPublicRegistryUnreachable
+                        }
+                        return PluginMeta{}, diags, ErrorServiceUnreachable
+                }
+                if registry.IsServiceNotProvided(err) {
+                        return PluginMeta{}, diags, err
+                }
+                return PluginMeta{}, diags, ErrorNoSuchProvider
         }
 
-        if len(versions) == 0 {
-                return PluginMeta{}, ErrorNoSuitableVersion
+        // Add any warnings from the response to diags
+        for _, warning := range allVersions.Warnings {
+                hostname, err := i.hostname()
+                if err != nil {
+                        return PluginMeta{}, diags, err
+                }
+                diag := tfdiags.SimpleWarning(fmt.Sprintf("%s: %s", hostname, warning))
+                diags = diags.Append(diag)
         }
 
-        versions = allowedVersions(versions, req)
+        if len(allVersions.Versions) == 0 {
+                return PluginMeta{}, diags, ErrorNoSuitableVersion
+        }
+        providerSource := allVersions.ID
+
+        // Filter the list of plugin versions to those which meet the version constraints
+        versions := allowedVersions(allVersions, req)
         if len(versions) == 0 {
-                return PluginMeta{}, ErrorNoSuitableVersion
+                return PluginMeta{}, diags, ErrorNoSuitableVersion
         }
 
-        // sort them newest to oldest
-        Versions(versions).Sort()
+        // sort them newest to oldest. The newest version wins!
+        response.ProviderVersionCollection(versions).Sort()
 
-        // Ensure that our installation directory exists
-        err = os.MkdirAll(i.Dir, os.ModePerm)
-        if err != nil {
-                return PluginMeta{}, fmt.Errorf("failed to create plugin dir %s: %s", i.Dir, err)
+        // if the chosen provider version does not support the requested platform,
+        // filter the list of acceptable versions to those that support that platform
+        if err := i.checkPlatformCompatibility(versions[0]); err != nil {
+                versions = i.platformCompatibleVersions(versions)
+                if len(versions) == 0 {
+                        return PluginMeta{}, diags, ErrorNoVersionCompatibleWithPlatform
+                }
         }
 
-        // take the first matching plugin we find
-        for _, v := range versions {
-                url := i.providerURL(provider, v.String())
+        // we now have a winning platform-compatible version
+        versionMeta := versions[0]
+        v := VersionStr(versionMeta.Version).MustParse()
 
-                if !i.SkipVerify {
-                        sha256, err := i.getProviderChecksum(provider, v.String())
-                        if err != nil {
-                                return PluginMeta{}, err
-                        }
+        // check protocol compatibility
+        if err := i.checkPluginProtocol(versionMeta); err != nil {
+                closestMatch, err := i.findClosestProtocolCompatibleVersion(allVersions.Versions)
+                if err != nil {
+                        // No operation here if we can't find a version with compatible protocol
+                        return PluginMeta{}, diags, err
+                }
 
-                        // add the checksum parameter for go-getter to verify the download for us.
-                        if sha256 != "" {
-                                url = url + "?checksum=sha256:" + sha256
-                        }
+                // Prompt version suggestion to UI based on closest protocol match
+                var errMsg string
+                closestVersion := VersionStr(closestMatch.Version).MustParse()
+                if v.NewerThan(closestVersion) {
+                        errMsg = providerProtocolTooNew
+                } else {
+                        errMsg = providerProtocolTooOld
                 }
 
-                log.Printf("[DEBUG] fetching provider info for %s version %s", provider, v)
-                if checkPlugin(url, i.PluginProtocolVersion) {
-                        i.Ui.Info(fmt.Sprintf("- Downloading plugin for provider %q (%s)...", provider, v.String()))
-                        log.Printf("[DEBUG] getting provider %q version %q", provider, v)
-                        err := i.install(provider, v, url)
-                        if err != nil {
-                                return PluginMeta{}, err
-                        }
+                constraintStr := req.String()
+                if constraintStr == "" {
+                        constraintStr = "(any version)"
+                }
 
-                        // Find what we just installed
-                        // (This is weird, because go-getter doesn't directly return
-                        //  information about what was extracted, and we just extracted
-                        //  the archive directly into a shared dir here.)
-                        log.Printf("[DEBUG] looking for the %s %s plugin we just installed", provider, v)
-                        metas := FindPlugins("provider", []string{i.Dir})
-                        log.Printf("[DEBUG] all plugins found %#v", metas)
-                        metas, _ = metas.ValidateVersions()
-                        metas = metas.WithName(provider).WithVersion(v)
-                        log.Printf("[DEBUG] filtered plugins %#v", metas)
-                        if metas.Count() == 0 {
-                                // This should never happen. Suggests that the release archive
-                                // contains an executable file whose name doesn't match the
-                                // expected convention.
-                                return PluginMeta{}, fmt.Errorf(
-                                        "failed to find installed plugin version %s; this is a bug in Terraform and should be reported",
-                                        v,
-                                )
-                        }
+                return PluginMeta{}, diags, errwrap.Wrap(ErrorVersionIncompatible, fmt.Errorf(fmt.Sprintf(
+                        errMsg, provider, v.String(), tfversion.String(),
+                        closestVersion.String(), closestVersion.MinorUpgradeConstraintStr(), constraintStr)))
+        }
 
-                        if metas.Count() > 1 {
-                                // This should also never happen, and suggests that a
-                                // particular version was re-released with a different
-                                // executable filename. We consider releases as immutable, so
-                                // this is an error.
-                                return PluginMeta{}, fmt.Errorf(
-                                        "multiple plugins installed for version %s; this is a bug in Terraform and should be reported",
-                                        v,
-                                )
-                        }
+        downloadURLs, err := i.listProviderDownloadURLs(providerSource, versionMeta.Version)
+        providerURL := downloadURLs.DownloadURL
+
+        if !i.SkipVerify {
+                // Terraform verifies the integrity of a provider release before downloading
+                // the plugin binary. The digital signature (SHA256SUMS.sig) on the
+                // release distribution (SHA256SUMS) is verified with the public key of the
+                // publisher provided in the Terraform Registry response, ensuring that
+                // everything is as intended by the publisher. The checksum of the provider
+                // plugin is expected in the SHA256SUMS file and is double checked to match
+                // the checksum of the original published release to the Registry. This
+                // enforces immutability of releases between the Registry and the plugin's
+                // host location. Lastly, the integrity of the binary is verified upon
+                // download matches the Registry and signed checksum.
+                sha256, err := i.getProviderChecksum(downloadURLs)
+                if err != nil {
+                        return PluginMeta{}, diags, err
+                }
 
-                        // By now we know we have exactly one meta, and so "Newest" will
-                        // return that one.
-                        return metas.Newest(), nil
+                // add the checksum parameter for go-getter to verify the download for us.
+                if sha256 != "" {
+                        providerURL = providerURL + "?checksum=sha256:" + sha256
                 }
+        }
+
+        printedProviderName := fmt.Sprintf("%q (%s)", provider, providerSource)
+        i.Ui.Info(fmt.Sprintf("- Downloading plugin for provider %s %s...", printedProviderName, versionMeta.Version))
+        log.Printf("[DEBUG] getting provider %s version %q", printedProviderName, versionMeta.Version)
+        err = i.install(provider, v, providerURL)
+        if err != nil {
+                return PluginMeta{}, diags, err
+        }
+
+        // Find what we just installed
+        // (This is weird, because go-getter doesn't directly return
+        //  information about what was extracted, and we just extracted
+        //  the archive directly into a shared dir here.)
+        log.Printf("[DEBUG] looking for the %s %s plugin we just installed", provider, versionMeta.Version)
+        metas := FindPlugins("provider", []string{i.Dir})
+        log.Printf("[DEBUG] all plugins found %#v", metas)
+        metas, _ = metas.ValidateVersions()
+        metas = metas.WithName(provider).WithVersion(v)
+        log.Printf("[DEBUG] filtered plugins %#v", metas)
+        if metas.Count() == 0 {
+                // This should never happen. Suggests that the release archive
+                // contains an executable file whose name doesn't match the
+                // expected convention.
+                return PluginMeta{}, diags, fmt.Errorf(
+                        "failed to find installed plugin version %s; this is a bug in Terraform and should be reported",
+                        versionMeta.Version,
+                )
+        }
 
-                log.Printf("[INFO] incompatible ProtocolVersion for %s version %s", provider, v)
+        if metas.Count() > 1 {
+                // This should also never happen, and suggests that a
+                // particular version was re-released with a different
+                // executable filename. We consider releases as immutable, so
+                // this is an error.
+                return PluginMeta{}, diags, fmt.Errorf(
+                        "multiple plugins installed for version %s; this is a bug in Terraform and should be reported",
+                        versionMeta.Version,
+                )
         }
 
-        return PluginMeta{}, ErrorNoVersionCompatible
+        // By now we know we have exactly one meta, and so "Newest" will
+        // return that one.
+        return metas.Newest(), diags, nil
 }
 
 func (i *ProviderInstaller) install(provider string, version Version, url string) error {
@@ -215,6 +295,14 @@ func (i *ProviderInstaller) install(provider string, version Version, url string
                 // normal resolution machinery can find it.
                 filename := filepath.Base(cached)
                 targetPath := filepath.Join(i.Dir, filename)
+                // check if the target dir exists, and create it if not
+                var err error
+                if _, StatErr := os.Stat(i.Dir); os.IsNotExist(StatErr) {
+                        err = os.MkdirAll(i.Dir, 0700)
+                }
+                if err != nil {
+                        return err
+                }
 
                 log.Printf("[DEBUG] installing %s %s to %s from local cache %s", provider, version, targetPath, cached)
 
@@ -280,7 +368,6 @@ func (i *ProviderInstaller) install(provider string, version Version, url string
                         return err
                 }
         }
-
         return nil
 }
 
@@ -316,182 +403,222 @@ func (i *ProviderInstaller) PurgeUnused(used map[string]PluginMeta) (PluginMetaS
         return removed, errs
 }
 
-// Plugins are referred to by the short name, but all URLs and files will use
-// the full name prefixed with terraform-<plugin_type>-
-func (i *ProviderInstaller) providerName(name string) string {
-        return "terraform-provider-" + name
-}
+func (i *ProviderInstaller) getProviderChecksum(resp *response.TerraformProviderPlatformLocation) (string, error) {
+        // Get SHA256SUMS file.
+        shasums, err := getFile(resp.ShasumsURL)
+        if err != nil {
+                log.Printf("[ERROR] error fetching checksums from %q: %s", resp.ShasumsURL, err)
+                return "", ErrorMissingChecksumVerification
+        }
 
-func (i *ProviderInstaller) providerFileName(name, version string) string {
-        os := i.OS
-        arch := i.Arch
-        if os == "" {
-                os = runtime.GOOS
+        // Get SHA256SUMS.sig file.
+        signature, err := getFile(resp.ShasumsSignatureURL)
+        if err != nil {
+                log.Printf("[ERROR] error fetching checksums signature from %q: %s", resp.ShasumsSignatureURL, err)
+                return "", ErrorSignatureVerification
         }
-        if arch == "" {
-                arch = runtime.GOARCH
+
+        // Verify the GPG signature returned from the Registry.
+        asciiArmor := resp.SigningKeys.GPGASCIIArmor()
+        signer, err := verifySig(shasums, signature, asciiArmor)
+        if err != nil {
+                log.Printf("[ERROR] error verifying signature: %s", err)
+                return "", ErrorSignatureVerification
         }
-        return fmt.Sprintf("%s_%s_%s_%s.zip", i.providerName(name), version, os, arch)
-}
 
-// providerVersionsURL returns the path to the released versions directory for the provider:
-// https://releases.hashicorp.com/terraform-provider-name/
-func (i *ProviderInstaller) providerVersionsURL(name string) string {
-        return releaseHost + "/" + i.providerName(name) + "/"
-}
+        // Also verify the GPG signature against the HashiCorp public key. This is
+        // a temporary additional check until a more robust key verification
+        // process is added in a future release.
+        _, err = verifySig(shasums, signature, HashicorpPublicKey)
+        if err != nil {
+                log.Printf("[ERROR] error verifying signature against HashiCorp public key: %s", err)
+                return "", ErrorSignatureVerification
+        }
 
-// providerURL returns the full path to the provider file, using the current OS
-// and ARCH:
-// .../terraform-provider-name_<x.y.z>/terraform-provider-name_<x.y.z>_<os>_<arch>.<ext>
-func (i *ProviderInstaller) providerURL(name, version string) string {
-        return fmt.Sprintf("%s%s/%s", i.providerVersionsURL(name), version, i.providerFileName(name, version))
-}
+        // Display identity for GPG key which succeeded verifying the signature.
+        // This could also be used to display to the user with i.Ui.Info().
+        identities := []string{}
+        for k := range signer.Identities {
+                identities = append(identities, k)
+        }
+        identity := strings.Join(identities, ", ")
+        log.Printf("[DEBUG] verified GPG signature with key from %s", identity)
+
+        // Extract checksum for this os/arch platform binary and verify against Registry
+        checksum := checksumForFile(shasums, resp.Filename)
+        if checksum == "" {
+                log.Printf("[ERROR] missing checksum for %s from source %s", resp.Filename, resp.ShasumsURL)
+                return "", ErrorMissingChecksumVerification
+        } else if checksum != resp.Shasum {
+                log.Printf("[ERROR] unexpected checksum for %s from source %q", resp.Filename, resp.ShasumsURL)
+                return "", ErrorChecksumVerification
+        }
 
-func (i *ProviderInstaller) providerChecksumURL(name, version string) string {
-        fileName := fmt.Sprintf("%s_%s_SHA256SUMS", i.providerName(name), version)
-        u := fmt.Sprintf("%s%s/%s", i.providerVersionsURL(name), version, fileName)
-        return u
+        return checksum, nil
 }
 
-func (i *ProviderInstaller) getProviderChecksum(name, version string) (string, error) {
-        checksums, err := getPluginSHA256SUMs(i.providerChecksumURL(name, version))
+func (i *ProviderInstaller) hostname() (string, error) {
+        provider := regsrc.NewTerraformProvider("", i.OS, i.Arch)
+        svchost, err := provider.SvcHost()
         if err != nil {
                 return "", err
         }
 
-        return checksumForFile(checksums, i.providerFileName(name, version)), nil
+        return svchost.ForDisplay(), nil
 }
 
-// Return the plugin version by making a HEAD request to the provided url.
-// If the header is not present, we assume the latest version will be
-// compatible, and leave the check for discovery or execution.
-func checkPlugin(url string, pluginProtocolVersion uint) bool {
-        resp, err := httpClient.Head(url)
-        if err != nil {
-                log.Printf("[ERROR] error fetching plugin headers: %s", err)
-                return false
-        }
+// list all versions available for the named provider
+func (i *ProviderInstaller) listProviderVersions(name string) (*response.TerraformProviderVersions, error) {
+        provider := regsrc.NewTerraformProvider(name, i.OS, i.Arch)
+        versions, err := i.registry.TerraformProviderVersions(provider)
+        return versions, err
+}
 
-        if resp.StatusCode != http.StatusOK {
-                log.Println("[ERROR] non-200 status fetching plugin headers:", resp.Status)
-                return false
+func (i *ProviderInstaller) listProviderDownloadURLs(name, version string) (*response.TerraformProviderPlatformLocation, error) {
+        urls, err := i.registry.TerraformProviderLocation(regsrc.NewTerraformProvider(name, i.OS, i.Arch), version)
+        if urls == nil {
+                return nil, fmt.Errorf("No download urls found for provider %s", name)
         }
+        return urls, err
+}
+
+// findClosestProtocolCompatibleVersion searches for the provider version with the closest protocol match.
+// Prerelease versions are filtered.
+func (i *ProviderInstaller) findClosestProtocolCompatibleVersion(versions []*response.TerraformProviderVersion) (*response.TerraformProviderVersion, error) {
+        // Loop through all the provider versions to find the earliest and latest
+        // versions that match the installer protocol to then select the closest of the two
+        var latest, earliest *response.TerraformProviderVersion
+        for _, version := range versions {
+                // Prereleases are filtered and will not be suggested
+                v, err := VersionStr(version.Version).Parse()
+                if err != nil || v.IsPrerelease() {
+                        continue
+                }
 
-        proto := resp.Header.Get(protocolVersionHeader)
-        if proto == "" {
-                // The header isn't present, but we don't make this error fatal since
-                // the latest version will probably work.
-                log.Printf("[WARN] missing %s from: %s", protocolVersionHeader, url)
-                return true
+                if err := i.checkPluginProtocol(version); err == nil {
+                        if earliest == nil {
+                                // Found the first provider version with compatible protocol
+                                earliest = version
+                        }
+                        // Update the latest protocol compatible version
+                        latest = version
+                }
+        }
+        if earliest == nil {
+                // No compatible protocol was found for any version
+                return nil, ErrorNoVersionCompatible
         }
 
-        protoVersion, err := strconv.Atoi(proto)
+        // Convert protocols to comparable types
+        protoString := strconv.Itoa(int(i.PluginProtocolVersion))
+        protocolVersion, err := VersionStr(protoString).Parse()
         if err != nil {
-                log.Printf("[ERROR] invalid ProtocolVersion: %s", proto)
-                return false
+                return nil, fmt.Errorf("invalid plugin protocol version: %q", i.PluginProtocolVersion)
         }
 
-        return protoVersion == int(pluginProtocolVersion)
-}
-
-// list the version available for the named plugin
-func (i *ProviderInstaller) listProviderVersions(name string) ([]Version, error) {
-        versions, err := listPluginVersions(i.providerVersionsURL(name))
+        earliestVersionProtocol, err := VersionStr(earliest.Protocols[0]).Parse()
         if err != nil {
-                // listPluginVersions returns a verbose error message indicating
-                // what was being accessed and what failed
                 return nil, err
         }
-        return versions, nil
-}
-
-var errVersionNotFound = errors.New("version not found")
 
-// take the list of available versions for a plugin, and filter out those that
-// don't fit the constraints.
-func allowedVersions(available []Version, required Constraints) []Version {
-        var allowed []Version
-
-        for _, v := range available {
-                if required.Allows(v) {
-                        allowed = append(allowed, v)
-                }
+        // Compare installer protocol version with the first protocol listed of the earliest match
+        // [A, B] where A is assumed the earliest compatible major version of the protocol pair
+        if protocolVersion.NewerThan(earliestVersionProtocol) {
+                // Provider protocols are too old, the closest version is the earliest compatible version
+                return earliest, nil
         }
 
-        return allowed
+        // Provider protocols are too new, the closest version is the latest compatible version
+        return latest, nil
 }
 
-// return a list of the plugin versions at the given URL
-func listPluginVersions(url string) ([]Version, error) {
-        resp, err := httpClient.Get(url)
+func (i *ProviderInstaller) checkPluginProtocol(versionMeta *response.TerraformProviderVersion) error {
+        // TODO: should this be a different error? We should probably differentiate between
+        // no compatible versions and no protocol versions listed at all
+        if len(versionMeta.Protocols) == 0 {
+                return fmt.Errorf("no plugin protocol versions listed")
+        }
+
+        protoString := strconv.Itoa(int(i.PluginProtocolVersion))
+        protocolVersion, err := VersionStr(protoString).Parse()
         if err != nil {
-                // http library produces a verbose error message that includes the
-                // URL being accessed, etc.
-                return nil, err
+                return fmt.Errorf("invalid plugin protocol version: %q", i.PluginProtocolVersion)
+        }
+        protocolConstraint, err := protocolVersion.MinorUpgradeConstraintStr().Parse()
+        if err != nil {
+                // This should not fail if the preceding function succeeded.
+                return fmt.Errorf("invalid plugin protocol version: %q", protocolVersion.String())
         }
-        defer resp.Body.Close()
 
-        if resp.StatusCode != http.StatusOK {
-                body, _ := ioutil.ReadAll(resp.Body)
-                log.Printf("[ERROR] failed to fetch plugin versions from %s\n%s\n%s", url, resp.Status, body)
-
-                switch resp.StatusCode {
-                case http.StatusNotFound, http.StatusForbidden:
-                        // These are treated as indicative of the given name not being
-                        // a valid provider name at all.
-                        return nil, ErrorNoSuchProvider
-
-                default:
-                        // All other errors are assumed to be operational problems.
-                        return nil, fmt.Errorf("error accessing %s: %s", url, resp.Status)
+        for _, p := range versionMeta.Protocols {
+                proPro, err := VersionStr(p).Parse()
+                if err != nil {
+                        // invalid protocol reported by the registry. Move along.
+                        log.Printf("[WARN] invalid provider protocol version %q found in the registry", versionMeta.Version)
+                        continue
+                }
+                // success!
+                if protocolConstraint.Allows(proPro) {
+                        return nil
                 }
-
         }
 
-        body, err := html.Parse(resp.Body)
-        if err != nil {
-                log.Fatal(err)
+        return ErrorNoVersionCompatible
+}
+
+// REVIEWER QUESTION (again): this ends up swallowing a bunch of errors from
+// checkPluginProtocol. Do they need to be percolated up better, or would
+// debug messages would suffice in these situations?
+func (i *ProviderInstaller) findPlatformCompatibleVersion(versions []*response.TerraformProviderVersion) (*response.TerraformProviderVersion, error) {
+        for _, version := range versions {
+                if err := i.checkPlatformCompatibility(version); err == nil {
+                        return version, nil
+                }
         }
 
-        names := []string{}
+        return nil, ErrorNoVersionCompatibleWithPlatform
+}
 
-        // all we need to do is list links on the directory listing page that look like plugins
-        var f func(*html.Node)
-        f = func(n *html.Node) {
-                if n.Type == html.ElementNode && n.Data == "a" {
-                        c := n.FirstChild
-                        if c != nil && c.Type == html.TextNode && strings.HasPrefix(c.Data, "terraform-") {
-                                names = append(names, c.Data)
-                                return
-                        }
-                }
-                for c := n.FirstChild; c != nil; c = c.NextSibling {
-                        f(c)
+// platformCompatibleVersions returns a list of provider versions that are
+// compatible with the requested platform.
+func (i *ProviderInstaller) platformCompatibleVersions(versions []*response.TerraformProviderVersion) []*response.TerraformProviderVersion {
+        var v []*response.TerraformProviderVersion
+        for _, version := range versions {
+                if err := i.checkPlatformCompatibility(version); err == nil {
+                        v = append(v, version)
                 }
         }
-        f(body)
+        return v
+}
 
-        return versionsFromNames(names), nil
+func (i *ProviderInstaller) checkPlatformCompatibility(versionMeta *response.TerraformProviderVersion) error {
+        if len(versionMeta.Platforms) == 0 {
+                return fmt.Errorf("no supported provider platforms listed")
+        }
+        for _, p := range versionMeta.Platforms {
+                if p.Arch == i.Arch && p.OS == i.OS {
+                        return nil
+                }
+        }
+        return fmt.Errorf("version %s does not support the requested platform %s_%s", versionMeta.Version, i.OS, i.Arch)
 }
 
-// parse the list of directory names into a sorted list of available versions
-func versionsFromNames(names []string) []Version {
-        var versions []Version
-        for _, name := range names {
-                parts := strings.SplitN(name, "_", 2)
-                if len(parts) == 2 && parts[1] != "" {
-                        v, err := VersionStr(parts[1]).Parse()
-                        if err != nil {
-                                // filter invalid versions scraped from the page
-                                log.Printf("[WARN] invalid version found for %q: %s", name, err)
-                                continue
-                        }
+// take the list of available versions for a plugin, and filter out those that
+// don't fit the constraints.
+func allowedVersions(available *response.TerraformProviderVersions, required Constraints) []*response.TerraformProviderVersion {
+        var allowed []*response.TerraformProviderVersion
 
-                        versions = append(versions, v)
+        for _, v := range available.Versions {
+                version, err := VersionStr(v.Version).Parse()
+                if err != nil {
+                        log.Printf("[WARN] invalid version found for %q: %s", available.ID, err)
+                        continue
+                }
+                if required.Allows(version) {
+                        allowed = append(allowed, v)
                 }
         }
-
-        return versions
+        return allowed
 }
 
 func checksumForFile(sums []byte, name string) string {
@@ -504,27 +631,6 @@ func checksumForFile(sums []byte, name string) string {
         return ""
 }
 
-// fetch the SHA256SUMS file provided, and verify its signature.
-func getPluginSHA256SUMs(sumsURL string) ([]byte, error) {
-        sigURL := sumsURL + ".sig"
-
-        sums, err := getFile(sumsURL)
-        if err != nil {
-                return nil, fmt.Errorf("error fetching checksums: %s", err)
-        }
-
-        sig, err := getFile(sigURL)
-        if err != nil {
-                return nil, fmt.Errorf("error fetching checksums signature: %s", err)
-        }
-
-        if err := verifySig(sums, sig); err != nil {
-                return nil, err
-        }
-
-        return sums, nil
-}
-
 func getFile(url string) ([]byte, error) {
         resp, err := httpClient.Get(url)
         if err != nil {
@@ -543,6 +649,41 @@ func getFile(url string) ([]byte, error) {
         return data, nil
 }
 
-func GetReleaseHost() string {
-        return releaseHost
-}
+// providerProtocolTooOld is a message sent to the CLI UI if the provider's
+// supported protocol versions are too old for the user's version of terraform,
+// but an older version of the provider is compatible.
+const providerProtocolTooOld = `
+[reset][bold][red]Provider %q v%s is not compatible with Terraform %s.[reset][red]
+
+Provider version %s is the earliest compatible version. Select it with 
+the following version constraint:
+
+        version = %q
+
+Terraform checked all of the plugin versions matching the given constraint:
+    %s
+
+Consult the documentation for this provider for more information on
+compatibility between provider and Terraform versions.
+`
+
+// providerProtocolTooNew is a message sent to the CLI UI if the provider's
+// supported protocol versions are too new for the user's version of terraform,
+// and the user could either upgrade terraform or choose an older version of the
+// provider
+const providerProtocolTooNew = `
+[reset][bold][red]Provider %q v%s is not compatible with Terraform %s.[reset][red]
+
+Provider version %s is the latest compatible version. Select it with 
+the following constraint:
+
+    version = %q
+
+Terraform checked all of the plugin versions matching the given constraint:
+    %s
+
+Consult the documentation for this provider for more information on
+compatibility between provider and Terraform versions.
+
+Alternatively, upgrade to the latest version of Terraform for compatibility with newer provider releases.
+`
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/hashicorp.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/hashicorp.go
new file mode 100644
index 0000000..4622ca0
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/hashicorp.go
@@ -0,0 +1,34 @@
+package discovery
+
+// HashicorpPublicKey is the HashiCorp public key, also available at
+// https://www.hashicorp.com/security
+const HashicorpPublicKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQENBFMORM0BCADBRyKO1MhCirazOSVwcfTr1xUxjPvfxD3hjUwHtjsOy/bT6p9f
+W2mRPfwnq2JB5As+paL3UGDsSRDnK9KAxQb0NNF4+eVhr/EJ18s3wwXXDMjpIifq
+fIm2WyH3G+aRLTLPIpscUNKDyxFOUbsmgXAmJ46Re1fn8uKxKRHbfa39aeuEYWFA
+3drdL1WoUngvED7f+RnKBK2G6ZEpO+LDovQk19xGjiMTtPJrjMjZJ3QXqPvx5wca
+KSZLr4lMTuoTI/ZXyZy5bD4tShiZz6KcyX27cD70q2iRcEZ0poLKHyEIDAi3TM5k
+SwbbWBFd5RNPOR0qzrb/0p9ksKK48IIfH2FvABEBAAG0K0hhc2hpQ29ycCBTZWN1
+cml0eSA8c2VjdXJpdHlAaGFzaGljb3JwLmNvbT6JATgEEwECACIFAlMORM0CGwMG
+CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEFGFLYc0j/xMyWIIAIPhcVqiQ59n
+Jc07gjUX0SWBJAxEG1lKxfzS4Xp+57h2xxTpdotGQ1fZwsihaIqow337YHQI3q0i
+SqV534Ms+j/tU7X8sq11xFJIeEVG8PASRCwmryUwghFKPlHETQ8jJ+Y8+1asRydi
+psP3B/5Mjhqv/uOK+Vy3zAyIpyDOMtIpOVfjSpCplVRdtSTFWBu9Em7j5I2HMn1w
+sJZnJgXKpybpibGiiTtmnFLOwibmprSu04rsnP4ncdC2XRD4wIjoyA+4PKgX3sCO
+klEzKryWYBmLkJOMDdo52LttP3279s7XrkLEE7ia0fXa2c12EQ0f0DQ1tGUvyVEW
+WmJVccm5bq25AQ0EUw5EzQEIANaPUY04/g7AmYkOMjaCZ6iTp9hB5Rsj/4ee/ln9
+wArzRO9+3eejLWh53FoN1rO+su7tiXJA5YAzVy6tuolrqjM8DBztPxdLBbEi4V+j
+2tK0dATdBQBHEh3OJApO2UBtcjaZBT31zrG9K55D+CrcgIVEHAKY8Cb4kLBkb5wM
+skn+DrASKU0BNIV1qRsxfiUdQHZfSqtp004nrql1lbFMLFEuiY8FZrkkQ9qduixo
+mTT6f34/oiY+Jam3zCK7RDN/OjuWheIPGj/Qbx9JuNiwgX6yRj7OE1tjUx6d8g9y
+0H1fmLJbb3WZZbuuGFnK6qrE3bGeY8+AWaJAZ37wpWh1p0cAEQEAAYkBHwQYAQIA
+CQUCUw5EzQIbDAAKCRBRhS2HNI/8TJntCAClU7TOO/X053eKF1jqNW4A1qpxctVc
+z8eTcY8Om5O4f6a/rfxfNFKn9Qyja/OG1xWNobETy7MiMXYjaa8uUx5iFy6kMVaP
+0BXJ59NLZjMARGw6lVTYDTIvzqqqwLxgliSDfSnqUhubGwvykANPO+93BBx89MRG
+unNoYGXtPlhNFrAsB1VR8+EyKLv2HQtGCPSFBhrjuzH3gxGibNDDdFQLxxuJWepJ
+EK1UbTS4ms0NgZ2Uknqn1WRU1Ki7rE4sTy68iZtWpKQXZEJa0IGnuI2sSINGcXCJ
+oEIgXTMyCILo34Fa/C6VCm2WBgz9zZO8/rHIiQm1J5zqz0DrDwKBUM9C
+=LYpS
+-----END PGP PUBLIC KEY BLOCK-----`
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/meta_set.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/meta_set.go
index 181ea1f..3a99289 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/meta_set.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/meta_set.go
@@ -63,7 +63,7 @@ func (s PluginMetaSet) WithName(name string) PluginMetaSet {
 // WithVersion returns the subset of metas that have the given version.
 //
 // This should be used only with the "valid" result from ValidateVersions;
-// it will ignore any plugin metas that have a invalid version strings.
+// it will ignore any plugin metas that have invalid version strings.
 func (s PluginMetaSet) WithVersion(version Version) PluginMetaSet {
         ns := make(PluginMetaSet)
         for p := range s {
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/requirements.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/requirements.go
index 75430fd..0466ab2 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/requirements.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/requirements.go
@@ -4,6 +4,12 @@ import (
         "bytes"
 )
 
+// PluginInstallProtocolVersion is the protocol version TF-core
+// supports to communicate with servers, and is used to resolve
+// plugin discovery with terraform registry, in addition to
+// any specified plugin version constraints
+const PluginInstallProtocolVersion = 5
+
 // PluginRequirements describes a set of plugins (assumed to be of a consistent
 // kind) that are required to exist and have versions within the given
 // corresponding sets.
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/signature.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/signature.go
index b6686a5..7bbae50 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/signature.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/signature.go
@@ -2,7 +2,6 @@ package discovery
 
 import (
         "bytes"
-        "log"
         "strings"
 
         "golang.org/x/crypto/openpgp"
@@ -10,44 +9,11 @@ import (
 
 // Verify the data using the provided openpgp detached signature and the
 // embedded hashicorp public key.
-func verifySig(data, sig []byte) error {
-        el, err := openpgp.ReadArmoredKeyRing(strings.NewReader(hashiPublicKey))
+func verifySig(data, sig []byte, armor string) (*openpgp.Entity, error) {
+        el, err := openpgp.ReadArmoredKeyRing(strings.NewReader(armor))
         if err != nil {
-                log.Fatal(err)
+                return nil, err
         }
 
-        _, err = openpgp.CheckDetachedSignature(el, bytes.NewReader(data), bytes.NewReader(sig))
-        return err
+        return openpgp.CheckDetachedSignature(el, bytes.NewReader(data), bytes.NewReader(sig))
 }
-
-// this is the public key that signs the checksums file for releases.
-const hashiPublicKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1
-
-mQENBFMORM0BCADBRyKO1MhCirazOSVwcfTr1xUxjPvfxD3hjUwHtjsOy/bT6p9f
-W2mRPfwnq2JB5As+paL3UGDsSRDnK9KAxQb0NNF4+eVhr/EJ18s3wwXXDMjpIifq
-fIm2WyH3G+aRLTLPIpscUNKDyxFOUbsmgXAmJ46Re1fn8uKxKRHbfa39aeuEYWFA
-3drdL1WoUngvED7f+RnKBK2G6ZEpO+LDovQk19xGjiMTtPJrjMjZJ3QXqPvx5wca
-KSZLr4lMTuoTI/ZXyZy5bD4tShiZz6KcyX27cD70q2iRcEZ0poLKHyEIDAi3TM5k
-SwbbWBFd5RNPOR0qzrb/0p9ksKK48IIfH2FvABEBAAG0K0hhc2hpQ29ycCBTZWN1
-cml0eSA8c2VjdXJpdHlAaGFzaGljb3JwLmNvbT6JATgEEwECACIFAlMORM0CGwMG
-CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEFGFLYc0j/xMyWIIAIPhcVqiQ59n
-Jc07gjUX0SWBJAxEG1lKxfzS4Xp+57h2xxTpdotGQ1fZwsihaIqow337YHQI3q0i
-SqV534Ms+j/tU7X8sq11xFJIeEVG8PASRCwmryUwghFKPlHETQ8jJ+Y8+1asRydi
-psP3B/5Mjhqv/uOK+Vy3zAyIpyDOMtIpOVfjSpCplVRdtSTFWBu9Em7j5I2HMn1w
-sJZnJgXKpybpibGiiTtmnFLOwibmprSu04rsnP4ncdC2XRD4wIjoyA+4PKgX3sCO
-klEzKryWYBmLkJOMDdo52LttP3279s7XrkLEE7ia0fXa2c12EQ0f0DQ1tGUvyVEW
-WmJVccm5bq25AQ0EUw5EzQEIANaPUY04/g7AmYkOMjaCZ6iTp9hB5Rsj/4ee/ln9
-wArzRO9+3eejLWh53FoN1rO+su7tiXJA5YAzVy6tuolrqjM8DBztPxdLBbEi4V+j
-2tK0dATdBQBHEh3OJApO2UBtcjaZBT31zrG9K55D+CrcgIVEHAKY8Cb4kLBkb5wM
-skn+DrASKU0BNIV1qRsxfiUdQHZfSqtp004nrql1lbFMLFEuiY8FZrkkQ9qduixo
-mTT6f34/oiY+Jam3zCK7RDN/OjuWheIPGj/Qbx9JuNiwgX6yRj7OE1tjUx6d8g9y
-0H1fmLJbb3WZZbuuGFnK6qrE3bGeY8+AWaJAZ37wpWh1p0cAEQEAAYkBHwQYAQIA
-CQUCUw5EzQIbDAAKCRBRhS2HNI/8TJntCAClU7TOO/X053eKF1jqNW4A1qpxctVc
-z8eTcY8Om5O4f6a/rfxfNFKn9Qyja/OG1xWNobETy7MiMXYjaa8uUx5iFy6kMVaP
-0BXJ59NLZjMARGw6lVTYDTIvzqqqwLxgliSDfSnqUhubGwvykANPO+93BBx89MRG
-unNoYGXtPlhNFrAsB1VR8+EyKLv2HQtGCPSFBhrjuzH3gxGibNDDdFQLxxuJWepJ
-EK1UbTS4ms0NgZ2Uknqn1WRU1Ki7rE4sTy68iZtWpKQXZEJa0IGnuI2sSINGcXCJ
-oEIgXTMyCILo34Fa/C6VCm2WBgz9zZO8/rHIiQm1J5zqz0DrDwKBUM9C
-=LYpS
------END PGP PUBLIC KEY BLOCK-----`
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/version.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/version.go
index 8fad58d..4311d51 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/version.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/version.go
@@ -55,6 +55,11 @@ func (v Version) Equal(other Version) bool {
         return v.raw.Equal(other.raw)
 }
 
+// IsPrerelease determines if version is a prerelease
+func (v Version) IsPrerelease() bool {
+        return v.raw.Prerelease() != ""
+}
+
 // MinorUpgradeConstraintStr returns a ConstraintStr that would permit
 // minor upgrades relative to the receiving version.
 func (v Version) MinorUpgradeConstraintStr() ConstraintStr {
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/version_set.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/version_set.go
index 0aefd75..de02f5e 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/version_set.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/version_set.go
@@ -36,6 +36,11 @@ type Constraints struct {
         raw version.Constraints
 }
 
+// NewConstraints creates a Constraints based on a version.Constraints.
+func NewConstraints(c version.Constraints) Constraints {
+        return Constraints{c}
+}
+
 // AllVersions is a Constraints containing all versions
 var AllVersions Constraints
 
diff --git a/vendor/github.com/hashicorp/terraform/plugin/grpc_provider.go b/vendor/github.com/hashicorp/terraform/plugin/grpc_provider.go
new file mode 100644
index 0000000..ae9a400
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/grpc_provider.go
@@ -0,0 +1,562 @@
+package plugin
+
+import (
+        "context"
+        "errors"
+        "log"
+        "sync"
+
+        "github.com/zclconf/go-cty/cty"
+
+        plugin "github.com/hashicorp/go-plugin"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/plugin/convert"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/version"
+        "github.com/zclconf/go-cty/cty/msgpack"
+        "google.golang.org/grpc"
+)
+
+// GRPCProviderPlugin implements plugin.GRPCPlugin for the go-plugin package.
+type GRPCProviderPlugin struct {
+        plugin.Plugin
+        GRPCProvider func() proto.ProviderServer
+}
+
+func (p *GRPCProviderPlugin) GRPCClient(ctx context.Context, broker *plugin.GRPCBroker, c *grpc.ClientConn) (interface{}, error) {
+        return &GRPCProvider{
+                client: proto.NewProviderClient(c),
+                ctx:    ctx,
+        }, nil
+}
+
+func (p *GRPCProviderPlugin) GRPCServer(broker *plugin.GRPCBroker, s *grpc.Server) error {
+        proto.RegisterProviderServer(s, p.GRPCProvider())
+        return nil
+}
+
+// GRPCProvider handles the client, or core side of the plugin rpc connection.
+// The GRPCProvider methods are mostly a translation layer between the
+// terraform provioders types and the grpc proto types, directly converting
+// between the two.
+type GRPCProvider struct {
+        // PluginClient provides a reference to the plugin.Client which controls the plugin process.
+        // This allows the GRPCProvider a way to shutdown the plugin process.
+        PluginClient *plugin.Client
+
+        // TestServer contains a grpc.Server to close when the GRPCProvider is being
+        // used in an end to end test of a provider.
+        TestServer *grpc.Server
+
+        // Proto client use to make the grpc service calls.
+        client proto.ProviderClient
+
+        // this context is created by the plugin package, and is canceled when the
+        // plugin process ends.
+        ctx context.Context
+
+        // schema stores the schema for this provider. This is used to properly
+        // serialize the state for requests.
+        mu      sync.Mutex
+        schemas providers.GetSchemaResponse
+}
+
+// getSchema is used internally to get the saved provider schema.  The schema
+// should have already been fetched from the provider, but we have to
+// synchronize access to avoid being called concurrently with GetSchema.
+func (p *GRPCProvider) getSchema() providers.GetSchemaResponse {
+        p.mu.Lock()
+        // unlock inline in case GetSchema needs to be called
+        if p.schemas.Provider.Block != nil {
+                p.mu.Unlock()
+                return p.schemas
+        }
+        p.mu.Unlock()
+
+        // the schema should have been fetched already, but give it another shot
+        // just in case things are being called out of order. This may happen for
+        // tests.
+        schemas := p.GetSchema()
+        if schemas.Diagnostics.HasErrors() {
+                panic(schemas.Diagnostics.Err())
+        }
+
+        return schemas
+}
+
+// getResourceSchema is a helper to extract the schema for a resource, and
+// panics if the schema is not available.
+func (p *GRPCProvider) getResourceSchema(name string) providers.Schema {
+        schema := p.getSchema()
+        resSchema, ok := schema.ResourceTypes[name]
+        if !ok {
+                panic("unknown resource type " + name)
+        }
+        return resSchema
+}
+
+// gettDatasourceSchema is a helper to extract the schema for a datasource, and
+// panics if that schema is not available.
+func (p *GRPCProvider) getDatasourceSchema(name string) providers.Schema {
+        schema := p.getSchema()
+        dataSchema, ok := schema.DataSources[name]
+        if !ok {
+                panic("unknown data source " + name)
+        }
+        return dataSchema
+}
+
+func (p *GRPCProvider) GetSchema() (resp providers.GetSchemaResponse) {
+        log.Printf("[TRACE] GRPCProvider: GetSchema")
+        p.mu.Lock()
+        defer p.mu.Unlock()
+
+        if p.schemas.Provider.Block != nil {
+                return p.schemas
+        }
+
+        resp.ResourceTypes = make(map[string]providers.Schema)
+        resp.DataSources = make(map[string]providers.Schema)
+
+        // Some providers may generate quite large schemas, and the internal default
+        // grpc response size limit is 4MB. 64MB should cover most any use case, and
+        // if we get providers nearing that we may want to consider a finer-grained
+        // API to fetch individual resource schemas.
+        // Note: this option is marked as EXPERIMENTAL in the grpc API.
+        const maxRecvSize = 64 << 20
+        protoResp, err := p.client.GetSchema(p.ctx, new(proto.GetProviderSchema_Request), grpc.MaxRecvMsgSizeCallOption{MaxRecvMsgSize: maxRecvSize})
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        if protoResp.Provider == nil {
+                resp.Diagnostics = resp.Diagnostics.Append(errors.New("missing provider schema"))
+                return resp
+        }
+
+        resp.Provider = convert.ProtoToProviderSchema(protoResp.Provider)
+
+        for name, res := range protoResp.ResourceSchemas {
+                resp.ResourceTypes[name] = convert.ProtoToProviderSchema(res)
+        }
+
+        for name, data := range protoResp.DataSourceSchemas {
+                resp.DataSources[name] = convert.ProtoToProviderSchema(data)
+        }
+
+        p.schemas = resp
+
+        return resp
+}
+
+func (p *GRPCProvider) PrepareProviderConfig(r providers.PrepareProviderConfigRequest) (resp providers.PrepareProviderConfigResponse) {
+        log.Printf("[TRACE] GRPCProvider: PrepareProviderConfig")
+
+        schema := p.getSchema()
+        ty := schema.Provider.Block.ImpliedType()
+
+        mp, err := msgpack.Marshal(r.Config, ty)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.PrepareProviderConfig_Request{
+                Config: &proto.DynamicValue{Msgpack: mp},
+        }
+
+        protoResp, err := p.client.PrepareProviderConfig(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        config := cty.NullVal(ty)
+        if protoResp.PreparedConfig != nil {
+                config, err = msgpack.Unmarshal(protoResp.PreparedConfig.Msgpack, ty)
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                        return resp
+                }
+        }
+        resp.PreparedConfig = config
+
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+        return resp
+}
+
+func (p *GRPCProvider) ValidateResourceTypeConfig(r providers.ValidateResourceTypeConfigRequest) (resp providers.ValidateResourceTypeConfigResponse) {
+        log.Printf("[TRACE] GRPCProvider: ValidateResourceTypeConfig")
+        resourceSchema := p.getResourceSchema(r.TypeName)
+
+        mp, err := msgpack.Marshal(r.Config, resourceSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ValidateResourceTypeConfig_Request{
+                TypeName: r.TypeName,
+                Config:   &proto.DynamicValue{Msgpack: mp},
+        }
+
+        protoResp, err := p.client.ValidateResourceTypeConfig(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+        return resp
+}
+
+func (p *GRPCProvider) ValidateDataSourceConfig(r providers.ValidateDataSourceConfigRequest) (resp providers.ValidateDataSourceConfigResponse) {
+        log.Printf("[TRACE] GRPCProvider: ValidateDataSourceConfig")
+
+        dataSchema := p.getDatasourceSchema(r.TypeName)
+
+        mp, err := msgpack.Marshal(r.Config, dataSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ValidateDataSourceConfig_Request{
+                TypeName: r.TypeName,
+                Config:   &proto.DynamicValue{Msgpack: mp},
+        }
+
+        protoResp, err := p.client.ValidateDataSourceConfig(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+        return resp
+}
+
+func (p *GRPCProvider) UpgradeResourceState(r providers.UpgradeResourceStateRequest) (resp providers.UpgradeResourceStateResponse) {
+        log.Printf("[TRACE] GRPCProvider: UpgradeResourceState")
+
+        resSchema := p.getResourceSchema(r.TypeName)
+
+        protoReq := &proto.UpgradeResourceState_Request{
+                TypeName: r.TypeName,
+                Version:  int64(r.Version),
+                RawState: &proto.RawState{
+                        Json:    r.RawStateJSON,
+                        Flatmap: r.RawStateFlatmap,
+                },
+        }
+
+        protoResp, err := p.client.UpgradeResourceState(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        state := cty.NullVal(resSchema.Block.ImpliedType())
+        if protoResp.UpgradedState != nil {
+                state, err = msgpack.Unmarshal(protoResp.UpgradedState.Msgpack, resSchema.Block.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                        return resp
+                }
+        }
+
+        resp.UpgradedState = state
+        return resp
+}
+
+func (p *GRPCProvider) Configure(r providers.ConfigureRequest) (resp providers.ConfigureResponse) {
+        log.Printf("[TRACE] GRPCProvider: Configure")
+
+        schema := p.getSchema()
+
+        var mp []byte
+
+        // we don't have anything to marshal if there's no config
+        mp, err := msgpack.Marshal(r.Config, schema.Provider.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.Configure_Request{
+                TerraformVersion: version.Version,
+                Config: &proto.DynamicValue{
+                        Msgpack: mp,
+                },
+        }
+
+        protoResp, err := p.client.Configure(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+        return resp
+}
+
+func (p *GRPCProvider) Stop() error {
+        log.Printf("[TRACE] GRPCProvider: Stop")
+
+        resp, err := p.client.Stop(p.ctx, new(proto.Stop_Request))
+        if err != nil {
+                return err
+        }
+
+        if resp.Error != "" {
+                return errors.New(resp.Error)
+        }
+        return nil
+}
+
+func (p *GRPCProvider) ReadResource(r providers.ReadResourceRequest) (resp providers.ReadResourceResponse) {
+        log.Printf("[TRACE] GRPCProvider: ReadResource")
+
+        resSchema := p.getResourceSchema(r.TypeName)
+
+        mp, err := msgpack.Marshal(r.PriorState, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ReadResource_Request{
+                TypeName:     r.TypeName,
+                CurrentState: &proto.DynamicValue{Msgpack: mp},
+        }
+
+        protoResp, err := p.client.ReadResource(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        state := cty.NullVal(resSchema.Block.ImpliedType())
+        if protoResp.NewState != nil {
+                state, err = msgpack.Unmarshal(protoResp.NewState.Msgpack, resSchema.Block.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                        return resp
+                }
+        }
+        resp.NewState = state
+
+        return resp
+}
+
+func (p *GRPCProvider) PlanResourceChange(r providers.PlanResourceChangeRequest) (resp providers.PlanResourceChangeResponse) {
+        log.Printf("[TRACE] GRPCProvider: PlanResourceChange")
+
+        resSchema := p.getResourceSchema(r.TypeName)
+
+        priorMP, err := msgpack.Marshal(r.PriorState, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        configMP, err := msgpack.Marshal(r.Config, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        propMP, err := msgpack.Marshal(r.ProposedNewState, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.PlanResourceChange_Request{
+                TypeName:         r.TypeName,
+                PriorState:       &proto.DynamicValue{Msgpack: priorMP},
+                Config:           &proto.DynamicValue{Msgpack: configMP},
+                ProposedNewState: &proto.DynamicValue{Msgpack: propMP},
+                PriorPrivate:     r.PriorPrivate,
+        }
+
+        protoResp, err := p.client.PlanResourceChange(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        state := cty.NullVal(resSchema.Block.ImpliedType())
+        if protoResp.PlannedState != nil {
+                state, err = msgpack.Unmarshal(protoResp.PlannedState.Msgpack, resSchema.Block.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                        return resp
+                }
+        }
+        resp.PlannedState = state
+
+        for _, p := range protoResp.RequiresReplace {
+                resp.RequiresReplace = append(resp.RequiresReplace, convert.AttributePathToPath(p))
+        }
+
+        resp.PlannedPrivate = protoResp.PlannedPrivate
+
+        resp.LegacyTypeSystem = protoResp.LegacyTypeSystem
+
+        return resp
+}
+
+func (p *GRPCProvider) ApplyResourceChange(r providers.ApplyResourceChangeRequest) (resp providers.ApplyResourceChangeResponse) {
+        log.Printf("[TRACE] GRPCProvider: ApplyResourceChange")
+
+        resSchema := p.getResourceSchema(r.TypeName)
+
+        priorMP, err := msgpack.Marshal(r.PriorState, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        plannedMP, err := msgpack.Marshal(r.PlannedState, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        configMP, err := msgpack.Marshal(r.Config, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ApplyResourceChange_Request{
+                TypeName:       r.TypeName,
+                PriorState:     &proto.DynamicValue{Msgpack: priorMP},
+                PlannedState:   &proto.DynamicValue{Msgpack: plannedMP},
+                Config:         &proto.DynamicValue{Msgpack: configMP},
+                PlannedPrivate: r.PlannedPrivate,
+        }
+
+        protoResp, err := p.client.ApplyResourceChange(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        resp.Private = protoResp.Private
+
+        state := cty.NullVal(resSchema.Block.ImpliedType())
+        if protoResp.NewState != nil {
+                state, err = msgpack.Unmarshal(protoResp.NewState.Msgpack, resSchema.Block.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                        return resp
+                }
+        }
+        resp.NewState = state
+
+        resp.LegacyTypeSystem = protoResp.LegacyTypeSystem
+
+        return resp
+}
+
+func (p *GRPCProvider) ImportResourceState(r providers.ImportResourceStateRequest) (resp providers.ImportResourceStateResponse) {
+        log.Printf("[TRACE] GRPCProvider: ImportResourceState")
+
+        protoReq := &proto.ImportResourceState_Request{
+                TypeName: r.TypeName,
+                Id:       r.ID,
+        }
+
+        protoResp, err := p.client.ImportResourceState(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        for _, imported := range protoResp.ImportedResources {
+                resource := providers.ImportedResource{
+                        TypeName: imported.TypeName,
+                        Private:  imported.Private,
+                }
+
+                resSchema := p.getResourceSchema(resource.TypeName)
+                state := cty.NullVal(resSchema.Block.ImpliedType())
+                if imported.State != nil {
+                        state, err = msgpack.Unmarshal(imported.State.Msgpack, resSchema.Block.ImpliedType())
+                        if err != nil {
+                                resp.Diagnostics = resp.Diagnostics.Append(err)
+                                return resp
+                        }
+                }
+                resource.State = state
+                resp.ImportedResources = append(resp.ImportedResources, resource)
+        }
+
+        return resp
+}
+
+func (p *GRPCProvider) ReadDataSource(r providers.ReadDataSourceRequest) (resp providers.ReadDataSourceResponse) {
+        log.Printf("[TRACE] GRPCProvider: ReadDataSource")
+
+        dataSchema := p.getDatasourceSchema(r.TypeName)
+
+        config, err := msgpack.Marshal(r.Config, dataSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ReadDataSource_Request{
+                TypeName: r.TypeName,
+                Config: &proto.DynamicValue{
+                        Msgpack: config,
+                },
+        }
+
+        protoResp, err := p.client.ReadDataSource(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        state := cty.NullVal(dataSchema.Block.ImpliedType())
+        if protoResp.State != nil {
+                state, err = msgpack.Unmarshal(protoResp.State.Msgpack, dataSchema.Block.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                        return resp
+                }
+        }
+        resp.State = state
+
+        return resp
+}
+
+// closing the grpc connection is final, and terraform will call it at the end of every phase.
+func (p *GRPCProvider) Close() error {
+        log.Printf("[TRACE] GRPCProvider: Close")
+
+        // Make sure to stop the server if we're not running within go-plugin.
+        if p.TestServer != nil {
+                p.TestServer.Stop()
+        }
+
+        // Check this since it's not automatically inserted during plugin creation.
+        // It's currently only inserted by the command package, because that is
+        // where the factory is built and is the only point with access to the
+        // plugin.Client.
+        if p.PluginClient == nil {
+                log.Println("[DEBUG] provider has no plugin.Client")
+                return nil
+        }
+
+        p.PluginClient.Kill()
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/grpc_provisioner.go b/vendor/github.com/hashicorp/terraform/plugin/grpc_provisioner.go
new file mode 100644
index 0000000..136c88d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/grpc_provisioner.go
@@ -0,0 +1,178 @@
+package plugin
+
+import (
+        "context"
+        "errors"
+        "io"
+        "log"
+        "sync"
+
+        plugin "github.com/hashicorp/go-plugin"
+        "github.com/hashicorp/terraform/configs/configschema"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/plugin/convert"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/msgpack"
+        "google.golang.org/grpc"
+)
+
+// GRPCProvisionerPlugin is the plugin.GRPCPlugin implementation.
+type GRPCProvisionerPlugin struct {
+        plugin.Plugin
+        GRPCProvisioner func() proto.ProvisionerServer
+}
+
+func (p *GRPCProvisionerPlugin) GRPCClient(ctx context.Context, broker *plugin.GRPCBroker, c *grpc.ClientConn) (interface{}, error) {
+        return &GRPCProvisioner{
+                client: proto.NewProvisionerClient(c),
+                ctx:    ctx,
+        }, nil
+}
+
+func (p *GRPCProvisionerPlugin) GRPCServer(broker *plugin.GRPCBroker, s *grpc.Server) error {
+        proto.RegisterProvisionerServer(s, p.GRPCProvisioner())
+        return nil
+}
+
+// provisioners.Interface grpc implementation
+type GRPCProvisioner struct {
+        // PluginClient provides a reference to the plugin.Client which controls the plugin process.
+        // This allows the GRPCProvider a way to shutdown the plugin process.
+        PluginClient *plugin.Client
+
+        client proto.ProvisionerClient
+        ctx    context.Context
+
+        // Cache the schema since we need it for serialization in each method call.
+        mu     sync.Mutex
+        schema *configschema.Block
+}
+
+func (p *GRPCProvisioner) GetSchema() (resp provisioners.GetSchemaResponse) {
+        p.mu.Lock()
+        defer p.mu.Unlock()
+
+        if p.schema != nil {
+                return provisioners.GetSchemaResponse{
+                        Provisioner: p.schema,
+                }
+        }
+
+        protoResp, err := p.client.GetSchema(p.ctx, new(proto.GetProvisionerSchema_Request))
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        if protoResp.Provisioner == nil {
+                resp.Diagnostics = resp.Diagnostics.Append(errors.New("missing provisioner schema"))
+                return resp
+        }
+
+        resp.Provisioner = convert.ProtoToConfigSchema(protoResp.Provisioner.Block)
+
+        p.schema = resp.Provisioner
+
+        return resp
+}
+
+func (p *GRPCProvisioner) ValidateProvisionerConfig(r provisioners.ValidateProvisionerConfigRequest) (resp provisioners.ValidateProvisionerConfigResponse) {
+        schema := p.GetSchema()
+        if schema.Diagnostics.HasErrors() {
+                resp.Diagnostics = resp.Diagnostics.Append(schema.Diagnostics)
+                return resp
+        }
+
+        mp, err := msgpack.Marshal(r.Config, schema.Provisioner.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ValidateProvisionerConfig_Request{
+                Config: &proto.DynamicValue{Msgpack: mp},
+        }
+        protoResp, err := p.client.ValidateProvisionerConfig(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+        return resp
+}
+
+func (p *GRPCProvisioner) ProvisionResource(r provisioners.ProvisionResourceRequest) (resp provisioners.ProvisionResourceResponse) {
+        schema := p.GetSchema()
+        if schema.Diagnostics.HasErrors() {
+                resp.Diagnostics = resp.Diagnostics.Append(schema.Diagnostics)
+                return resp
+        }
+
+        mp, err := msgpack.Marshal(r.Config, schema.Provisioner.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        // connection is always assumed to be a simple string map
+        connMP, err := msgpack.Marshal(r.Connection, cty.Map(cty.String))
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ProvisionResource_Request{
+                Config:     &proto.DynamicValue{Msgpack: mp},
+                Connection: &proto.DynamicValue{Msgpack: connMP},
+        }
+
+        outputClient, err := p.client.ProvisionResource(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        for {
+                rcv, err := outputClient.Recv()
+                if rcv != nil {
+                        r.UIOutput.Output(rcv.Output)
+                }
+                if err != nil {
+                        if err != io.EOF {
+                                resp.Diagnostics = resp.Diagnostics.Append(err)
+                        }
+                        break
+                }
+
+                if len(rcv.Diagnostics) > 0 {
+                        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(rcv.Diagnostics))
+                        break
+                }
+        }
+
+        return resp
+}
+
+func (p *GRPCProvisioner) Stop() error {
+        protoResp, err := p.client.Stop(p.ctx, &proto.Stop_Request{})
+        if err != nil {
+                return err
+        }
+        if protoResp.Error != "" {
+                return errors.New(protoResp.Error)
+        }
+        return nil
+}
+
+func (p *GRPCProvisioner) Close() error {
+        // check this since it's not automatically inserted during plugin creation
+        if p.PluginClient == nil {
+                log.Println("[DEBUG] provider has no plugin.Client")
+                return nil
+        }
+
+        p.PluginClient.Kill()
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/plugin.go b/vendor/github.com/hashicorp/terraform/plugin/plugin.go
index 00fa7b2..e4fb577 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/plugin.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/plugin.go
@@ -6,8 +6,9 @@ import (
 
 // See serve.go for serving plugins
 
-// PluginMap should be used by clients for the map of plugins.
-var PluginMap = map[string]plugin.Plugin{
-        "provider":    &ResourceProviderPlugin{},
-        "provisioner": &ResourceProvisionerPlugin{},
+var VersionedPlugins = map[int]plugin.PluginSet{
+        5: {
+                "provider":    &GRPCProviderPlugin{},
+                "provisioner": &GRPCProvisionerPlugin{},
+        },
 }
diff --git a/vendor/github.com/hashicorp/terraform/plugin/resource_provider.go b/vendor/github.com/hashicorp/terraform/plugin/resource_provider.go
index d6a433c..459661a 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/resource_provider.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/resource_provider.go
@@ -9,11 +9,14 @@ import (
 
 // ResourceProviderPlugin is the plugin.Plugin implementation.
 type ResourceProviderPlugin struct {
-        F func() terraform.ResourceProvider
+        ResourceProvider func() terraform.ResourceProvider
 }
 
 func (p *ResourceProviderPlugin) Server(b *plugin.MuxBroker) (interface{}, error) {
-        return &ResourceProviderServer{Broker: b, Provider: p.F()}, nil
+        return &ResourceProviderServer{
+                Broker:   b,
+                Provider: p.ResourceProvider(),
+        }, nil
 }
 
 func (p *ResourceProviderPlugin) Client(
diff --git a/vendor/github.com/hashicorp/terraform/plugin/resource_provisioner.go b/vendor/github.com/hashicorp/terraform/plugin/resource_provisioner.go
index 8fce9d8..f0cc341 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/resource_provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/resource_provisioner.go
@@ -4,16 +4,20 @@ import (
         "net/rpc"
 
         "github.com/hashicorp/go-plugin"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/terraform"
 )
 
 // ResourceProvisionerPlugin is the plugin.Plugin implementation.
 type ResourceProvisionerPlugin struct {
-        F func() terraform.ResourceProvisioner
+        ResourceProvisioner func() terraform.ResourceProvisioner
 }
 
 func (p *ResourceProvisionerPlugin) Server(b *plugin.MuxBroker) (interface{}, error) {
-        return &ResourceProvisionerServer{Broker: b, Provisioner: p.F()}, nil
+        return &ResourceProvisionerServer{
+                Broker:      b,
+                Provisioner: p.ResourceProvisioner(),
+        }, nil
 }
 
 func (p *ResourceProvisionerPlugin) Client(
@@ -28,6 +32,11 @@ type ResourceProvisioner struct {
         Client *rpc.Client
 }
 
+func (p *ResourceProvisioner) GetConfigSchema() (*configschema.Block, error) {
+        panic("not implemented")
+        return nil, nil
+}
+
 func (p *ResourceProvisioner) Validate(c *terraform.ResourceConfig) ([]string, []error) {
         var resp ResourceProvisionerValidateResponse
         args := ResourceProvisionerValidateArgs{
diff --git a/vendor/github.com/hashicorp/terraform/plugin/serve.go b/vendor/github.com/hashicorp/terraform/plugin/serve.go
index 2028a61..8d056c5 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/serve.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/serve.go
@@ -2,14 +2,23 @@ package plugin
 
 import (
         "github.com/hashicorp/go-plugin"
+        grpcplugin "github.com/hashicorp/terraform/helper/plugin"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
         "github.com/hashicorp/terraform/terraform"
 )
 
-// The constants below are the names of the plugins that can be dispensed
-// from the plugin server.
 const (
+        // The constants below are the names of the plugins that can be dispensed
+        // from the plugin server.
         ProviderPluginName    = "provider"
         ProvisionerPluginName = "provisioner"
+
+        // DefaultProtocolVersion is the protocol version assumed for legacy clients that don't specify
+        // a particular version during their handshake. This is the version used when Terraform 0.10
+        // and 0.11 launch plugins that were built with support for both versions 4 and 5, and must
+        // stay unchanged at 4 until we intentionally build plugins that are not compatible with 0.10 and
+        // 0.11.
+        DefaultProtocolVersion = 4
 )
 
 // Handshake is the HandshakeConfig used to configure clients and servers.
@@ -19,7 +28,7 @@ var Handshake = plugin.HandshakeConfig{
         // one or the other that makes it so that they can't safely communicate.
         // This could be adding a new interface value, it could be how
         // helper/schema computes diffs, etc.
-        ProtocolVersion: 4,
+        ProtocolVersion: DefaultProtocolVersion,
 
         // The magic cookie values should NEVER be changed.
         MagicCookieKey:   "TF_PLUGIN_MAGIC_COOKIE",
@@ -28,27 +37,85 @@ var Handshake = plugin.HandshakeConfig{
 
 type ProviderFunc func() terraform.ResourceProvider
 type ProvisionerFunc func() terraform.ResourceProvisioner
+type GRPCProviderFunc func() proto.ProviderServer
+type GRPCProvisionerFunc func() proto.ProvisionerServer
 
 // ServeOpts are the configurations to serve a plugin.
 type ServeOpts struct {
         ProviderFunc    ProviderFunc
         ProvisionerFunc ProvisionerFunc
+
+        // Wrapped versions of the above plugins will automatically shimmed and
+        // added to the GRPC functions when possible.
+        GRPCProviderFunc    GRPCProviderFunc
+        GRPCProvisionerFunc GRPCProvisionerFunc
 }
 
 // Serve serves a plugin. This function never returns and should be the final
 // function called in the main function of the plugin.
 func Serve(opts *ServeOpts) {
+        // since the plugins may not yet be aware of the new protocol, we
+        // automatically wrap the plugins in the grpc shims.
+        if opts.GRPCProviderFunc == nil && opts.ProviderFunc != nil {
+                provider := grpcplugin.NewGRPCProviderServerShim(opts.ProviderFunc())
+                // this is almost always going to be a *schema.Provider, but check that
+                // we got back a valid provider just in case.
+                if provider != nil {
+                        opts.GRPCProviderFunc = func() proto.ProviderServer {
+                                return provider
+                        }
+                }
+        }
+        if opts.GRPCProvisionerFunc == nil && opts.ProvisionerFunc != nil {
+                provisioner := grpcplugin.NewGRPCProvisionerServerShim(opts.ProvisionerFunc())
+                if provisioner != nil {
+                        opts.GRPCProvisionerFunc = func() proto.ProvisionerServer {
+                                return provisioner
+                        }
+                }
+        }
+
         plugin.Serve(&plugin.ServeConfig{
-                HandshakeConfig: Handshake,
-                Plugins:         pluginMap(opts),
+                HandshakeConfig:  Handshake,
+                VersionedPlugins: pluginSet(opts),
+                GRPCServer:       plugin.DefaultGRPCServer,
         })
 }
 
-// pluginMap returns the map[string]plugin.Plugin to use for configuring a plugin
-// server or client.
-func pluginMap(opts *ServeOpts) map[string]plugin.Plugin {
+// pluginMap returns the legacy map[string]plugin.Plugin to use for configuring
+// a plugin server or client.
+func legacyPluginMap(opts *ServeOpts) map[string]plugin.Plugin {
         return map[string]plugin.Plugin{
-                "provider":    &ResourceProviderPlugin{F: opts.ProviderFunc},
-                "provisioner": &ResourceProvisionerPlugin{F: opts.ProvisionerFunc},
+                "provider": &ResourceProviderPlugin{
+                        ResourceProvider: opts.ProviderFunc,
+                },
+                "provisioner": &ResourceProvisionerPlugin{
+                        ResourceProvisioner: opts.ProvisionerFunc,
+                },
+        }
+}
+
+func pluginSet(opts *ServeOpts) map[int]plugin.PluginSet {
+        // Set the legacy netrpc plugins at version 4.
+        // The oldest version is returned in when executed by a legacy go-plugin
+        // client.
+        plugins := map[int]plugin.PluginSet{
+                4: legacyPluginMap(opts),
+        }
+
+        // add the new protocol versions if they're configured
+        if opts.GRPCProviderFunc != nil || opts.GRPCProvisionerFunc != nil {
+                plugins[5] = plugin.PluginSet{}
+                if opts.GRPCProviderFunc != nil {
+                        plugins[5]["provider"] = &GRPCProviderPlugin{
+                                GRPCProvider: opts.GRPCProviderFunc,
+                        }
+                }
+                if opts.GRPCProvisionerFunc != nil {
+                        plugins[5]["provisioner"] = &GRPCProvisionerPlugin{
+                                GRPCProvisioner: opts.GRPCProvisionerFunc,
+                        }
+                }
         }
+        return plugins
 }
diff --git a/vendor/github.com/hashicorp/terraform/plugin/ui_input.go b/vendor/github.com/hashicorp/terraform/plugin/ui_input.go
index 493efc0..3469e6a 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/ui_input.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/ui_input.go
@@ -1,19 +1,20 @@
 package plugin
 
 import (
+        "context"
         "net/rpc"
 
         "github.com/hashicorp/go-plugin"
         "github.com/hashicorp/terraform/terraform"
 )
 
-// UIInput is an implementatin of terraform.UIInput that communicates
+// UIInput is an implementation of terraform.UIInput that communicates
 // over RPC.
 type UIInput struct {
         Client *rpc.Client
 }
 
-func (i *UIInput) Input(opts *terraform.InputOpts) (string, error) {
+func (i *UIInput) Input(ctx context.Context, opts *terraform.InputOpts) (string, error) {
         var resp UIInputInputResponse
         err := i.Client.Call("Plugin.Input", opts, &resp)
         if err != nil {
@@ -41,7 +42,7 @@ type UIInputServer struct {
 func (s *UIInputServer) Input(
         opts *terraform.InputOpts,
         reply *UIInputInputResponse) error {
-        value, err := s.UIInput.Input(opts)
+        value, err := s.UIInput.Input(context.Background(), opts)
         *reply = UIInputInputResponse{
                 Value: value,
                 Error: plugin.NewBasicError(err),
diff --git a/vendor/github.com/hashicorp/terraform/providers/addressed_types.go b/vendor/github.com/hashicorp/terraform/providers/addressed_types.go
new file mode 100644
index 0000000..7ed523f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/providers/addressed_types.go
@@ -0,0 +1,47 @@
+package providers
+
+import (
+        "sort"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// AddressedTypes is a helper that extracts all of the distinct provider
+// types from the given list of relative provider configuration addresses.
+func AddressedTypes(providerAddrs []addrs.ProviderConfig) []string {
+        if len(providerAddrs) == 0 {
+                return nil
+        }
+        m := map[string]struct{}{}
+        for _, addr := range providerAddrs {
+                m[addr.Type] = struct{}{}
+        }
+
+        names := make([]string, 0, len(m))
+        for typeName := range m {
+                names = append(names, typeName)
+        }
+
+        sort.Strings(names) // Stable result for tests
+        return names
+}
+
+// AddressedTypesAbs is a helper that extracts all of the distinct provider
+// types from the given list of absolute provider configuration addresses.
+func AddressedTypesAbs(providerAddrs []addrs.AbsProviderConfig) []string {
+        if len(providerAddrs) == 0 {
+                return nil
+        }
+        m := map[string]struct{}{}
+        for _, addr := range providerAddrs {
+                m[addr.ProviderConfig.Type] = struct{}{}
+        }
+
+        names := make([]string, 0, len(m))
+        for typeName := range m {
+                names = append(names, typeName)
+        }
+
+        sort.Strings(names) // Stable result for tests
+        return names
+}
diff --git a/vendor/github.com/hashicorp/terraform/providers/doc.go b/vendor/github.com/hashicorp/terraform/providers/doc.go
new file mode 100644
index 0000000..39aa1de
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/providers/doc.go
@@ -0,0 +1,3 @@
+// Package providers contains the interface and primary types required to
+// implement a Terraform resource provider.
+package providers
diff --git a/vendor/github.com/hashicorp/terraform/providers/provider.go b/vendor/github.com/hashicorp/terraform/providers/provider.go
new file mode 100644
index 0000000..1aa08c2
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/providers/provider.go
@@ -0,0 +1,351 @@
+package providers
+
+import (
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// Interface represents the set of methods required for a complete resource
+// provider plugin.
+type Interface interface {
+        // GetSchema returns the complete schema for the provider.
+        GetSchema() GetSchemaResponse
+
+        // PrepareProviderConfig allows the provider to validate the configuration
+        // values, and set or override any values with defaults.
+        PrepareProviderConfig(PrepareProviderConfigRequest) PrepareProviderConfigResponse
+
+        // ValidateResourceTypeConfig allows the provider to validate the resource
+        // configuration values.
+        ValidateResourceTypeConfig(ValidateResourceTypeConfigRequest) ValidateResourceTypeConfigResponse
+
+        // ValidateDataSource allows the provider to validate the data source
+        // configuration values.
+        ValidateDataSourceConfig(ValidateDataSourceConfigRequest) ValidateDataSourceConfigResponse
+
+        // UpgradeResourceState is called when the state loader encounters an
+        // instance state whose schema version is less than the one reported by the
+        // currently-used version of the corresponding provider, and the upgraded
+        // result is used for any further processing.
+        UpgradeResourceState(UpgradeResourceStateRequest) UpgradeResourceStateResponse
+
+        // Configure configures and initialized the provider.
+        Configure(ConfigureRequest) ConfigureResponse
+
+        // Stop is called when the provider should halt any in-flight actions.
+        //
+        // Stop should not block waiting for in-flight actions to complete. It
+        // should take any action it wants and return immediately acknowledging it
+        // has received the stop request. Terraform will not make any further API
+        // calls to the provider after Stop is called.
+        //
+        // The error returned, if non-nil, is assumed to mean that signaling the
+        // stop somehow failed and that the user should expect potentially waiting
+        // a longer period of time.
+        Stop() error
+
+        // ReadResource refreshes a resource and returns its current state.
+        ReadResource(ReadResourceRequest) ReadResourceResponse
+
+        // PlanResourceChange takes the current state and proposed state of a
+        // resource, and returns the planned final state.
+        PlanResourceChange(PlanResourceChangeRequest) PlanResourceChangeResponse
+
+        // ApplyResourceChange takes the planned state for a resource, which may
+        // yet contain unknown computed values, and applies the changes returning
+        // the final state.
+        ApplyResourceChange(ApplyResourceChangeRequest) ApplyResourceChangeResponse
+
+        // ImportResourceState requests that the given resource be imported.
+        ImportResourceState(ImportResourceStateRequest) ImportResourceStateResponse
+
+        // ReadDataSource returns the data source's current state.
+        ReadDataSource(ReadDataSourceRequest) ReadDataSourceResponse
+
+        // Close shuts down the plugin process if applicable.
+        Close() error
+}
+
+type GetSchemaResponse struct {
+        // Provider is the schema for the provider itself.
+        Provider Schema
+
+        // ResourceTypes map the resource type name to that type's schema.
+        ResourceTypes map[string]Schema
+
+        // DataSources maps the data source name to that data source's schema.
+        DataSources map[string]Schema
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+// Schema pairs a provider or resource schema with that schema's version.
+// This is used to be able to upgrade the schema in UpgradeResourceState.
+type Schema struct {
+        Version int64
+        Block   *configschema.Block
+}
+
+type PrepareProviderConfigRequest struct {
+        // Config is the raw configuration value for the provider.
+        Config cty.Value
+}
+
+type PrepareProviderConfigResponse struct {
+        // PreparedConfig is the configuration as prepared by the provider.
+        PreparedConfig cty.Value
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type ValidateResourceTypeConfigRequest struct {
+        // TypeName is the name of the resource type to validate.
+        TypeName string
+
+        // Config is the configuration value to validate, which may contain unknown
+        // values.
+        Config cty.Value
+}
+
+type ValidateResourceTypeConfigResponse struct {
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type ValidateDataSourceConfigRequest struct {
+        // TypeName is the name of the data source type to validate.
+        TypeName string
+
+        // Config is the configuration value to validate, which may contain unknown
+        // values.
+        Config cty.Value
+}
+
+type ValidateDataSourceConfigResponse struct {
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type UpgradeResourceStateRequest struct {
+        // TypeName is the name of the resource type being upgraded
+        TypeName string
+
+        // Version is version of the schema that created the current state.
+        Version int64
+
+        // RawStateJSON and RawStateFlatmap contiain the state that needs to be
+        // upgraded to match the current schema version. Because the schema is
+        // unknown, this contains only the raw data as stored in the state.
+        // RawStateJSON is the current json state encoding.
+        // RawStateFlatmap is the legacy flatmap encoding.
+        // Only on of these fields may be set for the upgrade request.
+        RawStateJSON    []byte
+        RawStateFlatmap map[string]string
+}
+
+type UpgradeResourceStateResponse struct {
+        // UpgradedState is the newly upgraded resource state.
+        UpgradedState cty.Value
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type ConfigureRequest struct {
+        // Terraform version is the version string from the running instance of
+        // terraform. Providers can use TerraformVersion to verify compatibility,
+        // and to store for informational purposes.
+        TerraformVersion string
+
+        // Config is the complete configuration value for the provider.
+        Config cty.Value
+}
+
+type ConfigureResponse struct {
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type ReadResourceRequest struct {
+        // TypeName is the name of the resource type being read.
+        TypeName string
+
+        // PriorState contains the previously saved state value for this resource.
+        PriorState cty.Value
+}
+
+type ReadResourceResponse struct {
+        // NewState contains the current state of the resource.
+        NewState cty.Value
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type PlanResourceChangeRequest struct {
+        // TypeName is the name of the resource type to plan.
+        TypeName string
+
+        // PriorState is the previously saved state value for this resource.
+        PriorState cty.Value
+
+        // ProposedNewState is the expected state after the new configuration is
+        // applied. This is created by directly applying the configuration to the
+        // PriorState. The provider is then responsible for applying any further
+        // changes required to create the proposed final state.
+        ProposedNewState cty.Value
+
+        // Config is the resource configuration, before being merged with the
+        // PriorState. Any value not explicitly set in the configuration will be
+        // null. Config is supplied for reference, but Provider implementations
+        // should prefer the ProposedNewState in most circumstances.
+        Config cty.Value
+
+        // PriorPrivate is the previously saved private data returned from the
+        // provider during the last apply.
+        PriorPrivate []byte
+}
+
+type PlanResourceChangeResponse struct {
+        // PlannedState is the expected state of the resource once the current
+        // configuration is applied.
+        PlannedState cty.Value
+
+        // RequiresReplace is the list of thee attributes that are requiring
+        // resource replacement.
+        RequiresReplace []cty.Path
+
+        // PlannedPrivate is an opaque blob that is not interpreted by terraform
+        // core. This will be saved and relayed back to the provider during
+        // ApplyResourceChange.
+        PlannedPrivate []byte
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+
+        // LegacyTypeSystem is set only if the provider is using the legacy SDK
+        // whose type system cannot be precisely mapped into the Terraform type
+        // system. We use this to bypass certain consistency checks that would
+        // otherwise fail due to this imprecise mapping. No other provider or SDK
+        // implementation is permitted to set this.
+        LegacyTypeSystem bool
+}
+
+type ApplyResourceChangeRequest struct {
+        // TypeName is the name of the resource type being applied.
+        TypeName string
+
+        // PriorState is the current state of resource.
+        PriorState cty.Value
+
+        // Planned state is the state returned from PlanResourceChange, and should
+        // represent the new state, minus any remaining computed attributes.
+        PlannedState cty.Value
+
+        // Config is the resource configuration, before being merged with the
+        // PriorState. Any value not explicitly set in the configuration will be
+        // null. Config is supplied for reference, but Provider implementations
+        // should prefer the PlannedState in most circumstances.
+        Config cty.Value
+
+        // PlannedPrivate is the same value as returned by PlanResourceChange.
+        PlannedPrivate []byte
+}
+
+type ApplyResourceChangeResponse struct {
+        // NewState is the new complete state after applying the planned change.
+        // In the event of an error, NewState should represent the most recent
+        // known state of the resource, if it exists.
+        NewState cty.Value
+
+        // Private is an opaque blob that will be stored in state along with the
+        // resource. It is intended only for interpretation by the provider itself.
+        Private []byte
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+
+        // LegacyTypeSystem is set only if the provider is using the legacy SDK
+        // whose type system cannot be precisely mapped into the Terraform type
+        // system. We use this to bypass certain consistency checks that would
+        // otherwise fail due to this imprecise mapping. No other provider or SDK
+        // implementation is permitted to set this.
+        LegacyTypeSystem bool
+}
+
+type ImportResourceStateRequest struct {
+        // TypeName is the name of the resource type to be imported.
+        TypeName string
+
+        // ID is a string with which the provider can identify the resource to be
+        // imported.
+        ID string
+}
+
+type ImportResourceStateResponse struct {
+        // ImportedResources contains one or more state values related to the
+        // imported resource. It is not required that these be complete, only that
+        // there is enough identifying information for the provider to successfully
+        // update the states in ReadResource.
+        ImportedResources []ImportedResource
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+// ImportedResource represents an object being imported into Terraform with the
+// help of a provider. An ImportedObject is a RemoteObject that has been read
+// by the provider's import handler but hasn't yet been committed to state.
+type ImportedResource struct {
+        // TypeName is the name of the resource type associated with the
+        // returned state. It's possible for providers to import multiple related
+        // types with a single import request.
+        TypeName string
+
+        // State is the state of the remote object being imported. This may not be
+        // complete, but must contain enough information to uniquely identify the
+        // resource.
+        State cty.Value
+
+        // Private is an opaque blob that will be stored in state along with the
+        // resource. It is intended only for interpretation by the provider itself.
+        Private []byte
+}
+
+// AsInstanceObject converts the receiving ImportedObject into a
+// ResourceInstanceObject that has status ObjectReady.
+//
+// The returned object does not know its own resource type, so the caller must
+// retain the ResourceType value from the source object if this information is
+// needed.
+//
+// The returned object also has no dependency addresses, but the caller may
+// freely modify the direct fields of the returned object without affecting
+// the receiver.
+func (ir ImportedResource) AsInstanceObject() *states.ResourceInstanceObject {
+        return &states.ResourceInstanceObject{
+                Status:  states.ObjectReady,
+                Value:   ir.State,
+                Private: ir.Private,
+        }
+}
+
+type ReadDataSourceRequest struct {
+        // TypeName is the name of the data source type to Read.
+        TypeName string
+
+        // Config is the complete configuration for the requested data source.
+        Config cty.Value
+}
+
+type ReadDataSourceResponse struct {
+        // State is the current state of the requested data source.
+        State cty.Value
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
diff --git a/vendor/github.com/hashicorp/terraform/providers/resolver.go b/vendor/github.com/hashicorp/terraform/providers/resolver.go
new file mode 100644
index 0000000..4de8e0a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/providers/resolver.go
@@ -0,0 +1,112 @@
+package providers
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/plugin/discovery"
+)
+
+// Resolver is an interface implemented by objects that are able to resolve
+// a given set of resource provider version constraints into Factory
+// callbacks.
+type Resolver interface {
+        // Given a constraint map, return a Factory for each requested provider.
+        // If some or all of the constraints cannot be satisfied, return a non-nil
+        // slice of errors describing the problems.
+        ResolveProviders(reqd discovery.PluginRequirements) (map[string]Factory, []error)
+}
+
+// ResolverFunc wraps a callback function and turns it into a Resolver
+// implementation, for convenience in situations where a function and its
+// associated closure are sufficient as a resolver implementation.
+type ResolverFunc func(reqd discovery.PluginRequirements) (map[string]Factory, []error)
+
+// ResolveProviders implements Resolver by calling the
+// wrapped function.
+func (f ResolverFunc) ResolveProviders(reqd discovery.PluginRequirements) (map[string]Factory, []error) {
+        return f(reqd)
+}
+
+// ResolverFixed returns a Resolver that has a fixed set of provider factories
+// provided by the caller. The returned resolver ignores version constraints
+// entirely and just returns the given factory for each requested provider
+// name.
+//
+// This function is primarily used in tests, to provide mock providers or
+// in-process providers under test.
+func ResolverFixed(factories map[string]Factory) Resolver {
+        return ResolverFunc(func(reqd discovery.PluginRequirements) (map[string]Factory, []error) {
+                ret := make(map[string]Factory, len(reqd))
+                var errs []error
+                for name := range reqd {
+                        if factory, exists := factories[name]; exists {
+                                ret[name] = factory
+                        } else {
+                                errs = append(errs, fmt.Errorf("provider %q is not available", name))
+                        }
+                }
+                return ret, errs
+        })
+}
+
+// Factory is a function type that creates a new instance of a resource
+// provider, or returns an error if that is impossible.
+type Factory func() (Interface, error)
+
+// FactoryFixed is a helper that creates a Factory that just returns some given
+// single provider.
+//
+// Unlike usual factories, the exact same instance is returned for each call
+// to the factory and so this must be used in only specialized situations where
+// the caller can take care to either not mutate the given provider at all
+// or to mutate it in ways that will not cause unexpected behavior for others
+// holding the same reference.
+func FactoryFixed(p Interface) Factory {
+        return func() (Interface, error) {
+                return p, nil
+        }
+}
+
+// ProviderHasResource is a helper that requests schema from the given provider
+// and checks if it has a resource type of the given name.
+//
+// This function is more expensive than it may first appear since it must
+// retrieve the entire schema from the underlying provider, and so it should
+// be used sparingly and especially not in tight loops.
+//
+// Since retrieving the provider may fail (e.g. if the provider is accessed
+// over an RPC channel that has operational problems), this function will
+// return false if the schema cannot be retrieved, under the assumption that
+// a subsequent call to do anything with the resource type would fail
+// anyway.
+func ProviderHasResource(provider Interface, typeName string) bool {
+        resp := provider.GetSchema()
+        if resp.Diagnostics.HasErrors() {
+                return false
+        }
+
+        _, exists := resp.ResourceTypes[typeName]
+        return exists
+}
+
+// ProviderHasDataSource is a helper that requests schema from the given
+// provider and checks if it has a data source of the given name.
+//
+// This function is more expensive than it may first appear since it must
+// retrieve the entire schema from the underlying provider, and so it should
+// be used sparingly and especially not in tight loops.
+//
+// Since retrieving the provider may fail (e.g. if the provider is accessed
+// over an RPC channel that has operational problems), this function will
+// return false if the schema cannot be retrieved, under the assumption that
+// a subsequent call to do anything with the data source would fail
+// anyway.
+func ProviderHasDataSource(provider Interface, dataSourceName string) bool {
+        resp := provider.GetSchema()
+        if resp.Diagnostics.HasErrors() {
+                return false
+        }
+
+        _, exists := resp.DataSources[dataSourceName]
+        return exists
+}
diff --git a/vendor/github.com/hashicorp/terraform/provisioners/doc.go b/vendor/github.com/hashicorp/terraform/provisioners/doc.go
new file mode 100644
index 0000000..b03ba9a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/provisioners/doc.go
@@ -0,0 +1,3 @@
+// Package provisioners contains the interface and primary types to implement a
+// Terraform resource provisioner.
+package provisioners
diff --git a/vendor/github.com/hashicorp/terraform/provisioners/factory.go b/vendor/github.com/hashicorp/terraform/provisioners/factory.go
new file mode 100644
index 0000000..590b97a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/provisioners/factory.go
@@ -0,0 +1,19 @@
+package provisioners
+
+// Factory is a function type that creates a new instance of a resource
+// provisioner, or returns an error if that is impossible.
+type Factory func() (Interface, error)
+
+// FactoryFixed is a helper that creates a Factory that just returns some given
+// single provisioner.
+//
+// Unlike usual factories, the exact same instance is returned for each call
+// to the factory and so this must be used in only specialized situations where
+// the caller can take care to either not mutate the given provider at all
+// or to mutate it in ways that will not cause unexpected behavior for others
+// holding the same reference.
+func FactoryFixed(p Interface) Factory {
+        return func() (Interface, error) {
+                return p, nil
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/provisioners/provisioner.go b/vendor/github.com/hashicorp/terraform/provisioners/provisioner.go
new file mode 100644
index 0000000..e53c884
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/provisioners/provisioner.go
@@ -0,0 +1,82 @@
+package provisioners
+
+import (
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Interface is the set of methods required for a resource provisioner plugin.
+type Interface interface {
+        // GetSchema returns the schema for the provisioner configuration.
+        GetSchema() GetSchemaResponse
+
+        // ValidateProvisionerConfig allows the provisioner to validate the
+        // configuration values.
+        ValidateProvisionerConfig(ValidateProvisionerConfigRequest) ValidateProvisionerConfigResponse
+
+        // ProvisionResource runs the provisioner with provided configuration.
+        // ProvisionResource blocks until the execution is complete.
+        // If the returned diagnostics contain any errors, the resource will be
+        // left in a tainted state.
+        ProvisionResource(ProvisionResourceRequest) ProvisionResourceResponse
+
+        // Stop is called to interrupt the provisioner.
+        //
+        // Stop should not block waiting for in-flight actions to complete. It
+        // should take any action it wants and return immediately acknowledging it
+        // has received the stop request. Terraform will not make any further API
+        // calls to the provisioner after Stop is called.
+        //
+        // The error returned, if non-nil, is assumed to mean that signaling the
+        // stop somehow failed and that the user should expect potentially waiting
+        // a longer period of time.
+        Stop() error
+
+        // Close shuts down the plugin process if applicable.
+        Close() error
+}
+
+type GetSchemaResponse struct {
+        // Provisioner contains the schema for this provisioner.
+        Provisioner *configschema.Block
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+// UIOutput provides the Output method for resource provisioner
+// plugins to write any output to the UI.
+//
+// Provisioners may call the Output method multiple times while Apply is in
+// progress. It is invalid to call Output after Apply returns.
+type UIOutput interface {
+        Output(string)
+}
+
+type ValidateProvisionerConfigRequest struct {
+        // Config is the complete configuration to be used for the provisioner.
+        Config cty.Value
+}
+
+type ValidateProvisionerConfigResponse struct {
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type ProvisionResourceRequest struct {
+        // Config is the complete provisioner configuration.
+        Config cty.Value
+
+        // Connection contains any information required to access the resource
+        // instance.
+        Connection cty.Value
+
+        // UIOutput is used to return output during the Apply operation.
+        UIOutput UIOutput
+}
+
+type ProvisionResourceResponse struct {
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/client.go b/vendor/github.com/hashicorp/terraform/registry/client.go
index a18e6b8..93424d1 100644
--- a/vendor/github.com/hashicorp/terraform/registry/client.go
+++ b/vendor/github.com/hashicorp/terraform/registry/client.go
@@ -20,10 +20,11 @@ import (
 )
 
 const (
-        xTerraformGet     = "X-Terraform-Get"
-        xTerraformVersion = "X-Terraform-Version"
-        requestTimeout    = 10 * time.Second
-        serviceID         = "modules.v1"
+        xTerraformGet      = "X-Terraform-Get"
+        xTerraformVersion  = "X-Terraform-Version"
+        requestTimeout     = 10 * time.Second
+        modulesServiceID   = "modules.v1"
+        providersServiceID = "providers.v1"
 )
 
 var tfVersion = version.String()
@@ -58,10 +59,10 @@ func NewClient(services *disco.Disco, client *http.Client) *Client {
 }
 
 // Discover queries the host, and returns the url for the registry.
-func (c *Client) Discover(host svchost.Hostname) (*url.URL, error) {
+func (c *Client) Discover(host svchost.Hostname, serviceID string) (*url.URL, error) {
         service, err := c.services.DiscoverServiceURL(host, serviceID)
         if err != nil {
-                return nil, err
+                return nil, &ServiceUnreachableError{err}
         }
         if !strings.HasSuffix(service.Path, "/") {
                 service.Path += "/"
@@ -69,14 +70,14 @@ func (c *Client) Discover(host svchost.Hostname) (*url.URL, error) {
         return service, nil
 }
 
-// Versions queries the registry for a module, and returns the available versions.
-func (c *Client) Versions(module *regsrc.Module) (*response.ModuleVersions, error) {
+// ModuleVersions queries the registry for a module, and returns the available versions.
+func (c *Client) ModuleVersions(module *regsrc.Module) (*response.ModuleVersions, error) {
         host, err := module.SvcHost()
         if err != nil {
                 return nil, err
         }
 
-        service, err := c.Discover(host)
+        service, err := c.Discover(host, modulesServiceID)
         if err != nil {
                 return nil, err
         }
@@ -141,15 +142,15 @@ func (c *Client) addRequestCreds(host svchost.Hostname, req *http.Request) {
         }
 }
 
-// Location find the download location for a specific version module.
+// ModuleLocation find the download location for a specific version module.
 // This returns a string, because the final location may contain special go-getter syntax.
-func (c *Client) Location(module *regsrc.Module, version string) (string, error) {
+func (c *Client) ModuleLocation(module *regsrc.Module, version string) (string, error) {
         host, err := module.SvcHost()
         if err != nil {
                 return "", err
         }
 
-        service, err := c.Discover(host)
+        service, err := c.Discover(host, modulesServiceID)
         if err != nil {
                 return "", err
         }
@@ -225,3 +226,118 @@ func (c *Client) Location(module *regsrc.Module, version string) (string, error)
 
         return location, nil
 }
+
+// TerraformProviderVersions queries the registry for a provider, and returns the available versions.
+func (c *Client) TerraformProviderVersions(provider *regsrc.TerraformProvider) (*response.TerraformProviderVersions, error) {
+        host, err := provider.SvcHost()
+        if err != nil {
+                return nil, err
+        }
+
+        service, err := c.Discover(host, providersServiceID)
+        if err != nil {
+                return nil, err
+        }
+
+        p, err := url.Parse(path.Join(provider.TerraformProvider(), "versions"))
+        if err != nil {
+                return nil, err
+        }
+
+        service = service.ResolveReference(p)
+
+        log.Printf("[DEBUG] fetching provider versions from %q", service)
+
+        req, err := http.NewRequest("GET", service.String(), nil)
+        if err != nil {
+                return nil, err
+        }
+
+        c.addRequestCreds(host, req)
+        req.Header.Set(xTerraformVersion, tfVersion)
+
+        resp, err := c.client.Do(req)
+        if err != nil {
+                return nil, err
+        }
+        defer resp.Body.Close()
+
+        switch resp.StatusCode {
+        case http.StatusOK:
+                // OK
+        case http.StatusNotFound:
+                return nil, &errProviderNotFound{addr: provider}
+        default:
+                return nil, fmt.Errorf("error looking up provider versions: %s", resp.Status)
+        }
+
+        var versions response.TerraformProviderVersions
+
+        dec := json.NewDecoder(resp.Body)
+        if err := dec.Decode(&versions); err != nil {
+                return nil, err
+        }
+
+        return &versions, nil
+}
+
+// TerraformProviderLocation queries the registry for a provider download metadata
+func (c *Client) TerraformProviderLocation(provider *regsrc.TerraformProvider, version string) (*response.TerraformProviderPlatformLocation, error) {
+        host, err := provider.SvcHost()
+        if err != nil {
+                return nil, err
+        }
+
+        service, err := c.Discover(host, providersServiceID)
+        if err != nil {
+                return nil, err
+        }
+
+        p, err := url.Parse(path.Join(
+                provider.TerraformProvider(),
+                version,
+                "download",
+                provider.OS,
+                provider.Arch,
+        ))
+        if err != nil {
+                return nil, err
+        }
+
+        service = service.ResolveReference(p)
+
+        log.Printf("[DEBUG] fetching provider location from %q", service)
+
+        req, err := http.NewRequest("GET", service.String(), nil)
+        if err != nil {
+                return nil, err
+        }
+
+        c.addRequestCreds(host, req)
+        req.Header.Set(xTerraformVersion, tfVersion)
+
+        resp, err := c.client.Do(req)
+        if err != nil {
+                return nil, err
+        }
+        defer resp.Body.Close()
+
+        var loc response.TerraformProviderPlatformLocation
+
+        dec := json.NewDecoder(resp.Body)
+        if err := dec.Decode(&loc); err != nil {
+                return nil, err
+        }
+
+        switch resp.StatusCode {
+        case http.StatusOK, http.StatusNoContent:
+                // OK
+        case http.StatusNotFound:
+                return nil, fmt.Errorf("provider %q version %q not found", provider.TerraformProvider(), version)
+        default:
+                // anything else is an error:
+                return nil, fmt.Errorf("error getting download location for %q: %s", provider.TerraformProvider(), resp.Status)
+        }
+
+        return &loc, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/errors.go b/vendor/github.com/hashicorp/terraform/registry/errors.go
index b8dcd31..5a6a31b 100644
--- a/vendor/github.com/hashicorp/terraform/registry/errors.go
+++ b/vendor/github.com/hashicorp/terraform/registry/errors.go
@@ -4,6 +4,7 @@ import (
         "fmt"
 
         "github.com/hashicorp/terraform/registry/regsrc"
+        "github.com/hashicorp/terraform/svchost/disco"
 )
 
 type errModuleNotFound struct {
@@ -21,3 +22,42 @@ func IsModuleNotFound(err error) bool {
         _, ok := err.(*errModuleNotFound)
         return ok
 }
+
+type errProviderNotFound struct {
+        addr *regsrc.TerraformProvider
+}
+
+func (e *errProviderNotFound) Error() string {
+        return fmt.Sprintf("provider %s not found", e.addr)
+}
+
+// IsProviderNotFound returns true only if the given error is a "provider not found"
+// error. This allows callers to recognize this particular error condition
+// as distinct from operational errors such as poor network connectivity.
+func IsProviderNotFound(err error) bool {
+        _, ok := err.(*errProviderNotFound)
+        return ok
+}
+
+// IsServiceNotProvided returns true only if the given error is a "service not provided"
+// error. This allows callers to recognize this particular error condition
+// as distinct from operational errors such as poor network connectivity.
+func IsServiceNotProvided(err error) bool {
+        _, ok := err.(*disco.ErrServiceNotProvided)
+        return ok
+}
+
+// ServiceUnreachableError Registry service is unreachable
+type ServiceUnreachableError struct {
+        err error
+}
+
+func (e *ServiceUnreachableError) Error() string {
+        return e.err.Error()
+}
+
+// IsServiceUnreachable returns true if the registry/discovery service was unreachable
+func IsServiceUnreachable(err error) bool {
+        _, ok := err.(*ServiceUnreachableError)
+        return ok
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/regsrc/terraform_provider.go b/vendor/github.com/hashicorp/terraform/registry/regsrc/terraform_provider.go
new file mode 100644
index 0000000..58dedee
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/regsrc/terraform_provider.go
@@ -0,0 +1,60 @@
+package regsrc
+
+import (
+        "fmt"
+        "runtime"
+        "strings"
+
+        "github.com/hashicorp/terraform/svchost"
+)
+
+var (
+        // DefaultProviderNamespace represents the namespace for canonical
+        // HashiCorp-controlled providers.
+        DefaultProviderNamespace = "-"
+)
+
+// TerraformProvider describes a Terraform Registry Provider source.
+type TerraformProvider struct {
+        RawHost      *FriendlyHost
+        RawNamespace string
+        RawName      string
+        OS           string
+        Arch         string
+}
+
+// NewTerraformProvider constructs a new provider source.
+func NewTerraformProvider(name, os, arch string) *TerraformProvider {
+        if os == "" {
+                os = runtime.GOOS
+        }
+        if arch == "" {
+                arch = runtime.GOARCH
+        }
+
+        // separate namespace if included
+        namespace := DefaultProviderNamespace
+        if names := strings.SplitN(name, "/", 2); len(names) == 2 {
+                namespace, name = names[0], names[1]
+        }
+        p := &TerraformProvider{
+                RawHost:      PublicRegistryHost,
+                RawNamespace: namespace,
+                RawName:      name,
+                OS:           os,
+                Arch:         arch,
+        }
+
+        return p
+}
+
+// Provider returns just the registry ID of the provider
+func (p *TerraformProvider) TerraformProvider() string {
+        return fmt.Sprintf("%s/%s", p.RawNamespace, p.RawName)
+}
+
+// SvcHost returns the svchost.Hostname for this provider. The
+// default PublicRegistryHost is returned.
+func (p *TerraformProvider) SvcHost() (svchost.Hostname, error) {
+        return svchost.ForComparison(PublicRegistryHost.Raw)
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/provider.go b/vendor/github.com/hashicorp/terraform/registry/response/provider.go
new file mode 100644
index 0000000..5e8bae3
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/provider.go
@@ -0,0 +1,36 @@
+package response
+
+import (
+        "time"
+)
+
+// Provider is the response structure with the data for a single provider
+// version. This is just the metadata. A full provider response will be
+// ProviderDetail.
+type Provider struct {
+        ID string `json:"id"`
+
+        //---------------------------------------------------------------
+        // Metadata about the overall provider.
+
+        Owner       string    `json:"owner"`
+        Namespace   string    `json:"namespace"`
+        Name        string    `json:"name"`
+        Version     string    `json:"version"`
+        Description string    `json:"description"`
+        Source      string    `json:"source"`
+        PublishedAt time.Time `json:"published_at"`
+        Downloads   int       `json:"downloads"`
+}
+
+// ProviderDetail represents a Provider with full detail.
+type ProviderDetail struct {
+        Provider
+
+        //---------------------------------------------------------------
+        // The fields below are only set when requesting this specific
+        // module. They are available to easily know all available versions
+        // without multiple API calls.
+
+        Versions []string `json:"versions"` // All versions
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/provider_list.go b/vendor/github.com/hashicorp/terraform/registry/response/provider_list.go
new file mode 100644
index 0000000..1dc7d23
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/provider_list.go
@@ -0,0 +1,7 @@
+package response
+
+// ProviderList is the response structure for a pageable list of providers.
+type ProviderList struct {
+        Meta      PaginationMeta `json:"meta"`
+        Providers []*Provider    `json:"providers"`
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/terraform_provider.go b/vendor/github.com/hashicorp/terraform/registry/response/terraform_provider.go
new file mode 100644
index 0000000..64e454a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/terraform_provider.go
@@ -0,0 +1,96 @@
+package response
+
+import (
+        "sort"
+        "strings"
+
+        version "github.com/hashicorp/go-version"
+)
+
+// TerraformProvider is the response structure for all required information for
+// Terraform to choose a download URL. It must include all versions and all
+// platforms for Terraform to perform version and os/arch constraint matching
+// locally.
+type TerraformProvider struct {
+        ID       string `json:"id"`
+        Verified bool   `json:"verified"`
+
+        Versions []*TerraformProviderVersion `json:"versions"`
+}
+
+// TerraformProviderVersion is the Terraform-specific response structure for a
+// provider version.
+type TerraformProviderVersion struct {
+        Version   string   `json:"version"`
+        Protocols []string `json:"protocols"`
+
+        Platforms []*TerraformProviderPlatform `json:"platforms"`
+}
+
+// TerraformProviderVersions is the Terraform-specific response structure for an
+// array of provider versions
+type TerraformProviderVersions struct {
+        ID       string                      `json:"id"`
+        Versions []*TerraformProviderVersion `json:"versions"`
+        Warnings []string                    `json:"warnings"`
+}
+
+// TerraformProviderPlatform is the Terraform-specific response structure for a
+// provider platform.
+type TerraformProviderPlatform struct {
+        OS   string `json:"os"`
+        Arch string `json:"arch"`
+}
+
+// TerraformProviderPlatformLocation is the Terraform-specific response
+// structure for a provider platform with all details required to perform a
+// download.
+type TerraformProviderPlatformLocation struct {
+        Protocols           []string `json:"protocols"`
+        OS                  string   `json:"os"`
+        Arch                string   `json:"arch"`
+        Filename            string   `json:"filename"`
+        DownloadURL         string   `json:"download_url"`
+        ShasumsURL          string   `json:"shasums_url"`
+        ShasumsSignatureURL string   `json:"shasums_signature_url"`
+        Shasum              string   `json:"shasum"`
+
+        SigningKeys SigningKeyList `json:"signing_keys"`
+}
+
+// SigningKeyList is the response structure for a list of signing keys.
+type SigningKeyList struct {
+        GPGKeys []*GPGKey `json:"gpg_public_keys"`
+}
+
+// GPGKey is the response structure for a GPG key.
+type GPGKey struct {
+        ASCIIArmor string  `json:"ascii_armor"`
+        Source     string  `json:"source"`
+        SourceURL  *string `json:"source_url"`
+}
+
+// Collection type for TerraformProviderVersion
+type ProviderVersionCollection []*TerraformProviderVersion
+
+// GPGASCIIArmor returns an ASCII-armor-formatted string for all of the gpg
+// keys in the response.
+func (signingKeys *SigningKeyList) GPGASCIIArmor() string {
+        keys := []string{}
+
+        for _, gpgKey := range signingKeys.GPGKeys {
+                keys = append(keys, gpgKey.ASCIIArmor)
+        }
+
+        return strings.Join(keys, "\n")
+}
+
+// Sort sorts versions from newest to oldest.
+func (v ProviderVersionCollection) Sort() {
+        sort.Slice(v, func(i, j int) bool {
+                versionA, _ := version.NewVersion(v[i].Version)
+                versionB, _ := version.NewVersion(v[j].Version)
+
+                return versionA.GreaterThan(versionB)
+        })
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/doc.go b/vendor/github.com/hashicorp/terraform/states/doc.go
new file mode 100644
index 0000000..7dd74ac
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/doc.go
@@ -0,0 +1,3 @@
+// Package states contains the types that are used to represent Terraform
+// states.
+package states
diff --git a/vendor/github.com/hashicorp/terraform/states/eachmode_string.go b/vendor/github.com/hashicorp/terraform/states/eachmode_string.go
new file mode 100644
index 0000000..0dc7349
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/eachmode_string.go
@@ -0,0 +1,35 @@
+// Code generated by "stringer -type EachMode"; DO NOT EDIT.
+
+package states
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[NoEach-0]
+        _ = x[EachList-76]
+        _ = x[EachMap-77]
+}
+
+const (
+        _EachMode_name_0 = "NoEach"
+        _EachMode_name_1 = "EachListEachMap"
+)
+
+var (
+        _EachMode_index_1 = [...]uint8{0, 8, 15}
+)
+
+func (i EachMode) String() string {
+        switch {
+        case i == 0:
+                return _EachMode_name_0
+        case 76 <= i && i <= 77:
+                i -= 76
+                return _EachMode_name_1[_EachMode_index_1[i]:_EachMode_index_1[i+1]]
+        default:
+                return "EachMode(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/instance_generation.go b/vendor/github.com/hashicorp/terraform/states/instance_generation.go
new file mode 100644
index 0000000..617ad4e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/instance_generation.go
@@ -0,0 +1,24 @@
+package states
+
+// Generation is used to represent multiple objects in a succession of objects
+// represented by a single resource instance address. A resource instance can
+// have multiple generations over its lifetime due to object replacement
+// (when a change can't be applied without destroying and re-creating), and
+// multiple generations can exist at the same time when create_before_destroy
+// is used.
+//
+// A Generation value can either be the value of the variable "CurrentGen" or
+// a value of type DeposedKey. Generation values can be compared for equality
+// using "==" and used as map keys. The zero value of Generation (nil) is not
+// a valid generation and must not be used.
+type Generation interface {
+        generation()
+}
+
+// CurrentGen is the Generation representing the currently-active object for
+// a resource instance.
+var CurrentGen Generation
+
+type currentGen struct{}
+
+func (g currentGen) generation() {}
diff --git a/vendor/github.com/hashicorp/terraform/states/instance_object.go b/vendor/github.com/hashicorp/terraform/states/instance_object.go
new file mode 100644
index 0000000..1374c59
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/instance_object.go
@@ -0,0 +1,120 @@
+package states
+
+import (
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// ResourceInstanceObject is the local representation of a specific remote
+// object associated with a resource instance. In practice not all remote
+// objects are actually remote in the sense of being accessed over the network,
+// but this is the most common case.
+//
+// It is not valid to mutate a ResourceInstanceObject once it has been created.
+// Instead, create a new object and replace the existing one.
+type ResourceInstanceObject struct {
+        // Value is the object-typed value representing the remote object within
+        // Terraform.
+        Value cty.Value
+
+        // Private is an opaque value set by the provider when this object was
+        // last created or updated. Terraform Core does not use this value in
+        // any way and it is not exposed anywhere in the user interface, so
+        // a provider can use it for retaining any necessary private state.
+        Private []byte
+
+        // Status represents the "readiness" of the object as of the last time
+        // it was updated.
+        Status ObjectStatus
+
+        // Dependencies is a set of other addresses in the same module which
+        // this instance depended on when the given attributes were evaluated.
+        // This is used to construct the dependency relationships for an object
+        // whose configuration is no longer available, such as if it has been
+        // removed from configuration altogether, or is now deposed.
+        Dependencies []addrs.Referenceable
+}
+
+// ObjectStatus represents the status of a RemoteObject.
+type ObjectStatus rune
+
+//go:generate stringer -type ObjectStatus
+
+const (
+        // ObjectReady is an object status for an object that is ready to use.
+        ObjectReady ObjectStatus = 'R'
+
+        // ObjectTainted is an object status representing an object that is in
+        // an unrecoverable bad state due to a partial failure during a create,
+        // update, or delete operation. Since it cannot be moved into the
+        // ObjectRead state, a tainted object must be replaced.
+        ObjectTainted ObjectStatus = 'T'
+
+        // ObjectPlanned is a special object status used only for the transient
+        // placeholder objects we place into state during the refresh and plan
+        // walks to stand in for objects that will be created during apply.
+        //
+        // Any object of this status must have a corresponding change recorded
+        // in the current plan, whose value must then be used in preference to
+        // the value stored in state when evaluating expressions. A planned
+        // object stored in state will be incomplete if any of its attributes are
+        // not yet known, and the plan must be consulted in order to "see" those
+        // unknown values, because the state is not able to represent them.
+        ObjectPlanned ObjectStatus = 'P'
+)
+
+// Encode marshals the value within the receiver to produce a
+// ResourceInstanceObjectSrc ready to be written to a state file.
+//
+// The given type must be the implied type of the resource type schema, and
+// the given value must conform to it. It is important to pass the schema
+// type and not the object's own type so that dynamically-typed attributes
+// will be stored correctly. The caller must also provide the version number
+// of the schema that the given type was derived from, which will be recorded
+// in the source object so it can be used to detect when schema migration is
+// required on read.
+//
+// The returned object may share internal references with the receiver and
+// so the caller must not mutate the receiver any further once once this
+// method is called.
+func (o *ResourceInstanceObject) Encode(ty cty.Type, schemaVersion uint64) (*ResourceInstanceObjectSrc, error) {
+        // Our state serialization can't represent unknown values, so we convert
+        // them to nulls here. This is lossy, but nobody should be writing unknown
+        // values here and expecting to get them out again later.
+        //
+        // We get unknown values here while we're building out a "planned state"
+        // during the plan phase, but the value stored in the plan takes precedence
+        // for expression evaluation. The apply step should never produce unknown
+        // values, but if it does it's the responsibility of the caller to detect
+        // and raise an error about that.
+        val := cty.UnknownAsNull(o.Value)
+
+        src, err := ctyjson.Marshal(val, ty)
+        if err != nil {
+                return nil, err
+        }
+
+        return &ResourceInstanceObjectSrc{
+                SchemaVersion: schemaVersion,
+                AttrsJSON:     src,
+                Private:       o.Private,
+                Status:        o.Status,
+                Dependencies:  o.Dependencies,
+        }, nil
+}
+
+// AsTainted returns a deep copy of the receiver with the status updated to
+// ObjectTainted.
+func (o *ResourceInstanceObject) AsTainted() *ResourceInstanceObject {
+        if o == nil {
+                // A nil object can't be tainted, but we'll allow this anyway to
+                // avoid a crash, since we presumably intend to eventually record
+                // the object has having been deleted anyway.
+                return nil
+        }
+        ret := o.DeepCopy()
+        ret.Status = ObjectTainted
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/instance_object_src.go b/vendor/github.com/hashicorp/terraform/states/instance_object_src.go
new file mode 100644
index 0000000..6cb3c27
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/instance_object_src.go
@@ -0,0 +1,113 @@
+package states
+
+import (
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+)
+
+// ResourceInstanceObjectSrc is a not-fully-decoded version of
+// ResourceInstanceObject. Decoding of it can be completed by first handling
+// any schema migration steps to get to the latest schema version and then
+// calling method Decode with the implied type of the latest schema.
+type ResourceInstanceObjectSrc struct {
+        // SchemaVersion is the resource-type-specific schema version number that
+        // was current when either AttrsJSON or AttrsFlat was encoded. Migration
+        // steps are required if this is less than the current version number
+        // reported by the corresponding provider.
+        SchemaVersion uint64
+
+        // AttrsJSON is a JSON-encoded representation of the object attributes,
+        // encoding the value (of the object type implied by the associated resource
+        // type schema) that represents this remote object in Terraform Language
+        // expressions, and is compared with configuration when producing a diff.
+        //
+        // This is retained in JSON format here because it may require preprocessing
+        // before decoding if, for example, the stored attributes are for an older
+        // schema version which the provider must upgrade before use. If the
+        // version is current, it is valid to simply decode this using the
+        // type implied by the current schema, without the need for the provider
+        // to perform an upgrade first.
+        //
+        // When writing a ResourceInstanceObject into the state, AttrsJSON should
+        // always be conformant to the current schema version and the current
+        // schema version should be recorded in the SchemaVersion field.
+        AttrsJSON []byte
+
+        // AttrsFlat is a legacy form of attributes used in older state file
+        // formats, and in the new state format for objects that haven't yet been
+        // upgraded. This attribute is mutually exclusive with Attrs: for any
+        // ResourceInstanceObject, only one of these attributes may be populated
+        // and the other must be nil.
+        //
+        // An instance object with this field populated should be upgraded to use
+        // Attrs at the earliest opportunity, since this legacy flatmap-based
+        // format will be phased out over time. AttrsFlat should not be used when
+        // writing new or updated objects to state; instead, callers must follow
+        // the recommendations in the AttrsJSON documentation above.
+        AttrsFlat map[string]string
+
+        // These fields all correspond to the fields of the same name on
+        // ResourceInstanceObject.
+        Private      []byte
+        Status       ObjectStatus
+        Dependencies []addrs.Referenceable
+}
+
+// Decode unmarshals the raw representation of the object attributes. Pass the
+// implied type of the corresponding resource type schema for correct operation.
+//
+// Before calling Decode, the caller must check that the SchemaVersion field
+// exactly equals the version number of the schema whose implied type is being
+// passed, or else the result is undefined.
+//
+// The returned object may share internal references with the receiver and
+// so the caller must not mutate the receiver any further once once this
+// method is called.
+func (os *ResourceInstanceObjectSrc) Decode(ty cty.Type) (*ResourceInstanceObject, error) {
+        var val cty.Value
+        var err error
+        if os.AttrsFlat != nil {
+                // Legacy mode. We'll do our best to unpick this from the flatmap.
+                val, err = hcl2shim.HCL2ValueFromFlatmap(os.AttrsFlat, ty)
+                if err != nil {
+                        return nil, err
+                }
+        } else {
+                val, err = ctyjson.Unmarshal(os.AttrsJSON, ty)
+                if err != nil {
+                        return nil, err
+                }
+        }
+
+        return &ResourceInstanceObject{
+                Value:        val,
+                Status:       os.Status,
+                Dependencies: os.Dependencies,
+                Private:      os.Private,
+        }, nil
+}
+
+// CompleteUpgrade creates a new ResourceInstanceObjectSrc by copying the
+// metadata from the receiver and writing in the given new schema version
+// and attribute value that are presumed to have resulted from upgrading
+// from an older schema version.
+func (os *ResourceInstanceObjectSrc) CompleteUpgrade(newAttrs cty.Value, newType cty.Type, newSchemaVersion uint64) (*ResourceInstanceObjectSrc, error) {
+        new := os.DeepCopy()
+        new.AttrsFlat = nil // We always use JSON after an upgrade, even if the source used flatmap
+
+        // This is the same principle as ResourceInstanceObject.Encode, but
+        // avoiding a decode/re-encode cycle because we don't have type info
+        // available for the "old" attributes.
+        newAttrs = cty.UnknownAsNull(newAttrs)
+        src, err := ctyjson.Marshal(newAttrs, newType)
+        if err != nil {
+                return nil, err
+        }
+
+        new.AttrsJSON = src
+        new.SchemaVersion = newSchemaVersion
+        return new, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/module.go b/vendor/github.com/hashicorp/terraform/states/module.go
new file mode 100644
index 0000000..d89e787
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/module.go
@@ -0,0 +1,285 @@
+package states
+
+import (
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Module is a container for the states of objects within a particular module.
+type Module struct {
+        Addr addrs.ModuleInstance
+
+        // Resources contains the state for each resource. The keys in this map are
+        // an implementation detail and must not be used by outside callers.
+        Resources map[string]*Resource
+
+        // OutputValues contains the state for each output value. The keys in this
+        // map are output value names.
+        OutputValues map[string]*OutputValue
+
+        // LocalValues contains the value for each named output value. The keys
+        // in this map are local value names.
+        LocalValues map[string]cty.Value
+}
+
+// NewModule constructs an empty module state for the given module address.
+func NewModule(addr addrs.ModuleInstance) *Module {
+        return &Module{
+                Addr:         addr,
+                Resources:    map[string]*Resource{},
+                OutputValues: map[string]*OutputValue{},
+                LocalValues:  map[string]cty.Value{},
+        }
+}
+
+// Resource returns the state for the resource with the given address within
+// the receiving module state, or nil if the requested resource is not tracked
+// in the state.
+func (ms *Module) Resource(addr addrs.Resource) *Resource {
+        return ms.Resources[addr.String()]
+}
+
+// ResourceInstance returns the state for the resource instance with the given
+// address within the receiving module state, or nil if the requested instance
+// is not tracked in the state.
+func (ms *Module) ResourceInstance(addr addrs.ResourceInstance) *ResourceInstance {
+        rs := ms.Resource(addr.Resource)
+        if rs == nil {
+                return nil
+        }
+        return rs.Instance(addr.Key)
+}
+
+// SetResourceMeta updates the resource-level metadata for the resource
+// with the given address, creating the resource state for it if it doesn't
+// already exist.
+func (ms *Module) SetResourceMeta(addr addrs.Resource, eachMode EachMode, provider addrs.AbsProviderConfig) {
+        rs := ms.Resource(addr)
+        if rs == nil {
+                rs = &Resource{
+                        Addr:      addr,
+                        Instances: map[addrs.InstanceKey]*ResourceInstance{},
+                }
+                ms.Resources[addr.String()] = rs
+        }
+
+        rs.EachMode = eachMode
+        rs.ProviderConfig = provider
+}
+
+// RemoveResource removes the entire state for the given resource, taking with
+// it any instances associated with the resource. This should generally be
+// called only for resource objects whose instances have all been destroyed.
+func (ms *Module) RemoveResource(addr addrs.Resource) {
+        delete(ms.Resources, addr.String())
+}
+
+// SetResourceInstanceCurrent saves the given instance object as the current
+// generation of the resource instance with the given address, simulataneously
+// updating the recorded provider configuration address, dependencies, and
+// resource EachMode.
+//
+// Any existing current instance object for the given resource is overwritten.
+// Set obj to nil to remove the primary generation object altogether. If there
+// are no deposed objects then the instance will be removed altogether.
+//
+// The provider address and "each mode" are resource-wide settings and so they
+// are updated for all other instances of the same resource as a side-effect of
+// this call.
+func (ms *Module) SetResourceInstanceCurrent(addr addrs.ResourceInstance, obj *ResourceInstanceObjectSrc, provider addrs.AbsProviderConfig) {
+        ms.SetResourceMeta(addr.Resource, eachModeForInstanceKey(addr.Key), provider)
+
+        rs := ms.Resource(addr.Resource)
+        is := rs.EnsureInstance(addr.Key)
+
+        is.Current = obj
+
+        if !is.HasObjects() {
+                // If we have no objects at all then we'll clean up.
+                delete(rs.Instances, addr.Key)
+        }
+        if rs.EachMode == NoEach && len(rs.Instances) == 0 {
+                // Also clean up if we only expect to have one instance anyway
+                // and there are none. We leave the resource behind if an each mode
+                // is active because an empty list or map of instances is a valid state.
+                delete(ms.Resources, addr.Resource.String())
+        }
+}
+
+// SetResourceInstanceDeposed saves the given instance object as a deposed
+// generation of the resource instance with the given address and deposed key.
+//
+// Call this method only for pre-existing deposed objects that already have
+// a known DeposedKey. For example, this method is useful if reloading objects
+// that were persisted to a state file. To mark the current object as deposed,
+// use DeposeResourceInstanceObject instead.
+//
+// The resource that contains the given instance must already exist in the
+// state, or this method will panic. Use Resource to check first if its
+// presence is not already guaranteed.
+//
+// Any existing current instance object for the given resource and deposed key
+// is overwritten. Set obj to nil to remove the deposed object altogether. If
+// the instance is left with no objects after this operation then it will
+// be removed from its containing resource altogether.
+func (ms *Module) SetResourceInstanceDeposed(addr addrs.ResourceInstance, key DeposedKey, obj *ResourceInstanceObjectSrc, provider addrs.AbsProviderConfig) {
+        ms.SetResourceMeta(addr.Resource, eachModeForInstanceKey(addr.Key), provider)
+
+        rs := ms.Resource(addr.Resource)
+        is := rs.EnsureInstance(addr.Key)
+        if obj != nil {
+                is.Deposed[key] = obj
+        } else {
+                delete(is.Deposed, key)
+        }
+
+        if !is.HasObjects() {
+                // If we have no objects at all then we'll clean up.
+                delete(rs.Instances, addr.Key)
+        }
+        if rs.EachMode == NoEach && len(rs.Instances) == 0 {
+                // Also clean up if we only expect to have one instance anyway
+                // and there are none. We leave the resource behind if an each mode
+                // is active because an empty list or map of instances is a valid state.
+                delete(ms.Resources, addr.Resource.String())
+        }
+}
+
+// ForgetResourceInstanceAll removes the record of all objects associated with
+// the specified resource instance, if present. If not present, this is a no-op.
+func (ms *Module) ForgetResourceInstanceAll(addr addrs.ResourceInstance) {
+        rs := ms.Resource(addr.Resource)
+        if rs == nil {
+                return
+        }
+        delete(rs.Instances, addr.Key)
+
+        if rs.EachMode == NoEach && len(rs.Instances) == 0 {
+                // Also clean up if we only expect to have one instance anyway
+                // and there are none. We leave the resource behind if an each mode
+                // is active because an empty list or map of instances is a valid state.
+                delete(ms.Resources, addr.Resource.String())
+        }
+}
+
+// ForgetResourceInstanceDeposed removes the record of the deposed object with
+// the given address and key, if present. If not present, this is a no-op.
+func (ms *Module) ForgetResourceInstanceDeposed(addr addrs.ResourceInstance, key DeposedKey) {
+        rs := ms.Resource(addr.Resource)
+        if rs == nil {
+                return
+        }
+        is := rs.Instance(addr.Key)
+        if is == nil {
+                return
+        }
+        delete(is.Deposed, key)
+
+        if !is.HasObjects() {
+                // If we have no objects at all then we'll clean up.
+                delete(rs.Instances, addr.Key)
+        }
+        if rs.EachMode == NoEach && len(rs.Instances) == 0 {
+                // Also clean up if we only expect to have one instance anyway
+                // and there are none. We leave the resource behind if an each mode
+                // is active because an empty list or map of instances is a valid state.
+                delete(ms.Resources, addr.Resource.String())
+        }
+}
+
+// deposeResourceInstanceObject is the real implementation of
+// SyncState.DeposeResourceInstanceObject.
+func (ms *Module) deposeResourceInstanceObject(addr addrs.ResourceInstance, forceKey DeposedKey) DeposedKey {
+        is := ms.ResourceInstance(addr)
+        if is == nil {
+                return NotDeposed
+        }
+        return is.deposeCurrentObject(forceKey)
+}
+
+// maybeRestoreResourceInstanceDeposed is the real implementation of
+// SyncState.MaybeRestoreResourceInstanceDeposed.
+func (ms *Module) maybeRestoreResourceInstanceDeposed(addr addrs.ResourceInstance, key DeposedKey) bool {
+        rs := ms.Resource(addr.Resource)
+        if rs == nil {
+                return false
+        }
+        is := rs.Instance(addr.Key)
+        if is == nil {
+                return false
+        }
+        if is.Current != nil {
+                return false
+        }
+        if len(is.Deposed) == 0 {
+                return false
+        }
+        is.Current = is.Deposed[key]
+        delete(is.Deposed, key)
+        return true
+}
+
+// SetOutputValue writes an output value into the state, overwriting any
+// existing value of the same name.
+func (ms *Module) SetOutputValue(name string, value cty.Value, sensitive bool) *OutputValue {
+        os := &OutputValue{
+                Value:     value,
+                Sensitive: sensitive,
+        }
+        ms.OutputValues[name] = os
+        return os
+}
+
+// RemoveOutputValue removes the output value of the given name from the state,
+// if it exists. This method is a no-op if there is no value of the given
+// name.
+func (ms *Module) RemoveOutputValue(name string) {
+        delete(ms.OutputValues, name)
+}
+
+// SetLocalValue writes a local value into the state, overwriting any
+// existing value of the same name.
+func (ms *Module) SetLocalValue(name string, value cty.Value) {
+        ms.LocalValues[name] = value
+}
+
+// RemoveLocalValue removes the local value of the given name from the state,
+// if it exists. This method is a no-op if there is no value of the given
+// name.
+func (ms *Module) RemoveLocalValue(name string) {
+        delete(ms.LocalValues, name)
+}
+
+// PruneResourceHusks is a specialized method that will remove any Resource
+// objects that do not contain any instances, even if they have an EachMode.
+//
+// You probably shouldn't call this! See the method of the same name on
+// type State for more information on what this is for and the rare situations
+// where it is safe to use.
+func (ms *Module) PruneResourceHusks() {
+        for _, rs := range ms.Resources {
+                if len(rs.Instances) == 0 {
+                        ms.RemoveResource(rs.Addr)
+                }
+        }
+}
+
+// empty returns true if the receving module state is contributing nothing
+// to the state. In other words, it returns true if the module could be
+// removed from the state altogether without changing the meaning of the state.
+//
+// In practice a module containing no objects is the same as a non-existent
+// module, and so we can opportunistically clean up once a module becomes
+// empty on the assumption that it will be re-added if needed later.
+func (ms *Module) empty() bool {
+        if ms == nil {
+                return true
+        }
+
+        // This must be updated to cover any new collections added to Module
+        // in future.
+        return (len(ms.Resources) == 0 &&
+                len(ms.OutputValues) == 0 &&
+                len(ms.LocalValues) == 0)
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/objectstatus_string.go b/vendor/github.com/hashicorp/terraform/states/objectstatus_string.go
new file mode 100644
index 0000000..96a6db2
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/objectstatus_string.go
@@ -0,0 +1,33 @@
+// Code generated by "stringer -type ObjectStatus"; DO NOT EDIT.
+
+package states
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[ObjectReady-82]
+        _ = x[ObjectTainted-84]
+        _ = x[ObjectPlanned-80]
+}
+
+const (
+        _ObjectStatus_name_0 = "ObjectPlanned"
+        _ObjectStatus_name_1 = "ObjectReady"
+        _ObjectStatus_name_2 = "ObjectTainted"
+)
+
+func (i ObjectStatus) String() string {
+        switch {
+        case i == 80:
+                return _ObjectStatus_name_0
+        case i == 82:
+                return _ObjectStatus_name_1
+        case i == 84:
+                return _ObjectStatus_name_2
+        default:
+                return "ObjectStatus(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/output_value.go b/vendor/github.com/hashicorp/terraform/states/output_value.go
new file mode 100644
index 0000000..d232b76
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/output_value.go
@@ -0,0 +1,14 @@
+package states
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// OutputValue represents the state of a particular output value.
+//
+// It is not valid to mutate an OutputValue object once it has been created.
+// Instead, create an entirely new OutputValue to replace the previous one.
+type OutputValue struct {
+        Value     cty.Value
+        Sensitive bool
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/resource.go b/vendor/github.com/hashicorp/terraform/states/resource.go
new file mode 100644
index 0000000..e2a2b85
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/resource.go
@@ -0,0 +1,239 @@
+package states
+
+import (
+        "fmt"
+        "math/rand"
+        "time"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Resource represents the state of a resource.
+type Resource struct {
+        // Addr is the module-relative address for the resource this state object
+        // belongs to.
+        Addr addrs.Resource
+
+        // EachMode is the multi-instance mode currently in use for this resource,
+        // or NoEach if this is a single-instance resource. This dictates what
+        // type of value is returned when accessing this resource via expressions
+        // in the Terraform language.
+        EachMode EachMode
+
+        // Instances contains the potentially-multiple instances associated with
+        // this resource. This map can contain a mixture of different key types,
+        // but only the ones of InstanceKeyType are considered current.
+        Instances map[addrs.InstanceKey]*ResourceInstance
+
+        // ProviderConfig is the absolute address for the provider configuration that
+        // most recently managed this resource. This is used to connect a resource
+        // with a provider configuration when the resource configuration block is
+        // not available, such as if it has been removed from configuration
+        // altogether.
+        ProviderConfig addrs.AbsProviderConfig
+}
+
+// Instance returns the state for the instance with the given key, or nil
+// if no such instance is tracked within the state.
+func (rs *Resource) Instance(key addrs.InstanceKey) *ResourceInstance {
+        return rs.Instances[key]
+}
+
+// EnsureInstance returns the state for the instance with the given key,
+// creating a new empty state for it if one doesn't already exist.
+//
+// Because this may create and save a new state, it is considered to be
+// a write operation.
+func (rs *Resource) EnsureInstance(key addrs.InstanceKey) *ResourceInstance {
+        ret := rs.Instance(key)
+        if ret == nil {
+                ret = NewResourceInstance()
+                rs.Instances[key] = ret
+        }
+        return ret
+}
+
+// ResourceInstance represents the state of a particular instance of a resource.
+type ResourceInstance struct {
+        // Current, if non-nil, is the remote object that is currently represented
+        // by the corresponding resource instance.
+        Current *ResourceInstanceObjectSrc
+
+        // Deposed, if len > 0, contains any remote objects that were previously
+        // represented by the corresponding resource instance but have been
+        // replaced and are pending destruction due to the create_before_destroy
+        // lifecycle mode.
+        Deposed map[DeposedKey]*ResourceInstanceObjectSrc
+}
+
+// NewResourceInstance constructs and returns a new ResourceInstance, ready to
+// use.
+func NewResourceInstance() *ResourceInstance {
+        return &ResourceInstance{
+                Deposed: map[DeposedKey]*ResourceInstanceObjectSrc{},
+        }
+}
+
+// HasCurrent returns true if this resource instance has a "current"-generation
+// object. Most instances do, but this can briefly be false during a
+// create-before-destroy replace operation when the current has been deposed
+// but its replacement has not yet been created.
+func (i *ResourceInstance) HasCurrent() bool {
+        return i != nil && i.Current != nil
+}
+
+// HasDeposed returns true if this resource instance has a deposed object
+// with the given key.
+func (i *ResourceInstance) HasDeposed(key DeposedKey) bool {
+        return i != nil && i.Deposed[key] != nil
+}
+
+// HasAnyDeposed returns true if this resource instance has one or more
+// deposed objects.
+func (i *ResourceInstance) HasAnyDeposed() bool {
+        return i != nil && len(i.Deposed) > 0
+}
+
+// HasObjects returns true if this resource has any objects at all, whether
+// current or deposed.
+func (i *ResourceInstance) HasObjects() bool {
+        return i.Current != nil || len(i.Deposed) != 0
+}
+
+// deposeCurrentObject is part of the real implementation of
+// SyncState.DeposeResourceInstanceObject. The exported method uses a lock
+// to ensure that we can safely allocate an unused deposed key without
+// collision.
+func (i *ResourceInstance) deposeCurrentObject(forceKey DeposedKey) DeposedKey {
+        if !i.HasCurrent() {
+                return NotDeposed
+        }
+
+        key := forceKey
+        if key == NotDeposed {
+                key = i.findUnusedDeposedKey()
+        } else {
+                if _, exists := i.Deposed[key]; exists {
+                        panic(fmt.Sprintf("forced key %s is already in use", forceKey))
+                }
+        }
+        i.Deposed[key] = i.Current
+        i.Current = nil
+        return key
+}
+
+// GetGeneration retrieves the object of the given generation from the
+// ResourceInstance, or returns nil if there is no such object.
+//
+// If the given generation is nil or invalid, this method will panic.
+func (i *ResourceInstance) GetGeneration(gen Generation) *ResourceInstanceObjectSrc {
+        if gen == CurrentGen {
+                return i.Current
+        }
+        if dk, ok := gen.(DeposedKey); ok {
+                return i.Deposed[dk]
+        }
+        if gen == nil {
+                panic(fmt.Sprintf("get with nil Generation"))
+        }
+        // Should never fall out here, since the above covers all possible
+        // Generation values.
+        panic(fmt.Sprintf("get invalid Generation %#v", gen))
+}
+
+// FindUnusedDeposedKey generates a unique DeposedKey that is guaranteed not to
+// already be in use for this instance at the time of the call.
+//
+// Note that the validity of this result may change if new deposed keys are
+// allocated before it is used. To avoid this risk, instead use the
+// DeposeResourceInstanceObject method on the SyncState wrapper type, which
+// allocates a key and uses it atomically.
+func (i *ResourceInstance) FindUnusedDeposedKey() DeposedKey {
+        return i.findUnusedDeposedKey()
+}
+
+// findUnusedDeposedKey generates a unique DeposedKey that is guaranteed not to
+// already be in use for this instance.
+func (i *ResourceInstance) findUnusedDeposedKey() DeposedKey {
+        for {
+                key := NewDeposedKey()
+                if _, exists := i.Deposed[key]; !exists {
+                        return key
+                }
+                // Spin until we find a unique one. This shouldn't take long, because
+                // we have a 32-bit keyspace and there's rarely more than one deposed
+                // instance.
+        }
+}
+
+// EachMode specifies the multi-instance mode for a resource.
+type EachMode rune
+
+const (
+        NoEach   EachMode = 0
+        EachList EachMode = 'L'
+        EachMap  EachMode = 'M'
+)
+
+//go:generate stringer -type EachMode
+
+func eachModeForInstanceKey(key addrs.InstanceKey) EachMode {
+        switch key.(type) {
+        case addrs.IntKey:
+                return EachList
+        case addrs.StringKey:
+                return EachMap
+        default:
+                if key == addrs.NoKey {
+                        return NoEach
+                }
+                panic(fmt.Sprintf("don't know an each mode for instance key %#v", key))
+        }
+}
+
+// DeposedKey is a 8-character hex string used to uniquely identify deposed
+// instance objects in the state.
+type DeposedKey string
+
+// NotDeposed is a special invalid value of DeposedKey that is used to represent
+// the absense of a deposed key. It must not be used as an actual deposed key.
+const NotDeposed = DeposedKey("")
+
+var deposedKeyRand = rand.New(rand.NewSource(time.Now().UnixNano()))
+
+// NewDeposedKey generates a pseudo-random deposed key. Because of the short
+// length of these keys, uniqueness is not a natural consequence and so the
+// caller should test to see if the generated key is already in use and generate
+// another if so, until a unique key is found.
+func NewDeposedKey() DeposedKey {
+        v := deposedKeyRand.Uint32()
+        return DeposedKey(fmt.Sprintf("%08x", v))
+}
+
+func (k DeposedKey) String() string {
+        return string(k)
+}
+
+func (k DeposedKey) GoString() string {
+        ks := string(k)
+        switch {
+        case ks == "":
+                return "states.NotDeposed"
+        default:
+                return fmt.Sprintf("states.DeposedKey(%s)", ks)
+        }
+}
+
+// Generation is a helper method to convert a DeposedKey into a Generation.
+// If the reciever is anything other than NotDeposed then the result is
+// just the same value as a Generation. If the receiver is NotDeposed then
+// the result is CurrentGen.
+func (k DeposedKey) Generation() Generation {
+        if k == NotDeposed {
+                return CurrentGen
+        }
+        return k
+}
+
+// generation is an implementation of Generation.
+func (k DeposedKey) generation() {}
diff --git a/vendor/github.com/hashicorp/terraform/states/state.go b/vendor/github.com/hashicorp/terraform/states/state.go
new file mode 100644
index 0000000..1f84235
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/state.go
@@ -0,0 +1,229 @@
+package states
+
+import (
+        "sort"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// State is the top-level type of a Terraform state.
+//
+// A state should be mutated only via its accessor methods, to ensure that
+// invariants are preserved.
+//
+// Access to State and the nested values within it is not concurrency-safe,
+// so when accessing a State object concurrently it is the caller's
+// responsibility to ensure that only one write is in progress at a time
+// and that reads only occur when no write is in progress. The most common
+// way to acheive this is to wrap the State in a SyncState and use the
+// higher-level atomic operations supported by that type.
+type State struct {
+        // Modules contains the state for each module. The keys in this map are
+        // an implementation detail and must not be used by outside callers.
+        Modules map[string]*Module
+}
+
+// NewState constructs a minimal empty state, containing an empty root module.
+func NewState() *State {
+        modules := map[string]*Module{}
+        modules[addrs.RootModuleInstance.String()] = NewModule(addrs.RootModuleInstance)
+        return &State{
+                Modules: modules,
+        }
+}
+
+// BuildState is a helper -- primarily intended for tests -- to build a state
+// using imperative code against the StateSync type while still acting as
+// an expression of type *State to assign into a containing struct.
+func BuildState(cb func(*SyncState)) *State {
+        s := NewState()
+        cb(s.SyncWrapper())
+        return s
+}
+
+// Empty returns true if there are no resources or populated output values
+// in the receiver. In other words, if this state could be safely replaced
+// with the return value of NewState and be functionally equivalent.
+func (s *State) Empty() bool {
+        if s == nil {
+                return true
+        }
+        for _, ms := range s.Modules {
+                if len(ms.Resources) != 0 {
+                        return false
+                }
+                if len(ms.OutputValues) != 0 {
+                        return false
+                }
+        }
+        return true
+}
+
+// Module returns the state for the module with the given address, or nil if
+// the requested module is not tracked in the state.
+func (s *State) Module(addr addrs.ModuleInstance) *Module {
+        if s == nil {
+                panic("State.Module on nil *State")
+        }
+        return s.Modules[addr.String()]
+}
+
+// RemoveModule removes the module with the given address from the state,
+// unless it is the root module. The root module cannot be deleted, and so
+// this method will panic if that is attempted.
+//
+// Removing a module implicitly discards all of the resources, outputs and
+// local values within it, and so this should usually be done only for empty
+// modules. For callers accessing the state through a SyncState wrapper, modules
+// are automatically pruned if they are empty after one of their contained
+// elements is removed.
+func (s *State) RemoveModule(addr addrs.ModuleInstance) {
+        if addr.IsRoot() {
+                panic("attempted to remove root module")
+        }
+
+        delete(s.Modules, addr.String())
+}
+
+// RootModule is a convenient alias for Module(addrs.RootModuleInstance).
+func (s *State) RootModule() *Module {
+        if s == nil {
+                panic("RootModule called on nil State")
+        }
+        return s.Modules[addrs.RootModuleInstance.String()]
+}
+
+// EnsureModule returns the state for the module with the given address,
+// creating and adding a new one if necessary.
+//
+// Since this might modify the state to add a new instance, it is considered
+// to be a write operation.
+func (s *State) EnsureModule(addr addrs.ModuleInstance) *Module {
+        ms := s.Module(addr)
+        if ms == nil {
+                ms = NewModule(addr)
+                s.Modules[addr.String()] = ms
+        }
+        return ms
+}
+
+// HasResources returns true if there is at least one resource (of any mode)
+// present in the receiving state.
+func (s *State) HasResources() bool {
+        if s == nil {
+                return false
+        }
+        for _, ms := range s.Modules {
+                if len(ms.Resources) > 0 {
+                        return true
+                }
+        }
+        return false
+}
+
+// Resource returns the state for the resource with the given address, or nil
+// if no such resource is tracked in the state.
+func (s *State) Resource(addr addrs.AbsResource) *Resource {
+        ms := s.Module(addr.Module)
+        if ms == nil {
+                return nil
+        }
+        return ms.Resource(addr.Resource)
+}
+
+// ResourceInstance returns the state for the resource instance with the given
+// address, or nil if no such resource is tracked in the state.
+func (s *State) ResourceInstance(addr addrs.AbsResourceInstance) *ResourceInstance {
+        if s == nil {
+                panic("State.ResourceInstance on nil *State")
+        }
+        ms := s.Module(addr.Module)
+        if ms == nil {
+                return nil
+        }
+        return ms.ResourceInstance(addr.Resource)
+}
+
+// OutputValue returns the state for the output value with the given address,
+// or nil if no such output value is tracked in the state.
+func (s *State) OutputValue(addr addrs.AbsOutputValue) *OutputValue {
+        ms := s.Module(addr.Module)
+        if ms == nil {
+                return nil
+        }
+        return ms.OutputValues[addr.OutputValue.Name]
+}
+
+// LocalValue returns the value of the named local value with the given address,
+// or cty.NilVal if no such value is tracked in the state.
+func (s *State) LocalValue(addr addrs.AbsLocalValue) cty.Value {
+        ms := s.Module(addr.Module)
+        if ms == nil {
+                return cty.NilVal
+        }
+        return ms.LocalValues[addr.LocalValue.Name]
+}
+
+// ProviderAddrs returns a list of all of the provider configuration addresses
+// referenced throughout the receiving state.
+//
+// The result is de-duplicated so that each distinct address appears only once.
+func (s *State) ProviderAddrs() []addrs.AbsProviderConfig {
+        if s == nil {
+                return nil
+        }
+
+        m := map[string]addrs.AbsProviderConfig{}
+        for _, ms := range s.Modules {
+                for _, rc := range ms.Resources {
+                        m[rc.ProviderConfig.String()] = rc.ProviderConfig
+                }
+        }
+        if len(m) == 0 {
+                return nil
+        }
+
+        // This is mainly just so we'll get stable results for testing purposes.
+        keys := make([]string, 0, len(m))
+        for k := range m {
+                keys = append(keys, k)
+        }
+        sort.Strings(keys)
+
+        ret := make([]addrs.AbsProviderConfig, len(keys))
+        for i, key := range keys {
+                ret[i] = m[key]
+        }
+
+        return ret
+}
+
+// PruneResourceHusks is a specialized method that will remove any Resource
+// objects that do not contain any instances, even if they have an EachMode.
+//
+// This should generally be used only after a "terraform destroy" operation,
+// to finalize the cleanup of the state. It is not correct to use this after
+// other operations because if a resource has "count = 0" or "for_each" over
+// an empty collection then we want to retain it in the state so that references
+// to it, particularly in "strange" contexts like "terraform console", can be
+// properly resolved.
+//
+// This method MUST NOT be called concurrently with other readers and writers
+// of the receiving state.
+func (s *State) PruneResourceHusks() {
+        for _, m := range s.Modules {
+                m.PruneResourceHusks()
+                if len(m.Resources) == 0 && !m.Addr.IsRoot() {
+                        s.RemoveModule(m.Addr)
+                }
+        }
+}
+
+// SyncWrapper returns a SyncState object wrapping the receiver.
+func (s *State) SyncWrapper() *SyncState {
+        return &SyncState{
+                state: s,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/state_deepcopy.go b/vendor/github.com/hashicorp/terraform/states/state_deepcopy.go
new file mode 100644
index 0000000..ea717d0
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/state_deepcopy.go
@@ -0,0 +1,218 @@
+package states
+
+import (
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Taking deep copies of states is an important operation because state is
+// otherwise a mutable data structure that is challenging to share across
+// many separate callers. It is important that the DeepCopy implementations
+// in this file comprehensively copy all parts of the state data structure
+// that could be mutated via pointers.
+
+// DeepCopy returns a new state that contains equivalent data to the reciever
+// but shares no backing memory in common.
+//
+// As with all methods on State, this method is not safe to use concurrently
+// with writing to any portion of the recieving data structure. It is the
+// caller's responsibility to ensure mutual exclusion for the duration of the
+// operation, but may then freely modify the receiver and the returned copy
+// independently once this method returns.
+func (s *State) DeepCopy() *State {
+        if s == nil {
+                return nil
+        }
+
+        modules := make(map[string]*Module, len(s.Modules))
+        for k, m := range s.Modules {
+                modules[k] = m.DeepCopy()
+        }
+        return &State{
+                Modules: modules,
+        }
+}
+
+// DeepCopy returns a new module state that contains equivalent data to the
+// receiver but shares no backing memory in common.
+//
+// As with all methods on Module, this method is not safe to use concurrently
+// with writing to any portion of the recieving data structure. It is the
+// caller's responsibility to ensure mutual exclusion for the duration of the
+// operation, but may then freely modify the receiver and the returned copy
+// independently once this method returns.
+func (ms *Module) DeepCopy() *Module {
+        if ms == nil {
+                return nil
+        }
+
+        resources := make(map[string]*Resource, len(ms.Resources))
+        for k, r := range ms.Resources {
+                resources[k] = r.DeepCopy()
+        }
+        outputValues := make(map[string]*OutputValue, len(ms.OutputValues))
+        for k, v := range ms.OutputValues {
+                outputValues[k] = v.DeepCopy()
+        }
+        localValues := make(map[string]cty.Value, len(ms.LocalValues))
+        for k, v := range ms.LocalValues {
+                // cty.Value is immutable, so we don't need to copy these.
+                localValues[k] = v
+        }
+
+        return &Module{
+                Addr:         ms.Addr, // technically mutable, but immutable by convention
+                Resources:    resources,
+                OutputValues: outputValues,
+                LocalValues:  localValues,
+        }
+}
+
+// DeepCopy returns a new resource state that contains equivalent data to the
+// receiver but shares no backing memory in common.
+//
+// As with all methods on Resource, this method is not safe to use concurrently
+// with writing to any portion of the recieving data structure. It is the
+// caller's responsibility to ensure mutual exclusion for the duration of the
+// operation, but may then freely modify the receiver and the returned copy
+// independently once this method returns.
+func (rs *Resource) DeepCopy() *Resource {
+        if rs == nil {
+                return nil
+        }
+
+        instances := make(map[addrs.InstanceKey]*ResourceInstance, len(rs.Instances))
+        for k, i := range rs.Instances {
+                instances[k] = i.DeepCopy()
+        }
+
+        return &Resource{
+                Addr:           rs.Addr,
+                EachMode:       rs.EachMode,
+                Instances:      instances,
+                ProviderConfig: rs.ProviderConfig, // technically mutable, but immutable by convention
+        }
+}
+
+// DeepCopy returns a new resource instance state that contains equivalent data
+// to the receiver but shares no backing memory in common.
+//
+// As with all methods on ResourceInstance, this method is not safe to use
+// concurrently with writing to any portion of the recieving data structure. It
+// is the caller's responsibility to ensure mutual exclusion for the duration
+// of the operation, but may then freely modify the receiver and the returned
+// copy independently once this method returns.
+func (is *ResourceInstance) DeepCopy() *ResourceInstance {
+        if is == nil {
+                return nil
+        }
+
+        deposed := make(map[DeposedKey]*ResourceInstanceObjectSrc, len(is.Deposed))
+        for k, obj := range is.Deposed {
+                deposed[k] = obj.DeepCopy()
+        }
+
+        return &ResourceInstance{
+                Current: is.Current.DeepCopy(),
+                Deposed: deposed,
+        }
+}
+
+// DeepCopy returns a new resource instance object that contains equivalent data
+// to the receiver but shares no backing memory in common.
+//
+// As with all methods on ResourceInstanceObjectSrc, this method is not safe to
+// use concurrently with writing to any portion of the recieving data structure.
+// It is the caller's responsibility to ensure mutual exclusion for the duration
+// of the operation, but may then freely modify the receiver and the returned
+// copy independently once this method returns.
+func (obj *ResourceInstanceObjectSrc) DeepCopy() *ResourceInstanceObjectSrc {
+        if obj == nil {
+                return nil
+        }
+
+        var attrsFlat map[string]string
+        if obj.AttrsFlat != nil {
+                attrsFlat = make(map[string]string, len(obj.AttrsFlat))
+                for k, v := range obj.AttrsFlat {
+                        attrsFlat[k] = v
+                }
+        }
+
+        var attrsJSON []byte
+        if obj.AttrsJSON != nil {
+                attrsJSON = make([]byte, len(obj.AttrsJSON))
+                copy(attrsJSON, obj.AttrsJSON)
+        }
+
+        var private []byte
+        if obj.Private != nil {
+                private := make([]byte, len(obj.Private))
+                copy(private, obj.Private)
+        }
+
+        // Some addrs.Referencable implementations are technically mutable, but
+        // we treat them as immutable by convention and so we don't deep-copy here.
+        dependencies := make([]addrs.Referenceable, len(obj.Dependencies))
+        copy(dependencies, obj.Dependencies)
+
+        return &ResourceInstanceObjectSrc{
+                Status:        obj.Status,
+                SchemaVersion: obj.SchemaVersion,
+                Private:       private,
+                AttrsFlat:     attrsFlat,
+                AttrsJSON:     attrsJSON,
+                Dependencies:  dependencies,
+        }
+}
+
+// DeepCopy returns a new resource instance object that contains equivalent data
+// to the receiver but shares no backing memory in common.
+//
+// As with all methods on ResourceInstanceObject, this method is not safe to use
+// concurrently with writing to any portion of the recieving data structure. It
+// is the caller's responsibility to ensure mutual exclusion for the duration
+// of the operation, but may then freely modify the receiver and the returned
+// copy independently once this method returns.
+func (obj *ResourceInstanceObject) DeepCopy() *ResourceInstanceObject {
+        if obj == nil {
+                return nil
+        }
+
+        var private []byte
+        if obj.Private != nil {
+                private := make([]byte, len(obj.Private))
+                copy(private, obj.Private)
+        }
+
+        // Some addrs.Referencable implementations are technically mutable, but
+        // we treat them as immutable by convention and so we don't deep-copy here.
+        dependencies := make([]addrs.Referenceable, len(obj.Dependencies))
+        copy(dependencies, obj.Dependencies)
+
+        return &ResourceInstanceObject{
+                Value:        obj.Value,
+                Status:       obj.Status,
+                Private:      private,
+                Dependencies: dependencies,
+        }
+}
+
+// DeepCopy returns a new output value state that contains equivalent data
+// to the receiver but shares no backing memory in common.
+//
+// As with all methods on OutputValue, this method is not safe to use
+// concurrently with writing to any portion of the recieving data structure. It
+// is the caller's responsibility to ensure mutual exclusion for the duration
+// of the operation, but may then freely modify the receiver and the returned
+// copy independently once this method returns.
+func (os *OutputValue) DeepCopy() *OutputValue {
+        if os == nil {
+                return nil
+        }
+
+        return &OutputValue{
+                Value:     os.Value,
+                Sensitive: os.Sensitive,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/state_equal.go b/vendor/github.com/hashicorp/terraform/states/state_equal.go
new file mode 100644
index 0000000..ea20967
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/state_equal.go
@@ -0,0 +1,18 @@
+package states
+
+import (
+        "reflect"
+)
+
+// Equal returns true if the receiver is functionally equivalent to other,
+// including any ephemeral portions of the state that would not be included
+// if the state were saved to files.
+//
+// To test only the persistent portions of two states for equality, instead
+// use statefile.StatesMarshalEqual.
+func (s *State) Equal(other *State) bool {
+        // For the moment this is sufficient, but we may need to do something
+        // more elaborate in future if we have any portions of state that require
+        // more sophisticated comparisons.
+        return reflect.DeepEqual(s, other)
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/state_string.go b/vendor/github.com/hashicorp/terraform/states/state_string.go
new file mode 100644
index 0000000..bca4581
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/state_string.go
@@ -0,0 +1,279 @@
+package states
+
+import (
+        "bufio"
+        "bytes"
+        "encoding/json"
+        "fmt"
+        "sort"
+        "strings"
+
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+)
+
+// String returns a rather-odd string representation of the entire state.
+//
+// This is intended to match the behavior of the older terraform.State.String
+// method that is used in lots of existing tests. It should not be used in
+// new tests: instead, use "cmp" to directly compare the state data structures
+// and print out a diff if they do not match.
+//
+// This method should never be used in non-test code, whether directly by call
+// or indirectly via a %s or %q verb in package fmt.
+func (s *State) String() string {
+        if s == nil {
+                return "<nil>"
+        }
+
+        // sort the modules by name for consistent output
+        modules := make([]string, 0, len(s.Modules))
+        for m := range s.Modules {
+                modules = append(modules, m)
+        }
+        sort.Strings(modules)
+
+        var buf bytes.Buffer
+        for _, name := range modules {
+                m := s.Modules[name]
+                mStr := m.testString()
+
+                // If we're the root module, we just write the output directly.
+                if m.Addr.IsRoot() {
+                        buf.WriteString(mStr + "\n")
+                        continue
+                }
+
+                // We need to build out a string that resembles the not-quite-standard
+                // format that terraform.State.String used to use, where there's a
+                // "module." prefix but then just a chain of all of the module names
+                // without any further "module." portions.
+                buf.WriteString("module")
+                for _, step := range m.Addr {
+                        buf.WriteByte('.')
+                        buf.WriteString(step.Name)
+                        if step.InstanceKey != addrs.NoKey {
+                                buf.WriteByte('[')
+                                buf.WriteString(step.InstanceKey.String())
+                                buf.WriteByte(']')
+                        }
+                }
+                buf.WriteString(":\n")
+
+                s := bufio.NewScanner(strings.NewReader(mStr))
+                for s.Scan() {
+                        text := s.Text()
+                        if text != "" {
+                                text = "  " + text
+                        }
+
+                        buf.WriteString(fmt.Sprintf("%s\n", text))
+                }
+        }
+
+        return strings.TrimSpace(buf.String())
+}
+
+// testString is used to produce part of the output of State.String. It should
+// never be used directly.
+func (m *Module) testString() string {
+        var buf bytes.Buffer
+
+        if len(m.Resources) == 0 {
+                buf.WriteString("<no state>")
+        }
+
+        // We use AbsResourceInstance here, even though everything belongs to
+        // the same module, just because we have a sorting behavior defined
+        // for those but not for just ResourceInstance.
+        addrsOrder := make([]addrs.AbsResourceInstance, 0, len(m.Resources))
+        for _, rs := range m.Resources {
+                for ik := range rs.Instances {
+                        addrsOrder = append(addrsOrder, rs.Addr.Instance(ik).Absolute(addrs.RootModuleInstance))
+                }
+        }
+
+        sort.Slice(addrsOrder, func(i, j int) bool {
+                return addrsOrder[i].Less(addrsOrder[j])
+        })
+
+        for _, fakeAbsAddr := range addrsOrder {
+                addr := fakeAbsAddr.Resource
+                rs := m.Resource(addr.ContainingResource())
+                is := m.ResourceInstance(addr)
+
+                // Here we need to fake up a legacy-style address as the old state
+                // types would've used, since that's what our tests against those
+                // old types expect. The significant difference is that instancekey
+                // is dot-separated rather than using index brackets.
+                k := addr.ContainingResource().String()
+                if addr.Key != addrs.NoKey {
+                        switch tk := addr.Key.(type) {
+                        case addrs.IntKey:
+                                k = fmt.Sprintf("%s.%d", k, tk)
+                        default:
+                                // No other key types existed for the legacy types, so we
+                                // can do whatever we want here. We'll just use our standard
+                                // syntax for these.
+                                k = k + tk.String()
+                        }
+                }
+
+                id := LegacyInstanceObjectID(is.Current)
+
+                taintStr := ""
+                if is.Current != nil && is.Current.Status == ObjectTainted {
+                        taintStr = " (tainted)"
+                }
+
+                deposedStr := ""
+                if len(is.Deposed) > 0 {
+                        deposedStr = fmt.Sprintf(" (%d deposed)", len(is.Deposed))
+                }
+
+                buf.WriteString(fmt.Sprintf("%s:%s%s\n", k, taintStr, deposedStr))
+                buf.WriteString(fmt.Sprintf("  ID = %s\n", id))
+                buf.WriteString(fmt.Sprintf("  provider = %s\n", rs.ProviderConfig.String()))
+
+                // Attributes were a flatmap before, but are not anymore. To preserve
+                // our old output as closely as possible we need to do a conversion
+                // to flatmap. Normally we'd want to do this with schema for
+                // accuracy, but for our purposes here it only needs to be approximate.
+                // This should produce an identical result for most cases, though
+                // in particular will differ in a few cases:
+                //  - The keys used for elements in a set will be different
+                //  - Values for attributes of type cty.DynamicPseudoType will be
+                //    misinterpreted (but these weren't possible in old world anyway)
+                var attributes map[string]string
+                if obj := is.Current; obj != nil {
+                        switch {
+                        case obj.AttrsFlat != nil:
+                                // Easy (but increasingly unlikely) case: the state hasn't
+                                // actually been upgraded to the new form yet.
+                                attributes = obj.AttrsFlat
+                        case obj.AttrsJSON != nil:
+                                ty, err := ctyjson.ImpliedType(obj.AttrsJSON)
+                                if err == nil {
+                                        val, err := ctyjson.Unmarshal(obj.AttrsJSON, ty)
+                                        if err == nil {
+                                                attributes = hcl2shim.FlatmapValueFromHCL2(val)
+                                        }
+                                }
+                        }
+                }
+                attrKeys := make([]string, 0, len(attributes))
+                for ak, val := range attributes {
+                        if ak == "id" {
+                                continue
+                        }
+
+                        // don't show empty containers in the output
+                        if val == "0" && (strings.HasSuffix(ak, ".#") || strings.HasSuffix(ak, ".%")) {
+                                continue
+                        }
+
+                        attrKeys = append(attrKeys, ak)
+                }
+
+                sort.Strings(attrKeys)
+
+                for _, ak := range attrKeys {
+                        av := attributes[ak]
+                        buf.WriteString(fmt.Sprintf("  %s = %s\n", ak, av))
+                }
+
+                // CAUTION: Since deposed keys are now random strings instead of
+                // incrementing integers, this result will not be deterministic
+                // if there is more than one deposed object.
+                i := 1
+                for _, t := range is.Deposed {
+                        id := LegacyInstanceObjectID(t)
+                        taintStr := ""
+                        if t.Status == ObjectTainted {
+                                taintStr = " (tainted)"
+                        }
+                        buf.WriteString(fmt.Sprintf("  Deposed ID %d = %s%s\n", i, id, taintStr))
+                        i++
+                }
+
+                if obj := is.Current; obj != nil && len(obj.Dependencies) > 0 {
+                        buf.WriteString(fmt.Sprintf("\n  Dependencies:\n"))
+                        for _, dep := range obj.Dependencies {
+                                buf.WriteString(fmt.Sprintf("    %s\n", dep.String()))
+                        }
+                }
+        }
+
+        if len(m.OutputValues) > 0 {
+                buf.WriteString("\nOutputs:\n\n")
+
+                ks := make([]string, 0, len(m.OutputValues))
+                for k := range m.OutputValues {
+                        ks = append(ks, k)
+                }
+                sort.Strings(ks)
+
+                for _, k := range ks {
+                        v := m.OutputValues[k]
+                        lv := hcl2shim.ConfigValueFromHCL2(v.Value)
+                        switch vTyped := lv.(type) {
+                        case string:
+                                buf.WriteString(fmt.Sprintf("%s = %s\n", k, vTyped))
+                        case []interface{}:
+                                buf.WriteString(fmt.Sprintf("%s = %s\n", k, vTyped))
+                        case map[string]interface{}:
+                                var mapKeys []string
+                                for key := range vTyped {
+                                        mapKeys = append(mapKeys, key)
+                                }
+                                sort.Strings(mapKeys)
+
+                                var mapBuf bytes.Buffer
+                                mapBuf.WriteString("{")
+                                for _, key := range mapKeys {
+                                        mapBuf.WriteString(fmt.Sprintf("%s:%s ", key, vTyped[key]))
+                                }
+                                mapBuf.WriteString("}")
+
+                                buf.WriteString(fmt.Sprintf("%s = %s\n", k, mapBuf.String()))
+                        default:
+                                buf.WriteString(fmt.Sprintf("%s = %#v\n", k, lv))
+                        }
+                }
+        }
+
+        return buf.String()
+}
+
+// LegacyInstanceObjectID is a helper for extracting an object id value from
+// an instance object in a way that approximates how we used to do this
+// for the old state types. ID is no longer first-class, so this is preserved
+// only for compatibility with old tests that include the id as part of their
+// expected value.
+func LegacyInstanceObjectID(obj *ResourceInstanceObjectSrc) string {
+        if obj == nil {
+                return "<not created>"
+        }
+
+        if obj.AttrsJSON != nil {
+                type WithID struct {
+                        ID string `json:"id"`
+                }
+                var withID WithID
+                err := json.Unmarshal(obj.AttrsJSON, &withID)
+                if err == nil {
+                        return withID.ID
+                }
+        } else if obj.AttrsFlat != nil {
+                if flatID, exists := obj.AttrsFlat["id"]; exists {
+                        return flatID
+                }
+        }
+
+        // For resource types created after we removed id as special there may
+        // not actually be one at all. This is okay because older tests won't
+        // encounter this, and new tests shouldn't be using ids.
+        return "<none>"
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/diagnostics.go b/vendor/github.com/hashicorp/terraform/states/statefile/diagnostics.go
new file mode 100644
index 0000000..a6d88ec
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/diagnostics.go
@@ -0,0 +1,62 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+const invalidFormat = "Invalid state file format"
+
+// jsonUnmarshalDiags is a helper that translates errors returned from
+// json.Unmarshal into hopefully-more-helpful diagnostics messages.
+func jsonUnmarshalDiags(err error) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+        if err == nil {
+                return diags
+        }
+
+        switch tErr := err.(type) {
+        case *json.SyntaxError:
+                // We've usually already successfully parsed a source file as JSON at
+                // least once before we'd use jsonUnmarshalDiags with it (to sniff
+                // the version number) so this particular error should not appear much
+                // in practice.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        invalidFormat,
+                        fmt.Sprintf("The state file could not be parsed as JSON: syntax error at byte offset %d.", tErr.Offset),
+                ))
+        case *json.UnmarshalTypeError:
+                // This is likely to be the most common area, describing a
+                // non-conformance between the file and the expected file format
+                // at a semantic level.
+                if tErr.Field != "" {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                invalidFormat,
+                                fmt.Sprintf("The state file field %q has invalid value %s", tErr.Field, tErr.Value),
+                        ))
+                        break
+                } else {
+                        // Without a field name, we can't really say anything helpful.
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                invalidFormat,
+                                "The state file does not conform to the expected JSON data structure.",
+                        ))
+                }
+        default:
+                // Fallback for all other types of errors. This can happen only for
+                // custom UnmarshalJSON implementations, so should be encountered
+                // only rarely.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        invalidFormat,
+                        fmt.Sprintf("The state file does not conform to the expected JSON data structure: %s.", err.Error()),
+                ))
+        }
+
+        return diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/doc.go b/vendor/github.com/hashicorp/terraform/states/statefile/doc.go
new file mode 100644
index 0000000..625d0cf
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/doc.go
@@ -0,0 +1,3 @@
+// Package statefile deals with the file format used to serialize states for
+// persistent storage and then deserialize them into memory again later.
+package statefile
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/file.go b/vendor/github.com/hashicorp/terraform/states/statefile/file.go
new file mode 100644
index 0000000..6e20240
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/file.go
@@ -0,0 +1,62 @@
+package statefile
+
+import (
+        version "github.com/hashicorp/go-version"
+
+        "github.com/hashicorp/terraform/states"
+        tfversion "github.com/hashicorp/terraform/version"
+)
+
+// File is the in-memory representation of a state file. It includes the state
+// itself along with various metadata used to track changing state files for
+// the same configuration over time.
+type File struct {
+        // TerraformVersion is the version of Terraform that wrote this state file.
+        TerraformVersion *version.Version
+
+        // Serial is incremented on any operation that modifies
+        // the State file. It is used to detect potentially conflicting
+        // updates.
+        Serial uint64
+
+        // Lineage is set when a new, blank state file is created and then
+        // never updated. This allows us to determine whether the serials
+        // of two states can be meaningfully compared.
+        // Apart from the guarantee that collisions between two lineages
+        // are very unlikely, this value is opaque and external callers
+        // should only compare lineage strings byte-for-byte for equality.
+        Lineage string
+
+        // State is the actual state represented by this file.
+        State *states.State
+}
+
+func New(state *states.State, lineage string, serial uint64) *File {
+        // To make life easier on callers, we'll accept a nil state here and just
+        // allocate an empty one, which is required for this file to be successfully
+        // written out.
+        if state == nil {
+                state = states.NewState()
+        }
+
+        return &File{
+                TerraformVersion: tfversion.SemVer,
+                State:            state,
+                Lineage:          lineage,
+                Serial:           serial,
+        }
+}
+
+// DeepCopy is a convenience method to create a new File object whose state
+// is a deep copy of the receiver's, as implemented by states.State.DeepCopy.
+func (f *File) DeepCopy() *File {
+        if f == nil {
+                return nil
+        }
+        return &File{
+                TerraformVersion: f.TerraformVersion,
+                Serial:           f.Serial,
+                Lineage:          f.Lineage,
+                State:            f.State.DeepCopy(),
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/marshal_equal.go b/vendor/github.com/hashicorp/terraform/states/statefile/marshal_equal.go
new file mode 100644
index 0000000..4948b39
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/marshal_equal.go
@@ -0,0 +1,40 @@
+package statefile
+
+import (
+        "bytes"
+
+        "github.com/hashicorp/terraform/states"
+)
+
+// StatesMarshalEqual returns true if and only if the two given states have
+// an identical (byte-for-byte) statefile representation.
+//
+// This function compares only the portions of the state that are persisted
+// in state files, so for example it will not return false if the only
+// differences between the two states are local values or descendent module
+// outputs.
+func StatesMarshalEqual(a, b *states.State) bool {
+        var aBuf bytes.Buffer
+        var bBuf bytes.Buffer
+
+        // nil states are not valid states, and so they can never martial equal.
+        if a == nil || b == nil {
+                return false
+        }
+
+        // We write here some temporary files that have no header information
+        // populated, thus ensuring that we're only comparing the state itself
+        // and not any metadata.
+        err := Write(&File{State: a}, &aBuf)
+        if err != nil {
+                // Should never happen, because we're writing to an in-memory buffer
+                panic(err)
+        }
+        err = Write(&File{State: b}, &bBuf)
+        if err != nil {
+                // Should never happen, because we're writing to an in-memory buffer
+                panic(err)
+        }
+
+        return bytes.Equal(aBuf.Bytes(), bBuf.Bytes())
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/read.go b/vendor/github.com/hashicorp/terraform/states/statefile/read.go
new file mode 100644
index 0000000..d691c02
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/read.go
@@ -0,0 +1,209 @@
+package statefile
+
+import (
+        "encoding/json"
+        "errors"
+        "fmt"
+        "io"
+        "io/ioutil"
+        "os"
+
+        version "github.com/hashicorp/go-version"
+
+        "github.com/hashicorp/terraform/tfdiags"
+        tfversion "github.com/hashicorp/terraform/version"
+)
+
+// ErrNoState is returned by ReadState when the state file is empty.
+var ErrNoState = errors.New("no state")
+
+// Read reads a state from the given reader.
+//
+// Legacy state format versions 1 through 3 are supported, but the result will
+// contain object attributes in the deprecated "flatmap" format and so must
+// be upgraded by the caller before use.
+//
+// If the state file is empty, the special error value ErrNoState is returned.
+// Otherwise, the returned error might be a wrapper around tfdiags.Diagnostics
+// potentially describing multiple errors.
+func Read(r io.Reader) (*File, error) {
+        // Some callers provide us a "typed nil" *os.File here, which would
+        // cause us to panic below if we tried to use it.
+        if f, ok := r.(*os.File); ok && f == nil {
+                return nil, ErrNoState
+        }
+
+        var diags tfdiags.Diagnostics
+
+        // We actually just buffer the whole thing in memory, because states are
+        // generally not huge and we need to do be able to sniff for a version
+        // number before full parsing.
+        src, err := ioutil.ReadAll(r)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to read state file",
+                        fmt.Sprintf("The state file could not be read: %s", err),
+                ))
+                return nil, diags.Err()
+        }
+
+        if len(src) == 0 {
+                return nil, ErrNoState
+        }
+
+        state, diags := readState(src)
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        if state == nil {
+                // Should never happen
+                panic("readState returned nil state with no errors")
+        }
+
+        if state.TerraformVersion != nil && state.TerraformVersion.GreaterThan(tfversion.SemVer) {
+                return state, fmt.Errorf(
+                        "state snapshot was created by Terraform v%s, which is newer than current v%s; upgrade to Terraform v%s or greater to work with this state",
+                        state.TerraformVersion,
+                        tfversion.SemVer,
+                        state.TerraformVersion,
+                )
+        }
+
+        return state, diags.Err()
+}
+
+func readState(src []byte) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        if looksLikeVersion0(src) {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        unsupportedFormat,
+                        "The state is stored in a legacy binary format that is not supported since Terraform v0.7. To continue, first upgrade the state using Terraform 0.6.16 or earlier.",
+                ))
+                return nil, diags
+        }
+
+        version, versionDiags := sniffJSONStateVersion(src)
+        diags = diags.Append(versionDiags)
+        if versionDiags.HasErrors() {
+                return nil, diags
+        }
+
+        switch version {
+        case 0:
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        unsupportedFormat,
+                        "The state file uses JSON syntax but has a version number of zero. There was never a JSON-based state format zero, so this state file is invalid and cannot be processed.",
+                ))
+                return nil, diags
+        case 1:
+                return readStateV1(src)
+        case 2:
+                return readStateV2(src)
+        case 3:
+                return readStateV3(src)
+        case 4:
+                return readStateV4(src)
+        default:
+                thisVersion := tfversion.SemVer.String()
+                creatingVersion := sniffJSONStateTerraformVersion(src)
+                switch {
+                case creatingVersion != "":
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                unsupportedFormat,
+                                fmt.Sprintf("The state file uses format version %d, which is not supported by Terraform %s. This state file was created by Terraform %s.", version, thisVersion, creatingVersion),
+                        ))
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                unsupportedFormat,
+                                fmt.Sprintf("The state file uses format version %d, which is not supported by Terraform %s. This state file may have been created by a newer version of Terraform.", version, thisVersion),
+                        ))
+                }
+                return nil, diags
+        }
+}
+
+func sniffJSONStateVersion(src []byte) (uint64, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        type VersionSniff struct {
+                Version *uint64 `json:"version"`
+        }
+        var sniff VersionSniff
+        err := json.Unmarshal(src, &sniff)
+        if err != nil {
+                switch tErr := err.(type) {
+                case *json.SyntaxError:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                unsupportedFormat,
+                                fmt.Sprintf("The state file could not be parsed as JSON: syntax error at byte offset %d.", tErr.Offset),
+                        ))
+                case *json.UnmarshalTypeError:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                unsupportedFormat,
+                                fmt.Sprintf("The version in the state file is %s. A positive whole number is required.", tErr.Value),
+                        ))
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                unsupportedFormat,
+                                "The state file could not be parsed as JSON.",
+                        ))
+                }
+        }
+
+        if sniff.Version == nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        unsupportedFormat,
+                        "The state file does not have a \"version\" attribute, which is required to identify the format version.",
+                ))
+                return 0, diags
+        }
+
+        return *sniff.Version, diags
+}
+
+// sniffJSONStateTerraformVersion attempts to sniff the Terraform version
+// specification from the given state file source code. The result is either
+// a version string or an empty string if no version number could be extracted.
+//
+// This is a best-effort function intended to produce nicer error messages. It
+// should not be used for any real processing.
+func sniffJSONStateTerraformVersion(src []byte) string {
+        type VersionSniff struct {
+                Version string `json:"terraform_version"`
+        }
+        var sniff VersionSniff
+
+        err := json.Unmarshal(src, &sniff)
+        if err != nil {
+                return ""
+        }
+
+        // Attempt to parse the string as a version so we won't report garbage
+        // as a version number.
+        _, err = version.NewVersion(sniff.Version)
+        if err != nil {
+                return ""
+        }
+
+        return sniff.Version
+}
+
+// unsupportedFormat is a diagnostic summary message for when the state file
+// seems to not be a state file at all, or is not a supported version.
+//
+// Use invalidFormat instead for the subtly-different case of "this looks like
+// it's intended to be a state file but it's not structured correctly".
+const unsupportedFormat = "Unsupported state file format"
+
+const upgradeFailed = "State format upgrade failed"
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version0.go b/vendor/github.com/hashicorp/terraform/states/statefile/version0.go
new file mode 100644
index 0000000..9b53331
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version0.go
@@ -0,0 +1,23 @@
+package statefile
+
+// looksLikeVersion0 sniffs for the signature indicating a version 0 state
+// file.
+//
+// Version 0 was the number retroactively assigned to Terraform's initial
+// (unversioned) binary state file format, which was later superseded by the
+// version 1 format in JSON.
+//
+// Version 0 is no longer supported, so this is used only to detect it and
+// return a nice error to the user.
+func looksLikeVersion0(src []byte) bool {
+        // Version 0 files begin with the magic prefix "tfstate".
+        const magic = "tfstate"
+        if len(src) < len(magic) {
+                // Not even long enough to have the magic prefix
+                return false
+        }
+        if string(src[0:len(magic)]) == magic {
+                return true
+        }
+        return false
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version1.go b/vendor/github.com/hashicorp/terraform/states/statefile/version1.go
new file mode 100644
index 0000000..80d711b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version1.go
@@ -0,0 +1,174 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func readStateV1(src []byte) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV1 := &stateV1{}
+        err := json.Unmarshal(src, sV1)
+        if err != nil {
+                diags = diags.Append(jsonUnmarshalDiags(err))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV1(sV1)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+func prepareStateV1(sV1 *stateV1) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV2, err := upgradeStateV1ToV2(sV1)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        upgradeFailed,
+                        fmt.Sprintf("Error upgrading state file format from version 1 to version 2: %s.", err),
+                ))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV2(sV2)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+// stateV1 is a representation of the legacy JSON state format version 1.
+//
+// It is only used to read version 1 JSON files prior to upgrading them to
+// the current format.
+type stateV1 struct {
+        // Version is the protocol version. "1" for a StateV1.
+        Version int `json:"version"`
+
+        // Serial is incremented on any operation that modifies
+        // the State file. It is used to detect potentially conflicting
+        // updates.
+        Serial int64 `json:"serial"`
+
+        // Remote is used to track the metadata required to
+        // pull and push state files from a remote storage endpoint.
+        Remote *remoteStateV1 `json:"remote,omitempty"`
+
+        // Modules contains all the modules in a breadth-first order
+        Modules []*moduleStateV1 `json:"modules"`
+}
+
+type remoteStateV1 struct {
+        // Type controls the client we use for the remote state
+        Type string `json:"type"`
+
+        // Config is used to store arbitrary configuration that
+        // is type specific
+        Config map[string]string `json:"config"`
+}
+
+type moduleStateV1 struct {
+        // Path is the import path from the root module. Modules imports are
+        // always disjoint, so the path represents amodule tree
+        Path []string `json:"path"`
+
+        // Outputs declared by the module and maintained for each module
+        // even though only the root module technically needs to be kept.
+        // This allows operators to inspect values at the boundaries.
+        Outputs map[string]string `json:"outputs"`
+
+        // Resources is a mapping of the logically named resource to
+        // the state of the resource. Each resource may actually have
+        // N instances underneath, although a user only needs to think
+        // about the 1:1 case.
+        Resources map[string]*resourceStateV1 `json:"resources"`
+
+        // Dependencies are a list of things that this module relies on
+        // existing to remain intact. For example: an module may depend
+        // on a VPC ID given by an aws_vpc resource.
+        //
+        // Terraform uses this information to build valid destruction
+        // orders and to warn the user if they're destroying a module that
+        // another resource depends on.
+        //
+        // Things can be put into this list that may not be managed by
+        // Terraform. If Terraform doesn't find a matching ID in the
+        // overall state, then it assumes it isn't managed and doesn't
+        // worry about it.
+        Dependencies []string `json:"depends_on,omitempty"`
+}
+
+type resourceStateV1 struct {
+        // This is filled in and managed by Terraform, and is the resource
+        // type itself such as "mycloud_instance". If a resource provider sets
+        // this value, it won't be persisted.
+        Type string `json:"type"`
+
+        // Dependencies are a list of things that this resource relies on
+        // existing to remain intact. For example: an AWS instance might
+        // depend on a subnet (which itself might depend on a VPC, and so
+        // on).
+        //
+        // Terraform uses this information to build valid destruction
+        // orders and to warn the user if they're destroying a resource that
+        // another resource depends on.
+        //
+        // Things can be put into this list that may not be managed by
+        // Terraform. If Terraform doesn't find a matching ID in the
+        // overall state, then it assumes it isn't managed and doesn't
+        // worry about it.
+        Dependencies []string `json:"depends_on,omitempty"`
+
+        // Primary is the current active instance for this resource.
+        // It can be replaced but only after a successful creation.
+        // This is the instances on which providers will act.
+        Primary *instanceStateV1 `json:"primary"`
+
+        // Tainted is used to track any underlying instances that
+        // have been created but are in a bad or unknown state and
+        // need to be cleaned up subsequently.  In the
+        // standard case, there is only at most a single instance.
+        // However, in pathological cases, it is possible for the number
+        // of instances to accumulate.
+        Tainted []*instanceStateV1 `json:"tainted,omitempty"`
+
+        // Deposed is used in the mechanics of CreateBeforeDestroy: the existing
+        // Primary is Deposed to get it out of the way for the replacement Primary to
+        // be created by Apply. If the replacement Primary creates successfully, the
+        // Deposed instance is cleaned up. If there were problems creating the
+        // replacement, the instance remains in the Deposed list so it can be
+        // destroyed in a future run. Functionally, Deposed instances are very
+        // similar to Tainted instances in that Terraform is only tracking them in
+        // order to remember to destroy them.
+        Deposed []*instanceStateV1 `json:"deposed,omitempty"`
+
+        // Provider is used when a resource is connected to a provider with an alias.
+        // If this string is empty, the resource is connected to the default provider,
+        // e.g. "aws_instance" goes with the "aws" provider.
+        // If the resource block contained a "provider" key, that value will be set here.
+        Provider string `json:"provider,omitempty"`
+}
+
+type instanceStateV1 struct {
+        // A unique ID for this resource. This is opaque to Terraform
+        // and is only meant as a lookup mechanism for the providers.
+        ID string `json:"id"`
+
+        // Attributes are basic information about the resource. Any keys here
+        // are accessible in variable format within Terraform configurations:
+        // ${resourcetype.name.attribute}.
+        Attributes map[string]string `json:"attributes,omitempty"`
+
+        // Meta is a simple K/V map that is persisted to the State but otherwise
+        // ignored by Terraform core. It's meant to be used for accounting by
+        // external client code.
+        Meta map[string]string `json:"meta,omitempty"`
+}
+
+type ephemeralStateV1 struct {
+        // ConnInfo is used for the providers to export information which is
+        // used to connect to the resource for provisioning. For example,
+        // this could contain SSH or WinRM credentials.
+        ConnInfo map[string]string `json:"-"`
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version1_upgrade.go b/vendor/github.com/hashicorp/terraform/states/statefile/version1_upgrade.go
new file mode 100644
index 0000000..0b417e1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version1_upgrade.go
@@ -0,0 +1,172 @@
+package statefile
+
+import (
+        "fmt"
+        "log"
+
+        "github.com/mitchellh/copystructure"
+)
+
+// upgradeStateV1ToV2 is used to upgrade a V1 state representation
+// into a V2 state representation
+func upgradeStateV1ToV2(old *stateV1) (*stateV2, error) {
+        log.Printf("[TRACE] statefile.Read: upgrading format from v1 to v2")
+        if old == nil {
+                return nil, nil
+        }
+
+        remote, err := old.Remote.upgradeToV2()
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading State V1: %v", err)
+        }
+
+        modules := make([]*moduleStateV2, len(old.Modules))
+        for i, module := range old.Modules {
+                upgraded, err := module.upgradeToV2()
+                if err != nil {
+                        return nil, fmt.Errorf("Error upgrading State V1: %v", err)
+                }
+                modules[i] = upgraded
+        }
+        if len(modules) == 0 {
+                modules = nil
+        }
+
+        newState := &stateV2{
+                Version: 2,
+                Serial:  old.Serial,
+                Remote:  remote,
+                Modules: modules,
+        }
+
+        return newState, nil
+}
+
+func (old *remoteStateV1) upgradeToV2() (*remoteStateV2, error) {
+        if old == nil {
+                return nil, nil
+        }
+
+        config, err := copystructure.Copy(old.Config)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading RemoteState V1: %v", err)
+        }
+
+        return &remoteStateV2{
+                Type:   old.Type,
+                Config: config.(map[string]string),
+        }, nil
+}
+
+func (old *moduleStateV1) upgradeToV2() (*moduleStateV2, error) {
+        if old == nil {
+                return nil, nil
+        }
+
+        pathRaw, err := copystructure.Copy(old.Path)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading ModuleState V1: %v", err)
+        }
+        path, ok := pathRaw.([]string)
+        if !ok {
+                return nil, fmt.Errorf("Error upgrading ModuleState V1: path is not a list of strings")
+        }
+        if len(path) == 0 {
+                // We found some V1 states with a nil path. Assume root.
+                path = []string{"root"}
+        }
+
+        // Outputs needs upgrading to use the new structure
+        outputs := make(map[string]*outputStateV2)
+        for key, output := range old.Outputs {
+                outputs[key] = &outputStateV2{
+                        Type:      "string",
+                        Value:     output,
+                        Sensitive: false,
+                }
+        }
+
+        resources := make(map[string]*resourceStateV2)
+        for key, oldResource := range old.Resources {
+                upgraded, err := oldResource.upgradeToV2()
+                if err != nil {
+                        return nil, fmt.Errorf("Error upgrading ModuleState V1: %v", err)
+                }
+                resources[key] = upgraded
+        }
+
+        dependencies, err := copystructure.Copy(old.Dependencies)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading ModuleState V1: %v", err)
+        }
+
+        return &moduleStateV2{
+                Path:         path,
+                Outputs:      outputs,
+                Resources:    resources,
+                Dependencies: dependencies.([]string),
+        }, nil
+}
+
+func (old *resourceStateV1) upgradeToV2() (*resourceStateV2, error) {
+        if old == nil {
+                return nil, nil
+        }
+
+        dependencies, err := copystructure.Copy(old.Dependencies)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading ResourceState V1: %v", err)
+        }
+
+        primary, err := old.Primary.upgradeToV2()
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading ResourceState V1: %v", err)
+        }
+
+        deposed := make([]*instanceStateV2, len(old.Deposed))
+        for i, v := range old.Deposed {
+                upgraded, err := v.upgradeToV2()
+                if err != nil {
+                        return nil, fmt.Errorf("Error upgrading ResourceState V1: %v", err)
+                }
+                deposed[i] = upgraded
+        }
+        if len(deposed) == 0 {
+                deposed = nil
+        }
+
+        return &resourceStateV2{
+                Type:         old.Type,
+                Dependencies: dependencies.([]string),
+                Primary:      primary,
+                Deposed:      deposed,
+                Provider:     old.Provider,
+        }, nil
+}
+
+func (old *instanceStateV1) upgradeToV2() (*instanceStateV2, error) {
+        if old == nil {
+                return nil, nil
+        }
+
+        attributes, err := copystructure.Copy(old.Attributes)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading InstanceState V1: %v", err)
+        }
+
+        meta, err := copystructure.Copy(old.Meta)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading InstanceState V1: %v", err)
+        }
+
+        newMeta := make(map[string]interface{})
+        for k, v := range meta.(map[string]string) {
+                newMeta[k] = v
+        }
+
+        return &instanceStateV2{
+                ID:         old.ID,
+                Attributes: attributes.(map[string]string),
+                Meta:       newMeta,
+        }, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version2.go b/vendor/github.com/hashicorp/terraform/states/statefile/version2.go
new file mode 100644
index 0000000..6fe2ab8
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version2.go
@@ -0,0 +1,209 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+        "sync"
+
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func readStateV2(src []byte) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV2 := &stateV2{}
+        err := json.Unmarshal(src, sV2)
+        if err != nil {
+                diags = diags.Append(jsonUnmarshalDiags(err))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV2(sV2)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+func prepareStateV2(sV2 *stateV2) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV3, err := upgradeStateV2ToV3(sV2)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        upgradeFailed,
+                        fmt.Sprintf("Error upgrading state file format from version 2 to version 3: %s.", err),
+                ))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV3(sV3)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+// stateV2 is a representation of the legacy JSON state format version 2.
+//
+// It is only used to read version 2 JSON files prior to upgrading them to
+// the current format.
+type stateV2 struct {
+        // Version is the state file protocol version.
+        Version int `json:"version"`
+
+        // TFVersion is the version of Terraform that wrote this state.
+        TFVersion string `json:"terraform_version,omitempty"`
+
+        // Serial is incremented on any operation that modifies
+        // the State file. It is used to detect potentially conflicting
+        // updates.
+        Serial int64 `json:"serial"`
+
+        // Lineage is set when a new, blank state is created and then
+        // never updated. This allows us to determine whether the serials
+        // of two states can be meaningfully compared.
+        // Apart from the guarantee that collisions between two lineages
+        // are very unlikely, this value is opaque and external callers
+        // should only compare lineage strings byte-for-byte for equality.
+        Lineage string `json:"lineage"`
+
+        // Remote is used to track the metadata required to
+        // pull and push state files from a remote storage endpoint.
+        Remote *remoteStateV2 `json:"remote,omitempty"`
+
+        // Backend tracks the configuration for the backend in use with
+        // this state. This is used to track any changes in the backend
+        // configuration.
+        Backend *backendStateV2 `json:"backend,omitempty"`
+
+        // Modules contains all the modules in a breadth-first order
+        Modules []*moduleStateV2 `json:"modules"`
+}
+
+type remoteStateV2 struct {
+        // Type controls the client we use for the remote state
+        Type string `json:"type"`
+
+        // Config is used to store arbitrary configuration that
+        // is type specific
+        Config map[string]string `json:"config"`
+}
+
+type outputStateV2 struct {
+        // Sensitive describes whether the output is considered sensitive,
+        // which may lead to masking the value on screen in some cases.
+        Sensitive bool `json:"sensitive"`
+        // Type describes the structure of Value. Valid values are "string",
+        // "map" and "list"
+        Type string `json:"type"`
+        // Value contains the value of the output, in the structure described
+        // by the Type field.
+        Value interface{} `json:"value"`
+
+        mu sync.Mutex
+}
+
+type moduleStateV2 struct {
+        // Path is the import path from the root module. Modules imports are
+        // always disjoint, so the path represents amodule tree
+        Path []string `json:"path"`
+
+        // Locals are kept only transiently in-memory, because we can always
+        // re-compute them.
+        Locals map[string]interface{} `json:"-"`
+
+        // Outputs declared by the module and maintained for each module
+        // even though only the root module technically needs to be kept.
+        // This allows operators to inspect values at the boundaries.
+        Outputs map[string]*outputStateV2 `json:"outputs"`
+
+        // Resources is a mapping of the logically named resource to
+        // the state of the resource. Each resource may actually have
+        // N instances underneath, although a user only needs to think
+        // about the 1:1 case.
+        Resources map[string]*resourceStateV2 `json:"resources"`
+
+        // Dependencies are a list of things that this module relies on
+        // existing to remain intact. For example: an module may depend
+        // on a VPC ID given by an aws_vpc resource.
+        //
+        // Terraform uses this information to build valid destruction
+        // orders and to warn the user if they're destroying a module that
+        // another resource depends on.
+        //
+        // Things can be put into this list that may not be managed by
+        // Terraform. If Terraform doesn't find a matching ID in the
+        // overall state, then it assumes it isn't managed and doesn't
+        // worry about it.
+        Dependencies []string `json:"depends_on"`
+}
+
+type resourceStateV2 struct {
+        // This is filled in and managed by Terraform, and is the resource
+        // type itself such as "mycloud_instance". If a resource provider sets
+        // this value, it won't be persisted.
+        Type string `json:"type"`
+
+        // Dependencies are a list of things that this resource relies on
+        // existing to remain intact. For example: an AWS instance might
+        // depend on a subnet (which itself might depend on a VPC, and so
+        // on).
+        //
+        // Terraform uses this information to build valid destruction
+        // orders and to warn the user if they're destroying a resource that
+        // another resource depends on.
+        //
+        // Things can be put into this list that may not be managed by
+        // Terraform. If Terraform doesn't find a matching ID in the
+        // overall state, then it assumes it isn't managed and doesn't
+        // worry about it.
+        Dependencies []string `json:"depends_on"`
+
+        // Primary is the current active instance for this resource.
+        // It can be replaced but only after a successful creation.
+        // This is the instances on which providers will act.
+        Primary *instanceStateV2 `json:"primary"`
+
+        // Deposed is used in the mechanics of CreateBeforeDestroy: the existing
+        // Primary is Deposed to get it out of the way for the replacement Primary to
+        // be created by Apply. If the replacement Primary creates successfully, the
+        // Deposed instance is cleaned up.
+        //
+        // If there were problems creating the replacement Primary, the Deposed
+        // instance and the (now tainted) replacement Primary will be swapped so the
+        // tainted replacement will be cleaned up instead.
+        //
+        // An instance will remain in the Deposed list until it is successfully
+        // destroyed and purged.
+        Deposed []*instanceStateV2 `json:"deposed"`
+
+        // Provider is used when a resource is connected to a provider with an alias.
+        // If this string is empty, the resource is connected to the default provider,
+        // e.g. "aws_instance" goes with the "aws" provider.
+        // If the resource block contained a "provider" key, that value will be set here.
+        Provider string `json:"provider"`
+
+        mu sync.Mutex
+}
+
+type instanceStateV2 struct {
+        // A unique ID for this resource. This is opaque to Terraform
+        // and is only meant as a lookup mechanism for the providers.
+        ID string `json:"id"`
+
+        // Attributes are basic information about the resource. Any keys here
+        // are accessible in variable format within Terraform configurations:
+        // ${resourcetype.name.attribute}.
+        Attributes map[string]string `json:"attributes"`
+
+        // Meta is a simple K/V map that is persisted to the State but otherwise
+        // ignored by Terraform core. It's meant to be used for accounting by
+        // external client code. The value here must only contain Go primitives
+        // and collections.
+        Meta map[string]interface{} `json:"meta"`
+
+        // Tainted is used to mark a resource for recreation.
+        Tainted bool `json:"tainted"`
+}
+
+type backendStateV2 struct {
+        Type      string          `json:"type"`   // Backend type
+        ConfigRaw json.RawMessage `json:"config"` // Backend raw config
+        Hash      int             `json:"hash"`   // Hash of portion of configuration from config files
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version2_upgrade.go b/vendor/github.com/hashicorp/terraform/states/statefile/version2_upgrade.go
new file mode 100644
index 0000000..2d03c07
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version2_upgrade.go
@@ -0,0 +1,145 @@
+package statefile
+
+import (
+        "fmt"
+        "log"
+        "regexp"
+        "sort"
+        "strconv"
+        "strings"
+
+        "github.com/mitchellh/copystructure"
+)
+
+func upgradeStateV2ToV3(old *stateV2) (*stateV3, error) {
+        if old == nil {
+                return (*stateV3)(nil), nil
+        }
+
+        var new *stateV3
+        {
+                copy, err := copystructure.Config{Lock: true}.Copy(old)
+                if err != nil {
+                        panic(err)
+                }
+                newWrongType := copy.(*stateV2)
+                newRightType := (stateV3)(*newWrongType)
+                new = &newRightType
+        }
+
+        // Set the new version number
+        new.Version = 3
+
+        // Change the counts for things which look like maps to use the %
+        // syntax. Remove counts for empty collections - they will be added
+        // back in later.
+        for _, module := range new.Modules {
+                for _, resource := range module.Resources {
+                        // Upgrade Primary
+                        if resource.Primary != nil {
+                                upgradeAttributesV2ToV3(resource.Primary)
+                        }
+
+                        // Upgrade Deposed
+                        for _, deposed := range resource.Deposed {
+                                upgradeAttributesV2ToV3(deposed)
+                        }
+                }
+        }
+
+        return new, nil
+}
+
+func upgradeAttributesV2ToV3(instanceState *instanceStateV2) error {
+        collectionKeyRegexp := regexp.MustCompile(`^(.*\.)#$`)
+        collectionSubkeyRegexp := regexp.MustCompile(`^([^\.]+)\..*`)
+
+        // Identify the key prefix of anything which is a collection
+        var collectionKeyPrefixes []string
+        for key := range instanceState.Attributes {
+                if submatches := collectionKeyRegexp.FindAllStringSubmatch(key, -1); len(submatches) > 0 {
+                        collectionKeyPrefixes = append(collectionKeyPrefixes, submatches[0][1])
+                }
+        }
+        sort.Strings(collectionKeyPrefixes)
+
+        log.Printf("[STATE UPGRADE] Detected the following collections in state: %v", collectionKeyPrefixes)
+
+        // This could be rolled into fewer loops, but it is somewhat clearer this way, and will not
+        // run very often.
+        for _, prefix := range collectionKeyPrefixes {
+                // First get the actual keys that belong to this prefix
+                var potentialKeysMatching []string
+                for key := range instanceState.Attributes {
+                        if strings.HasPrefix(key, prefix) {
+                                potentialKeysMatching = append(potentialKeysMatching, strings.TrimPrefix(key, prefix))
+                        }
+                }
+                sort.Strings(potentialKeysMatching)
+
+                var actualKeysMatching []string
+                for _, key := range potentialKeysMatching {
+                        if submatches := collectionSubkeyRegexp.FindAllStringSubmatch(key, -1); len(submatches) > 0 {
+                                actualKeysMatching = append(actualKeysMatching, submatches[0][1])
+                        } else {
+                                if key != "#" {
+                                        actualKeysMatching = append(actualKeysMatching, key)
+                                }
+                        }
+                }
+                actualKeysMatching = uniqueSortedStrings(actualKeysMatching)
+
+                // Now inspect the keys in order to determine whether this is most likely to be
+                // a map, list or set. There is room for error here, so we log in each case. If
+                // there is no method of telling, we remove the key from the InstanceState in
+                // order that it will be recreated. Again, this could be rolled into fewer loops
+                // but we prefer clarity.
+
+                oldCountKey := fmt.Sprintf("%s#", prefix)
+
+                // First, detect "obvious" maps - which have non-numeric keys (mostly).
+                hasNonNumericKeys := false
+                for _, key := range actualKeysMatching {
+                        if _, err := strconv.Atoi(key); err != nil {
+                                hasNonNumericKeys = true
+                        }
+                }
+                if hasNonNumericKeys {
+                        newCountKey := fmt.Sprintf("%s%%", prefix)
+
+                        instanceState.Attributes[newCountKey] = instanceState.Attributes[oldCountKey]
+                        delete(instanceState.Attributes, oldCountKey)
+                        log.Printf("[STATE UPGRADE] Detected %s as a map. Replaced count = %s",
+                                strings.TrimSuffix(prefix, "."), instanceState.Attributes[newCountKey])
+                }
+
+                // Now detect empty collections and remove them from state.
+                if len(actualKeysMatching) == 0 {
+                        delete(instanceState.Attributes, oldCountKey)
+                        log.Printf("[STATE UPGRADE] Detected %s as an empty collection. Removed from state.",
+                                strings.TrimSuffix(prefix, "."))
+                }
+        }
+
+        return nil
+}
+
+// uniqueSortedStrings removes duplicates from a slice of strings and returns
+// a sorted slice of the unique strings.
+func uniqueSortedStrings(input []string) []string {
+        uniquemap := make(map[string]struct{})
+        for _, str := range input {
+                uniquemap[str] = struct{}{}
+        }
+
+        output := make([]string, len(uniquemap))
+
+        i := 0
+        for key := range uniquemap {
+                output[i] = key
+                i = i + 1
+        }
+
+        sort.Strings(output)
+        return output
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version3.go b/vendor/github.com/hashicorp/terraform/states/statefile/version3.go
new file mode 100644
index 0000000..ab6414b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version3.go
@@ -0,0 +1,50 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func readStateV3(src []byte) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV3 := &stateV3{}
+        err := json.Unmarshal(src, sV3)
+        if err != nil {
+                diags = diags.Append(jsonUnmarshalDiags(err))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV3(sV3)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+func prepareStateV3(sV3 *stateV3) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV4, err := upgradeStateV3ToV4(sV3)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        upgradeFailed,
+                        fmt.Sprintf("Error upgrading state file format from version 3 to version 4: %s.", err),
+                ))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV4(sV4)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+// stateV2 is a representation of the legacy JSON state format version 3.
+//
+// It is only used to read version 3 JSON files prior to upgrading them to
+// the current format.
+//
+// The differences between version 2 and version 3 are only in the data and
+// not in the structure, so stateV3 actually shares the same structs as
+// stateV2. Type stateV3 represents that the data within is formatted as
+// expected by the V3 format, rather than the V2 format.
+type stateV3 stateV2
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version3_upgrade.go b/vendor/github.com/hashicorp/terraform/states/statefile/version3_upgrade.go
new file mode 100644
index 0000000..2cbe8a5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version3_upgrade.go
@@ -0,0 +1,431 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+        "strconv"
+        "strings"
+
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func upgradeStateV3ToV4(old *stateV3) (*stateV4, error) {
+
+        if old.Serial < 0 {
+                // The new format is using uint64 here, which should be fine for any
+                // real state (we only used positive integers in practice) but we'll
+                // catch this explicitly here to avoid weird behavior if a state file
+                // has been tampered with in some way.
+                return nil, fmt.Errorf("state has serial less than zero, which is invalid")
+        }
+
+        new := &stateV4{
+                TerraformVersion: old.TFVersion,
+                Serial:           uint64(old.Serial),
+                Lineage:          old.Lineage,
+                RootOutputs:      map[string]outputStateV4{},
+                Resources:        []resourceStateV4{},
+        }
+
+        if new.TerraformVersion == "" {
+                // Older formats considered this to be optional, but now it's required
+                // and so we'll stub it out with something that's definitely older
+                // than the version that really created this state.
+                new.TerraformVersion = "0.0.0"
+        }
+
+        for _, msOld := range old.Modules {
+                if len(msOld.Path) < 1 || msOld.Path[0] != "root" {
+                        return nil, fmt.Errorf("state contains invalid module path %#v", msOld.Path)
+                }
+
+                // Convert legacy-style module address into our newer address type.
+                // Since these old formats are only generated by versions of Terraform
+                // that don't support count and for_each on modules, we can just assume
+                // all of the modules are unkeyed.
+                moduleAddr := make(addrs.ModuleInstance, len(msOld.Path)-1)
+                for i, name := range msOld.Path[1:] {
+                        moduleAddr[i] = addrs.ModuleInstanceStep{
+                                Name:        name,
+                                InstanceKey: addrs.NoKey,
+                        }
+                }
+
+                // In a v3 state file, a "resource state" is actually an instance
+                // state, so we need to fill in a missing level of heirarchy here
+                // by lazily creating resource states as we encounter them.
+                // We'll track them in here, keyed on the string representation of
+                // the resource address.
+                resourceStates := map[string]*resourceStateV4{}
+
+                for legacyAddr, rsOld := range msOld.Resources {
+                        instAddr, err := parseLegacyResourceAddress(legacyAddr)
+                        if err != nil {
+                                return nil, err
+                        }
+
+                        resAddr := instAddr.Resource
+                        rs, exists := resourceStates[resAddr.String()]
+                        if !exists {
+                                var modeStr string
+                                switch resAddr.Mode {
+                                case addrs.ManagedResourceMode:
+                                        modeStr = "managed"
+                                case addrs.DataResourceMode:
+                                        modeStr = "data"
+                                default:
+                                        return nil, fmt.Errorf("state contains resource %s with an unsupported resource mode", resAddr)
+                                }
+
+                                // In state versions prior to 4 we allowed each instance of a
+                                // resource to have its own provider configuration address,
+                                // which makes no real sense in practice because providers
+                                // are associated with resources in the configuration. We
+                                // elevate that to the resource level during this upgrade,
+                                // implicitly taking the provider address of the first instance
+                                // we encounter for each resource. While this is lossy in
+                                // theory, in practice there is no reason for these values to
+                                // differ between instances.
+                                var providerAddr addrs.AbsProviderConfig
+                                oldProviderAddr := rsOld.Provider
+                                if strings.Contains(oldProviderAddr, "provider.") {
+                                        // Smells like a new-style provider address, but we'll test it.
+                                        var diags tfdiags.Diagnostics
+                                        providerAddr, diags = addrs.ParseAbsProviderConfigStr(oldProviderAddr)
+                                        if diags.HasErrors() {
+                                                return nil, diags.Err()
+                                        }
+                                } else {
+                                        // Smells like an old-style module-local provider address,
+                                        // which we'll need to migrate. We'll assume it's referring
+                                        // to the same module the resource is in, which might be
+                                        // incorrect but it'll get fixed up next time any updates
+                                        // are made to an instance.
+                                        if oldProviderAddr != "" {
+                                                localAddr, diags := addrs.ParseProviderConfigCompactStr(oldProviderAddr)
+                                                if diags.HasErrors() {
+                                                        return nil, diags.Err()
+                                                }
+                                                providerAddr = localAddr.Absolute(moduleAddr)
+                                        } else {
+                                                providerAddr = resAddr.DefaultProviderConfig().Absolute(moduleAddr)
+                                        }
+                                }
+
+                                rs = &resourceStateV4{
+                                        Module:         moduleAddr.String(),
+                                        Mode:           modeStr,
+                                        Type:           resAddr.Type,
+                                        Name:           resAddr.Name,
+                                        Instances:      []instanceObjectStateV4{},
+                                        ProviderConfig: providerAddr.String(),
+                                }
+                                resourceStates[resAddr.String()] = rs
+                        }
+
+                        // Now we'll deal with the instance itself, which may either be
+                        // the first instance in a resource we just created or an additional
+                        // instance for a resource added on a prior loop.
+                        instKey := instAddr.Key
+                        if isOld := rsOld.Primary; isOld != nil {
+                                isNew, err := upgradeInstanceObjectV3ToV4(rsOld, isOld, instKey, states.NotDeposed)
+                                if err != nil {
+                                        return nil, fmt.Errorf("failed to migrate primary generation of %s: %s", instAddr, err)
+                                }
+                                rs.Instances = append(rs.Instances, *isNew)
+                        }
+                        for i, isOld := range rsOld.Deposed {
+                                // When we migrate old instances we'll use sequential deposed
+                                // keys just so that the upgrade result is deterministic. New
+                                // deposed keys allocated moving forward will be pseudorandomly
+                                // selected, but we check for collisions and so these
+                                // non-random ones won't hurt.
+                                deposedKey := states.DeposedKey(fmt.Sprintf("%08x", i+1))
+                                isNew, err := upgradeInstanceObjectV3ToV4(rsOld, isOld, instKey, deposedKey)
+                                if err != nil {
+                                        return nil, fmt.Errorf("failed to migrate deposed generation index %d of %s: %s", i, instAddr, err)
+                                }
+                                rs.Instances = append(rs.Instances, *isNew)
+                        }
+
+                        if instKey != addrs.NoKey && rs.EachMode == "" {
+                                rs.EachMode = "list"
+                        }
+                }
+
+                for _, rs := range resourceStates {
+                        new.Resources = append(new.Resources, *rs)
+                }
+
+                if len(msOld.Path) == 1 && msOld.Path[0] == "root" {
+                        // We'll migrate the outputs for this module too, then.
+                        for name, oldOS := range msOld.Outputs {
+                                newOS := outputStateV4{
+                                        Sensitive: oldOS.Sensitive,
+                                }
+
+                                valRaw := oldOS.Value
+                                valSrc, err := json.Marshal(valRaw)
+                                if err != nil {
+                                        // Should never happen, because this value came from JSON
+                                        // in the first place and so we're just round-tripping here.
+                                        return nil, fmt.Errorf("failed to serialize output %q value as JSON: %s", name, err)
+                                }
+
+                                // The "type" field in state V2 wasn't really that useful
+                                // since it was only able to capture string vs. list vs. map.
+                                // For this reason, during upgrade we'll just discard it
+                                // altogether and use cty's idea of the implied type of
+                                // turning our old value into JSON.
+                                ty, err := ctyjson.ImpliedType(valSrc)
+                                if err != nil {
+                                        // REALLY should never happen, because we literally just
+                                        // encoded this as JSON above!
+                                        return nil, fmt.Errorf("failed to parse output %q value from JSON: %s", name, err)
+                                }
+
+                                // ImpliedType tends to produce structural types, but since older
+                                // version of Terraform didn't support those a collection type
+                                // is probably what was intended, so we'll see if we can
+                                // interpret our value as one.
+                                ty = simplifyImpliedValueType(ty)
+
+                                tySrc, err := ctyjson.MarshalType(ty)
+                                if err != nil {
+                                        return nil, fmt.Errorf("failed to serialize output %q type as JSON: %s", name, err)
+                                }
+
+                                newOS.ValueRaw = json.RawMessage(valSrc)
+                                newOS.ValueTypeRaw = json.RawMessage(tySrc)
+
+                                new.RootOutputs[name] = newOS
+                        }
+                }
+        }
+
+        new.normalize()
+
+        return new, nil
+}
+
+func upgradeInstanceObjectV3ToV4(rsOld *resourceStateV2, isOld *instanceStateV2, instKey addrs.InstanceKey, deposedKey states.DeposedKey) (*instanceObjectStateV4, error) {
+
+        // Schema versions were, in prior formats, a private concern of the provider
+        // SDK, and not a first-class concept in the state format. Here we're
+        // sniffing for the pre-0.12 SDK's way of representing schema versions
+        // and promoting it to our first-class field if we find it. We'll ignore
+        // it if it doesn't look like what the SDK would've written. If this
+        // sniffing fails then we'll assume schema version 0.
+        var schemaVersion uint64
+        migratedSchemaVersion := false
+        if raw, exists := isOld.Meta["schema_version"]; exists {
+                switch tv := raw.(type) {
+                case string:
+                        v, err := strconv.ParseUint(tv, 10, 64)
+                        if err == nil {
+                                schemaVersion = v
+                                migratedSchemaVersion = true
+                        }
+                case int:
+                        schemaVersion = uint64(tv)
+                        migratedSchemaVersion = true
+                case float64:
+                        schemaVersion = uint64(tv)
+                        migratedSchemaVersion = true
+                }
+        }
+
+        private := map[string]interface{}{}
+        for k, v := range isOld.Meta {
+                if k == "schema_version" && migratedSchemaVersion {
+                        // We're gonna promote this into our first-class schema version field
+                        continue
+                }
+                private[k] = v
+        }
+        var privateJSON []byte
+        if len(private) != 0 {
+                var err error
+                privateJSON, err = json.Marshal(private)
+                if err != nil {
+                        // This shouldn't happen, because the Meta values all came from JSON
+                        // originally anyway.
+                        return nil, fmt.Errorf("cannot serialize private instance object data: %s", err)
+                }
+        }
+
+        var status string
+        if isOld.Tainted {
+                status = "tainted"
+        }
+
+        var instKeyRaw interface{}
+        switch tk := instKey.(type) {
+        case addrs.IntKey:
+                instKeyRaw = int(tk)
+        case addrs.StringKey:
+                instKeyRaw = string(tk)
+        default:
+                if instKeyRaw != nil {
+                        return nil, fmt.Errorf("insupported instance key: %#v", instKey)
+                }
+        }
+
+        var attributes map[string]string
+        if isOld.Attributes != nil {
+                attributes = make(map[string]string, len(isOld.Attributes))
+                for k, v := range isOld.Attributes {
+                        attributes[k] = v
+                }
+        }
+        if isOld.ID != "" {
+                // As a special case, if we don't already have an "id" attribute and
+                // yet there's a non-empty first-class ID on the old object then we'll
+                // create a synthetic id attribute to avoid losing that first-class id.
+                // In practice this generally arises only in tests where state literals
+                // are hand-written in a non-standard way; real code prior to 0.12
+                // would always force the first-class ID to be copied into the
+                // id attribute before storing.
+                if attributes == nil {
+                        attributes = make(map[string]string, len(isOld.Attributes))
+                }
+                if idVal := attributes["id"]; idVal == "" {
+                        attributes["id"] = isOld.ID
+                }
+        }
+
+        dependencies := make([]string, len(rsOld.Dependencies))
+        for i, v := range rsOld.Dependencies {
+                dependencies[i] = parseLegacyDependency(v)
+        }
+
+        return &instanceObjectStateV4{
+                IndexKey:       instKeyRaw,
+                Status:         status,
+                Deposed:        string(deposedKey),
+                AttributesFlat: attributes,
+                Dependencies:   dependencies,
+                SchemaVersion:  schemaVersion,
+                PrivateRaw:     privateJSON,
+        }, nil
+}
+
+// parseLegacyResourceAddress parses the different identifier format used
+// state formats before version 4, like "instance.name.0".
+func parseLegacyResourceAddress(s string) (addrs.ResourceInstance, error) {
+        var ret addrs.ResourceInstance
+
+        // Split based on ".". Every resource address should have at least two
+        // elements (type and name).
+        parts := strings.Split(s, ".")
+        if len(parts) < 2 || len(parts) > 4 {
+                return ret, fmt.Errorf("invalid internal resource address format: %s", s)
+        }
+
+        // Data resource if we have at least 3 parts and the first one is data
+        ret.Resource.Mode = addrs.ManagedResourceMode
+        if len(parts) > 2 && parts[0] == "data" {
+                ret.Resource.Mode = addrs.DataResourceMode
+                parts = parts[1:]
+        }
+
+        // If we're not a data resource and we have more than 3, then it is an error
+        if len(parts) > 3 && ret.Resource.Mode != addrs.DataResourceMode {
+                return ret, fmt.Errorf("invalid internal resource address format: %s", s)
+        }
+
+        // Build the parts of the resource address that are guaranteed to exist
+        ret.Resource.Type = parts[0]
+        ret.Resource.Name = parts[1]
+        ret.Key = addrs.NoKey
+
+        // If we have more parts, then we have an index. Parse that.
+        if len(parts) > 2 {
+                idx, err := strconv.ParseInt(parts[2], 0, 0)
+                if err != nil {
+                        return ret, fmt.Errorf("error parsing resource address %q: %s", s, err)
+                }
+
+                ret.Key = addrs.IntKey(idx)
+        }
+
+        return ret, nil
+}
+
+// simplifyImpliedValueType attempts to heuristically simplify a value type
+// derived from a legacy stored output value into something simpler that
+// is closer to what would've fitted into the pre-v0.12 value type system.
+func simplifyImpliedValueType(ty cty.Type) cty.Type {
+        switch {
+        case ty.IsTupleType():
+                // If all of the element types are the same then we'll make this
+                // a list instead. This is very likely to be true, since prior versions
+                // of Terraform did not officially support mixed-type collections.
+
+                if ty.Equals(cty.EmptyTuple) {
+                        // Don't know what the element type would be, then.
+                        return ty
+                }
+
+                etys := ty.TupleElementTypes()
+                ety := etys[0]
+                for _, other := range etys[1:] {
+                        if !other.Equals(ety) {
+                                // inconsistent types
+                                return ty
+                        }
+                }
+                ety = simplifyImpliedValueType(ety)
+                return cty.List(ety)
+
+        case ty.IsObjectType():
+                // If all of the attribute types are the same then we'll make this
+                // a map instead. This is very likely to be true, since prior versions
+                // of Terraform did not officially support mixed-type collections.
+
+                if ty.Equals(cty.EmptyObject) {
+                        // Don't know what the element type would be, then.
+                        return ty
+                }
+
+                atys := ty.AttributeTypes()
+                var ety cty.Type
+                for _, other := range atys {
+                        if ety == cty.NilType {
+                                ety = other
+                                continue
+                        }
+                        if !other.Equals(ety) {
+                                // inconsistent types
+                                return ty
+                        }
+                }
+                ety = simplifyImpliedValueType(ety)
+                return cty.Map(ety)
+
+        default:
+                // No other normalizations are possible
+                return ty
+        }
+}
+
+func parseLegacyDependency(s string) string {
+        parts := strings.Split(s, ".")
+        ret := parts[0]
+        for _, part := range parts[1:] {
+                if part == "*" {
+                        break
+                }
+                if i, err := strconv.Atoi(part); err == nil {
+                        ret = ret + fmt.Sprintf("[%d]", i)
+                        break
+                }
+                ret = ret + "." + part
+        }
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version4.go b/vendor/github.com/hashicorp/terraform/states/statefile/version4.go
new file mode 100644
index 0000000..ee8b652
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version4.go
@@ -0,0 +1,604 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+        "io"
+        "sort"
+
+        version "github.com/hashicorp/go-version"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func readStateV4(src []byte) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV4 := &stateV4{}
+        err := json.Unmarshal(src, sV4)
+        if err != nil {
+                diags = diags.Append(jsonUnmarshalDiags(err))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV4(sV4)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+func prepareStateV4(sV4 *stateV4) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        var tfVersion *version.Version
+        if sV4.TerraformVersion != "" {
+                var err error
+                tfVersion, err = version.NewVersion(sV4.TerraformVersion)
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid Terraform version string",
+                                fmt.Sprintf("State file claims to have been written by Terraform version %q, which is not a valid version string.", sV4.TerraformVersion),
+                        ))
+                }
+        }
+
+        file := &File{
+                TerraformVersion: tfVersion,
+                Serial:           sV4.Serial,
+                Lineage:          sV4.Lineage,
+        }
+
+        state := states.NewState()
+
+        for _, rsV4 := range sV4.Resources {
+                rAddr := addrs.Resource{
+                        Type: rsV4.Type,
+                        Name: rsV4.Name,
+                }
+                switch rsV4.Mode {
+                case "managed":
+                        rAddr.Mode = addrs.ManagedResourceMode
+                case "data":
+                        rAddr.Mode = addrs.DataResourceMode
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid resource mode in state",
+                                fmt.Sprintf("State contains a resource with mode %q (%q %q) which is not supported.", rsV4.Mode, rAddr.Type, rAddr.Name),
+                        ))
+                        continue
+                }
+
+                moduleAddr := addrs.RootModuleInstance
+                if rsV4.Module != "" {
+                        var addrDiags tfdiags.Diagnostics
+                        moduleAddr, addrDiags = addrs.ParseModuleInstanceStr(rsV4.Module)
+                        diags = diags.Append(addrDiags)
+                        if addrDiags.HasErrors() {
+                                continue
+                        }
+                }
+
+                providerAddr, addrDiags := addrs.ParseAbsProviderConfigStr(rsV4.ProviderConfig)
+                diags.Append(addrDiags)
+                if addrDiags.HasErrors() {
+                        continue
+                }
+
+                var eachMode states.EachMode
+                switch rsV4.EachMode {
+                case "":
+                        eachMode = states.NoEach
+                case "list":
+                        eachMode = states.EachList
+                case "map":
+                        eachMode = states.EachMap
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid resource metadata in state",
+                                fmt.Sprintf("Resource %s has invalid \"each\" value %q in state.", rAddr.Absolute(moduleAddr), eachMode),
+                        ))
+                        continue
+                }
+
+                ms := state.EnsureModule(moduleAddr)
+
+                // Ensure the resource container object is present in the state.
+                ms.SetResourceMeta(rAddr, eachMode, providerAddr)
+
+                for _, isV4 := range rsV4.Instances {
+                        keyRaw := isV4.IndexKey
+                        var key addrs.InstanceKey
+                        switch tk := keyRaw.(type) {
+                        case int:
+                                key = addrs.IntKey(tk)
+                        case float64:
+                                // Since JSON only has one number type, reading from encoding/json
+                                // gives us a float64 here even if the number is whole.
+                                // float64 has a smaller integer range than int, but in practice
+                                // we rarely have more than a few tens of instances and so
+                                // it's unlikely that we'll exhaust the 52 bits in a float64.
+                                key = addrs.IntKey(int(tk))
+                        case string:
+                                key = addrs.StringKey(tk)
+                        default:
+                                if keyRaw != nil {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Invalid resource instance metadata in state",
+                                                fmt.Sprintf("Resource %s has an instance with the invalid instance key %#v.", rAddr.Absolute(moduleAddr), keyRaw),
+                                        ))
+                                        continue
+                                }
+                                key = addrs.NoKey
+                        }
+
+                        instAddr := rAddr.Instance(key)
+
+                        obj := &states.ResourceInstanceObjectSrc{
+                                SchemaVersion: isV4.SchemaVersion,
+                        }
+
+                        {
+                                // Instance attributes
+                                switch {
+                                case isV4.AttributesRaw != nil:
+                                        obj.AttrsJSON = isV4.AttributesRaw
+                                case isV4.AttributesFlat != nil:
+                                        obj.AttrsFlat = isV4.AttributesFlat
+                                default:
+                                        // This is odd, but we'll accept it and just treat the
+                                        // object has being empty. In practice this should arise
+                                        // only from the contrived sort of state objects we tend
+                                        // to hand-write inline in tests.
+                                        obj.AttrsJSON = []byte{'{', '}'}
+                                }
+                        }
+
+                        {
+                                // Status
+                                raw := isV4.Status
+                                switch raw {
+                                case "":
+                                        obj.Status = states.ObjectReady
+                                case "tainted":
+                                        obj.Status = states.ObjectTainted
+                                default:
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Invalid resource instance metadata in state",
+                                                fmt.Sprintf("Instance %s has invalid status %q.", instAddr.Absolute(moduleAddr), raw),
+                                        ))
+                                        continue
+                                }
+                        }
+
+                        if raw := isV4.PrivateRaw; len(raw) > 0 {
+                                obj.Private = raw
+                        }
+
+                        {
+                                depsRaw := isV4.Dependencies
+                                deps := make([]addrs.Referenceable, 0, len(depsRaw))
+                                for _, depRaw := range depsRaw {
+                                        ref, refDiags := addrs.ParseRefStr(depRaw)
+                                        diags = diags.Append(refDiags)
+                                        if refDiags.HasErrors() {
+                                                continue
+                                        }
+                                        if len(ref.Remaining) != 0 {
+                                                diags = diags.Append(tfdiags.Sourceless(
+                                                        tfdiags.Error,
+                                                        "Invalid resource instance metadata in state",
+                                                        fmt.Sprintf("Instance %s declares dependency on %q, which is not a reference to a dependable object.", instAddr.Absolute(moduleAddr), depRaw),
+                                                ))
+                                        }
+                                        if ref.Subject == nil {
+                                                // Should never happen
+                                                panic(fmt.Sprintf("parsing dependency %q for instance %s returned a nil address", depRaw, instAddr.Absolute(moduleAddr)))
+                                        }
+                                        deps = append(deps, ref.Subject)
+                                }
+                                obj.Dependencies = deps
+                        }
+
+                        switch {
+                        case isV4.Deposed != "":
+                                dk := states.DeposedKey(isV4.Deposed)
+                                if len(dk) != 8 {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Invalid resource instance metadata in state",
+                                                fmt.Sprintf("Instance %s has an object with deposed key %q, which is not correctly formatted.", instAddr.Absolute(moduleAddr), isV4.Deposed),
+                                        ))
+                                        continue
+                                }
+                                is := ms.ResourceInstance(instAddr)
+                                if is.HasDeposed(dk) {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Duplicate resource instance in state",
+                                                fmt.Sprintf("Instance %s deposed object %q appears multiple times in the state file.", instAddr.Absolute(moduleAddr), dk),
+                                        ))
+                                        continue
+                                }
+
+                                ms.SetResourceInstanceDeposed(instAddr, dk, obj, providerAddr)
+                        default:
+                                is := ms.ResourceInstance(instAddr)
+                                if is.HasCurrent() {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Duplicate resource instance in state",
+                                                fmt.Sprintf("Instance %s appears multiple times in the state file.", instAddr.Absolute(moduleAddr)),
+                                        ))
+                                        continue
+                                }
+
+                                ms.SetResourceInstanceCurrent(instAddr, obj, providerAddr)
+                        }
+                }
+
+                // We repeat this after creating the instances because
+                // SetResourceInstanceCurrent automatically resets this metadata based
+                // on the incoming objects. That behavior is useful when we're making
+                // piecemeal updates to the state during an apply, but when we're
+                // reading the state file we want to reflect its contents exactly.
+                ms.SetResourceMeta(rAddr, eachMode, providerAddr)
+        }
+
+        // The root module is special in that we persist its attributes and thus
+        // need to reload them now. (For descendent modules we just re-calculate
+        // them based on the latest configuration on each run.)
+        {
+                rootModule := state.RootModule()
+                for name, fos := range sV4.RootOutputs {
+                        os := &states.OutputValue{}
+                        os.Sensitive = fos.Sensitive
+
+                        ty, err := ctyjson.UnmarshalType([]byte(fos.ValueTypeRaw))
+                        if err != nil {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid output value type in state",
+                                        fmt.Sprintf("The state file has an invalid type specification for output %q: %s.", name, err),
+                                ))
+                                continue
+                        }
+
+                        val, err := ctyjson.Unmarshal([]byte(fos.ValueRaw), ty)
+                        if err != nil {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid output value saved in state",
+                                        fmt.Sprintf("The state file has an invalid value for output %q: %s.", name, err),
+                                ))
+                                continue
+                        }
+
+                        os.Value = val
+                        rootModule.OutputValues[name] = os
+                }
+        }
+
+        file.State = state
+        return file, diags
+}
+
+func writeStateV4(file *File, w io.Writer) tfdiags.Diagnostics {
+        // Here we'll convert back from the "File" representation to our
+        // stateV4 struct representation and write that.
+        //
+        // While we support legacy state formats for reading, we only support the
+        // latest for writing and so if a V5 is added in future then this function
+        // should be deleted and replaced with a writeStateV5, even though the
+        // read/prepare V4 functions above would stick around.
+
+        var diags tfdiags.Diagnostics
+        if file == nil || file.State == nil {
+                panic("attempt to write nil state to file")
+        }
+
+        var terraformVersion string
+        if file.TerraformVersion != nil {
+                terraformVersion = file.TerraformVersion.String()
+        }
+
+        sV4 := &stateV4{
+                TerraformVersion: terraformVersion,
+                Serial:           file.Serial,
+                Lineage:          file.Lineage,
+                RootOutputs:      map[string]outputStateV4{},
+                Resources:        []resourceStateV4{},
+        }
+
+        for name, os := range file.State.RootModule().OutputValues {
+                src, err := ctyjson.Marshal(os.Value, os.Value.Type())
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to serialize output value in state",
+                                fmt.Sprintf("An error occured while serializing output value %q: %s.", name, err),
+                        ))
+                        continue
+                }
+
+                typeSrc, err := ctyjson.MarshalType(os.Value.Type())
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to serialize output value in state",
+                                fmt.Sprintf("An error occured while serializing the type of output value %q: %s.", name, err),
+                        ))
+                        continue
+                }
+
+                sV4.RootOutputs[name] = outputStateV4{
+                        Sensitive:    os.Sensitive,
+                        ValueRaw:     json.RawMessage(src),
+                        ValueTypeRaw: json.RawMessage(typeSrc),
+                }
+        }
+
+        for _, ms := range file.State.Modules {
+                moduleAddr := ms.Addr
+                for _, rs := range ms.Resources {
+                        resourceAddr := rs.Addr
+
+                        var mode string
+                        switch resourceAddr.Mode {
+                        case addrs.ManagedResourceMode:
+                                mode = "managed"
+                        case addrs.DataResourceMode:
+                                mode = "data"
+                        default:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Failed to serialize resource in state",
+                                        fmt.Sprintf("Resource %s has mode %s, which cannot be serialized in state", resourceAddr.Absolute(moduleAddr), resourceAddr.Mode),
+                                ))
+                                continue
+                        }
+
+                        var eachMode string
+                        switch rs.EachMode {
+                        case states.NoEach:
+                                eachMode = ""
+                        case states.EachList:
+                                eachMode = "list"
+                        case states.EachMap:
+                                eachMode = "map"
+                        default:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Failed to serialize resource in state",
+                                        fmt.Sprintf("Resource %s has \"each\" mode %s, which cannot be serialized in state", resourceAddr.Absolute(moduleAddr), rs.EachMode),
+                                ))
+                                continue
+                        }
+
+                        sV4.Resources = append(sV4.Resources, resourceStateV4{
+                                Module:         moduleAddr.String(),
+                                Mode:           mode,
+                                Type:           resourceAddr.Type,
+                                Name:           resourceAddr.Name,
+                                EachMode:       eachMode,
+                                ProviderConfig: rs.ProviderConfig.String(),
+                                Instances:      []instanceObjectStateV4{},
+                        })
+                        rsV4 := &(sV4.Resources[len(sV4.Resources)-1])
+
+                        for key, is := range rs.Instances {
+                                if is.HasCurrent() {
+                                        var objDiags tfdiags.Diagnostics
+                                        rsV4.Instances, objDiags = appendInstanceObjectStateV4(
+                                                rs, is, key, is.Current, states.NotDeposed,
+                                                rsV4.Instances,
+                                        )
+                                        diags = diags.Append(objDiags)
+                                }
+                                for dk, obj := range is.Deposed {
+                                        var objDiags tfdiags.Diagnostics
+                                        rsV4.Instances, objDiags = appendInstanceObjectStateV4(
+                                                rs, is, key, obj, dk,
+                                                rsV4.Instances,
+                                        )
+                                        diags = diags.Append(objDiags)
+                                }
+                        }
+                }
+        }
+
+        sV4.normalize()
+
+        src, err := json.MarshalIndent(sV4, "", "  ")
+        if err != nil {
+                // Shouldn't happen if we do our conversion to *stateV4 correctly above.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to serialize state",
+                        fmt.Sprintf("An error occured while serializing the state to save it. This is a bug in Terraform and should be reported: %s.", err),
+                ))
+                return diags
+        }
+        src = append(src, '\n')
+
+        _, err = w.Write(src)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to write state",
+                        fmt.Sprintf("An error occured while writing the serialized state: %s.", err),
+                ))
+                return diags
+        }
+
+        return diags
+}
+
+func appendInstanceObjectStateV4(rs *states.Resource, is *states.ResourceInstance, key addrs.InstanceKey, obj *states.ResourceInstanceObjectSrc, deposed states.DeposedKey, isV4s []instanceObjectStateV4) ([]instanceObjectStateV4, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        var status string
+        switch obj.Status {
+        case states.ObjectReady:
+                status = ""
+        case states.ObjectTainted:
+                status = "tainted"
+        default:
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to serialize resource instance in state",
+                        fmt.Sprintf("Instance %s has status %s, which cannot be saved in state.", rs.Addr.Instance(key), obj.Status),
+                ))
+        }
+
+        var privateRaw []byte
+        if len(obj.Private) > 0 {
+                privateRaw = obj.Private
+        }
+
+        deps := make([]string, len(obj.Dependencies))
+        for i, depAddr := range obj.Dependencies {
+                deps[i] = depAddr.String()
+        }
+
+        var rawKey interface{}
+        switch tk := key.(type) {
+        case addrs.IntKey:
+                rawKey = int(tk)
+        case addrs.StringKey:
+                rawKey = string(tk)
+        default:
+                if key != addrs.NoKey {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to serialize resource instance in state",
+                                fmt.Sprintf("Instance %s has an unsupported instance key: %#v.", rs.Addr.Instance(key), key),
+                        ))
+                }
+        }
+
+        return append(isV4s, instanceObjectStateV4{
+                IndexKey:       rawKey,
+                Deposed:        string(deposed),
+                Status:         status,
+                SchemaVersion:  obj.SchemaVersion,
+                AttributesFlat: obj.AttrsFlat,
+                AttributesRaw:  obj.AttrsJSON,
+                PrivateRaw:     privateRaw,
+                Dependencies:   deps,
+        }), diags
+}
+
+type stateV4 struct {
+        Version          stateVersionV4           `json:"version"`
+        TerraformVersion string                   `json:"terraform_version"`
+        Serial           uint64                   `json:"serial"`
+        Lineage          string                   `json:"lineage"`
+        RootOutputs      map[string]outputStateV4 `json:"outputs"`
+        Resources        []resourceStateV4        `json:"resources"`
+}
+
+// normalize makes some in-place changes to normalize the way items are
+// stored to ensure that two functionally-equivalent states will be stored
+// identically.
+func (s *stateV4) normalize() {
+        sort.Stable(sortResourcesV4(s.Resources))
+        for _, rs := range s.Resources {
+                sort.Stable(sortInstancesV4(rs.Instances))
+        }
+}
+
+type outputStateV4 struct {
+        ValueRaw     json.RawMessage `json:"value"`
+        ValueTypeRaw json.RawMessage `json:"type"`
+        Sensitive    bool            `json:"sensitive,omitempty"`
+}
+
+type resourceStateV4 struct {
+        Module         string                  `json:"module,omitempty"`
+        Mode           string                  `json:"mode"`
+        Type           string                  `json:"type"`
+        Name           string                  `json:"name"`
+        EachMode       string                  `json:"each,omitempty"`
+        ProviderConfig string                  `json:"provider"`
+        Instances      []instanceObjectStateV4 `json:"instances"`
+}
+
+type instanceObjectStateV4 struct {
+        IndexKey interface{} `json:"index_key,omitempty"`
+        Status   string      `json:"status,omitempty"`
+        Deposed  string      `json:"deposed,omitempty"`
+
+        SchemaVersion  uint64            `json:"schema_version"`
+        AttributesRaw  json.RawMessage   `json:"attributes,omitempty"`
+        AttributesFlat map[string]string `json:"attributes_flat,omitempty"`
+
+        PrivateRaw []byte `json:"private,omitempty"`
+
+        Dependencies []string `json:"depends_on,omitempty"`
+}
+
+// stateVersionV4 is a weird special type we use to produce our hard-coded
+// "version": 4 in the JSON serialization.
+type stateVersionV4 struct{}
+
+func (sv stateVersionV4) MarshalJSON() ([]byte, error) {
+        return []byte{'4'}, nil
+}
+
+func (sv stateVersionV4) UnmarshalJSON([]byte) error {
+        // Nothing to do: we already know we're version 4
+        return nil
+}
+
+type sortResourcesV4 []resourceStateV4
+
+func (sr sortResourcesV4) Len() int      { return len(sr) }
+func (sr sortResourcesV4) Swap(i, j int) { sr[i], sr[j] = sr[j], sr[i] }
+func (sr sortResourcesV4) Less(i, j int) bool {
+        switch {
+        case sr[i].Mode != sr[j].Mode:
+                return sr[i].Mode < sr[j].Mode
+        case sr[i].Type != sr[j].Type:
+                return sr[i].Type < sr[j].Type
+        case sr[i].Name != sr[j].Name:
+                return sr[i].Name < sr[j].Name
+        default:
+                return false
+        }
+}
+
+type sortInstancesV4 []instanceObjectStateV4
+
+func (si sortInstancesV4) Len() int      { return len(si) }
+func (si sortInstancesV4) Swap(i, j int) { si[i], si[j] = si[j], si[i] }
+func (si sortInstancesV4) Less(i, j int) bool {
+        ki := si[i].IndexKey
+        kj := si[j].IndexKey
+        if ki != kj {
+                if (ki == nil) != (kj == nil) {
+                        return ki == nil
+                }
+                if kii, isInt := ki.(int); isInt {
+                        if kji, isInt := kj.(int); isInt {
+                                return kii < kji
+                        }
+                        return true
+                }
+                if kis, isStr := ki.(string); isStr {
+                        if kjs, isStr := kj.(string); isStr {
+                                return kis < kjs
+                        }
+                        return true
+                }
+        }
+        if si[i].Deposed != si[j].Deposed {
+                return si[i].Deposed < si[j].Deposed
+        }
+        return false
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/write.go b/vendor/github.com/hashicorp/terraform/states/statefile/write.go
new file mode 100644
index 0000000..548ba8a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/write.go
@@ -0,0 +1,17 @@
+package statefile
+
+import (
+        "io"
+
+        tfversion "github.com/hashicorp/terraform/version"
+)
+
+// Write writes the given state to the given writer in the current state
+// serialization format.
+func Write(s *File, w io.Writer) error {
+        // Always record the current terraform version in the state.
+        s.TerraformVersion = tfversion.SemVer
+
+        diags := writeStateV4(s, w)
+        return diags.Err()
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/sync.go b/vendor/github.com/hashicorp/terraform/states/sync.go
new file mode 100644
index 0000000..a377446
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/sync.go
@@ -0,0 +1,537 @@
+package states
+
+import (
+        "log"
+        "sync"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// SyncState is a wrapper around State that provides concurrency-safe access to
+// various common operations that occur during a Terraform graph walk, or other
+// similar concurrent contexts.
+//
+// When a SyncState wrapper is in use, no concurrent direct access to the
+// underlying objects is permitted unless the caller first acquires an explicit
+// lock, using the Lock and Unlock methods. Most callers should _not_
+// explicitly lock, and should instead use the other methods of this type that
+// handle locking automatically.
+//
+// Since SyncState is able to safely consolidate multiple updates into a single
+// atomic operation, many of its methods are at a higher level than those
+// of the underlying types, and operate on the state as a whole rather than
+// on individual sub-structures of the state.
+//
+// SyncState can only protect against races within its own methods. It cannot
+// provide any guarantees about the order in which concurrent operations will
+// be processed, so callers may still need to employ higher-level techniques
+// for ensuring correct operation sequencing, such as building and walking
+// a dependency graph.
+type SyncState struct {
+        state *State
+        lock  sync.RWMutex
+}
+
+// Module returns a snapshot of the state of the module instance with the given
+// address, or nil if no such module is tracked.
+//
+// The return value is a pointer to a copy of the module state, which the
+// caller may then freely access and mutate. However, since the module state
+// tends to be a large data structure with many child objects, where possible
+// callers should prefer to use a more granular accessor to access a child
+// module directly, and thus reduce the amount of copying required.
+func (s *SyncState) Module(addr addrs.ModuleInstance) *Module {
+        s.lock.RLock()
+        ret := s.state.Module(addr).DeepCopy()
+        s.lock.RUnlock()
+        return ret
+}
+
+// RemoveModule removes the entire state for the given module, taking with
+// it any resources associated with the module. This should generally be
+// called only for modules whose resources have all been destroyed, but
+// that is not enforced by this method.
+func (s *SyncState) RemoveModule(addr addrs.ModuleInstance) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        s.state.RemoveModule(addr)
+}
+
+// OutputValue returns a snapshot of the state of the output value with the
+// given address, or nil if no such output value is tracked.
+//
+// The return value is a pointer to a copy of the output value state, which the
+// caller may then freely access and mutate.
+func (s *SyncState) OutputValue(addr addrs.AbsOutputValue) *OutputValue {
+        s.lock.RLock()
+        ret := s.state.OutputValue(addr).DeepCopy()
+        s.lock.RUnlock()
+        return ret
+}
+
+// SetOutputValue writes a given output value into the state, overwriting
+// any existing value of the same name.
+//
+// If the module containing the output is not yet tracked in state then it
+// be added as a side-effect.
+func (s *SyncState) SetOutputValue(addr addrs.AbsOutputValue, value cty.Value, sensitive bool) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.SetOutputValue(addr.OutputValue.Name, value, sensitive)
+}
+
+// RemoveOutputValue removes the stored value for the output value with the
+// given address.
+//
+// If this results in its containing module being empty, the module will be
+// pruned from the state as a side-effect.
+func (s *SyncState) RemoveOutputValue(addr addrs.AbsOutputValue) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return
+        }
+        ms.RemoveOutputValue(addr.OutputValue.Name)
+        s.maybePruneModule(addr.Module)
+}
+
+// LocalValue returns the current value associated with the given local value
+// address.
+func (s *SyncState) LocalValue(addr addrs.AbsLocalValue) cty.Value {
+        s.lock.RLock()
+        // cty.Value is immutable, so we don't need any extra copying here.
+        ret := s.state.LocalValue(addr)
+        s.lock.RUnlock()
+        return ret
+}
+
+// SetLocalValue writes a given output value into the state, overwriting
+// any existing value of the same name.
+//
+// If the module containing the local value is not yet tracked in state then it
+// will be added as a side-effect.
+func (s *SyncState) SetLocalValue(addr addrs.AbsLocalValue, value cty.Value) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.SetLocalValue(addr.LocalValue.Name, value)
+}
+
+// RemoveLocalValue removes the stored value for the local value with the
+// given address.
+//
+// If this results in its containing module being empty, the module will be
+// pruned from the state as a side-effect.
+func (s *SyncState) RemoveLocalValue(addr addrs.AbsLocalValue) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return
+        }
+        ms.RemoveLocalValue(addr.LocalValue.Name)
+        s.maybePruneModule(addr.Module)
+}
+
+// Resource returns a snapshot of the state of the resource with the given
+// address, or nil if no such resource is tracked.
+//
+// The return value is a pointer to a copy of the resource state, which the
+// caller may then freely access and mutate.
+func (s *SyncState) Resource(addr addrs.AbsResource) *Resource {
+        s.lock.RLock()
+        ret := s.state.Resource(addr).DeepCopy()
+        s.lock.RUnlock()
+        return ret
+}
+
+// ResourceInstance returns a snapshot of the state the resource instance with
+// the given address, or nil if no such instance is tracked.
+//
+// The return value is a pointer to a copy of the instance state, which the
+// caller may then freely access and mutate.
+func (s *SyncState) ResourceInstance(addr addrs.AbsResourceInstance) *ResourceInstance {
+        s.lock.RLock()
+        ret := s.state.ResourceInstance(addr).DeepCopy()
+        s.lock.RUnlock()
+        return ret
+}
+
+// ResourceInstanceObject returns a snapshot of the current instance object
+// of the given generation belonging to the instance with the given address,
+// or nil if no such object is tracked..
+//
+// The return value is a pointer to a copy of the object, which the caller may
+// then freely access and mutate.
+func (s *SyncState) ResourceInstanceObject(addr addrs.AbsResourceInstance, gen Generation) *ResourceInstanceObjectSrc {
+        s.lock.RLock()
+        defer s.lock.RUnlock()
+
+        inst := s.state.ResourceInstance(addr)
+        if inst == nil {
+                return nil
+        }
+        return inst.GetGeneration(gen).DeepCopy()
+}
+
+// SetResourceMeta updates the resource-level metadata for the resource at
+// the given address, creating the containing module state and resource state
+// as a side-effect if not already present.
+func (s *SyncState) SetResourceMeta(addr addrs.AbsResource, eachMode EachMode, provider addrs.AbsProviderConfig) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.SetResourceMeta(addr.Resource, eachMode, provider)
+}
+
+// RemoveResource removes the entire state for the given resource, taking with
+// it any instances associated with the resource. This should generally be
+// called only for resource objects whose instances have all been destroyed,
+// but that is not enforced by this method. (Use RemoveResourceIfEmpty instead
+// to safely check first.)
+func (s *SyncState) RemoveResource(addr addrs.AbsResource) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.RemoveResource(addr.Resource)
+        s.maybePruneModule(addr.Module)
+}
+
+// RemoveResourceIfEmpty is similar to RemoveResource but first checks to
+// make sure there are no instances or objects left in the resource.
+//
+// Returns true if the resource was removed, or false if remaining child
+// objects prevented its removal. Returns true also if the resource was
+// already absent, and thus no action needed to be taken.
+func (s *SyncState) RemoveResourceIfEmpty(addr addrs.AbsResource) bool {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return true // nothing to do
+        }
+        rs := ms.Resource(addr.Resource)
+        if rs == nil {
+                return true // nothing to do
+        }
+        if len(rs.Instances) != 0 {
+                // We don't check here for the possibility of instances that exist
+                // but don't have any objects because it's the responsibility of the
+                // instance-mutation methods to prune those away automatically.
+                return false
+        }
+        ms.RemoveResource(addr.Resource)
+        s.maybePruneModule(addr.Module)
+        return true
+}
+
+// MaybeFixUpResourceInstanceAddressForCount deals with the situation where a
+// resource has changed from having "count" set to not set, or vice-versa, and
+// so we need to rename the zeroth instance key to no key at all, or vice-versa.
+//
+// Set countEnabled to true if the resource has count set in its new
+// configuration, or false if it does not.
+//
+// The state is modified in-place if necessary, moving a resource instance
+// between the two addresses. The return value is true if a change was made,
+// and false otherwise.
+func (s *SyncState) MaybeFixUpResourceInstanceAddressForCount(addr addrs.AbsResource, countEnabled bool) bool {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return false
+        }
+
+        relAddr := addr.Resource
+        rs := ms.Resource(relAddr)
+        if rs == nil {
+                return false
+        }
+        huntKey := addrs.NoKey
+        replaceKey := addrs.InstanceKey(addrs.IntKey(0))
+        if !countEnabled {
+                huntKey, replaceKey = replaceKey, huntKey
+        }
+
+        is, exists := rs.Instances[huntKey]
+        if !exists {
+                return false
+        }
+
+        if _, exists := rs.Instances[replaceKey]; exists {
+                // If the replacement key also exists then we'll do nothing and keep both.
+                return false
+        }
+
+        // If we get here then we need to "rename" from hunt to replace
+        rs.Instances[replaceKey] = is
+        delete(rs.Instances, huntKey)
+        return true
+}
+
+// SetResourceInstanceCurrent saves the given instance object as the current
+// generation of the resource instance with the given address, simulataneously
+// updating the recorded provider configuration address, dependencies, and
+// resource EachMode.
+//
+// Any existing current instance object for the given resource is overwritten.
+// Set obj to nil to remove the primary generation object altogether. If there
+// are no deposed objects then the instance as a whole will be removed, which
+// may in turn also remove the containing module if it becomes empty.
+//
+// The caller must ensure that the given ResourceInstanceObject is not
+// concurrently mutated during this call, but may be freely used again once
+// this function returns.
+//
+// The provider address and "each mode" are resource-wide settings and so they
+// are updated for all other instances of the same resource as a side-effect of
+// this call.
+//
+// If the containing module for this resource or the resource itself are not
+// already tracked in state then they will be added as a side-effect.
+func (s *SyncState) SetResourceInstanceCurrent(addr addrs.AbsResourceInstance, obj *ResourceInstanceObjectSrc, provider addrs.AbsProviderConfig) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.SetResourceInstanceCurrent(addr.Resource, obj.DeepCopy(), provider)
+        s.maybePruneModule(addr.Module)
+}
+
+// SetResourceInstanceDeposed saves the given instance object as a deposed
+// generation of the resource instance with the given address and deposed key.
+//
+// Call this method only for pre-existing deposed objects that already have
+// a known DeposedKey. For example, this method is useful if reloading objects
+// that were persisted to a state file. To mark the current object as deposed,
+// use DeposeResourceInstanceObject instead.
+//
+// The caller must ensure that the given ResourceInstanceObject is not
+// concurrently mutated during this call, but may be freely used again once
+// this function returns.
+//
+// The resource that contains the given instance must already exist in the
+// state, or this method will panic. Use Resource to check first if its
+// presence is not already guaranteed.
+//
+// Any existing current instance object for the given resource and deposed key
+// is overwritten. Set obj to nil to remove the deposed object altogether. If
+// the instance is left with no objects after this operation then it will
+// be removed from its containing resource altogether.
+//
+// If the containing module for this resource or the resource itself are not
+// already tracked in state then they will be added as a side-effect.
+func (s *SyncState) SetResourceInstanceDeposed(addr addrs.AbsResourceInstance, key DeposedKey, obj *ResourceInstanceObjectSrc, provider addrs.AbsProviderConfig) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.SetResourceInstanceDeposed(addr.Resource, key, obj.DeepCopy(), provider)
+        s.maybePruneModule(addr.Module)
+}
+
+// DeposeResourceInstanceObject moves the current instance object for the
+// given resource instance address into the deposed set, leaving the instance
+// without a current object.
+//
+// The return value is the newly-allocated deposed key, or NotDeposed if the
+// given instance is already lacking a current object.
+//
+// If the containing module for this resource or the resource itself are not
+// already tracked in state then there cannot be a current object for the
+// given instance, and so NotDeposed will be returned without modifying the
+// state at all.
+func (s *SyncState) DeposeResourceInstanceObject(addr addrs.AbsResourceInstance) DeposedKey {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return NotDeposed
+        }
+
+        return ms.deposeResourceInstanceObject(addr.Resource, NotDeposed)
+}
+
+// DeposeResourceInstanceObjectForceKey is like DeposeResourceInstanceObject
+// but uses a pre-allocated key. It's the caller's responsibility to ensure
+// that there aren't any races to use a particular key; this method will panic
+// if the given key is already in use.
+func (s *SyncState) DeposeResourceInstanceObjectForceKey(addr addrs.AbsResourceInstance, forcedKey DeposedKey) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        if forcedKey == NotDeposed {
+                // Usage error: should use DeposeResourceInstanceObject in this case
+                panic("DeposeResourceInstanceObjectForceKey called without forced key")
+        }
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return // Nothing to do, since there can't be any current object either.
+        }
+
+        ms.deposeResourceInstanceObject(addr.Resource, forcedKey)
+}
+
+// ForgetResourceInstanceAll removes the record of all objects associated with
+// the specified resource instance, if present. If not present, this is a no-op.
+func (s *SyncState) ForgetResourceInstanceAll(addr addrs.AbsResourceInstance) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return
+        }
+        ms.ForgetResourceInstanceAll(addr.Resource)
+        s.maybePruneModule(addr.Module)
+}
+
+// ForgetResourceInstanceDeposed removes the record of the deposed object with
+// the given address and key, if present. If not present, this is a no-op.
+func (s *SyncState) ForgetResourceInstanceDeposed(addr addrs.AbsResourceInstance, key DeposedKey) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return
+        }
+        ms.ForgetResourceInstanceDeposed(addr.Resource, key)
+        s.maybePruneModule(addr.Module)
+}
+
+// MaybeRestoreResourceInstanceDeposed will restore the deposed object with the
+// given key on the specified resource as the current object for that instance
+// if and only if that would not cause us to forget an existing current
+// object for that instance.
+//
+// Returns true if the object was restored to current, or false if no change
+// was made at all.
+func (s *SyncState) MaybeRestoreResourceInstanceDeposed(addr addrs.AbsResourceInstance, key DeposedKey) bool {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        if key == NotDeposed {
+                panic("MaybeRestoreResourceInstanceDeposed called without DeposedKey")
+        }
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                // Nothing to do, since the specified deposed object cannot exist.
+                return false
+        }
+
+        return ms.maybeRestoreResourceInstanceDeposed(addr.Resource, key)
+}
+
+// RemovePlannedResourceInstanceObjects removes from the state any resource
+// instance objects that have the status ObjectPlanned, indiciating that they
+// are just transient placeholders created during planning.
+//
+// Note that this does not restore any "ready" or "tainted" object that might
+// have been present before the planned object was written. The only real use
+// for this method is in preparing the state created during a refresh walk,
+// where we run the planning step for certain instances just to create enough
+// information to allow correct expression evaluation within provider and
+// data resource blocks. Discarding planned instances in that case is okay
+// because the refresh phase only creates planned objects to stand in for
+// objects that don't exist yet, and thus the planned object must have been
+// absent before by definition.
+func (s *SyncState) RemovePlannedResourceInstanceObjects() {
+        // TODO: Merge together the refresh and plan phases into a single walk,
+        // so we can remove the need to create this "partial plan" during refresh
+        // that we then need to clean up before proceeding.
+
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        for _, ms := range s.state.Modules {
+                moduleAddr := ms.Addr
+
+                for _, rs := range ms.Resources {
+                        resAddr := rs.Addr
+
+                        for ik, is := range rs.Instances {
+                                instAddr := resAddr.Instance(ik)
+
+                                if is.Current != nil && is.Current.Status == ObjectPlanned {
+                                        // Setting the current instance to nil removes it from the
+                                        // state altogether if there are not also deposed instances.
+                                        ms.SetResourceInstanceCurrent(instAddr, nil, rs.ProviderConfig)
+                                }
+
+                                for dk, obj := range is.Deposed {
+                                        // Deposed objects should never be "planned", but we'll
+                                        // do this anyway for the sake of completeness.
+                                        if obj.Status == ObjectPlanned {
+                                                ms.ForgetResourceInstanceDeposed(instAddr, dk)
+                                        }
+                                }
+                        }
+                }
+
+                // We may have deleted some objects, which means that we may have
+                // left a module empty, and so we must prune to preserve the invariant
+                // that only the root module is allowed to be empty.
+                s.maybePruneModule(moduleAddr)
+        }
+}
+
+// Lock acquires an explicit lock on the state, allowing direct read and write
+// access to the returned state object. The caller must call Unlock once
+// access is no longer needed, and then immediately discard the state pointer
+// pointer.
+//
+// Most callers should not use this. Instead, use the concurrency-safe
+// accessors and mutators provided directly on SyncState.
+func (s *SyncState) Lock() *State {
+        s.lock.Lock()
+        return s.state
+}
+
+// Unlock releases a lock previously acquired by Lock, at which point the
+// caller must cease all use of the state pointer that was returned.
+//
+// Do not call this method except to end an explicit lock acquired by
+// Lock. If a caller calls Unlock without first holding the lock, behavior
+// is undefined.
+func (s *SyncState) Unlock() {
+        s.lock.Unlock()
+}
+
+// maybePruneModule will remove a module from the state altogether if it is
+// empty, unless it's the root module which must always be present.
+//
+// This helper method is not concurrency-safe on its own, so must only be
+// called while the caller is already holding the lock for writing.
+func (s *SyncState) maybePruneModule(addr addrs.ModuleInstance) {
+        if addr.IsRoot() {
+                // We never prune the root.
+                return
+        }
+
+        ms := s.state.Module(addr)
+        if ms == nil {
+                return
+        }
+
+        if ms.empty() {
+                log.Printf("[TRACE] states.SyncState: pruning %s because it is empty", addr)
+                s.state.RemoveModule(addr)
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/context.go b/vendor/github.com/hashicorp/terraform/terraform/context.go
index f133cc2..afdba99 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/context.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/context.go
@@ -1,20 +1,26 @@
 package terraform
 
 import (
+        "bytes"
         "context"
         "fmt"
         "log"
-        "sort"
         "strings"
         "sync"
 
-        "github.com/hashicorp/terraform/tfdiags"
-
-        "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/hcl"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
-        "github.com/hashicorp/terraform/version"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/states/statefile"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // InputMode defines what sort of input will be asked for when Input
@@ -51,19 +57,18 @@ var (
 // ContextOpts are the user-configurable options to create a context with
 // NewContext.
 type ContextOpts struct {
-        Meta               *ContextMeta
-        Destroy            bool
-        Diff               *Diff
-        Hooks              []Hook
-        Module             *module.Tree
-        Parallelism        int
-        State              *State
-        StateFutureAllowed bool
-        ProviderResolver   ResourceProviderResolver
-        Provisioners       map[string]ResourceProvisionerFactory
-        Shadow             bool
-        Targets            []string
-        Variables          map[string]interface{}
+        Config    *configs.Config
+        Changes   *plans.Changes
+        State     *states.State
+        Targets   []addrs.Targetable
+        Variables InputValues
+        Meta      *ContextMeta
+        Destroy   bool
+
+        Hooks            []Hook
+        Parallelism      int
+        ProviderResolver providers.Resolver
+        Provisioners     map[string]ProvisionerFactory
 
         // If non-nil, will apply as additional constraints on the provider
         // plugins that will be requested from the provider resolver.
@@ -83,32 +88,25 @@ type ContextMeta struct {
 
 // Context represents all the context that Terraform needs in order to
 // perform operations on infrastructure. This structure is built using
-// NewContext. See the documentation for that.
-//
-// Extra functions on Context can be found in context_*.go files.
+// NewContext.
 type Context struct {
-        // Maintainer note: Anytime this struct is changed, please verify
-        // that newShadowContext still does the right thing. Tests should
-        // fail regardless but putting this note here as well.
+        config    *configs.Config
+        changes   *plans.Changes
+        state     *states.State
+        targets   []addrs.Targetable
+        variables InputValues
+        meta      *ContextMeta
+        destroy   bool
 
-        components contextComponentFactory
-        destroy    bool
-        diff       *Diff
-        diffLock   sync.RWMutex
         hooks      []Hook
-        meta       *ContextMeta
-        module     *module.Tree
+        components contextComponentFactory
+        schemas    *Schemas
         sh         *stopHook
-        shadow     bool
-        state      *State
-        stateLock  sync.RWMutex
-        targets    []string
         uiInput    UIInput
-        variables  map[string]interface{}
 
         l                   sync.Mutex // Lock acquired during any task
         parallelSem         Semaphore
-        providerInputConfig map[string]map[string]interface{}
+        providerInputConfig map[string]map[string]cty.Value
         providerSHA256s     map[string][]byte
         runLock             sync.Mutex
         runCond             *sync.Cond
@@ -117,17 +115,23 @@ type Context struct {
         shadowErr           error
 }
 
+// (additional methods on Context can be found in context_*.go files.)
+
 // NewContext creates a new Context structure.
 //
-// Once a Context is creator, the pointer values within ContextOpts
-// should not be mutated in any way, since the pointers are copied, not
-// the values themselves.
-func NewContext(opts *ContextOpts) (*Context, error) {
-        // Validate the version requirement if it is given
-        if opts.Module != nil {
-                if err := CheckRequiredVersion(opts.Module); err != nil {
-                        return nil, err
-                }
+// Once a Context is created, the caller must not access or mutate any of
+// the objects referenced (directly or indirectly) by the ContextOpts fields.
+//
+// If the returned diagnostics contains errors then the resulting context is
+// invalid and must not be used.
+func NewContext(opts *ContextOpts) (*Context, tfdiags.Diagnostics) {
+        log.Printf("[TRACE] terraform.NewContext: starting")
+        diags := CheckCoreVersionRequirements(opts.Config)
+        // If version constraints are not met then we'll bail early since otherwise
+        // we're likely to just see a bunch of other errors related to
+        // incompatibilities, which could be overwhelming for the user.
+        if diags.HasErrors() {
+                return nil, diags
         }
 
         // Copy all the hooks and add our stop hook. We don't append directly
@@ -139,21 +143,9 @@ func NewContext(opts *ContextOpts) (*Context, error) {
 
         state := opts.State
         if state == nil {
-                state = new(State)
-                state.init()
-        }
-
-        // If our state is from the future, then error. Callers can avoid
-        // this error by explicitly setting `StateFutureAllowed`.
-        if err := CheckStateVersion(state); err != nil && !opts.StateFutureAllowed {
-                return nil, err
+                state = states.NewState()
         }
 
-        // Explicitly reset our state version to our current version so that
-        // any operations we do will write out that our latest version
-        // has run.
-        state.TFVersion = version.Version
-
         // Determine parallelism, default to 10. We do this both to limit
         // CPU pressure but also to have an extra guard against rate throttling
         // from providers.
@@ -168,60 +160,84 @@ func NewContext(opts *ContextOpts) (*Context, error) {
         //    2 - Take values specified in -var flags, overriding values
         //        set by environment variables if necessary. This includes
         //        values taken from -var-file in addition.
-        variables := make(map[string]interface{})
-        if opts.Module != nil {
-                var err error
-                variables, err = Variables(opts.Module, opts.Variables)
-                if err != nil {
-                        return nil, err
-                }
+        var variables InputValues
+        if opts.Config != nil {
+                // Default variables from the configuration seed our map.
+                variables = DefaultVariableValues(opts.Config.Module.Variables)
         }
+        // Variables provided by the caller (from CLI, environment, etc) can
+        // override the defaults.
+        variables = variables.Override(opts.Variables)
 
         // Bind available provider plugins to the constraints in config
-        var providers map[string]ResourceProviderFactory
+        var providerFactories map[string]providers.Factory
         if opts.ProviderResolver != nil {
-                var err error
-                deps := ModuleTreeDependencies(opts.Module, state)
+                deps := ConfigTreeDependencies(opts.Config, state)
                 reqd := deps.AllPluginRequirements()
                 if opts.ProviderSHA256s != nil && !opts.SkipProviderVerify {
                         reqd.LockExecutables(opts.ProviderSHA256s)
                 }
-                providers, err = resourceProviderFactories(opts.ProviderResolver, reqd)
-                if err != nil {
-                        return nil, err
+                log.Printf("[TRACE] terraform.NewContext: resolving provider version selections")
+
+                var providerDiags tfdiags.Diagnostics
+                providerFactories, providerDiags = resourceProviderFactories(opts.ProviderResolver, reqd)
+                diags = diags.Append(providerDiags)
+
+                if diags.HasErrors() {
+                        return nil, diags
                 }
         } else {
-                providers = make(map[string]ResourceProviderFactory)
+                providerFactories = make(map[string]providers.Factory)
         }
 
-        diff := opts.Diff
-        if diff == nil {
-                diff = &Diff{}
+        components := &basicComponentFactory{
+                providers:    providerFactories,
+                provisioners: opts.Provisioners,
         }
 
+        log.Printf("[TRACE] terraform.NewContext: loading provider schemas")
+        schemas, err := LoadSchemas(opts.Config, opts.State, components)
+        if err != nil {
+                diags = diags.Append(err)
+                return nil, diags
+        }
+
+        changes := opts.Changes
+        if changes == nil {
+                changes = plans.NewChanges()
+        }
+
+        config := opts.Config
+        if config == nil {
+                config = configs.NewEmptyConfig()
+        }
+
+        log.Printf("[TRACE] terraform.NewContext: complete")
+
         return &Context{
-                components: &basicComponentFactory{
-                        providers:    providers,
-                        provisioners: opts.Provisioners,
-                },
-                destroy:   opts.Destroy,
-                diff:      diff,
-                hooks:     hooks,
-                meta:      opts.Meta,
-                module:    opts.Module,
-                shadow:    opts.Shadow,
-                state:     state,
-                targets:   opts.Targets,
-                uiInput:   opts.UIInput,
-                variables: variables,
+                components: components,
+                schemas:    schemas,
+                destroy:    opts.Destroy,
+                changes:    changes,
+                hooks:      hooks,
+                meta:       opts.Meta,
+                config:     config,
+                state:      state,
+                targets:    opts.Targets,
+                uiInput:    opts.UIInput,
+                variables:  variables,
 
                 parallelSem:         NewSemaphore(par),
-                providerInputConfig: make(map[string]map[string]interface{}),
+                providerInputConfig: make(map[string]map[string]cty.Value),
                 providerSHA256s:     opts.ProviderSHA256s,
                 sh:                  sh,
         }, nil
 }
 
+func (c *Context) Schemas() *Schemas {
+        return c.schemas
+}
+
 type ContextGraphOpts struct {
         // If true, validates the graph structure (checks for cycles).
         Validate bool
@@ -233,7 +249,7 @@ type ContextGraphOpts struct {
 // Graph returns the graph used for the given operation type.
 //
 // The most extensive or complex graph type is GraphTypePlan.
-func (c *Context) Graph(typ GraphType, opts *ContextGraphOpts) (*Graph, error) {
+func (c *Context) Graph(typ GraphType, opts *ContextGraphOpts) (*Graph, tfdiags.Diagnostics) {
         if opts == nil {
                 opts = &ContextGraphOpts{Validate: true}
         }
@@ -242,65 +258,71 @@ func (c *Context) Graph(typ GraphType, opts *ContextGraphOpts) (*Graph, error) {
         switch typ {
         case GraphTypeApply:
                 return (&ApplyGraphBuilder{
-                        Module:       c.module,
-                        Diff:         c.diff,
-                        State:        c.state,
-                        Providers:    c.components.ResourceProviders(),
-                        Provisioners: c.components.ResourceProvisioners(),
-                        Targets:      c.targets,
-                        Destroy:      c.destroy,
-                        Validate:     opts.Validate,
-                }).Build(RootModulePath)
-
-        case GraphTypeInput:
-                // The input graph is just a slightly modified plan graph
-                fallthrough
+                        Config:     c.config,
+                        Changes:    c.changes,
+                        State:      c.state,
+                        Components: c.components,
+                        Schemas:    c.schemas,
+                        Targets:    c.targets,
+                        Destroy:    c.destroy,
+                        Validate:   opts.Validate,
+                }).Build(addrs.RootModuleInstance)
+
         case GraphTypeValidate:
                 // The validate graph is just a slightly modified plan graph
                 fallthrough
         case GraphTypePlan:
                 // Create the plan graph builder
                 p := &PlanGraphBuilder{
-                        Module:    c.module,
-                        State:     c.state,
-                        Providers: c.components.ResourceProviders(),
-                        Targets:   c.targets,
-                        Validate:  opts.Validate,
+                        Config:     c.config,
+                        State:      c.state,
+                        Components: c.components,
+                        Schemas:    c.schemas,
+                        Targets:    c.targets,
+                        Validate:   opts.Validate,
                 }
 
                 // Some special cases for other graph types shared with plan currently
                 var b GraphBuilder = p
                 switch typ {
-                case GraphTypeInput:
-                        b = InputGraphBuilder(p)
                 case GraphTypeValidate:
-                        // We need to set the provisioners so those can be validated
-                        p.Provisioners = c.components.ResourceProvisioners()
-
                         b = ValidateGraphBuilder(p)
                 }
 
-                return b.Build(RootModulePath)
+                return b.Build(addrs.RootModuleInstance)
 
         case GraphTypePlanDestroy:
                 return (&DestroyPlanGraphBuilder{
-                        Module:   c.module,
-                        State:    c.state,
-                        Targets:  c.targets,
-                        Validate: opts.Validate,
-                }).Build(RootModulePath)
+                        Config:     c.config,
+                        State:      c.state,
+                        Components: c.components,
+                        Schemas:    c.schemas,
+                        Targets:    c.targets,
+                        Validate:   opts.Validate,
+                }).Build(addrs.RootModuleInstance)
 
         case GraphTypeRefresh:
                 return (&RefreshGraphBuilder{
-                        Module:    c.module,
-                        State:     c.state,
-                        Providers: c.components.ResourceProviders(),
-                        Targets:   c.targets,
-                        Validate:  opts.Validate,
-                }).Build(RootModulePath)
-        }
+                        Config:     c.config,
+                        State:      c.state,
+                        Components: c.components,
+                        Schemas:    c.schemas,
+                        Targets:    c.targets,
+                        Validate:   opts.Validate,
+                }).Build(addrs.RootModuleInstance)
+
+        case GraphTypeEval:
+                return (&EvalGraphBuilder{
+                        Config:     c.config,
+                        State:      c.state,
+                        Components: c.components,
+                        Schemas:    c.schemas,
+                }).Build(addrs.RootModuleInstance)
 
-        return nil, fmt.Errorf("unknown graph type: %s", typ)
+        default:
+                // Should never happen, because the above is exhaustive for all graph types.
+                panic(fmt.Errorf("unsupported graph type %s", typ))
+        }
 }
 
 // ShadowError returns any errors caught during a shadow operation.
@@ -333,141 +355,72 @@ func (c *Context) ShadowError() error {
 // State returns a copy of the current state associated with this context.
 //
 // This cannot safely be called in parallel with any other Context function.
-func (c *Context) State() *State {
+func (c *Context) State() *states.State {
         return c.state.DeepCopy()
 }
 
-// Interpolater returns an Interpolater built on a copy of the state
-// that can be used to test interpolation values.
-func (c *Context) Interpolater() *Interpolater {
-        var varLock sync.Mutex
-        var stateLock sync.RWMutex
-        return &Interpolater{
-                Operation:          walkApply,
-                Meta:               c.meta,
-                Module:             c.module,
-                State:              c.state.DeepCopy(),
-                StateLock:          &stateLock,
-                VariableValues:     c.variables,
-                VariableValuesLock: &varLock,
-        }
-}
-
-// Input asks for input to fill variables and provider configurations.
-// This modifies the configuration in-place, so asking for Input twice
-// may result in different UI output showing different current values.
-func (c *Context) Input(mode InputMode) error {
-        defer c.acquireRun("input")()
-
-        if mode&InputModeVar != 0 {
-                // Walk the variables first for the root module. We walk them in
-                // alphabetical order for UX reasons.
-                rootConf := c.module.Config()
-                names := make([]string, len(rootConf.Variables))
-                m := make(map[string]*config.Variable)
-                for i, v := range rootConf.Variables {
-                        names[i] = v.Name
-                        m[v.Name] = v
-                }
-                sort.Strings(names)
-                for _, n := range names {
-                        // If we only care about unset variables, then if the variable
-                        // is set, continue on.
-                        if mode&InputModeVarUnset != 0 {
-                                if _, ok := c.variables[n]; ok {
-                                        continue
-                                }
-                        }
-
-                        var valueType config.VariableType
-
-                        v := m[n]
-                        switch valueType = v.Type(); valueType {
-                        case config.VariableTypeUnknown:
-                                continue
-                        case config.VariableTypeMap:
-                                // OK
-                        case config.VariableTypeList:
-                                // OK
-                        case config.VariableTypeString:
-                                // OK
-                        default:
-                                panic(fmt.Sprintf("Unknown variable type: %#v", v.Type()))
-                        }
-
-                        // If the variable is not already set, and the variable defines a
-                        // default, use that for the value.
-                        if _, ok := c.variables[n]; !ok {
-                                if v.Default != nil {
-                                        c.variables[n] = v.Default.(string)
-                                        continue
-                                }
-                        }
-
-                        // this should only happen during tests
-                        if c.uiInput == nil {
-                                log.Println("[WARN] Content.uiInput is nil")
-                                continue
-                        }
-
-                        // Ask the user for a value for this variable
-                        var value string
-                        retry := 0
-                        for {
-                                var err error
-                                value, err = c.uiInput.Input(&InputOpts{
-                                        Id:          fmt.Sprintf("var.%s", n),
-                                        Query:       fmt.Sprintf("var.%s", n),
-                                        Description: v.Description,
-                                })
-                                if err != nil {
-                                        return fmt.Errorf(
-                                                "Error asking for %s: %s", n, err)
-                                }
-
-                                if value == "" && v.Required() {
-                                        // Redo if it is required, but abort if we keep getting
-                                        // blank entries
-                                        if retry > 2 {
-                                                return fmt.Errorf("missing required value for %q", n)
-                                        }
-                                        retry++
-                                        continue
-                                }
-
-                                break
-                        }
-
-                        // no value provided, so don't set the variable at all
-                        if value == "" {
-                                continue
-                        }
-
-                        decoded, err := parseVariableAsHCL(n, value, valueType)
-                        if err != nil {
-                                return err
-                        }
-
-                        if decoded != nil {
-                                c.variables[n] = decoded
-                        }
-                }
-        }
+// Eval produces a scope in which expressions can be evaluated for
+// the given module path.
+//
+// This method must first evaluate any ephemeral values (input variables, local
+// values, and output values) in the configuration. These ephemeral values are
+// not included in the persisted state, so they must be re-computed using other
+// values in the state before they can be properly evaluated. The updated
+// values are retained in the main state associated with the receiving context.
+//
+// This function takes no action against remote APIs but it does need access
+// to all provider and provisioner instances in order to obtain their schemas
+// for type checking.
+//
+// The result is an evaluation scope that can be used to resolve references
+// against the root module. If the returned diagnostics contains errors then
+// the returned scope may be nil. If it is not nil then it may still be used
+// to attempt expression evaluation or other analysis, but some expressions
+// may not behave as expected.
+func (c *Context) Eval(path addrs.ModuleInstance) (*lang.Scope, tfdiags.Diagnostics) {
+        // This is intended for external callers such as the "terraform console"
+        // command. Internally, we create an evaluator in c.walk before walking
+        // the graph, and create scopes in ContextGraphWalker.
 
-        if mode&InputModeProvider != 0 {
-                // Build the graph
-                graph, err := c.Graph(GraphTypeInput, nil)
-                if err != nil {
-                        return err
-                }
+        var diags tfdiags.Diagnostics
+        defer c.acquireRun("eval")()
 
-                // Do the walk
-                if _, err := c.walk(graph, walkInput); err != nil {
-                        return err
-                }
-        }
+        // Start with a copy of state so that we don't affect any instances
+        // that other methods may have already returned.
+        c.state = c.state.DeepCopy()
+        var walker *ContextGraphWalker
+
+        graph, graphDiags := c.Graph(GraphTypeEval, nil)
+        diags = diags.Append(graphDiags)
+        if !diags.HasErrors() {
+                var walkDiags tfdiags.Diagnostics
+                walker, walkDiags = c.walk(graph, walkEval)
+                diags = diags.Append(walker.NonFatalDiagnostics)
+                diags = diags.Append(walkDiags)
+        }
+
+        if walker == nil {
+                // If we skipped walking the graph (due to errors) then we'll just
+                // use a placeholder graph walker here, which'll refer to the
+                // unmodified state.
+                walker = c.graphWalker(walkEval)
+        }
+
+        // This is a bit weird since we don't normally evaluate outside of
+        // the context of a walk, but we'll "re-enter" our desired path here
+        // just to get hold of an EvalContext for it. GraphContextBuiltin
+        // caches its contexts, so we should get hold of the context that was
+        // previously used for evaluation here, unless we skipped walking.
+        evalCtx := walker.EnterPath(path)
+        return evalCtx.EvaluationScope(nil, EvalDataForNoInstanceKey), diags
+}
 
-        return nil
+// Interpolater is no longer used. Use Evaluator instead.
+//
+// The interpolator returned from this function will return an error on any use.
+func (c *Context) Interpolater() *Interpolater {
+        // FIXME: Remove this once all callers are updated to no longer use it.
+        return &Interpolater{}
 }
 
 // Apply applies the changes represented by this context and returns
@@ -484,23 +437,16 @@ func (c *Context) Input(mode InputMode) error {
 //       State() method. Currently the helper/resource testing framework relies
 //       on the absence of a returned state to determine if Destroy can be
 //       called, so that will need to be refactored before this can be changed.
-func (c *Context) Apply() (*State, error) {
+func (c *Context) Apply() (*states.State, tfdiags.Diagnostics) {
         defer c.acquireRun("apply")()
 
-        // Check there are no empty target parameter values
-        for _, target := range c.targets {
-                if target == "" {
-                        return nil, fmt.Errorf("Target parameter must not have empty value")
-                }
-        }
-
         // Copy our own state
         c.state = c.state.DeepCopy()
 
         // Build the graph.
-        graph, err := c.Graph(GraphTypeApply, nil)
-        if err != nil {
-                return nil, err
+        graph, diags := c.Graph(GraphTypeApply, nil)
+        if diags.HasErrors() {
+                return nil, diags
         }
 
         // Determine the operation
@@ -510,15 +456,30 @@ func (c *Context) Apply() (*State, error) {
         }
 
         // Walk the graph
-        walker, err := c.walk(graph, operation)
-        if len(walker.ValidationErrors) > 0 {
-                err = multierror.Append(err, walker.ValidationErrors...)
-        }
-
-        // Clean out any unused things
-        c.state.prune()
-
-        return c.state, err
+        walker, walkDiags := c.walk(graph, operation)
+        diags = diags.Append(walker.NonFatalDiagnostics)
+        diags = diags.Append(walkDiags)
+
+        if c.destroy && !diags.HasErrors() {
+                // If we know we were trying to destroy objects anyway, and we
+                // completed without any errors, then we'll also prune out any
+                // leftover empty resource husks (left after all of the instances
+                // of a resource with "count" or "for_each" are destroyed) to
+                // help ensure we end up with an _actually_ empty state, assuming
+                // we weren't destroying with -target here.
+                //
+                // (This doesn't actually take into account -target, but that should
+                // be okay because it doesn't throw away anything we can't recompute
+                // on a subsequent "terraform plan" run, if the resources are still
+                // present in the configuration. However, this _will_ cause "count = 0"
+                // resources to read as unknown during the next refresh walk, which
+                // may cause some additional churn if used in a data resource or
+                // provider block, until we remove refreshing as a separate walk and
+                // just do it as part of the plan walk.)
+                c.state.PruneResourceHusks()
+        }
+
+        return c.state, diags
 }
 
 // Plan generates an execution plan for the given context.
@@ -528,38 +489,45 @@ func (c *Context) Apply() (*State, error) {
 //
 // Plan also updates the diff of this context to be the diff generated
 // by the plan, so Apply can be called after.
-func (c *Context) Plan() (*Plan, error) {
+func (c *Context) Plan() (*plans.Plan, tfdiags.Diagnostics) {
         defer c.acquireRun("plan")()
+        c.changes = plans.NewChanges()
 
-        // Check there are no empty target parameter values
-        for _, target := range c.targets {
-                if target == "" {
-                        return nil, fmt.Errorf("Target parameter must not have empty value")
+        var diags tfdiags.Diagnostics
+
+        varVals := make(map[string]plans.DynamicValue, len(c.variables))
+        for k, iv := range c.variables {
+                // We use cty.DynamicPseudoType here so that we'll save both the
+                // value _and_ its dynamic type in the plan, so we can recover
+                // exactly the same value later.
+                dv, err := plans.NewDynamicValue(iv.Value, cty.DynamicPseudoType)
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to prepare variable value for plan",
+                                fmt.Sprintf("The value for variable %q could not be serialized to store in the plan: %s.", k, err),
+                        ))
+                        continue
                 }
+                varVals[k] = dv
         }
 
-        p := &Plan{
-                Module:  c.module,
-                Vars:    c.variables,
-                State:   c.state,
-                Targets: c.targets,
-
-                TerraformVersion: version.String(),
-                ProviderSHA256s:  c.providerSHA256s,
+        p := &plans.Plan{
+                VariableValues:  varVals,
+                TargetAddrs:     c.targets,
+                ProviderSHA256s: c.providerSHA256s,
         }
 
         var operation walkOperation
         if c.destroy {
                 operation = walkPlanDestroy
-                p.Destroy = true
         } else {
                 // Set our state to be something temporary. We do this so that
                 // the plan can update a fake state so that variables work, then
                 // we replace it back with our old state.
                 old := c.state
                 if old == nil {
-                        c.state = &State{}
-                        c.state.init()
+                        c.state = states.NewState()
                 } else {
                         c.state = old.DeepCopy()
                 }
@@ -570,57 +538,27 @@ func (c *Context) Plan() (*Plan, error) {
                 operation = walkPlan
         }
 
-        // Setup our diff
-        c.diffLock.Lock()
-        c.diff = new(Diff)
-        c.diff.init()
-        c.diffLock.Unlock()
-
         // Build the graph.
         graphType := GraphTypePlan
         if c.destroy {
                 graphType = GraphTypePlanDestroy
         }
-        graph, err := c.Graph(graphType, nil)
-        if err != nil {
-                return nil, err
+        graph, graphDiags := c.Graph(graphType, nil)
+        diags = diags.Append(graphDiags)
+        if graphDiags.HasErrors() {
+                return nil, diags
         }
 
         // Do the walk
-        walker, err := c.walk(graph, operation)
-        if err != nil {
-                return nil, err
+        walker, walkDiags := c.walk(graph, operation)
+        diags = diags.Append(walker.NonFatalDiagnostics)
+        diags = diags.Append(walkDiags)
+        if walkDiags.HasErrors() {
+                return nil, diags
         }
-        p.Diff = c.diff
-
-        // If this is true, it means we're running unit tests. In this case,
-        // we perform a deep copy just to ensure that all context tests also
-        // test that a diff is copy-able. This will panic if it fails. This
-        // is enabled during unit tests.
-        //
-        // This should never be true during production usage, but even if it is,
-        // it can't do any real harm.
-        if contextTestDeepCopyOnPlan {
-                p.Diff.DeepCopy()
-        }
-
-        /*
-                // We don't do the reverification during the new destroy plan because
-                // it will use a different apply process.
-                if X_legacyGraph {
-                        // Now that we have a diff, we can build the exact graph that Apply will use
-                        // and catch any possible cycles during the Plan phase.
-                        if _, err := c.Graph(GraphTypeLegacy, nil); err != nil {
-                                return nil, err
-                        }
-                }
-        */
+        p.Changes = c.changes
 
-        var errs error
-        if len(walker.ValidationErrors) > 0 {
-                errs = multierror.Append(errs, walker.ValidationErrors...)
-        }
-        return p, errs
+        return p, diags
 }
 
 // Refresh goes through all the resources in the state and refreshes them
@@ -629,27 +567,46 @@ func (c *Context) Plan() (*Plan, error) {
 //
 // Even in the case an error is returned, the state may be returned and
 // will potentially be partially updated.
-func (c *Context) Refresh() (*State, error) {
+func (c *Context) Refresh() (*states.State, tfdiags.Diagnostics) {
         defer c.acquireRun("refresh")()
 
         // Copy our own state
         c.state = c.state.DeepCopy()
 
+        // Refresh builds a partial changeset as part of its work because it must
+        // create placeholder stubs for any resource instances that'll be created
+        // in subsequent plan so that provider configurations and data resources
+        // can interpolate from them. This plan is always thrown away after
+        // the operation completes, restoring any existing changeset.
+        oldChanges := c.changes
+        defer func() { c.changes = oldChanges }()
+        c.changes = plans.NewChanges()
+
         // Build the graph.
-        graph, err := c.Graph(GraphTypeRefresh, nil)
-        if err != nil {
-                return nil, err
+        graph, diags := c.Graph(GraphTypeRefresh, nil)
+        if diags.HasErrors() {
+                return nil, diags
         }
 
         // Do the walk
-        if _, err := c.walk(graph, walkRefresh); err != nil {
-                return nil, err
-        }
-
-        // Clean out any unused things
-        c.state.prune()
-
-        return c.state, nil
+        _, walkDiags := c.walk(graph, walkRefresh)
+        diags = diags.Append(walkDiags)
+        if walkDiags.HasErrors() {
+                return nil, diags
+        }
+
+        // During our walk we will have created planned object placeholders in
+        // state for resource instances that are in configuration but not yet
+        // created. These were created only to allow expression evaluation to
+        // work properly in provider and data blocks during the walk and must
+        // now be discarded, since a subsequent plan walk is responsible for
+        // creating these "for real".
+        // TODO: Consolidate refresh and plan into a single walk, so that the
+        // refresh walk doesn't need to emulate various aspects of the plan
+        // walk in order to properly evaluate provider and data blocks.
+        c.state.SyncWrapper().RemovePlannedResourceInstanceObjects()
+
+        return c.state, diags
 }
 
 // Stop stops the running task.
@@ -675,32 +632,33 @@ func (c *Context) Stop() {
 
         // Grab the condition var before we exit
         if cond := c.runCond; cond != nil {
+                log.Printf("[INFO] terraform: waiting for graceful stop to complete")
                 cond.Wait()
         }
 
         log.Printf("[WARN] terraform: stop complete")
 }
 
-// Validate validates the configuration and returns any warnings or errors.
+// Validate performs semantic validation of the configuration, and returning
+// any warnings or errors.
+//
+// Syntax and structural checks are performed by the configuration loader,
+// and so are not repeated here.
 func (c *Context) Validate() tfdiags.Diagnostics {
         defer c.acquireRun("validate")()
 
         var diags tfdiags.Diagnostics
 
-        // Validate the configuration itself
-        diags = diags.Append(c.module.Validate())
-
-        // This only needs to be done for the root module, since inter-module
-        // variables are validated in the module tree.
-        if config := c.module.Config(); config != nil {
-                // Validate the user variables
-                for _, err := range smcUserVariables(config, c.variables) {
-                        diags = diags.Append(err)
-                }
+        // Validate input variables. We do this only for the values supplied
+        // by the root module, since child module calls are validated when we
+        // visit their graph nodes.
+        if c.config != nil {
+                varDiags := checkInputVariables(c.config.Module.Variables, c.variables)
+                diags = diags.Append(varDiags)
         }
 
-        // If we have errors at this point, the graphing has no chance,
-        // so just bail early.
+        // If we have errors at this point then we probably won't be able to
+        // construct a graph without producing redundant errors, so we'll halt early.
         if diags.HasErrors() {
                 return diags
         }
@@ -709,48 +667,41 @@ func (c *Context) Validate() tfdiags.Diagnostics {
         // We also validate the graph generated here, but this graph doesn't
         // necessarily match the graph that Plan will generate, so we'll validate the
         // graph again later after Planning.
-        graph, err := c.Graph(GraphTypeValidate, nil)
-        if err != nil {
-                diags = diags.Append(err)
+        graph, graphDiags := c.Graph(GraphTypeValidate, nil)
+        diags = diags.Append(graphDiags)
+        if graphDiags.HasErrors() {
                 return diags
         }
 
         // Walk
-        walker, err := c.walk(graph, walkValidate)
-        if err != nil {
-                diags = diags.Append(err)
-        }
-
-        sort.Strings(walker.ValidationWarnings)
-        sort.Slice(walker.ValidationErrors, func(i, j int) bool {
-                return walker.ValidationErrors[i].Error() < walker.ValidationErrors[j].Error()
-        })
-
-        for _, warn := range walker.ValidationWarnings {
-                diags = diags.Append(tfdiags.SimpleWarning(warn))
-        }
-        for _, err := range walker.ValidationErrors {
-                diags = diags.Append(err)
+        walker, walkDiags := c.walk(graph, walkValidate)
+        diags = diags.Append(walker.NonFatalDiagnostics)
+        diags = diags.Append(walkDiags)
+        if walkDiags.HasErrors() {
+                return diags
         }
 
         return diags
 }
 
-// Module returns the module tree associated with this context.
-func (c *Context) Module() *module.Tree {
-        return c.module
+// Config returns the configuration tree associated with this context.
+func (c *Context) Config() *configs.Config {
+        return c.config
 }
 
 // Variables will return the mapping of variables that were defined
 // for this Context. If Input was called, this mapping may be different
 // than what was given.
-func (c *Context) Variables() map[string]interface{} {
+func (c *Context) Variables() InputValues {
         return c.variables
 }
 
 // SetVariable sets a variable after a context has already been built.
-func (c *Context) SetVariable(k string, v interface{}) {
-        c.variables[k] = v
+func (c *Context) SetVariable(k string, v cty.Value) {
+        c.variables[k] = &InputValue{
+                Value:      v,
+                SourceType: ValueFromCaller,
+        }
 }
 
 func (c *Context) acquireRun(phase string) func() {
@@ -767,9 +718,6 @@ func (c *Context) acquireRun(phase string) func() {
         // Build our lock
         c.runCond = sync.NewCond(&c.l)
 
-        // Setup debugging
-        dbug.SetPhase(phase)
-
         // Create a new run context
         c.runContext, c.runContextCancel = context.WithCancel(context.Background())
 
@@ -787,11 +735,6 @@ func (c *Context) releaseRun() {
         c.l.Lock()
         defer c.l.Unlock()
 
-        // setting the phase to "INVALID" lets us easily detect if we have
-        // operations happening outside of a run, or we missed setting the proper
-        // phase
-        dbug.SetPhase("INVALID")
-
         // End our run. We check if runContext is non-nil because it can be
         // set to nil if it was cancelled via Stop()
         if c.runContextCancel != nil {
@@ -807,30 +750,33 @@ func (c *Context) releaseRun() {
         c.runContext = nil
 }
 
-func (c *Context) walk(graph *Graph, operation walkOperation) (*ContextGraphWalker, error) {
-        // Keep track of the "real" context which is the context that does
-        // the real work: talking to real providers, modifying real state, etc.
-        realCtx := c
-
+func (c *Context) walk(graph *Graph, operation walkOperation) (*ContextGraphWalker, tfdiags.Diagnostics) {
         log.Printf("[DEBUG] Starting graph walk: %s", operation.String())
 
-        walker := &ContextGraphWalker{
-                Context:     realCtx,
-                Operation:   operation,
-                StopContext: c.runContext,
-        }
+        walker := c.graphWalker(operation)
 
         // Watch for a stop so we can call the provider Stop() API.
         watchStop, watchWait := c.watchStop(walker)
 
         // Walk the real graph, this will block until it completes
-        realErr := graph.Walk(walker)
+        diags := graph.Walk(walker)
 
         // Close the channel so the watcher stops, and wait for it to return.
         close(watchStop)
         <-watchWait
 
-        return walker, realErr
+        return walker, diags
+}
+
+func (c *Context) graphWalker(operation walkOperation) *ContextGraphWalker {
+        return &ContextGraphWalker{
+                Context:            c,
+                State:              c.state.SyncWrapper(),
+                Changes:            c.changes.SyncWrapper(),
+                Operation:          operation,
+                StopContext:        c.runContext,
+                RootVariableValues: c.variables,
+        }
 }
 
 // watchStop immediately returns a `stop` and a `wait` chan after dispatching
@@ -863,12 +809,13 @@ func (c *Context) watchStop(walker *ContextGraphWalker) (chan struct{}, <-chan s
                 }
 
                 // If we're here, we're stopped, trigger the call.
+                log.Printf("[TRACE] Context: requesting providers and provisioners to gracefully stop")
 
                 {
                         // Copy the providers so that a misbehaved blocking Stop doesn't
                         // completely hang Terraform.
                         walker.providerLock.Lock()
-                        ps := make([]ResourceProvider, 0, len(walker.providerCache))
+                        ps := make([]providers.Interface, 0, len(walker.providerCache))
                         for _, p := range walker.providerCache {
                                 ps = append(ps, p)
                         }
@@ -885,7 +832,7 @@ func (c *Context) watchStop(walker *ContextGraphWalker) (chan struct{}, <-chan s
                 {
                         // Call stop on all the provisioners
                         walker.provisionerLock.Lock()
-                        ps := make([]ResourceProvisioner, 0, len(walker.provisionerCache))
+                        ps := make([]provisioners.Interface, 0, len(walker.provisionerCache))
                         for _, p := range walker.provisionerCache {
                                 ps = append(ps, p)
                         }
@@ -955,3 +902,37 @@ func parseVariableAsHCL(name string, input string, targetType config.VariableTyp
                 panic(fmt.Errorf("unknown type %s", targetType.Printable()))
         }
 }
+
+// ShimLegacyState is a helper that takes the legacy state type and
+// converts it to the new state type.
+//
+// This is implemented as a state file upgrade, so it will not preserve
+// parts of the state structure that are not included in a serialized state,
+// such as the resolved results of any local values, outputs in non-root
+// modules, etc.
+func ShimLegacyState(legacy *State) (*states.State, error) {
+        if legacy == nil {
+                return nil, nil
+        }
+        var buf bytes.Buffer
+        err := WriteState(legacy, &buf)
+        if err != nil {
+                return nil, err
+        }
+        f, err := statefile.Read(&buf)
+        if err != nil {
+                return nil, err
+        }
+        return f.State, err
+}
+
+// MustShimLegacyState is a wrapper around ShimLegacyState that panics if
+// the conversion does not succeed. This is primarily intended for tests where
+// the given legacy state is an object constructed within the test.
+func MustShimLegacyState(legacy *State) *states.State {
+        ret, err := ShimLegacyState(legacy)
+        if err != nil {
+                panic(err)
+        }
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/context_components.go b/vendor/github.com/hashicorp/terraform/terraform/context_components.go
index 6f50744..26ec995 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/context_components.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/context_components.go
@@ -2,6 +2,9 @@ package terraform
 
 import (
         "fmt"
+
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
 )
 
 // contextComponentFactory is the interface that Context uses
@@ -12,25 +15,25 @@ type contextComponentFactory interface {
         // ResourceProvider creates a new ResourceProvider with the given
         // type. The "uid" is a unique identifier for this provider being
         // initialized that can be used for internal tracking.
-        ResourceProvider(typ, uid string) (ResourceProvider, error)
+        ResourceProvider(typ, uid string) (providers.Interface, error)
         ResourceProviders() []string
 
         // ResourceProvisioner creates a new ResourceProvisioner with the
         // given type. The "uid" is a unique identifier for this provisioner
         // being initialized that can be used for internal tracking.
-        ResourceProvisioner(typ, uid string) (ResourceProvisioner, error)
+        ResourceProvisioner(typ, uid string) (provisioners.Interface, error)
         ResourceProvisioners() []string
 }
 
 // basicComponentFactory just calls a factory from a map directly.
 type basicComponentFactory struct {
-        providers    map[string]ResourceProviderFactory
-        provisioners map[string]ResourceProvisionerFactory
+        providers    map[string]providers.Factory
+        provisioners map[string]ProvisionerFactory
 }
 
 func (c *basicComponentFactory) ResourceProviders() []string {
         result := make([]string, len(c.providers))
-        for k, _ := range c.providers {
+        for k := range c.providers {
                 result = append(result, k)
         }
 
@@ -39,14 +42,14 @@ func (c *basicComponentFactory) ResourceProviders() []string {
 
 func (c *basicComponentFactory) ResourceProvisioners() []string {
         result := make([]string, len(c.provisioners))
-        for k, _ := range c.provisioners {
+        for k := range c.provisioners {
                 result = append(result, k)
         }
 
         return result
 }
 
-func (c *basicComponentFactory) ResourceProvider(typ, uid string) (ResourceProvider, error) {
+func (c *basicComponentFactory) ResourceProvider(typ, uid string) (providers.Interface, error) {
         f, ok := c.providers[typ]
         if !ok {
                 return nil, fmt.Errorf("unknown provider %q", typ)
@@ -55,7 +58,7 @@ func (c *basicComponentFactory) ResourceProvider(typ, uid string) (ResourceProvi
         return f()
 }
 
-func (c *basicComponentFactory) ResourceProvisioner(typ, uid string) (ResourceProvisioner, error) {
+func (c *basicComponentFactory) ResourceProvisioner(typ, uid string) (provisioners.Interface, error) {
         f, ok := c.provisioners[typ]
         if !ok {
                 return nil, fmt.Errorf("unknown provisioner %q", typ)
diff --git a/vendor/github.com/hashicorp/terraform/terraform/context_graph_type.go b/vendor/github.com/hashicorp/terraform/terraform/context_graph_type.go
index 084f010..0a424a0 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/context_graph_type.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/context_graph_type.go
@@ -14,8 +14,8 @@ const (
         GraphTypePlan
         GraphTypePlanDestroy
         GraphTypeApply
-        GraphTypeInput
         GraphTypeValidate
+        GraphTypeEval // only visits in-memory elements such as variables, locals, and outputs.
 )
 
 // GraphTypeMap is a mapping of human-readable string to GraphType. This
@@ -23,10 +23,10 @@ const (
 // graph types.
 var GraphTypeMap = map[string]GraphType{
         "apply":        GraphTypeApply,
-        "input":        GraphTypeInput,
         "plan":         GraphTypePlan,
         "plan-destroy": GraphTypePlanDestroy,
         "refresh":      GraphTypeRefresh,
         "legacy":       GraphTypeLegacy,
         "validate":     GraphTypeValidate,
+        "eval":         GraphTypeEval,
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/context_import.go b/vendor/github.com/hashicorp/terraform/terraform/context_import.go
index e940143..313e909 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/context_import.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/context_import.go
@@ -1,7 +1,10 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ImportOpts are used as the configuration for Import.
@@ -9,23 +12,23 @@ type ImportOpts struct {
         // Targets are the targets to import
         Targets []*ImportTarget
 
-        // Module is optional, and specifies a config module that is loaded
-        // into the graph and evaluated. The use case for this is to provide
-        // provider configuration.
-        Module *module.Tree
+        // Config is optional, and specifies a config tree that will be loaded
+        // into the graph and evaluated. This is the source for provider
+        // configurations.
+        Config *configs.Config
 }
 
 // ImportTarget is a single resource to import.
 type ImportTarget struct {
-        // Addr is the full resource address of the resource to import.
-        // Example: "module.foo.aws_instance.bar"
-        Addr string
+        // Addr is the address for the resource instance that the new object should
+        // be imported into.
+        Addr addrs.AbsResourceInstance
 
         // ID is the ID of the resource to import. This is resource-specific.
         ID string
 
-        // Provider string
-        Provider string
+        // ProviderAddr is the address of the provider that should handle the import.
+        ProviderAddr addrs.AbsProviderConfig
 }
 
 // Import takes already-created external resources and brings them
@@ -38,7 +41,9 @@ type ImportTarget struct {
 // Further, this operation also gracefully handles partial state. If during
 // an import there is a failure, all previously imported resources remain
 // imported.
-func (c *Context) Import(opts *ImportOpts) (*State, error) {
+func (c *Context) Import(opts *ImportOpts) (*states.State, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
         // Hold a lock since we can modify our own state here
         defer c.acquireRun("import")()
 
@@ -47,31 +52,32 @@ func (c *Context) Import(opts *ImportOpts) (*State, error) {
 
         // If no module is given, default to the module configured with
         // the Context.
-        module := opts.Module
-        if module == nil {
-                module = c.module
+        config := opts.Config
+        if config == nil {
+                config = c.config
         }
 
         // Initialize our graph builder
         builder := &ImportGraphBuilder{
                 ImportTargets: opts.Targets,
-                Module:        module,
-                Providers:     c.components.ResourceProviders(),
+                Config:        config,
+                Components:    c.components,
+                Schemas:       c.schemas,
         }
 
         // Build the graph!
-        graph, err := builder.Build(RootModulePath)
-        if err != nil {
-                return c.state, err
+        graph, graphDiags := builder.Build(addrs.RootModuleInstance)
+        diags = diags.Append(graphDiags)
+        if graphDiags.HasErrors() {
+                return c.state, diags
         }
 
         // Walk it
-        if _, err := c.walk(graph, walkImport); err != nil {
-                return c.state, err
+        _, walkDiags := c.walk(graph, walkImport)
+        diags = diags.Append(walkDiags)
+        if walkDiags.HasErrors() {
+                return c.state, diags
         }
 
-        // Clean the state
-        c.state.prune()
-
-        return c.state, nil
+        return c.state, diags
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/context_input.go b/vendor/github.com/hashicorp/terraform/terraform/context_input.go
new file mode 100644
index 0000000..6c7be88
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/context_input.go
@@ -0,0 +1,251 @@
+package terraform
+
+import (
+        "context"
+        "fmt"
+        "log"
+        "sort"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// Input asks for input to fill variables and provider configurations.
+// This modifies the configuration in-place, so asking for Input twice
+// may result in different UI output showing different current values.
+func (c *Context) Input(mode InputMode) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+        defer c.acquireRun("input")()
+
+        if c.uiInput == nil {
+                log.Printf("[TRACE] Context.Input: uiInput is nil, so skipping")
+                return diags
+        }
+
+        ctx := context.Background()
+
+        if mode&InputModeVar != 0 {
+                log.Printf("[TRACE] Context.Input: Prompting for variables")
+
+                // Walk the variables first for the root module. We walk them in
+                // alphabetical order for UX reasons.
+                configs := c.config.Module.Variables
+                names := make([]string, 0, len(configs))
+                for name := range configs {
+                        names = append(names, name)
+                }
+                sort.Strings(names)
+        Variables:
+                for _, n := range names {
+                        v := configs[n]
+
+                        // If we only care about unset variables, then we should set any
+                        // variable that is already set.
+                        if mode&InputModeVarUnset != 0 {
+                                if _, isSet := c.variables[n]; isSet {
+                                        continue
+                                }
+                        }
+
+                        // this should only happen during tests
+                        if c.uiInput == nil {
+                                log.Println("[WARN] Context.uiInput is nil during input walk")
+                                continue
+                        }
+
+                        // Ask the user for a value for this variable
+                        var rawValue string
+                        retry := 0
+                        for {
+                                var err error
+                                rawValue, err = c.uiInput.Input(ctx, &InputOpts{
+                                        Id:          fmt.Sprintf("var.%s", n),
+                                        Query:       fmt.Sprintf("var.%s", n),
+                                        Description: v.Description,
+                                })
+                                if err != nil {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Failed to request interactive input",
+                                                fmt.Sprintf("Terraform attempted to request a value for var.%s interactively, but encountered an error: %s.", n, err),
+                                        ))
+                                        return diags
+                                }
+
+                                if rawValue == "" && v.Default == cty.NilVal {
+                                        // Redo if it is required, but abort if we keep getting
+                                        // blank entries
+                                        if retry > 2 {
+                                                diags = diags.Append(tfdiags.Sourceless(
+                                                        tfdiags.Error,
+                                                        "Required variable not assigned",
+                                                        fmt.Sprintf("The variable %q is required, so Terraform cannot proceed without a defined value for it.", n),
+                                                ))
+                                                continue Variables
+                                        }
+                                        retry++
+                                        continue
+                                }
+
+                                break
+                        }
+
+                        val, valDiags := v.ParsingMode.Parse(n, rawValue)
+                        diags = diags.Append(valDiags)
+                        if diags.HasErrors() {
+                                continue
+                        }
+
+                        c.variables[n] = &InputValue{
+                                Value:      val,
+                                SourceType: ValueFromInput,
+                        }
+                }
+        }
+
+        if mode&InputModeProvider != 0 {
+                log.Printf("[TRACE] Context.Input: Prompting for provider arguments")
+
+                // We prompt for input only for provider configurations defined in
+                // the root module. At the time of writing that is an arbitrary
+                // restriction, but we have future plans to support "count" and
+                // "for_each" on modules that will then prevent us from supporting
+                // input for child module configurations anyway (since we'd need to
+                // dynamic-expand first), and provider configurations in child modules
+                // are not recommended since v0.11 anyway, so this restriction allows
+                // us to keep this relatively simple without significant hardship.
+
+                pcs := make(map[string]*configs.Provider)
+                pas := make(map[string]addrs.ProviderConfig)
+                for _, pc := range c.config.Module.ProviderConfigs {
+                        addr := pc.Addr()
+                        pcs[addr.String()] = pc
+                        pas[addr.String()] = addr
+                        log.Printf("[TRACE] Context.Input: Provider %s declared at %s", addr, pc.DeclRange)
+                }
+                // We also need to detect _implied_ provider configs from resources.
+                // These won't have *configs.Provider objects, but they will still
+                // exist in the map and we'll just treat them as empty below.
+                for _, rc := range c.config.Module.ManagedResources {
+                        pa := rc.ProviderConfigAddr()
+                        if pa.Alias != "" {
+                                continue // alias configurations cannot be implied
+                        }
+                        if _, exists := pcs[pa.String()]; !exists {
+                                pcs[pa.String()] = nil
+                                pas[pa.String()] = pa
+                                log.Printf("[TRACE] Context.Input: Provider %s implied by resource block at %s", pa, rc.DeclRange)
+                        }
+                }
+                for _, rc := range c.config.Module.DataResources {
+                        pa := rc.ProviderConfigAddr()
+                        if pa.Alias != "" {
+                                continue // alias configurations cannot be implied
+                        }
+                        if _, exists := pcs[pa.String()]; !exists {
+                                pcs[pa.String()] = nil
+                                pas[pa.String()] = pa
+                                log.Printf("[TRACE] Context.Input: Provider %s implied by data block at %s", pa, rc.DeclRange)
+                        }
+                }
+
+                for pk, pa := range pas {
+                        pc := pcs[pk] // will be nil if this is an implied config
+
+                        // Wrap the input into a namespace
+                        input := &PrefixUIInput{
+                                IdPrefix:    pk,
+                                QueryPrefix: pk + ".",
+                                UIInput:     c.uiInput,
+                        }
+
+                        schema := c.schemas.ProviderConfig(pa.Type)
+                        if schema == nil {
+                                // Could either be an incorrect config or just an incomplete
+                                // mock in tests. We'll let a later pass decide, and just
+                                // ignore this for the purposes of gathering input.
+                                log.Printf("[TRACE] Context.Input: No schema available for provider type %q", pa.Type)
+                                continue
+                        }
+
+                        // For our purposes here we just want to detect if attrbutes are
+                        // set in config at all, so rather than doing a full decode
+                        // (which would require us to prepare an evalcontext, etc) we'll
+                        // use the low-level HCL API to process only the top-level
+                        // structure.
+                        var attrExprs hcl.Attributes // nil if there is no config
+                        if pc != nil && pc.Config != nil {
+                                lowLevelSchema := schemaForInputSniffing(hcldec.ImpliedSchema(schema.DecoderSpec()))
+                                content, _, diags := pc.Config.PartialContent(lowLevelSchema)
+                                if diags.HasErrors() {
+                                        log.Printf("[TRACE] Context.Input: %s has decode error, so ignoring: %s", pa, diags.Error())
+                                        continue
+                                }
+                                attrExprs = content.Attributes
+                        }
+
+                        keys := make([]string, 0, len(schema.Attributes))
+                        for key := range schema.Attributes {
+                                keys = append(keys, key)
+                        }
+                        sort.Strings(keys)
+
+                        vals := map[string]cty.Value{}
+                        for _, key := range keys {
+                                attrS := schema.Attributes[key]
+                                if attrS.Optional {
+                                        continue
+                                }
+                                if attrExprs != nil {
+                                        if _, exists := attrExprs[key]; exists {
+                                                continue
+                                        }
+                                }
+                                if !attrS.Type.Equals(cty.String) {
+                                        continue
+                                }
+
+                                log.Printf("[TRACE] Context.Input: Prompting for %s argument %s", pa, key)
+                                rawVal, err := input.Input(ctx, &InputOpts{
+                                        Id:          key,
+                                        Query:       key,
+                                        Description: attrS.Description,
+                                })
+                                if err != nil {
+                                        log.Printf("[TRACE] Context.Input: Failed to prompt for %s argument %s: %s", pa, key, err)
+                                        continue
+                                }
+
+                                vals[key] = cty.StringVal(rawVal)
+                        }
+
+                        c.providerInputConfig[pk] = vals
+                        log.Printf("[TRACE] Context.Input: Input for %s: %#v", pk, vals)
+                }
+        }
+
+        return diags
+}
+
+// schemaForInputSniffing returns a transformed version of a given schema
+// that marks all attributes as optional, which the Context.Input method can
+// use to detect whether a required argument is set without missing arguments
+// themselves generating errors.
+func schemaForInputSniffing(schema *hcl.BodySchema) *hcl.BodySchema {
+        ret := &hcl.BodySchema{
+                Attributes: make([]hcl.AttributeSchema, len(schema.Attributes)),
+                Blocks:     schema.Blocks,
+        }
+
+        for i, attrS := range schema.Attributes {
+                ret.Attributes[i] = attrS
+                ret.Attributes[i].Required = false
+        }
+
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/debug.go b/vendor/github.com/hashicorp/terraform/terraform/debug.go
deleted file mode 100644
index 265339f..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/debug.go
+++ /dev/null
@@ -1,523 +0,0 @@
-package terraform
-
-import (
-        "archive/tar"
-        "bytes"
-        "compress/gzip"
-        "encoding/json"
-        "fmt"
-        "io"
-        "os"
-        "path/filepath"
-        "sync"
-        "time"
-)
-
-// DebugInfo is the global handler for writing the debug archive. All methods
-// are safe to call concurrently. Setting DebugInfo to nil will disable writing
-// the debug archive. All methods are safe to call on the nil value.
-var dbug *debugInfo
-
-// SetDebugInfo initializes the debug handler with a backing file in the
-// provided directory. This must be called before any other terraform package
-// operations or not at all. Once his is called, CloseDebugInfo should be
-// called before program exit.
-func SetDebugInfo(path string) error {
-        if os.Getenv("TF_DEBUG") == "" {
-                return nil
-        }
-
-        di, err := newDebugInfoFile(path)
-        if err != nil {
-                return err
-        }
-
-        dbug = di
-        return nil
-}
-
-// CloseDebugInfo is the exported interface to Close the debug info handler.
-// The debug handler needs to be closed before program exit, so we export this
-// function to be deferred in the appropriate entrypoint for our executable.
-func CloseDebugInfo() error {
-        return dbug.Close()
-}
-
-// newDebugInfoFile initializes the global debug handler with a backing file in
-// the provided directory.
-func newDebugInfoFile(dir string) (*debugInfo, error) {
-        err := os.MkdirAll(dir, 0755)
-        if err != nil {
-                return nil, err
-        }
-
-        // FIXME: not guaranteed unique, but good enough for now
-        name := fmt.Sprintf("debug-%s", time.Now().Format("2006-01-02-15-04-05.999999999"))
-        archivePath := filepath.Join(dir, name+".tar.gz")
-
-        f, err := os.OpenFile(archivePath, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0666)
-        if err != nil {
-                return nil, err
-        }
-        return newDebugInfo(name, f)
-}
-
-// newDebugInfo initializes the global debug handler.
-func newDebugInfo(name string, w io.Writer) (*debugInfo, error) {
-        gz := gzip.NewWriter(w)
-
-        d := &debugInfo{
-                name: name,
-                w:    w,
-                gz:   gz,
-                tar:  tar.NewWriter(gz),
-        }
-
-        // create the subdirs we need
-        topHdr := &tar.Header{
-                Name:     name,
-                Typeflag: tar.TypeDir,
-                Mode:     0755,
-        }
-        graphsHdr := &tar.Header{
-                Name:     name + "/graphs",
-                Typeflag: tar.TypeDir,
-                Mode:     0755,
-        }
-        err := d.tar.WriteHeader(topHdr)
-        // if the first errors, the second will too
-        err = d.tar.WriteHeader(graphsHdr)
-        if err != nil {
-                return nil, err
-        }
-
-        return d, nil
-}
-
-// debugInfo provides various methods for writing debug information to a
-// central archive. The debugInfo struct should be initialized once before any
-// output is written, and Close should be called before program exit. All
-// exported methods on debugInfo will be safe for concurrent use. The exported
-// methods are also all safe to call on a nil pointer, so that there is no need
-// for conditional blocks before writing debug information.
-//
-// Each write operation done by the debugInfo will flush the gzip.Writer and
-// tar.Writer, and call Sync() or Flush() on the output writer as needed. This
-// ensures that as much data as possible is written to storage in the event of
-// a crash. The append format of the tar file, and the stream format of the
-// gzip writer allow easy recovery f the data in the event that the debugInfo
-// is not closed before program exit.
-type debugInfo struct {
-        sync.Mutex
-
-        // archive root directory name
-        name string
-
-        // current operation phase
-        phase string
-
-        // step is monotonic counter for for recording the order of operations
-        step int
-
-        // flag to protect Close()
-        closed bool
-
-        // the debug log output is in a tar.gz format, written to the io.Writer w
-        w   io.Writer
-        gz  *gzip.Writer
-        tar *tar.Writer
-}
-
-// Set the name of the current operational phase in the debug handler. Each file
-// in the archive will contain the name of the phase in which it was created,
-// i.e. "input", "apply", "plan", "refresh", "validate"
-func (d *debugInfo) SetPhase(phase string) {
-        if d == nil {
-                return
-        }
-        d.Lock()
-        defer d.Unlock()
-
-        d.phase = phase
-}
-
-// Close the debugInfo, finalizing the data in storage. This closes the
-// tar.Writer, the gzip.Wrtier, and if the output writer is an io.Closer, it is
-// also closed.
-func (d *debugInfo) Close() error {
-        if d == nil {
-                return nil
-        }
-
-        d.Lock()
-        defer d.Unlock()
-
-        if d.closed {
-                return nil
-        }
-        d.closed = true
-
-        d.tar.Close()
-        d.gz.Close()
-
-        if c, ok := d.w.(io.Closer); ok {
-                return c.Close()
-        }
-        return nil
-}
-
-// debug buffer is an io.WriteCloser that will write itself to the debug
-// archive when closed.
-type debugBuffer struct {
-        debugInfo *debugInfo
-        name      string
-        buf       bytes.Buffer
-}
-
-func (b *debugBuffer) Write(d []byte) (int, error) {
-        return b.buf.Write(d)
-}
-
-func (b *debugBuffer) Close() error {
-        return b.debugInfo.WriteFile(b.name, b.buf.Bytes())
-}
-
-// ioutils only has a noop ReadCloser
-type nopWriteCloser struct{}
-
-func (nopWriteCloser) Write([]byte) (int, error) { return 0, nil }
-func (nopWriteCloser) Close() error              { return nil }
-
-// NewFileWriter returns an io.WriteClose that will be buffered and written to
-// the debug archive when closed.
-func (d *debugInfo) NewFileWriter(name string) io.WriteCloser {
-        if d == nil {
-                return nopWriteCloser{}
-        }
-
-        return &debugBuffer{
-                debugInfo: d,
-                name:      name,
-        }
-}
-
-type syncer interface {
-        Sync() error
-}
-
-type flusher interface {
-        Flush() error
-}
-
-// Flush the tar.Writer and the gzip.Writer. Flush() or Sync() will be called
-// on the output writer if they are available.
-func (d *debugInfo) flush() {
-        d.tar.Flush()
-        d.gz.Flush()
-
-        if f, ok := d.w.(flusher); ok {
-                f.Flush()
-        }
-
-        if s, ok := d.w.(syncer); ok {
-                s.Sync()
-        }
-}
-
-// WriteFile writes data as a single file to the debug arhive.
-func (d *debugInfo) WriteFile(name string, data []byte) error {
-        if d == nil {
-                return nil
-        }
-
-        d.Lock()
-        defer d.Unlock()
-        return d.writeFile(name, data)
-}
-
-func (d *debugInfo) writeFile(name string, data []byte) error {
-        defer d.flush()
-        path := fmt.Sprintf("%s/%d-%s-%s", d.name, d.step, d.phase, name)
-        d.step++
-
-        hdr := &tar.Header{
-                Name: path,
-                Mode: 0644,
-                Size: int64(len(data)),
-        }
-        err := d.tar.WriteHeader(hdr)
-        if err != nil {
-                return err
-        }
-
-        _, err = d.tar.Write(data)
-        return err
-}
-
-// DebugHook implements all methods of the terraform.Hook interface, and writes
-// the arguments to a file in the archive. When a suitable format for the
-// argument isn't available, the argument is encoded using json.Marshal. If the
-// debug handler is nil, all DebugHook methods are noop, so no time is spent in
-// marshaling the data structures.
-type DebugHook struct{}
-
-func (*DebugHook) PreApply(ii *InstanceInfo, is *InstanceState, id *InstanceDiff) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String() + "\n")
-        }
-
-        idCopy, err := id.Copy()
-        if err != nil {
-                return HookActionContinue, err
-        }
-        js, err := json.MarshalIndent(idCopy, "", "  ")
-        if err != nil {
-                return HookActionContinue, err
-        }
-        buf.Write(js)
-
-        dbug.WriteFile("hook-PreApply", buf.Bytes())
-
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PostApply(ii *InstanceInfo, is *InstanceState, err error) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String() + "\n")
-        }
-
-        if err != nil {
-                buf.WriteString(err.Error())
-        }
-
-        dbug.WriteFile("hook-PostApply", buf.Bytes())
-
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PreDiff(ii *InstanceInfo, is *InstanceState) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String())
-                buf.WriteString("\n")
-        }
-        dbug.WriteFile("hook-PreDiff", buf.Bytes())
-
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PostDiff(ii *InstanceInfo, id *InstanceDiff) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        idCopy, err := id.Copy()
-        if err != nil {
-                return HookActionContinue, err
-        }
-        js, err := json.MarshalIndent(idCopy, "", "  ")
-        if err != nil {
-                return HookActionContinue, err
-        }
-        buf.Write(js)
-
-        dbug.WriteFile("hook-PostDiff", buf.Bytes())
-
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PreProvisionResource(ii *InstanceInfo, is *InstanceState) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String())
-                buf.WriteString("\n")
-        }
-        dbug.WriteFile("hook-PreProvisionResource", buf.Bytes())
-
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PostProvisionResource(ii *InstanceInfo, is *InstanceState) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId())
-                buf.WriteString("\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String())
-                buf.WriteString("\n")
-        }
-        dbug.WriteFile("hook-PostProvisionResource", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PreProvision(ii *InstanceInfo, s string) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId())
-                buf.WriteString("\n")
-        }
-        buf.WriteString(s + "\n")
-
-        dbug.WriteFile("hook-PreProvision", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PostProvision(ii *InstanceInfo, s string, err error) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-        buf.WriteString(s + "\n")
-
-        dbug.WriteFile("hook-PostProvision", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) ProvisionOutput(ii *InstanceInfo, s1 string, s2 string) {
-        if dbug == nil {
-                return
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId())
-                buf.WriteString("\n")
-        }
-        buf.WriteString(s1 + "\n")
-        buf.WriteString(s2 + "\n")
-
-        dbug.WriteFile("hook-ProvisionOutput", buf.Bytes())
-}
-
-func (*DebugHook) PreRefresh(ii *InstanceInfo, is *InstanceState) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String())
-                buf.WriteString("\n")
-        }
-        dbug.WriteFile("hook-PreRefresh", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PostRefresh(ii *InstanceInfo, is *InstanceState) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId())
-                buf.WriteString("\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String())
-                buf.WriteString("\n")
-        }
-        dbug.WriteFile("hook-PostRefresh", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PreImportState(ii *InstanceInfo, s string) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId())
-                buf.WriteString("\n")
-        }
-        buf.WriteString(s + "\n")
-
-        dbug.WriteFile("hook-PreImportState", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PostImportState(ii *InstanceInfo, iss []*InstanceState) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        for _, is := range iss {
-                if is != nil {
-                        buf.WriteString(is.String() + "\n")
-                }
-        }
-        dbug.WriteFile("hook-PostImportState", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-// skip logging this for now, since it could be huge
-func (*DebugHook) PostStateUpdate(*State) (HookAction, error) {
-        return HookActionContinue, nil
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/diff.go b/vendor/github.com/hashicorp/terraform/terraform/diff.go
index d6dc550..7a6ef3d 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/diff.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/diff.go
@@ -4,12 +4,20 @@ import (
         "bufio"
         "bytes"
         "fmt"
+        "log"
         "reflect"
         "regexp"
         "sort"
+        "strconv"
         "strings"
         "sync"
 
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+
         "github.com/mitchellh/copystructure"
 )
 
@@ -69,8 +77,24 @@ func (d *Diff) Prune() {
 //
 // This should be the preferred method to add module diffs since it
 // allows us to optimize lookups later as well as control sorting.
-func (d *Diff) AddModule(path []string) *ModuleDiff {
-        m := &ModuleDiff{Path: path}
+func (d *Diff) AddModule(path addrs.ModuleInstance) *ModuleDiff {
+        // Lower the new-style address into a legacy-style address.
+        // This requires that none of the steps have instance keys, which is
+        // true for all addresses at the time of implementing this because
+        // "count" and "for_each" are not yet implemented for modules.
+        legacyPath := make([]string, len(path))
+        for i, step := range path {
+                if step.InstanceKey != addrs.NoKey {
+                        // FIXME: Once the rest of Terraform is ready to use count and
+                        // for_each, remove all of this and just write the addrs.ModuleInstance
+                        // value itself into the ModuleState.
+                        panic("diff cannot represent modules with count or for_each keys")
+                }
+
+                legacyPath[i] = step.Name
+        }
+
+        m := &ModuleDiff{Path: legacyPath}
         m.init()
         d.Modules = append(d.Modules, m)
         return m
@@ -79,7 +103,7 @@ func (d *Diff) AddModule(path []string) *ModuleDiff {
 // ModuleByPath is used to lookup the module diff for the given path.
 // This should be the preferred lookup mechanism as it allows for future
 // lookup optimizations.
-func (d *Diff) ModuleByPath(path []string) *ModuleDiff {
+func (d *Diff) ModuleByPath(path addrs.ModuleInstance) *ModuleDiff {
         if d == nil {
                 return nil
         }
@@ -87,7 +111,8 @@ func (d *Diff) ModuleByPath(path []string) *ModuleDiff {
                 if mod.Path == nil {
                         panic("missing module path")
                 }
-                if reflect.DeepEqual(mod.Path, path) {
+                modPath := normalizeModulePath(mod.Path)
+                if modPath.String() == path.String() {
                         return mod
                 }
         }
@@ -96,7 +121,7 @@ func (d *Diff) ModuleByPath(path []string) *ModuleDiff {
 
 // RootModule returns the ModuleState for the root module
 func (d *Diff) RootModule() *ModuleDiff {
-        root := d.ModuleByPath(rootModulePath)
+        root := d.ModuleByPath(addrs.RootModuleInstance)
         if root == nil {
                 panic("missing root module")
         }
@@ -166,7 +191,8 @@ func (d *Diff) String() string {
         keys := make([]string, 0, len(d.Modules))
         lookup := make(map[string]*ModuleDiff)
         for _, m := range d.Modules {
-                key := fmt.Sprintf("module.%s", strings.Join(m.Path[1:], "."))
+                addr := normalizeModulePath(m.Path)
+                key := addr.String()
                 keys = append(keys, key)
                 lookup[key] = m
         }
@@ -384,6 +410,541 @@ type InstanceDiff struct {
 func (d *InstanceDiff) Lock()   { d.mu.Lock() }
 func (d *InstanceDiff) Unlock() { d.mu.Unlock() }
 
+// ApplyToValue merges the receiver into the given base value, returning a
+// new value that incorporates the planned changes. The given value must
+// conform to the given schema, or this method will panic.
+//
+// This method is intended for shimming old subsystems that still use this
+// legacy diff type to work with the new-style types.
+func (d *InstanceDiff) ApplyToValue(base cty.Value, schema *configschema.Block) (cty.Value, error) {
+        // Create an InstanceState attributes from our existing state.
+        // We can use this to more easily apply the diff changes.
+        attrs := hcl2shim.FlatmapValueFromHCL2(base)
+        applied, err := d.Apply(attrs, schema)
+        if err != nil {
+                return base, err
+        }
+
+        val, err := hcl2shim.HCL2ValueFromFlatmap(applied, schema.ImpliedType())
+        if err != nil {
+                return base, err
+        }
+
+        return schema.CoerceValue(val)
+}
+
+// Apply applies the diff to the provided flatmapped attributes,
+// returning the new instance attributes.
+//
+// This method is intended for shimming old subsystems that still use this
+// legacy diff type to work with the new-style types.
+func (d *InstanceDiff) Apply(attrs map[string]string, schema *configschema.Block) (map[string]string, error) {
+        // We always build a new value here, even if the given diff is "empty",
+        // because we might be planning to create a new instance that happens
+        // to have no attributes set, and so we want to produce an empty object
+        // rather than just echoing back the null old value.
+        if attrs == nil {
+                attrs = map[string]string{}
+        }
+
+        // Rather applying the diff to mutate the attrs, we'll copy new values into
+        // here to avoid the possibility of leaving stale values.
+        result := map[string]string{}
+
+        if d.Destroy || d.DestroyDeposed || d.DestroyTainted {
+                return result, nil
+        }
+
+        return d.applyBlockDiff(nil, attrs, schema)
+}
+
+func (d *InstanceDiff) applyBlockDiff(path []string, attrs map[string]string, schema *configschema.Block) (map[string]string, error) {
+        result := map[string]string{}
+        name := ""
+        if len(path) > 0 {
+                name = path[len(path)-1]
+        }
+
+        // localPrefix is used to build the local result map
+        localPrefix := ""
+        if name != "" {
+                localPrefix = name + "."
+        }
+
+        // iterate over the schema rather than the attributes, so we can handle
+        // different block types separately from plain attributes
+        for n, attrSchema := range schema.Attributes {
+                var err error
+                newAttrs, err := d.applyAttrDiff(append(path, n), attrs, attrSchema)
+
+                if err != nil {
+                        return result, err
+                }
+
+                for k, v := range newAttrs {
+                        result[localPrefix+k] = v
+                }
+        }
+
+        blockPrefix := strings.Join(path, ".")
+        if blockPrefix != "" {
+                blockPrefix += "."
+        }
+        for n, block := range schema.BlockTypes {
+                // we need to find the set of all keys that traverse this block
+                candidateKeys := map[string]bool{}
+                blockKey := blockPrefix + n + "."
+                localBlockPrefix := localPrefix + n + "."
+
+                // we can only trust the diff for sets, since the path changes, so don't
+                // count existing values as candidate keys. If it turns out we're
+                // keeping the attributes, we will catch it down below with "keepBlock"
+                // after we check the set count.
+                if block.Nesting != configschema.NestingSet {
+                        for k := range attrs {
+                                if strings.HasPrefix(k, blockKey) {
+                                        nextDot := strings.Index(k[len(blockKey):], ".")
+                                        if nextDot < 0 {
+                                                continue
+                                        }
+                                        nextDot += len(blockKey)
+                                        candidateKeys[k[len(blockKey):nextDot]] = true
+                                }
+                        }
+                }
+
+                for k, diff := range d.Attributes {
+                        if strings.HasPrefix(k, blockKey) {
+                                nextDot := strings.Index(k[len(blockKey):], ".")
+                                if nextDot < 0 {
+                                        continue
+                                }
+
+                                if diff.NewRemoved {
+                                        continue
+                                }
+
+                                nextDot += len(blockKey)
+                                candidateKeys[k[len(blockKey):nextDot]] = true
+                        }
+                }
+
+                // check each set candidate to see if it was removed.
+                // we need to do this, because when entire sets are removed, they may
+                // have the wrong key, and ony show diffs going to ""
+                if block.Nesting == configschema.NestingSet {
+                        for k := range candidateKeys {
+                                indexPrefix := strings.Join(append(path, n, k), ".") + "."
+                                keep := false
+                                // now check each set element to see if it's a new diff, or one
+                                // that we're dropping. Since we're only applying the "New"
+                                // portion of the set, we can ignore diffs that only contain "Old"
+                                for attr, diff := range d.Attributes {
+                                        if !strings.HasPrefix(attr, indexPrefix) {
+                                                continue
+                                        }
+
+                                        // check for empty "count" keys
+                                        if (strings.HasSuffix(attr, ".#") || strings.HasSuffix(attr, ".%")) && diff.New == "0" {
+                                                continue
+                                        }
+
+                                        // removed items don't count either
+                                        if diff.NewRemoved {
+                                                continue
+                                        }
+
+                                        // this must be a diff to keep
+                                        keep = true
+                                        break
+                                }
+                                if !keep {
+                                        delete(candidateKeys, k)
+                                }
+                        }
+                }
+
+                for k := range candidateKeys {
+                        newAttrs, err := d.applyBlockDiff(append(path, n, k), attrs, &block.Block)
+                        if err != nil {
+                                return result, err
+                        }
+
+                        for attr, v := range newAttrs {
+                                result[localBlockPrefix+attr] = v
+                        }
+                }
+
+                keepBlock := true
+                // check this block's count diff directly first, since we may not
+                // have candidates because it was removed and only set to "0"
+                if diff, ok := d.Attributes[blockKey+"#"]; ok {
+                        if diff.New == "0" || diff.NewRemoved {
+                                keepBlock = false
+                        }
+                }
+
+                // if there was no diff at all, then we need to keep the block attributes
+                if len(candidateKeys) == 0 && keepBlock {
+                        for k, v := range attrs {
+                                if strings.HasPrefix(k, blockKey) {
+                                        // we need the key relative to this block, so remove the
+                                        // entire prefix, then re-insert the block name.
+                                        localKey := localBlockPrefix + k[len(blockKey):]
+                                        result[localKey] = v
+                                }
+                        }
+                }
+
+                countAddr := strings.Join(append(path, n, "#"), ".")
+                if countDiff, ok := d.Attributes[countAddr]; ok {
+                        if countDiff.NewComputed {
+                                result[localBlockPrefix+"#"] = hcl2shim.UnknownVariableValue
+                        } else {
+                                result[localBlockPrefix+"#"] = countDiff.New
+
+                                // While sets are complete, list are not, and we may not have all the
+                                // information to track removals. If the list was truncated, we need to
+                                // remove the extra items from the result.
+                                if block.Nesting == configschema.NestingList &&
+                                        countDiff.New != "" && countDiff.New != hcl2shim.UnknownVariableValue {
+                                        length, _ := strconv.Atoi(countDiff.New)
+                                        for k := range result {
+                                                if !strings.HasPrefix(k, localBlockPrefix) {
+                                                        continue
+                                                }
+
+                                                index := k[len(localBlockPrefix):]
+                                                nextDot := strings.Index(index, ".")
+                                                if nextDot < 1 {
+                                                        continue
+                                                }
+                                                index = index[:nextDot]
+                                                i, err := strconv.Atoi(index)
+                                                if err != nil {
+                                                        // this shouldn't happen since we added these
+                                                        // ourself, but make note of it just in case.
+                                                        log.Printf("[ERROR] bad list index in %q: %s", k, err)
+                                                        continue
+                                                }
+                                                if i >= length {
+                                                        delete(result, k)
+                                                }
+                                        }
+                                }
+                        }
+                } else if origCount, ok := attrs[countAddr]; ok && keepBlock {
+                        result[localBlockPrefix+"#"] = origCount
+                } else {
+                        result[localBlockPrefix+"#"] = countFlatmapContainerValues(localBlockPrefix+"#", result)
+                }
+        }
+
+        return result, nil
+}
+
+func (d *InstanceDiff) applyAttrDiff(path []string, attrs map[string]string, attrSchema *configschema.Attribute) (map[string]string, error) {
+        ty := attrSchema.Type
+        switch {
+        case ty.IsListType(), ty.IsTupleType(), ty.IsMapType():
+                return d.applyCollectionDiff(path, attrs, attrSchema)
+        case ty.IsSetType():
+                return d.applySetDiff(path, attrs, attrSchema)
+        default:
+                return d.applySingleAttrDiff(path, attrs, attrSchema)
+        }
+}
+
+func (d *InstanceDiff) applySingleAttrDiff(path []string, attrs map[string]string, attrSchema *configschema.Attribute) (map[string]string, error) {
+        currentKey := strings.Join(path, ".")
+
+        attr := path[len(path)-1]
+
+        result := map[string]string{}
+        diff := d.Attributes[currentKey]
+        old, exists := attrs[currentKey]
+
+        if diff != nil && diff.NewComputed {
+                result[attr] = config.UnknownVariableValue
+                return result, nil
+        }
+
+        // "id" must exist and not be an empty string, or it must be unknown.
+        // This only applied to top-level "id" fields.
+        if attr == "id" && len(path) == 1 {
+                if old == "" {
+                        result[attr] = config.UnknownVariableValue
+                } else {
+                        result[attr] = old
+                }
+                return result, nil
+        }
+
+        // attribute diffs are sometimes missed, so assume no diff means keep the
+        // old value
+        if diff == nil {
+                if exists {
+                        result[attr] = old
+                } else {
+                        // We need required values, so set those with an empty value. It
+                        // must be set in the config, since if it were missing it would have
+                        // failed validation.
+                        if attrSchema.Required {
+                                // we only set a missing string here, since bool or number types
+                                // would have distinct zero value which shouldn't have been
+                                // lost.
+                                if attrSchema.Type == cty.String {
+                                        result[attr] = ""
+                                }
+                        }
+                }
+                return result, nil
+        }
+
+        // check for missmatched diff values
+        if exists &&
+                old != diff.Old &&
+                old != config.UnknownVariableValue &&
+                diff.Old != config.UnknownVariableValue {
+                return result, fmt.Errorf("diff apply conflict for %s: diff expects %q, but prior value has %q", attr, diff.Old, old)
+        }
+
+        if diff.NewRemoved {
+                // don't set anything in the new value
+                return map[string]string{}, nil
+        }
+
+        if diff.Old == diff.New && diff.New == "" {
+                // this can only be a valid empty string
+                if attrSchema.Type == cty.String {
+                        result[attr] = ""
+                }
+                return result, nil
+        }
+
+        if attrSchema.Computed && diff.NewComputed {
+                result[attr] = config.UnknownVariableValue
+                return result, nil
+        }
+
+        result[attr] = diff.New
+
+        return result, nil
+}
+
+func (d *InstanceDiff) applyCollectionDiff(path []string, attrs map[string]string, attrSchema *configschema.Attribute) (map[string]string, error) {
+        result := map[string]string{}
+
+        prefix := ""
+        if len(path) > 1 {
+                prefix = strings.Join(path[:len(path)-1], ".") + "."
+        }
+
+        name := ""
+        if len(path) > 0 {
+                name = path[len(path)-1]
+        }
+
+        currentKey := prefix + name
+
+        // check the index first for special handling
+        for k, diff := range d.Attributes {
+                // check the index value, which can be set, and 0
+                if k == currentKey+".#" || k == currentKey+".%" || k == currentKey {
+                        if diff.NewRemoved {
+                                return result, nil
+                        }
+
+                        if diff.NewComputed {
+                                result[k[len(prefix):]] = config.UnknownVariableValue
+                                return result, nil
+                        }
+
+                        // do what the diff tells us to here, so that it's consistent with applies
+                        if diff.New == "0" {
+                                result[k[len(prefix):]] = "0"
+                                return result, nil
+                        }
+                }
+        }
+
+        // collect all the keys from the diff and the old state
+        noDiff := true
+        keys := map[string]bool{}
+        for k := range d.Attributes {
+                if !strings.HasPrefix(k, currentKey+".") {
+                        continue
+                }
+                noDiff = false
+                keys[k] = true
+        }
+
+        noAttrs := true
+        for k := range attrs {
+                if !strings.HasPrefix(k, currentKey+".") {
+                        continue
+                }
+                noAttrs = false
+                keys[k] = true
+        }
+
+        // If there's no diff and no attrs, then there's no value at all.
+        // This prevents an unexpected zero-count attribute in the attributes.
+        if noDiff && noAttrs {
+                return result, nil
+        }
+
+        idx := "#"
+        if attrSchema.Type.IsMapType() {
+                idx = "%"
+        }
+
+        for k := range keys {
+                // generate an schema placeholder for the values
+                elSchema := &configschema.Attribute{
+                        Type: attrSchema.Type.ElementType(),
+                }
+
+                res, err := d.applySingleAttrDiff(append(path, k[len(currentKey)+1:]), attrs, elSchema)
+                if err != nil {
+                        return result, err
+                }
+
+                for k, v := range res {
+                        result[name+"."+k] = v
+                }
+        }
+
+        // Just like in nested list blocks, for simple lists we may need to fill in
+        // missing empty strings.
+        countKey := name + "." + idx
+        count := result[countKey]
+        length, _ := strconv.Atoi(count)
+
+        if count != "" && count != hcl2shim.UnknownVariableValue &&
+                attrSchema.Type.Equals(cty.List(cty.String)) {
+                // insert empty strings into missing indexes
+                for i := 0; i < length; i++ {
+                        key := fmt.Sprintf("%s.%d", name, i)
+                        if _, ok := result[key]; !ok {
+                                result[key] = ""
+                        }
+                }
+        }
+
+        // now check for truncation in any type of list
+        if attrSchema.Type.IsListType() {
+                for key := range result {
+                        if key == countKey {
+                                continue
+                        }
+
+                        if len(key) <= len(name)+1 {
+                                // not sure what this is, but don't panic
+                                continue
+                        }
+
+                        index := key[len(name)+1:]
+
+                        // It is possible to have nested sets or maps, so look for another dot
+                        dot := strings.Index(index, ".")
+                        if dot > 0 {
+                                index = index[:dot]
+                        }
+
+                        // This shouldn't have any more dots, since the element type is only string.
+                        num, err := strconv.Atoi(index)
+                        if err != nil {
+                                log.Printf("[ERROR] bad list index in %q: %s", currentKey, err)
+                                continue
+                        }
+
+                        if num >= length {
+                                delete(result, key)
+                        }
+                }
+        }
+
+        // Fill in the count value if it wasn't present in the diff for some reason,
+        // or if there is no count at all.
+        _, countDiff := d.Attributes[countKey]
+        if result[countKey] == "" || (!countDiff && len(keys) != len(result)) {
+                result[countKey] = countFlatmapContainerValues(countKey, result)
+        }
+
+        return result, nil
+}
+
+func (d *InstanceDiff) applySetDiff(path []string, attrs map[string]string, attrSchema *configschema.Attribute) (map[string]string, error) {
+        // We only need this special behavior for sets of object.
+        if !attrSchema.Type.ElementType().IsObjectType() {
+                // The normal collection apply behavior will work okay for this one, then.
+                return d.applyCollectionDiff(path, attrs, attrSchema)
+        }
+
+        // When we're dealing with a set of an object type we actually want to
+        // use our normal _block type_ apply behaviors, so we'll construct ourselves
+        // a synthetic schema that treats the object type as a block type and
+        // then delegate to our block apply method.
+        synthSchema := &configschema.Block{
+                Attributes: make(map[string]*configschema.Attribute),
+        }
+
+        for name, ty := range attrSchema.Type.ElementType().AttributeTypes() {
+                // We can safely make everything into an attribute here because in the
+                // event that there are nested set attributes we'll end up back in
+                // here again recursively and can then deal with the next level of
+                // expansion.
+                synthSchema.Attributes[name] = &configschema.Attribute{
+                        Type:     ty,
+                        Optional: true,
+                }
+        }
+
+        parentPath := path[:len(path)-1]
+        childName := path[len(path)-1]
+        containerSchema := &configschema.Block{
+                BlockTypes: map[string]*configschema.NestedBlock{
+                        childName: {
+                                Nesting: configschema.NestingSet,
+                                Block:   *synthSchema,
+                        },
+                },
+        }
+
+        return d.applyBlockDiff(parentPath, attrs, containerSchema)
+}
+
+// countFlatmapContainerValues returns the number of values in the flatmapped container
+// (set, map, list) indexed by key. The key argument is expected to include the
+// trailing ".#", or ".%".
+func countFlatmapContainerValues(key string, attrs map[string]string) string {
+        if len(key) < 3 || !(strings.HasSuffix(key, ".#") || strings.HasSuffix(key, ".%")) {
+                panic(fmt.Sprintf("invalid index value %q", key))
+        }
+
+        prefix := key[:len(key)-1]
+        items := map[string]int{}
+
+        for k := range attrs {
+                if k == key {
+                        continue
+                }
+                if !strings.HasPrefix(k, prefix) {
+                        continue
+                }
+
+                suffix := k[len(prefix):]
+                dot := strings.Index(suffix, ".")
+                if dot > 0 {
+                        suffix = suffix[:dot]
+                }
+
+                items[suffix]++
+        }
+        return strconv.Itoa(len(items))
+}
+
 // ResourceAttrDiff is the diff of a single attribute of a resource.
 type ResourceAttrDiff struct {
         Old         string      // Old Value
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval.go b/vendor/github.com/hashicorp/terraform/terraform/eval.go
index 10d9c22..48ed353 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval.go
@@ -2,7 +2,8 @@ package terraform
 
 import (
         "log"
-        "strings"
+
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalNode is the interface that must be implemented by graph nodes to
@@ -46,15 +47,21 @@ func Eval(n EvalNode, ctx EvalContext) (interface{}, error) {
 func EvalRaw(n EvalNode, ctx EvalContext) (interface{}, error) {
         path := "unknown"
         if ctx != nil {
-                path = strings.Join(ctx.Path(), ".")
+                path = ctx.Path().String()
+        }
+        if path == "" {
+                path = "<root>"
         }
 
         log.Printf("[TRACE] %s: eval: %T", path, n)
         output, err := n.Eval(ctx)
         if err != nil {
-                if _, ok := err.(EvalEarlyExitError); ok {
-                        log.Printf("[TRACE] %s: eval: %T, err: %s", path, n, err)
-                } else {
+                switch err.(type) {
+                case EvalEarlyExitError:
+                        log.Printf("[TRACE] %s: eval: %T, early exit err: %s", path, n, err)
+                case tfdiags.NonFatalError:
+                        log.Printf("[WARN] %s: eval: %T, non-fatal err: %s", path, n, err)
+                default:
                         log.Printf("[ERROR] %s: eval: %T, err: %s", path, n, err)
                 }
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go b/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go
index b9b4806..09313f7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go
@@ -3,119 +3,316 @@ package terraform
 import (
         "fmt"
         "log"
-        "strconv"
+        "strings"
 
         "github.com/hashicorp/go-multierror"
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/plans/objchange"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalApply is an EvalNode implementation that writes the diff to
 // the full diff.
 type EvalApply struct {
-        Info      *InstanceInfo
-        State     **InstanceState
-        Diff      **InstanceDiff
-        Provider  *ResourceProvider
-        Output    **InstanceState
-        CreateNew *bool
-        Error     *error
+        Addr           addrs.ResourceInstance
+        Config         *configs.Resource
+        Dependencies   []addrs.Referenceable
+        State          **states.ResourceInstanceObject
+        Change         **plans.ResourceInstanceChange
+        ProviderAddr   addrs.AbsProviderConfig
+        Provider       *providers.Interface
+        ProviderSchema **ProviderSchema
+        Output         **states.ResourceInstanceObject
+        CreateNew      *bool
+        Error          *error
 }
 
 // TODO: test
 func (n *EvalApply) Eval(ctx EvalContext) (interface{}, error) {
-        diff := *n.Diff
+        var diags tfdiags.Diagnostics
+
+        change := *n.Change
         provider := *n.Provider
         state := *n.State
+        absAddr := n.Addr.Absolute(ctx.Path())
 
-        // If we have no diff, we have nothing to do!
-        if diff.Empty() {
-                log.Printf(
-                        "[DEBUG] apply: %s: diff is empty, doing nothing.", n.Info.Id)
-                return nil, nil
+        if state == nil {
+                state = &states.ResourceInstanceObject{}
+        }
+
+        schema, _ := (*n.ProviderSchema).SchemaForResourceType(n.Addr.Resource.Mode, n.Addr.Resource.Type)
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support resource type %q", n.Addr.Resource.Type)
+        }
+
+        if n.CreateNew != nil {
+                *n.CreateNew = (change.Action == plans.Create || change.Action.IsReplace())
         }
 
-        // Remove any output values from the diff
-        for k, ad := range diff.CopyAttributes() {
-                if ad.Type == DiffAttrOutput {
-                        diff.DelAttribute(k)
+        configVal := cty.NullVal(cty.DynamicPseudoType)
+        if n.Config != nil {
+                var configDiags tfdiags.Diagnostics
+                keyData := EvalDataForInstanceKey(n.Addr.Key)
+                configVal, _, configDiags = ctx.EvaluateBlock(n.Config.Config, schema, nil, keyData)
+                diags = diags.Append(configDiags)
+                if configDiags.HasErrors() {
+                        return nil, diags.Err()
                 }
         }
 
-        // If the state is nil, make it non-nil
-        if state == nil {
-                state = new(InstanceState)
+        log.Printf("[DEBUG] %s: applying the planned %s change", n.Addr.Absolute(ctx.Path()), change.Action)
+        resp := provider.ApplyResourceChange(providers.ApplyResourceChangeRequest{
+                TypeName:       n.Addr.Resource.Type,
+                PriorState:     change.Before,
+                Config:         configVal,
+                PlannedState:   change.After,
+                PlannedPrivate: change.Private,
+        })
+        applyDiags := resp.Diagnostics
+        if n.Config != nil {
+                applyDiags = applyDiags.InConfigBody(n.Config.Config)
         }
-        state.init()
+        diags = diags.Append(applyDiags)
+
+        // Even if there are errors in the returned diagnostics, the provider may
+        // have returned a _partial_ state for an object that already exists but
+        // failed to fully configure, and so the remaining code must always run
+        // to completion but must be defensive against the new value being
+        // incomplete.
+        newVal := resp.NewState
+
+        if newVal == cty.NilVal {
+                // Providers are supposed to return a partial new value even when errors
+                // occur, but sometimes they don't and so in that case we'll patch that up
+                // by just using the prior state, so we'll at least keep track of the
+                // object for the user to retry.
+                newVal = change.Before
+
+                // As a special case, we'll set the new value to null if it looks like
+                // we were trying to execute a delete, because the provider in this case
+                // probably left the newVal unset intending it to be interpreted as "null".
+                if change.After.IsNull() {
+                        newVal = cty.NullVal(schema.ImpliedType())
+                }
 
-        // Flag if we're creating a new instance
-        if n.CreateNew != nil {
-                *n.CreateNew = state.ID == "" && !diff.GetDestroy() || diff.RequiresNew()
+                // Ideally we'd produce an error or warning here if newVal is nil and
+                // there are no errors in diags, because that indicates a buggy
+                // provider not properly reporting its result, but unfortunately many
+                // of our historical test mocks behave in this way and so producing
+                // a diagnostic here fails hundreds of tests. Instead, we must just
+                // silently retain the old value for now. Returning a nil value with
+                // no errors is still always considered a bug in the provider though,
+                // and should be fixed for any "real" providers that do it.
         }
 
-        // With the completed diff, apply!
-        log.Printf("[DEBUG] apply: %s: executing Apply", n.Info.Id)
-        state, err := provider.Apply(n.Info, state, diff)
-        if state == nil {
-                state = new(InstanceState)
+        var conformDiags tfdiags.Diagnostics
+        for _, err := range newVal.Type().TestConformance(schema.ImpliedType()) {
+                conformDiags = conformDiags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced invalid object",
+                        fmt.Sprintf(
+                                "Provider %q produced an invalid value after apply for %s. The result cannot not be saved in the Terraform state.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatErrorPrefixed(err, absAddr.String()),
+                        ),
+                ))
+        }
+        diags = diags.Append(conformDiags)
+        if conformDiags.HasErrors() {
+                // Bail early in this particular case, because an object that doesn't
+                // conform to the schema can't be saved in the state anyway -- the
+                // serializer will reject it.
+                return nil, diags.Err()
+        }
+
+        // After this point we have a type-conforming result object and so we
+        // must always run to completion to ensure it can be saved. If n.Error
+        // is set then we must not return a non-nil error, in order to allow
+        // evaluation to continue to a later point where our state object will
+        // be saved.
+
+        // By this point there must not be any unknown values remaining in our
+        // object, because we've applied the change and we can't save unknowns
+        // in our persistent state. If any are present then we will indicate an
+        // error (which is always a bug in the provider) but we will also replace
+        // them with nulls so that we can successfully save the portions of the
+        // returned value that are known.
+        if !newVal.IsWhollyKnown() {
+                // To generate better error messages, we'll go for a walk through the
+                // value and make a separate diagnostic for each unknown value we
+                // find.
+                cty.Walk(newVal, func(path cty.Path, val cty.Value) (bool, error) {
+                        if !val.IsKnown() {
+                                pathStr := tfdiags.FormatCtyPath(path)
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Provider returned invalid result object after apply",
+                                        fmt.Sprintf(
+                                                "After the apply operation, the provider still indicated an unknown value for %s%s. All values must be known after apply, so this is always a bug in the provider and should be reported in the provider's own repository. Terraform will still save the other known object values in the state.",
+                                                n.Addr.Absolute(ctx.Path()), pathStr,
+                                        ),
+                                ))
+                        }
+                        return true, nil
+                })
+
+                // NOTE: This operation can potentially be lossy if there are multiple
+                // elements in a set that differ only by unknown values: after
+                // replacing with null these will be merged together into a single set
+                // element. Since we can only get here in the presence of a provider
+                // bug, we accept this because storing a result here is always a
+                // best-effort sort of thing.
+                newVal = cty.UnknownAsNull(newVal)
+        }
+
+        if change.Action != plans.Delete && !diags.HasErrors() {
+                // Only values that were marked as unknown in the planned value are allowed
+                // to change during the apply operation. (We do this after the unknown-ness
+                // check above so that we also catch anything that became unknown after
+                // being known during plan.)
+                //
+                // If we are returning other errors anyway then we'll give this
+                // a pass since the other errors are usually the explanation for
+                // this one and so it's more helpful to let the user focus on the
+                // root cause rather than distract with this extra problem.
+                if errs := objchange.AssertObjectCompatible(schema, change.After, newVal); len(errs) > 0 {
+                        if resp.LegacyTypeSystem {
+                                // The shimming of the old type system in the legacy SDK is not precise
+                                // enough to pass this consistency check, so we'll give it a pass here,
+                                // but we will generate a warning about it so that we are more likely
+                                // to notice in the logs if an inconsistency beyond the type system
+                                // leads to a downstream provider failure.
+                                var buf strings.Builder
+                                fmt.Fprintf(&buf, "[WARN] Provider %q produced an unexpected new value for %s, but we are tolerating it because it is using the legacy plugin SDK.\n    The following problems may be the cause of any confusing errors from downstream operations:", n.ProviderAddr.ProviderConfig.Type, absAddr)
+                                for _, err := range errs {
+                                        fmt.Fprintf(&buf, "\n      - %s", tfdiags.FormatError(err))
+                                }
+                                log.Print(buf.String())
+
+                                // The sort of inconsistency we won't catch here is if a known value
+                                // in the plan is changed during apply. That can cause downstream
+                                // problems because a dependent resource would make its own plan based
+                                // on the planned value, and thus get a different result during the
+                                // apply phase. This will usually lead to a "Provider produced invalid plan"
+                                // error that incorrectly blames the downstream resource for the change.
+
+                        } else {
+                                for _, err := range errs {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Provider produced inconsistent result after apply",
+                                                fmt.Sprintf(
+                                                        "When applying changes to %s, provider %q produced an unexpected new value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                                        absAddr, n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatError(err),
+                                                ),
+                                        ))
+                                }
+                        }
+                }
+        }
+
+        // If a provider returns a null or non-null object at the wrong time then
+        // we still want to save that but it often causes some confusing behaviors
+        // where it seems like Terraform is failing to take any action at all,
+        // so we'll generate some errors to draw attention to it.
+        if !diags.HasErrors() {
+                if change.Action == plans.Delete && !newVal.IsNull() {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Provider returned invalid result object after apply",
+                                fmt.Sprintf(
+                                        "After applying a %s plan, the provider returned a non-null object for %s. Destroying should always produce a null value, so this is always a bug in the provider and should be reported in the provider's own repository. Terraform will still save this errant object in the state for debugging and recovery.",
+                                        change.Action, n.Addr.Absolute(ctx.Path()),
+                                ),
+                        ))
+                }
+                if change.Action != plans.Delete && newVal.IsNull() {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Provider returned invalid result object after apply",
+                                fmt.Sprintf(
+                                        "After applying a %s plan, the provider returned a null object for %s. Only destroying should always produce a null value, so this is always a bug in the provider and should be reported in the provider's own repository.",
+                                        change.Action, n.Addr.Absolute(ctx.Path()),
+                                ),
+                        ))
+                }
         }
-        state.init()
 
-        // Force the "id" attribute to be our ID
-        if state.ID != "" {
-                state.Attributes["id"] = state.ID
+        // Sometimes providers return a null value when an operation fails for some
+        // reason, but we'd rather keep the prior state so that the error can be
+        // corrected on a subsequent run. We must only do this for null new value
+        // though, or else we may discard partial updates the provider was able to
+        // complete.
+        if diags.HasErrors() && newVal.IsNull() {
+                // Otherwise, we'll continue but using the prior state as the new value,
+                // making this effectively a no-op. If the item really _has_ been
+                // deleted then our next refresh will detect that and fix it up.
+                // If change.Action is Create then change.Before will also be null,
+                // which is fine.
+                newVal = change.Before
         }
 
-        // If the value is the unknown variable value, then it is an error.
-        // In this case we record the error and remove it from the state
-        for ak, av := range state.Attributes {
-                if av == config.UnknownVariableValue {
-                        err = multierror.Append(err, fmt.Errorf(
-                                "Attribute with unknown value: %s", ak))
-                        delete(state.Attributes, ak)
+        var newState *states.ResourceInstanceObject
+        if !newVal.IsNull() { // null value indicates that the object is deleted, so we won't set a new state in that case
+                newState = &states.ResourceInstanceObject{
+                        Status:       states.ObjectReady,
+                        Value:        newVal,
+                        Private:      resp.Private,
+                        Dependencies: n.Dependencies, // Should be populated by the caller from the StateDependencies method on the resource instance node
                 }
         }
 
         // Write the final state
         if n.Output != nil {
-                *n.Output = state
+                *n.Output = newState
         }
 
-        // If there are no errors, then we append it to our output error
-        // if we have one, otherwise we just output it.
-        if err != nil {
+        if diags.HasErrors() {
+                // If the caller provided an error pointer then they are expected to
+                // handle the error some other way and we treat our own result as
+                // success.
                 if n.Error != nil {
-                        helpfulErr := fmt.Errorf("%s: %s", n.Info.Id, err.Error())
-                        *n.Error = multierror.Append(*n.Error, helpfulErr)
-                } else {
-                        return nil, err
+                        err := diags.Err()
+                        *n.Error = err
+                        log.Printf("[DEBUG] %s: apply errored, but we're indicating that via the Error pointer rather than returning it: %s", n.Addr.Absolute(ctx.Path()), err)
+                        return nil, nil
                 }
         }
 
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
 
 // EvalApplyPre is an EvalNode implementation that does the pre-Apply work
 type EvalApplyPre struct {
-        Info  *InstanceInfo
-        State **InstanceState
-        Diff  **InstanceDiff
+        Addr   addrs.ResourceInstance
+        Gen    states.Generation
+        State  **states.ResourceInstanceObject
+        Change **plans.ResourceInstanceChange
 }
 
 // TODO: test
 func (n *EvalApplyPre) Eval(ctx EvalContext) (interface{}, error) {
-        state := *n.State
-        diff := *n.Diff
+        change := *n.Change
+        absAddr := n.Addr.Absolute(ctx.Path())
 
-        // If the state is nil, make it non-nil
-        if state == nil {
-                state = new(InstanceState)
+        if change == nil {
+                panic(fmt.Sprintf("EvalApplyPre for %s called with nil Change", absAddr))
         }
-        state.init()
 
-        if resourceHasUserVisibleApply(n.Info) {
-                // Call post-apply hook
+        if resourceHasUserVisibleApply(n.Addr) {
+                priorState := change.Before
+                plannedNewState := change.After
+
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PreApply(n.Info, state, diff)
+                        return h.PreApply(absAddr, n.Gen, change.Action, priorState, plannedNewState)
                 })
                 if err != nil {
                         return nil, err
@@ -127,8 +324,9 @@ func (n *EvalApplyPre) Eval(ctx EvalContext) (interface{}, error) {
 
 // EvalApplyPost is an EvalNode implementation that does the post-Apply work
 type EvalApplyPost struct {
-        Info  *InstanceInfo
-        State **InstanceState
+        Addr  addrs.ResourceInstance
+        Gen   states.Generation
+        State **states.ResourceInstanceObject
         Error *error
 }
 
@@ -136,33 +334,93 @@ type EvalApplyPost struct {
 func (n *EvalApplyPost) Eval(ctx EvalContext) (interface{}, error) {
         state := *n.State
 
-        if resourceHasUserVisibleApply(n.Info) {
-                // Call post-apply hook
-                err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PostApply(n.Info, state, *n.Error)
+        if resourceHasUserVisibleApply(n.Addr) {
+                absAddr := n.Addr.Absolute(ctx.Path())
+                var newState cty.Value
+                if state != nil {
+                        newState = state.Value
+                } else {
+                        newState = cty.NullVal(cty.DynamicPseudoType)
+                }
+                var err error
+                if n.Error != nil {
+                        err = *n.Error
+                }
+
+                hookErr := ctx.Hook(func(h Hook) (HookAction, error) {
+                        return h.PostApply(absAddr, n.Gen, newState, err)
                 })
-                if err != nil {
-                        return nil, err
+                if hookErr != nil {
+                        return nil, hookErr
                 }
         }
 
         return nil, *n.Error
 }
 
+// EvalMaybeTainted is an EvalNode that takes the planned change, new value,
+// and possible error from an apply operation and produces a new instance
+// object marked as tainted if it appears that a create operation has failed.
+//
+// This EvalNode never returns an error, to ensure that a subsequent EvalNode
+// can still record the possibly-tainted object in the state.
+type EvalMaybeTainted struct {
+        Addr   addrs.ResourceInstance
+        Gen    states.Generation
+        Change **plans.ResourceInstanceChange
+        State  **states.ResourceInstanceObject
+        Error  *error
+
+        // If StateOutput is not nil, its referent will be assigned either the same
+        // pointer as State or a new object with its status set as Tainted,
+        // depending on whether an error is given and if this was a create action.
+        StateOutput **states.ResourceInstanceObject
+}
+
+// TODO: test
+func (n *EvalMaybeTainted) Eval(ctx EvalContext) (interface{}, error) {
+        state := *n.State
+        change := *n.Change
+        err := *n.Error
+
+        if state != nil && state.Status == states.ObjectTainted {
+                log.Printf("[TRACE] EvalMaybeTainted: %s was already tainted, so nothing to do", n.Addr.Absolute(ctx.Path()))
+                return nil, nil
+        }
+
+        if n.StateOutput != nil {
+                if err != nil && change.Action == plans.Create {
+                        // If there are errors during a _create_ then the object is
+                        // in an undefined state, and so we'll mark it as tainted so
+                        // we can try again on the next run.
+                        //
+                        // We don't do this for other change actions because errors
+                        // during updates will often not change the remote object at all.
+                        // If there _were_ changes prior to the error, it's the provider's
+                        // responsibility to record the effect of those changes in the
+                        // object value it returned.
+                        log.Printf("[TRACE] EvalMaybeTainted: %s encountered an error during creation, so it is now marked as tainted", n.Addr.Absolute(ctx.Path()))
+                        *n.StateOutput = state.AsTainted()
+                } else {
+                        *n.StateOutput = state
+                }
+        }
+
+        return nil, nil
+}
+
 // resourceHasUserVisibleApply returns true if the given resource is one where
 // apply actions should be exposed to the user.
 //
 // Certain resources do apply actions only as an implementation detail, so
 // these should not be advertised to code outside of this package.
-func resourceHasUserVisibleApply(info *InstanceInfo) bool {
-        addr := info.ResourceAddress()
-
+func resourceHasUserVisibleApply(addr addrs.ResourceInstance) bool {
         // Only managed resources have user-visible apply actions.
         // In particular, this excludes data resources since we "apply" these
         // only as an implementation detail of removing them from state when
         // they are destroyed. (When reading, they don't get here at all because
         // we present them as "Refresh" actions.)
-        return addr.Mode == config.ManagedResourceMode
+        return addr.ContainingResource().Mode == addrs.ManagedResourceMode
 }
 
 // EvalApplyProvisioners is an EvalNode implementation that executes
@@ -171,23 +429,33 @@ func resourceHasUserVisibleApply(info *InstanceInfo) bool {
 // TODO(mitchellh): This should probably be split up into a more fine-grained
 // ApplyProvisioner (single) that is looped over.
 type EvalApplyProvisioners struct {
-        Info           *InstanceInfo
-        State          **InstanceState
-        Resource       *config.Resource
-        InterpResource *Resource
+        Addr           addrs.ResourceInstance
+        State          **states.ResourceInstanceObject
+        ResourceConfig *configs.Resource
         CreateNew      *bool
         Error          *error
 
         // When is the type of provisioner to run at this point
-        When config.ProvisionerWhen
+        When configs.ProvisionerWhen
 }
 
 // TODO: test
 func (n *EvalApplyProvisioners) Eval(ctx EvalContext) (interface{}, error) {
+        absAddr := n.Addr.Absolute(ctx.Path())
         state := *n.State
-
-        if n.CreateNew != nil && !*n.CreateNew {
+        if state == nil {
+                log.Printf("[TRACE] EvalApplyProvisioners: %s has no state, so skipping provisioners", n.Addr)
+                return nil, nil
+        }
+        if n.When == configs.ProvisionerWhenCreate && n.CreateNew != nil && !*n.CreateNew {
                 // If we're not creating a new resource, then don't run provisioners
+                log.Printf("[TRACE] EvalApplyProvisioners: %s is not freshly-created, so no provisioning is required", n.Addr)
+                return nil, nil
+        }
+        if state.Status == states.ObjectTainted {
+                // No point in provisioning an object that is already tainted, since
+                // it's going to get recreated on the next apply anyway.
+                log.Printf("[TRACE] EvalApplyProvisioners: %s is tainted, so skipping provisioning", n.Addr)
                 return nil, nil
         }
 
@@ -197,14 +465,7 @@ func (n *EvalApplyProvisioners) Eval(ctx EvalContext) (interface{}, error) {
                 return nil, nil
         }
 
-        // taint tells us whether to enable tainting.
-        taint := n.When == config.ProvisionerWhenCreate
-
         if n.Error != nil && *n.Error != nil {
-                if taint {
-                        state.Tainted = true
-                }
-
                 // We're already tainted, so just return out
                 return nil, nil
         }
@@ -212,7 +473,7 @@ func (n *EvalApplyProvisioners) Eval(ctx EvalContext) (interface{}, error) {
         {
                 // Call pre hook
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PreProvisionResource(n.Info, state)
+                        return h.PreProvisionInstance(absAddr, state.Value)
                 })
                 if err != nil {
                         return nil, err
@@ -223,18 +484,19 @@ func (n *EvalApplyProvisioners) Eval(ctx EvalContext) (interface{}, error) {
         // if we have one, otherwise we just output it.
         err := n.apply(ctx, provs)
         if err != nil {
-                if taint {
-                        state.Tainted = true
-                }
-
                 *n.Error = multierror.Append(*n.Error, err)
-                return nil, err
+                if n.Error == nil {
+                        return nil, err
+                } else {
+                        log.Printf("[TRACE] EvalApplyProvisioners: %s provisioning failed, but we will continue anyway at the caller's request", absAddr)
+                        return nil, nil
+                }
         }
 
         {
                 // Call post hook
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PostProvisionResource(n.Info, state)
+                        return h.PostProvisionInstance(absAddr, state.Value)
                 })
                 if err != nil {
                         return nil, err
@@ -246,18 +508,18 @@ func (n *EvalApplyProvisioners) Eval(ctx EvalContext) (interface{}, error) {
 
 // filterProvisioners filters the provisioners on the resource to only
 // the provisioners specified by the "when" option.
-func (n *EvalApplyProvisioners) filterProvisioners() []*config.Provisioner {
+func (n *EvalApplyProvisioners) filterProvisioners() []*configs.Provisioner {
         // Fast path the zero case
-        if n.Resource == nil {
+        if n.ResourceConfig == nil || n.ResourceConfig.Managed == nil {
                 return nil
         }
 
-        if len(n.Resource.Provisioners) == 0 {
+        if len(n.ResourceConfig.Managed.Provisioners) == 0 {
                 return nil
         }
 
-        result := make([]*config.Provisioner, 0, len(n.Resource.Provisioners))
-        for _, p := range n.Resource.Provisioners {
+        result := make([]*configs.Provisioner, 0, len(n.ResourceConfig.Managed.Provisioners))
+        for _, p := range n.ResourceConfig.Managed.Provisioners {
                 if p.When == n.When {
                         result = append(result, p)
                 }
@@ -266,64 +528,71 @@ func (n *EvalApplyProvisioners) filterProvisioners() []*config.Provisioner {
         return result
 }
 
-func (n *EvalApplyProvisioners) apply(ctx EvalContext, provs []*config.Provisioner) error {
-        state := *n.State
-
-        // Store the original connection info, restore later
-        origConnInfo := state.Ephemeral.ConnInfo
-        defer func() {
-                state.Ephemeral.ConnInfo = origConnInfo
-        }()
+func (n *EvalApplyProvisioners) apply(ctx EvalContext, provs []*configs.Provisioner) error {
+        var diags tfdiags.Diagnostics
+        instanceAddr := n.Addr
+        absAddr := instanceAddr.Absolute(ctx.Path())
+
+        // If there's a connection block defined directly inside the resource block
+        // then it'll serve as a base connection configuration for all of the
+        // provisioners.
+        var baseConn hcl.Body
+        if n.ResourceConfig.Managed != nil && n.ResourceConfig.Managed.Connection != nil {
+                baseConn = n.ResourceConfig.Managed.Connection.Config
+        }
 
         for _, prov := range provs {
+                log.Printf("[TRACE] EvalApplyProvisioners: provisioning %s with %q", absAddr, prov.Type)
+
                 // Get the provisioner
                 provisioner := ctx.Provisioner(prov.Type)
+                schema := ctx.ProvisionerSchema(prov.Type)
 
-                // Interpolate the provisioner config
-                provConfig, err := ctx.Interpolate(prov.RawConfig.Copy(), n.InterpResource)
-                if err != nil {
-                        return err
-                }
+                keyData := EvalDataForInstanceKey(instanceAddr.Key)
 
-                // Interpolate the conn info, since it may contain variables
-                connInfo, err := ctx.Interpolate(prov.ConnInfo.Copy(), n.InterpResource)
-                if err != nil {
-                        return err
+                // Evaluate the main provisioner configuration.
+                config, _, configDiags := ctx.EvaluateBlock(prov.Config, schema, instanceAddr, keyData)
+                diags = diags.Append(configDiags)
+
+                // If the provisioner block contains a connection block of its own then
+                // it can override the base connection configuration, if any.
+                var localConn hcl.Body
+                if prov.Connection != nil {
+                        localConn = prov.Connection.Config
                 }
 
-                // Merge the connection information
-                overlay := make(map[string]string)
-                if origConnInfo != nil {
-                        for k, v := range origConnInfo {
-                                overlay[k] = v
-                        }
+                var connBody hcl.Body
+                switch {
+                case baseConn != nil && localConn != nil:
+                        // Our standard merging logic applies here, similar to what we do
+                        // with _override.tf configuration files: arguments from the
+                        // base connection block will be masked by any arguments of the
+                        // same name in the local connection block.
+                        connBody = configs.MergeBodies(baseConn, localConn)
+                case baseConn != nil:
+                        connBody = baseConn
+                case localConn != nil:
+                        connBody = localConn
                 }
-                for k, v := range connInfo.Config {
-                        switch vt := v.(type) {
-                        case string:
-                                overlay[k] = vt
-                        case int64:
-                                overlay[k] = strconv.FormatInt(vt, 10)
-                        case int32:
-                                overlay[k] = strconv.FormatInt(int64(vt), 10)
-                        case int:
-                                overlay[k] = strconv.FormatInt(int64(vt), 10)
-                        case float32:
-                                overlay[k] = strconv.FormatFloat(float64(vt), 'f', 3, 32)
-                        case float64:
-                                overlay[k] = strconv.FormatFloat(vt, 'f', 3, 64)
-                        case bool:
-                                overlay[k] = strconv.FormatBool(vt)
-                        default:
-                                overlay[k] = fmt.Sprintf("%v", vt)
+
+                // start with an empty connInfo
+                connInfo := cty.NullVal(connectionBlockSupersetSchema.ImpliedType())
+
+                if connBody != nil {
+                        var connInfoDiags tfdiags.Diagnostics
+                        connInfo, _, connInfoDiags = ctx.EvaluateBlock(connBody, connectionBlockSupersetSchema, instanceAddr, keyData)
+                        diags = diags.Append(connInfoDiags)
+                        if diags.HasErrors() {
+                                // "on failure continue" setting only applies to failures of the
+                                // provisioner itself, not to invalid configuration.
+                                return diags.Err()
                         }
                 }
-                state.Ephemeral.ConnInfo = overlay
 
                 {
                         // Call pre hook
                         err := ctx.Hook(func(h Hook) (HookAction, error) {
-                                return h.PreProvision(n.Info, prov.Type)
+                                return h.PreProvisionInstanceStep(absAddr, prov.Type)
                         })
                         if err != nil {
                                 return err
@@ -333,31 +602,37 @@ func (n *EvalApplyProvisioners) apply(ctx EvalContext, provs []*config.Provision
                 // The output function
                 outputFn := func(msg string) {
                         ctx.Hook(func(h Hook) (HookAction, error) {
-                                h.ProvisionOutput(n.Info, prov.Type, msg)
+                                h.ProvisionOutput(absAddr, prov.Type, msg)
                                 return HookActionContinue, nil
                         })
                 }
 
-                // Invoke the Provisioner
                 output := CallbackUIOutput{OutputFn: outputFn}
-                applyErr := provisioner.Apply(&output, state, provConfig)
+                resp := provisioner.ProvisionResource(provisioners.ProvisionResourceRequest{
+                        Config:     config,
+                        Connection: connInfo,
+                        UIOutput:   &output,
+                })
+                applyDiags := resp.Diagnostics.InConfigBody(prov.Config)
 
                 // Call post hook
                 hookErr := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PostProvision(n.Info, prov.Type, applyErr)
+                        return h.PostProvisionInstanceStep(absAddr, prov.Type, applyDiags.Err())
                 })
 
-                // Handle the error before we deal with the hook
-                if applyErr != nil {
-                        // Determine failure behavior
-                        switch prov.OnFailure {
-                        case config.ProvisionerOnFailureContinue:
-                                log.Printf(
-                                        "[INFO] apply: %s [%s]: error during provision, continue requested",
-                                        n.Info.Id, prov.Type)
-
-                        case config.ProvisionerOnFailureFail:
-                                return applyErr
+                switch prov.OnFailure {
+                case configs.ProvisionerOnFailureContinue:
+                        if applyDiags.HasErrors() {
+                                log.Printf("[WARN] Errors while provisioning %s with %q, but continuing as requested in configuration", n.Addr, prov.Type)
+                        } else {
+                                // Maybe there are warnings that we still want to see
+                                diags = diags.Append(applyDiags)
+                        }
+                default:
+                        diags = diags.Append(applyDiags)
+                        if applyDiags.HasErrors() {
+                                log.Printf("[WARN] Errors while provisioning %s with %q, so aborting", n.Addr, prov.Type)
+                                return diags.Err()
                         }
                 }
 
@@ -367,6 +642,5 @@ func (n *EvalApplyProvisioners) apply(ctx EvalContext, provs []*config.Provision
                 }
         }
 
-        return nil
-
+        return diags.ErrWithWarnings()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_check_prevent_destroy.go b/vendor/github.com/hashicorp/terraform/terraform/eval_check_prevent_destroy.go
index 715e79e..4dff0c8 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_check_prevent_destroy.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_check_prevent_destroy.go
@@ -3,33 +3,44 @@ package terraform
 import (
         "fmt"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/plans"
+
+        "github.com/hashicorp/hcl2/hcl"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalPreventDestroy is an EvalNode implementation that returns an
 // error if a resource has PreventDestroy configured and the diff
 // would destroy the resource.
 type EvalCheckPreventDestroy struct {
-        Resource   *config.Resource
-        ResourceId string
-        Diff       **InstanceDiff
+        Addr   addrs.ResourceInstance
+        Config *configs.Resource
+        Change **plans.ResourceInstanceChange
 }
 
 func (n *EvalCheckPreventDestroy) Eval(ctx EvalContext) (interface{}, error) {
-        if n.Diff == nil || *n.Diff == nil || n.Resource == nil {
+        if n.Change == nil || *n.Change == nil || n.Config == nil || n.Config.Managed == nil {
                 return nil, nil
         }
 
-        diff := *n.Diff
-        preventDestroy := n.Resource.Lifecycle.PreventDestroy
-
-        if diff.GetDestroy() && preventDestroy {
-                resourceId := n.ResourceId
-                if resourceId == "" {
-                        resourceId = n.Resource.Id()
-                }
-
-                return nil, fmt.Errorf(preventDestroyErrStr, resourceId)
+        change := *n.Change
+        preventDestroy := n.Config.Managed.PreventDestroy
+
+        if (change.Action == plans.Delete || change.Action.IsReplace()) && preventDestroy {
+                var diags tfdiags.Diagnostics
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Instance cannot be destroyed",
+                        Detail: fmt.Sprintf(
+                                "Resource %s has lifecycle.prevent_destroy set, but the plan calls for this resource to be destroyed. To avoid this error and continue with the plan, either disable lifecycle.prevent_destroy or reduce the scope of the plan using the -target flag.",
+                                n.Addr.Absolute(ctx.Path()).String(),
+                        ),
+                        Subject: &n.Config.DeclRange,
+                })
+                return nil, diags.Err()
         }
 
         return nil, nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_context.go b/vendor/github.com/hashicorp/terraform/terraform/eval_context.go
index 86481de..08f3059 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_context.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_context.go
@@ -1,9 +1,16 @@
 package terraform
 
 import (
-        "sync"
-
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // EvalContext is the interface that is given to eval nodes to execute.
@@ -13,7 +20,7 @@ type EvalContext interface {
         Stopped() <-chan struct{}
 
         // Path is the current module path.
-        Path() []string
+        Path() addrs.ModuleInstance
 
         // Hook is used to call hook methods. The callback is called for each
         // hook and should return the hook action to take and the error.
@@ -22,68 +29,105 @@ type EvalContext interface {
         // Input is the UIInput object for interacting with the UI.
         Input() UIInput
 
-        // InitProvider initializes the provider with the given type and name, and
+        // InitProvider initializes the provider with the given type and address, and
         // returns the implementation of the resource provider or an error.
         //
         // It is an error to initialize the same provider more than once.
-        InitProvider(typ string, name string) (ResourceProvider, error)
+        InitProvider(typ string, addr addrs.ProviderConfig) (providers.Interface, error)
 
-        // Provider gets the provider instance with the given name (already
+        // Provider gets the provider instance with the given address (already
         // initialized) or returns nil if the provider isn't initialized.
-        Provider(string) ResourceProvider
+        //
+        // This method expects an _absolute_ provider configuration address, since
+        // resources in one module are able to use providers from other modules.
+        // InitProvider must've been called on the EvalContext of the module
+        // that owns the given provider before calling this method.
+        Provider(addrs.AbsProviderConfig) providers.Interface
+
+        // ProviderSchema retrieves the schema for a particular provider, which
+        // must have already been initialized with InitProvider.
+        //
+        // This method expects an _absolute_ provider configuration address, since
+        // resources in one module are able to use providers from other modules.
+        ProviderSchema(addrs.AbsProviderConfig) *ProviderSchema
 
         // CloseProvider closes provider connections that aren't needed anymore.
-        CloseProvider(string) error
+        CloseProvider(addrs.ProviderConfig) error
 
         // ConfigureProvider configures the provider with the given
         // configuration. This is a separate context call because this call
         // is used to store the provider configuration for inheritance lookups
         // with ParentProviderConfig().
-        ConfigureProvider(string, *ResourceConfig) error
+        ConfigureProvider(addrs.ProviderConfig, cty.Value) tfdiags.Diagnostics
 
         // ProviderInput and SetProviderInput are used to configure providers
         // from user input.
-        ProviderInput(string) map[string]interface{}
-        SetProviderInput(string, map[string]interface{})
+        ProviderInput(addrs.ProviderConfig) map[string]cty.Value
+        SetProviderInput(addrs.ProviderConfig, map[string]cty.Value)
 
         // InitProvisioner initializes the provisioner with the given name and
         // returns the implementation of the resource provisioner or an error.
         //
         // It is an error to initialize the same provisioner more than once.
-        InitProvisioner(string) (ResourceProvisioner, error)
+        InitProvisioner(string) (provisioners.Interface, error)
 
         // Provisioner gets the provisioner instance with the given name (already
         // initialized) or returns nil if the provisioner isn't initialized.
-        Provisioner(string) ResourceProvisioner
+        Provisioner(string) provisioners.Interface
+
+        // ProvisionerSchema retrieves the main configuration schema for a
+        // particular provisioner, which must have already been initialized with
+        // InitProvisioner.
+        ProvisionerSchema(string) *configschema.Block
 
         // CloseProvisioner closes provisioner connections that aren't needed
         // anymore.
         CloseProvisioner(string) error
 
-        // Interpolate takes the given raw configuration and completes
-        // the interpolations, returning the processed ResourceConfig.
+        // EvaluateBlock takes the given raw configuration block and associated
+        // schema and evaluates it to produce a value of an object type that
+        // conforms to the implied type of the schema.
+        //
+        // The "self" argument is optional. If given, it is the referenceable
+        // address that the name "self" should behave as an alias for when
+        // evaluating. Set this to nil if the "self" object should not be available.
+        //
+        // The "key" argument is also optional. If given, it is the instance key
+        // of the current object within the multi-instance container it belongs
+        // to. For example, on a resource block with "count" set this should be
+        // set to a different addrs.IntKey for each instance created from that
+        // block. Set this to addrs.NoKey if not appropriate.
+        //
+        // The returned body is an expanded version of the given body, with any
+        // "dynamic" blocks replaced with zero or more static blocks. This can be
+        // used to extract correct source location information about attributes of
+        // the returned object value.
+        EvaluateBlock(body hcl.Body, schema *configschema.Block, self addrs.Referenceable, keyData InstanceKeyEvalData) (cty.Value, hcl.Body, tfdiags.Diagnostics)
+
+        // EvaluateExpr takes the given HCL expression and evaluates it to produce
+        // a value.
+        //
+        // The "self" argument is optional. If given, it is the referenceable
+        // address that the name "self" should behave as an alias for when
+        // evaluating. Set this to nil if the "self" object should not be available.
+        EvaluateExpr(expr hcl.Expression, wantType cty.Type, self addrs.Referenceable) (cty.Value, tfdiags.Diagnostics)
+
+        // EvaluationScope returns a scope that can be used to evaluate reference
+        // addresses in this context.
+        EvaluationScope(self addrs.Referenceable, keyData InstanceKeyEvalData) *lang.Scope
+
+        // SetModuleCallArguments defines values for the variables of a particular
+        // child module call.
         //
-        // The resource argument is optional. If given, it is the resource
-        // that is currently being acted upon.
-        Interpolate(*config.RawConfig, *Resource) (*ResourceConfig, error)
-
-        // InterpolateProvider takes a ProviderConfig and interpolates it with the
-        // stored interpolation scope. Since provider configurations can be
-        // inherited, the interpolation scope may be different from the current
-        // context path. Interplation is otherwise executed the same as in the
-        // Interpolation method.
-        InterpolateProvider(*config.ProviderConfig, *Resource) (*ResourceConfig, error)
-
-        // SetVariables sets the variables for the module within
-        // this context with the name n. This function call is additive:
-        // the second parameter is merged with any previous call.
-        SetVariables(string, map[string]interface{})
-
-        // Diff returns the global diff as well as the lock that should
-        // be used to modify that diff.
-        Diff() (*Diff, *sync.RWMutex)
-
-        // State returns the global state as well as the lock that should
-        // be used to modify that state.
-        State() (*State, *sync.RWMutex)
+        // Calling this function multiple times has merging behavior, keeping any
+        // previously-set keys that are not present in the new map.
+        SetModuleCallArguments(addrs.ModuleCallInstance, map[string]cty.Value)
+
+        // Changes returns the writer object that can be used to write new proposed
+        // changes into the global changes set.
+        Changes() *plans.ChangesSync
+
+        // State returns a wrapper object that provides safe concurrent access to
+        // the global state.
+        State() *states.SyncState
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_context_builtin.go b/vendor/github.com/hashicorp/terraform/terraform/eval_context_builtin.go
index 1b6ee5a..20b3793 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_context_builtin.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_context_builtin.go
@@ -6,7 +6,20 @@ import (
         "log"
         "sync"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/version"
+
+        "github.com/hashicorp/terraform/states"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/tfdiags"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // BuiltinEvalContext is an EvalContext implementation that is used by
@@ -16,35 +29,47 @@ type BuiltinEvalContext struct {
         StopContext context.Context
 
         // PathValue is the Path that this context is operating within.
-        PathValue []string
+        PathValue addrs.ModuleInstance
 
-        // Interpolater setting below affect the interpolation of variables.
+        // Evaluator is used for evaluating expressions within the scope of this
+        // eval context.
+        Evaluator *Evaluator
+
+        // Schemas is a repository of all of the schemas we should need to
+        // decode configuration blocks and expressions. This must be constructed by
+        // the caller to include schemas for all of the providers, resource types,
+        // data sources and provisioners used by the given configuration and
+        // state.
         //
-        // The InterpolaterVars are the exact value for ${var.foo} values.
-        // The map is shared between all contexts and is a mapping of
-        // PATH to KEY to VALUE. Because it is shared by all contexts as well
-        // as the Interpolater itself, it is protected by InterpolaterVarLock
-        // which must be locked during any access to the map.
-        Interpolater        *Interpolater
-        InterpolaterVars    map[string]map[string]interface{}
-        InterpolaterVarLock *sync.Mutex
+        // This must not be mutated during evaluation.
+        Schemas *Schemas
+
+        // VariableValues contains the variable values across all modules. This
+        // structure is shared across the entire containing context, and so it
+        // may be accessed only when holding VariableValuesLock.
+        // The keys of the first level of VariableValues are the string
+        // representations of addrs.ModuleInstance values. The second-level keys
+        // are variable names within each module instance.
+        VariableValues     map[string]map[string]cty.Value
+        VariableValuesLock *sync.Mutex
 
         Components          contextComponentFactory
         Hooks               []Hook
         InputValue          UIInput
-        ProviderCache       map[string]ResourceProvider
-        ProviderInputConfig map[string]map[string]interface{}
+        ProviderCache       map[string]providers.Interface
+        ProviderInputConfig map[string]map[string]cty.Value
         ProviderLock        *sync.Mutex
-        ProvisionerCache    map[string]ResourceProvisioner
+        ProvisionerCache    map[string]provisioners.Interface
         ProvisionerLock     *sync.Mutex
-        DiffValue           *Diff
-        DiffLock            *sync.RWMutex
-        StateValue          *State
-        StateLock           *sync.RWMutex
+        ChangesValue        *plans.ChangesSync
+        StateValue          *states.SyncState
 
         once sync.Once
 }
 
+// BuiltinEvalContext implements EvalContext
+var _ EvalContext = (*BuiltinEvalContext)(nil)
+
 func (ctx *BuiltinEvalContext) Stopped() <-chan struct{} {
         // This can happen during tests. During tests, we just block forever.
         if ctx.StopContext == nil {
@@ -78,12 +103,13 @@ func (ctx *BuiltinEvalContext) Input() UIInput {
         return ctx.InputValue
 }
 
-func (ctx *BuiltinEvalContext) InitProvider(typeName, name string) (ResourceProvider, error) {
+func (ctx *BuiltinEvalContext) InitProvider(typeName string, addr addrs.ProviderConfig) (providers.Interface, error) {
         ctx.once.Do(ctx.init)
+        absAddr := addr.Absolute(ctx.Path())
 
         // If we already initialized, it is an error
-        if p := ctx.Provider(name); p != nil {
-                return nil, fmt.Errorf("Provider '%s' already initialized", name)
+        if p := ctx.Provider(absAddr); p != nil {
+                return nil, fmt.Errorf("%s is already initialized", addr)
         }
 
         // Warning: make sure to acquire these locks AFTER the call to Provider
@@ -91,85 +117,102 @@ func (ctx *BuiltinEvalContext) InitProvider(typeName, name string) (ResourceProv
         ctx.ProviderLock.Lock()
         defer ctx.ProviderLock.Unlock()
 
-        p, err := ctx.Components.ResourceProvider(typeName, name)
+        key := absAddr.String()
+
+        p, err := ctx.Components.ResourceProvider(typeName, key)
         if err != nil {
                 return nil, err
         }
 
-        ctx.ProviderCache[name] = p
+        log.Printf("[TRACE] BuiltinEvalContext: Initialized %q provider for %s", typeName, absAddr)
+        ctx.ProviderCache[key] = p
+
         return p, nil
 }
 
-func (ctx *BuiltinEvalContext) Provider(n string) ResourceProvider {
+func (ctx *BuiltinEvalContext) Provider(addr addrs.AbsProviderConfig) providers.Interface {
         ctx.once.Do(ctx.init)
 
         ctx.ProviderLock.Lock()
         defer ctx.ProviderLock.Unlock()
 
-        return ctx.ProviderCache[n]
+        return ctx.ProviderCache[addr.String()]
+}
+
+func (ctx *BuiltinEvalContext) ProviderSchema(addr addrs.AbsProviderConfig) *ProviderSchema {
+        ctx.once.Do(ctx.init)
+
+        return ctx.Schemas.ProviderSchema(addr.ProviderConfig.Type)
 }
 
-func (ctx *BuiltinEvalContext) CloseProvider(n string) error {
+func (ctx *BuiltinEvalContext) CloseProvider(addr addrs.ProviderConfig) error {
         ctx.once.Do(ctx.init)
 
         ctx.ProviderLock.Lock()
         defer ctx.ProviderLock.Unlock()
 
-        var provider interface{}
-        provider = ctx.ProviderCache[n]
+        key := addr.Absolute(ctx.Path()).String()
+        provider := ctx.ProviderCache[key]
         if provider != nil {
-                if p, ok := provider.(ResourceProviderCloser); ok {
-                        delete(ctx.ProviderCache, n)
-                        return p.Close()
-                }
+                delete(ctx.ProviderCache, key)
+                return provider.Close()
         }
 
         return nil
 }
 
-func (ctx *BuiltinEvalContext) ConfigureProvider(
-        n string, cfg *ResourceConfig) error {
-        p := ctx.Provider(n)
+func (ctx *BuiltinEvalContext) ConfigureProvider(addr addrs.ProviderConfig, cfg cty.Value) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+        absAddr := addr.Absolute(ctx.Path())
+        p := ctx.Provider(absAddr)
         if p == nil {
-                return fmt.Errorf("Provider '%s' not initialized", n)
+                diags = diags.Append(fmt.Errorf("%s not initialized", addr))
+                return diags
         }
-        return p.Configure(cfg)
+
+        providerSchema := ctx.ProviderSchema(absAddr)
+        if providerSchema == nil {
+                diags = diags.Append(fmt.Errorf("schema for %s is not available", absAddr))
+                return diags
+        }
+
+        req := providers.ConfigureRequest{
+                TerraformVersion: version.String(),
+                Config:           cfg,
+        }
+
+        resp := p.Configure(req)
+        return resp.Diagnostics
 }
 
-func (ctx *BuiltinEvalContext) ProviderInput(n string) map[string]interface{} {
+func (ctx *BuiltinEvalContext) ProviderInput(pc addrs.ProviderConfig) map[string]cty.Value {
         ctx.ProviderLock.Lock()
         defer ctx.ProviderLock.Unlock()
 
-        // Make a copy of the path so we can safely edit it
-        path := ctx.Path()
-        pathCopy := make([]string, len(path)+1)
-        copy(pathCopy, path)
-
-        // Go up the tree.
-        for i := len(path) - 1; i >= 0; i-- {
-                pathCopy[i+1] = n
-                k := PathCacheKey(pathCopy[:i+2])
-                if v, ok := ctx.ProviderInputConfig[k]; ok {
-                        return v
-                }
+        if !ctx.Path().IsRoot() {
+                // Only root module provider configurations can have input.
+                return nil
         }
 
-        return nil
+        return ctx.ProviderInputConfig[pc.String()]
 }
 
-func (ctx *BuiltinEvalContext) SetProviderInput(n string, c map[string]interface{}) {
-        providerPath := make([]string, len(ctx.Path())+1)
-        copy(providerPath, ctx.Path())
-        providerPath[len(providerPath)-1] = n
+func (ctx *BuiltinEvalContext) SetProviderInput(pc addrs.ProviderConfig, c map[string]cty.Value) {
+        absProvider := pc.Absolute(ctx.Path())
+
+        if !ctx.Path().IsRoot() {
+                // Only root module provider configurations can have input.
+                log.Printf("[WARN] BuiltinEvalContext: attempt to SetProviderInput for non-root module")
+                return
+        }
 
         // Save the configuration
         ctx.ProviderLock.Lock()
-        ctx.ProviderInputConfig[PathCacheKey(providerPath)] = c
+        ctx.ProviderInputConfig[absProvider.String()] = c
         ctx.ProviderLock.Unlock()
 }
 
-func (ctx *BuiltinEvalContext) InitProvisioner(
-        n string) (ResourceProvisioner, error) {
+func (ctx *BuiltinEvalContext) InitProvisioner(n string) (provisioners.Interface, error) {
         ctx.once.Do(ctx.init)
 
         // If we already initialized, it is an error
@@ -182,10 +225,7 @@ func (ctx *BuiltinEvalContext) InitProvisioner(
         ctx.ProvisionerLock.Lock()
         defer ctx.ProvisionerLock.Unlock()
 
-        provPath := make([]string, len(ctx.Path())+1)
-        copy(provPath, ctx.Path())
-        provPath[len(provPath)-1] = n
-        key := PathCacheKey(provPath)
+        key := PathObjectCacheKey(ctx.Path(), n)
 
         p, err := ctx.Components.ResourceProvisioner(n, key)
         if err != nil {
@@ -193,20 +233,24 @@ func (ctx *BuiltinEvalContext) InitProvisioner(
         }
 
         ctx.ProvisionerCache[key] = p
+
         return p, nil
 }
 
-func (ctx *BuiltinEvalContext) Provisioner(n string) ResourceProvisioner {
+func (ctx *BuiltinEvalContext) Provisioner(n string) provisioners.Interface {
         ctx.once.Do(ctx.init)
 
         ctx.ProvisionerLock.Lock()
         defer ctx.ProvisionerLock.Unlock()
 
-        provPath := make([]string, len(ctx.Path())+1)
-        copy(provPath, ctx.Path())
-        provPath[len(provPath)-1] = n
+        key := PathObjectCacheKey(ctx.Path(), n)
+        return ctx.ProvisionerCache[key]
+}
+
+func (ctx *BuiltinEvalContext) ProvisionerSchema(n string) *configschema.Block {
+        ctx.once.Do(ctx.init)
 
-        return ctx.ProvisionerCache[PathCacheKey(provPath)]
+        return ctx.Schemas.ProvisionerConfig(n)
 }
 
 func (ctx *BuiltinEvalContext) CloseProvisioner(n string) error {
@@ -215,106 +259,70 @@ func (ctx *BuiltinEvalContext) CloseProvisioner(n string) error {
         ctx.ProvisionerLock.Lock()
         defer ctx.ProvisionerLock.Unlock()
 
-        provPath := make([]string, len(ctx.Path())+1)
-        copy(provPath, ctx.Path())
-        provPath[len(provPath)-1] = n
+        key := PathObjectCacheKey(ctx.Path(), n)
 
-        var prov interface{}
-        prov = ctx.ProvisionerCache[PathCacheKey(provPath)]
+        prov := ctx.ProvisionerCache[key]
         if prov != nil {
-                if p, ok := prov.(ResourceProvisionerCloser); ok {
-                        delete(ctx.ProvisionerCache, PathCacheKey(provPath))
-                        return p.Close()
-                }
+                return prov.Close()
         }
 
         return nil
 }
 
-func (ctx *BuiltinEvalContext) Interpolate(
-        cfg *config.RawConfig, r *Resource) (*ResourceConfig, error) {
-
-        if cfg != nil {
-                scope := &InterpolationScope{
-                        Path:     ctx.Path(),
-                        Resource: r,
-                }
-
-                vs, err := ctx.Interpolater.Values(scope, cfg.Variables)
-                if err != nil {
-                        return nil, err
-                }
-
-                // Do the interpolation
-                if err := cfg.Interpolate(vs); err != nil {
-                        return nil, err
-                }
-        }
-
-        result := NewResourceConfig(cfg)
-        result.interpolateForce()
-        return result, nil
+func (ctx *BuiltinEvalContext) EvaluateBlock(body hcl.Body, schema *configschema.Block, self addrs.Referenceable, keyData InstanceKeyEvalData) (cty.Value, hcl.Body, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        scope := ctx.EvaluationScope(self, keyData)
+        body, evalDiags := scope.ExpandBlock(body, schema)
+        diags = diags.Append(evalDiags)
+        val, evalDiags := scope.EvalBlock(body, schema)
+        diags = diags.Append(evalDiags)
+        return val, body, diags
 }
 
-func (ctx *BuiltinEvalContext) InterpolateProvider(
-        pc *config.ProviderConfig, r *Resource) (*ResourceConfig, error) {
-
-        var cfg *config.RawConfig
-
-        if pc != nil && pc.RawConfig != nil {
-                scope := &InterpolationScope{
-                        Path:     ctx.Path(),
-                        Resource: r,
-                }
-
-                cfg = pc.RawConfig
-
-                vs, err := ctx.Interpolater.Values(scope, cfg.Variables)
-                if err != nil {
-                        return nil, err
-                }
+func (ctx *BuiltinEvalContext) EvaluateExpr(expr hcl.Expression, wantType cty.Type, self addrs.Referenceable) (cty.Value, tfdiags.Diagnostics) {
+        scope := ctx.EvaluationScope(self, EvalDataForNoInstanceKey)
+        return scope.EvalExpr(expr, wantType)
+}
 
-                // Do the interpolation
-                if err := cfg.Interpolate(vs); err != nil {
-                        return nil, err
-                }
+func (ctx *BuiltinEvalContext) EvaluationScope(self addrs.Referenceable, keyData InstanceKeyEvalData) *lang.Scope {
+        data := &evaluationStateData{
+                Evaluator:       ctx.Evaluator,
+                ModulePath:      ctx.PathValue,
+                InstanceKeyData: keyData,
+                Operation:       ctx.Evaluator.Operation,
         }
-
-        result := NewResourceConfig(cfg)
-        result.interpolateForce()
-        return result, nil
+        return ctx.Evaluator.Scope(data, self)
 }
 
-func (ctx *BuiltinEvalContext) Path() []string {
+func (ctx *BuiltinEvalContext) Path() addrs.ModuleInstance {
         return ctx.PathValue
 }
 
-func (ctx *BuiltinEvalContext) SetVariables(n string, vs map[string]interface{}) {
-        ctx.InterpolaterVarLock.Lock()
-        defer ctx.InterpolaterVarLock.Unlock()
+func (ctx *BuiltinEvalContext) SetModuleCallArguments(n addrs.ModuleCallInstance, vals map[string]cty.Value) {
+        ctx.VariableValuesLock.Lock()
+        defer ctx.VariableValuesLock.Unlock()
 
-        path := make([]string, len(ctx.Path())+1)
-        copy(path, ctx.Path())
-        path[len(path)-1] = n
-        key := PathCacheKey(path)
+        childPath := n.ModuleInstance(ctx.PathValue)
+        key := childPath.String()
 
-        vars := ctx.InterpolaterVars[key]
-        if vars == nil {
-                vars = make(map[string]interface{})
-                ctx.InterpolaterVars[key] = vars
+        args := ctx.VariableValues[key]
+        if args == nil {
+                args = make(map[string]cty.Value)
+                ctx.VariableValues[key] = vals
+                return
         }
 
-        for k, v := range vs {
-                vars[k] = v
+        for k, v := range vals {
+                args[k] = v
         }
 }
 
-func (ctx *BuiltinEvalContext) Diff() (*Diff, *sync.RWMutex) {
-        return ctx.DiffValue, ctx.DiffLock
+func (ctx *BuiltinEvalContext) Changes() *plans.ChangesSync {
+        return ctx.ChangesValue
 }
 
-func (ctx *BuiltinEvalContext) State() (*State, *sync.RWMutex) {
-        return ctx.StateValue, ctx.StateLock
+func (ctx *BuiltinEvalContext) State() *states.SyncState {
+        return ctx.StateValue
 }
 
 func (ctx *BuiltinEvalContext) init() {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_context_mock.go b/vendor/github.com/hashicorp/terraform/terraform/eval_context_mock.go
index 6464517..195ecc5 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_context_mock.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_context_mock.go
@@ -1,9 +1,20 @@
 package terraform
 
 import (
-        "sync"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
 
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // MockEvalContext is a mock version of EvalContext that can be used
@@ -20,43 +31,84 @@ type MockEvalContext struct {
         InputInput  UIInput
 
         InitProviderCalled   bool
-        InitProviderName     string
-        InitProviderProvider ResourceProvider
+        InitProviderType     string
+        InitProviderAddr     addrs.ProviderConfig
+        InitProviderProvider providers.Interface
         InitProviderError    error
 
         ProviderCalled   bool
-        ProviderName     string
-        ProviderProvider ResourceProvider
+        ProviderAddr     addrs.AbsProviderConfig
+        ProviderProvider providers.Interface
+
+        ProviderSchemaCalled bool
+        ProviderSchemaAddr   addrs.AbsProviderConfig
+        ProviderSchemaSchema *ProviderSchema
 
         CloseProviderCalled   bool
-        CloseProviderName     string
-        CloseProviderProvider ResourceProvider
+        CloseProviderAddr     addrs.ProviderConfig
+        CloseProviderProvider providers.Interface
 
         ProviderInputCalled bool
-        ProviderInputName   string
-        ProviderInputConfig map[string]interface{}
+        ProviderInputAddr   addrs.ProviderConfig
+        ProviderInputValues map[string]cty.Value
 
         SetProviderInputCalled bool
-        SetProviderInputName   string
-        SetProviderInputConfig map[string]interface{}
+        SetProviderInputAddr   addrs.ProviderConfig
+        SetProviderInputValues map[string]cty.Value
 
         ConfigureProviderCalled bool
-        ConfigureProviderName   string
-        ConfigureProviderConfig *ResourceConfig
-        ConfigureProviderError  error
+        ConfigureProviderAddr   addrs.ProviderConfig
+        ConfigureProviderConfig cty.Value
+        ConfigureProviderDiags  tfdiags.Diagnostics
 
         InitProvisionerCalled      bool
         InitProvisionerName        string
-        InitProvisionerProvisioner ResourceProvisioner
+        InitProvisionerProvisioner provisioners.Interface
         InitProvisionerError       error
 
         ProvisionerCalled      bool
         ProvisionerName        string
-        ProvisionerProvisioner ResourceProvisioner
+        ProvisionerProvisioner provisioners.Interface
+
+        ProvisionerSchemaCalled bool
+        ProvisionerSchemaName   string
+        ProvisionerSchemaSchema *configschema.Block
 
         CloseProvisionerCalled      bool
         CloseProvisionerName        string
-        CloseProvisionerProvisioner ResourceProvisioner
+        CloseProvisionerProvisioner provisioners.Interface
+
+        EvaluateBlockCalled     bool
+        EvaluateBlockBody       hcl.Body
+        EvaluateBlockSchema     *configschema.Block
+        EvaluateBlockSelf       addrs.Referenceable
+        EvaluateBlockKeyData    InstanceKeyEvalData
+        EvaluateBlockResultFunc func(
+                body hcl.Body,
+                schema *configschema.Block,
+                self addrs.Referenceable,
+                keyData InstanceKeyEvalData,
+        ) (cty.Value, hcl.Body, tfdiags.Diagnostics) // overrides the other values below, if set
+        EvaluateBlockResult       cty.Value
+        EvaluateBlockExpandedBody hcl.Body
+        EvaluateBlockDiags        tfdiags.Diagnostics
+
+        EvaluateExprCalled     bool
+        EvaluateExprExpr       hcl.Expression
+        EvaluateExprWantType   cty.Type
+        EvaluateExprSelf       addrs.Referenceable
+        EvaluateExprResultFunc func(
+                expr hcl.Expression,
+                wantType cty.Type,
+                self addrs.Referenceable,
+        ) (cty.Value, tfdiags.Diagnostics) // overrides the other values below, if set
+        EvaluateExprResult cty.Value
+        EvaluateExprDiags  tfdiags.Diagnostics
+
+        EvaluationScopeCalled  bool
+        EvaluationScopeSelf    addrs.Referenceable
+        EvaluationScopeKeyData InstanceKeyEvalData
+        EvaluationScopeScope   *lang.Scope
 
         InterpolateCalled       bool
         InterpolateConfig       *config.RawConfig
@@ -71,21 +123,22 @@ type MockEvalContext struct {
         InterpolateProviderError        error
 
         PathCalled bool
-        PathPath   []string
+        PathPath   addrs.ModuleInstance
 
-        SetVariablesCalled    bool
-        SetVariablesModule    string
-        SetVariablesVariables map[string]interface{}
+        SetModuleCallArgumentsCalled bool
+        SetModuleCallArgumentsModule addrs.ModuleCallInstance
+        SetModuleCallArgumentsValues map[string]cty.Value
 
-        DiffCalled bool
-        DiffDiff   *Diff
-        DiffLock   *sync.RWMutex
+        ChangesCalled  bool
+        ChangesChanges *plans.ChangesSync
 
         StateCalled bool
-        StateState  *State
-        StateLock   *sync.RWMutex
+        StateState  *states.SyncState
 }
 
+// MockEvalContext implements EvalContext
+var _ EvalContext = (*MockEvalContext)(nil)
+
 func (c *MockEvalContext) Stopped() <-chan struct{} {
         c.StoppedCalled = true
         return c.StoppedValue
@@ -107,61 +160,157 @@ func (c *MockEvalContext) Input() UIInput {
         return c.InputInput
 }
 
-func (c *MockEvalContext) InitProvider(t, n string) (ResourceProvider, error) {
+func (c *MockEvalContext) InitProvider(t string, addr addrs.ProviderConfig) (providers.Interface, error) {
         c.InitProviderCalled = true
-        c.InitProviderName = n
+        c.InitProviderType = t
+        c.InitProviderAddr = addr
         return c.InitProviderProvider, c.InitProviderError
 }
 
-func (c *MockEvalContext) Provider(n string) ResourceProvider {
+func (c *MockEvalContext) Provider(addr addrs.AbsProviderConfig) providers.Interface {
         c.ProviderCalled = true
-        c.ProviderName = n
+        c.ProviderAddr = addr
         return c.ProviderProvider
 }
 
-func (c *MockEvalContext) CloseProvider(n string) error {
+func (c *MockEvalContext) ProviderSchema(addr addrs.AbsProviderConfig) *ProviderSchema {
+        c.ProviderSchemaCalled = true
+        c.ProviderSchemaAddr = addr
+        return c.ProviderSchemaSchema
+}
+
+func (c *MockEvalContext) CloseProvider(addr addrs.ProviderConfig) error {
         c.CloseProviderCalled = true
-        c.CloseProviderName = n
+        c.CloseProviderAddr = addr
         return nil
 }
 
-func (c *MockEvalContext) ConfigureProvider(n string, cfg *ResourceConfig) error {
+func (c *MockEvalContext) ConfigureProvider(addr addrs.ProviderConfig, cfg cty.Value) tfdiags.Diagnostics {
         c.ConfigureProviderCalled = true
-        c.ConfigureProviderName = n
+        c.ConfigureProviderAddr = addr
         c.ConfigureProviderConfig = cfg
-        return c.ConfigureProviderError
+        return c.ConfigureProviderDiags
 }
 
-func (c *MockEvalContext) ProviderInput(n string) map[string]interface{} {
+func (c *MockEvalContext) ProviderInput(addr addrs.ProviderConfig) map[string]cty.Value {
         c.ProviderInputCalled = true
-        c.ProviderInputName = n
-        return c.ProviderInputConfig
+        c.ProviderInputAddr = addr
+        return c.ProviderInputValues
 }
 
-func (c *MockEvalContext) SetProviderInput(n string, cfg map[string]interface{}) {
+func (c *MockEvalContext) SetProviderInput(addr addrs.ProviderConfig, vals map[string]cty.Value) {
         c.SetProviderInputCalled = true
-        c.SetProviderInputName = n
-        c.SetProviderInputConfig = cfg
+        c.SetProviderInputAddr = addr
+        c.SetProviderInputValues = vals
 }
 
-func (c *MockEvalContext) InitProvisioner(n string) (ResourceProvisioner, error) {
+func (c *MockEvalContext) InitProvisioner(n string) (provisioners.Interface, error) {
         c.InitProvisionerCalled = true
         c.InitProvisionerName = n
         return c.InitProvisionerProvisioner, c.InitProvisionerError
 }
 
-func (c *MockEvalContext) Provisioner(n string) ResourceProvisioner {
+func (c *MockEvalContext) Provisioner(n string) provisioners.Interface {
         c.ProvisionerCalled = true
         c.ProvisionerName = n
         return c.ProvisionerProvisioner
 }
 
+func (c *MockEvalContext) ProvisionerSchema(n string) *configschema.Block {
+        c.ProvisionerSchemaCalled = true
+        c.ProvisionerSchemaName = n
+        return c.ProvisionerSchemaSchema
+}
+
 func (c *MockEvalContext) CloseProvisioner(n string) error {
         c.CloseProvisionerCalled = true
         c.CloseProvisionerName = n
         return nil
 }
 
+func (c *MockEvalContext) EvaluateBlock(body hcl.Body, schema *configschema.Block, self addrs.Referenceable, keyData InstanceKeyEvalData) (cty.Value, hcl.Body, tfdiags.Diagnostics) {
+        c.EvaluateBlockCalled = true
+        c.EvaluateBlockBody = body
+        c.EvaluateBlockSchema = schema
+        c.EvaluateBlockSelf = self
+        c.EvaluateBlockKeyData = keyData
+        if c.EvaluateBlockResultFunc != nil {
+                return c.EvaluateBlockResultFunc(body, schema, self, keyData)
+        }
+        return c.EvaluateBlockResult, c.EvaluateBlockExpandedBody, c.EvaluateBlockDiags
+}
+
+func (c *MockEvalContext) EvaluateExpr(expr hcl.Expression, wantType cty.Type, self addrs.Referenceable) (cty.Value, tfdiags.Diagnostics) {
+        c.EvaluateExprCalled = true
+        c.EvaluateExprExpr = expr
+        c.EvaluateExprWantType = wantType
+        c.EvaluateExprSelf = self
+        if c.EvaluateExprResultFunc != nil {
+                return c.EvaluateExprResultFunc(expr, wantType, self)
+        }
+        return c.EvaluateExprResult, c.EvaluateExprDiags
+}
+
+// installSimpleEval is a helper to install a simple mock implementation of
+// both EvaluateBlock and EvaluateExpr into the receiver.
+//
+// These default implementations will either evaluate the given input against
+// the scope in field EvaluationScopeScope or, if it is nil, with no eval
+// context at all so that only constant values may be used.
+//
+// This function overwrites any existing functions installed in fields
+// EvaluateBlockResultFunc and EvaluateExprResultFunc.
+func (c *MockEvalContext) installSimpleEval() {
+        c.EvaluateBlockResultFunc = func(body hcl.Body, schema *configschema.Block, self addrs.Referenceable, keyData InstanceKeyEvalData) (cty.Value, hcl.Body, tfdiags.Diagnostics) {
+                if scope := c.EvaluationScopeScope; scope != nil {
+                        // Fully-functional codepath.
+                        var diags tfdiags.Diagnostics
+                        body, diags = scope.ExpandBlock(body, schema)
+                        if diags.HasErrors() {
+                                return cty.DynamicVal, body, diags
+                        }
+                        val, evalDiags := c.EvaluationScopeScope.EvalBlock(body, schema)
+                        diags = diags.Append(evalDiags)
+                        if evalDiags.HasErrors() {
+                                return cty.DynamicVal, body, diags
+                        }
+                        return val, body, diags
+                }
+
+                // Fallback codepath supporting constant values only.
+                val, hclDiags := hcldec.Decode(body, schema.DecoderSpec(), nil)
+                return val, body, tfdiags.Diagnostics(nil).Append(hclDiags)
+        }
+        c.EvaluateExprResultFunc = func(expr hcl.Expression, wantType cty.Type, self addrs.Referenceable) (cty.Value, tfdiags.Diagnostics) {
+                if scope := c.EvaluationScopeScope; scope != nil {
+                        // Fully-functional codepath.
+                        return scope.EvalExpr(expr, wantType)
+                }
+
+                // Fallback codepath supporting constant values only.
+                var diags tfdiags.Diagnostics
+                val, hclDiags := expr.Value(nil)
+                diags = diags.Append(hclDiags)
+                if hclDiags.HasErrors() {
+                        return cty.DynamicVal, diags
+                }
+                var err error
+                val, err = convert.Convert(val, wantType)
+                if err != nil {
+                        diags = diags.Append(err)
+                        return cty.DynamicVal, diags
+                }
+                return val, diags
+        }
+}
+
+func (c *MockEvalContext) EvaluationScope(self addrs.Referenceable, keyData InstanceKeyEvalData) *lang.Scope {
+        c.EvaluationScopeCalled = true
+        c.EvaluationScopeSelf = self
+        c.EvaluationScopeKeyData = keyData
+        return c.EvaluationScopeScope
+}
+
 func (c *MockEvalContext) Interpolate(
         config *config.RawConfig, resource *Resource) (*ResourceConfig, error) {
         c.InterpolateCalled = true
@@ -178,23 +327,23 @@ func (c *MockEvalContext) InterpolateProvider(
         return c.InterpolateProviderConfigResult, c.InterpolateError
 }
 
-func (c *MockEvalContext) Path() []string {
+func (c *MockEvalContext) Path() addrs.ModuleInstance {
         c.PathCalled = true
         return c.PathPath
 }
 
-func (c *MockEvalContext) SetVariables(n string, vs map[string]interface{}) {
-        c.SetVariablesCalled = true
-        c.SetVariablesModule = n
-        c.SetVariablesVariables = vs
+func (c *MockEvalContext) SetModuleCallArguments(n addrs.ModuleCallInstance, values map[string]cty.Value) {
+        c.SetModuleCallArgumentsCalled = true
+        c.SetModuleCallArgumentsModule = n
+        c.SetModuleCallArgumentsValues = values
 }
 
-func (c *MockEvalContext) Diff() (*Diff, *sync.RWMutex) {
-        c.DiffCalled = true
-        return c.DiffDiff, c.DiffLock
+func (c *MockEvalContext) Changes() *plans.ChangesSync {
+        c.ChangesCalled = true
+        return c.ChangesChanges
 }
 
-func (c *MockEvalContext) State() (*State, *sync.RWMutex) {
+func (c *MockEvalContext) State() *states.SyncState {
         c.StateCalled = true
-        return c.StateState, c.StateLock
+        return c.StateState
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_count.go b/vendor/github.com/hashicorp/terraform/terraform/eval_count.go
index 2ae56a7..8083105 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_count.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_count.go
@@ -1,58 +1,120 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config"
+        "fmt"
+        "log"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/gocty"
 )
 
-// EvalCountFixZeroOneBoundary is an EvalNode that fixes up the state
-// when there is a resource count with zero/one boundary, i.e. fixing
-// a resource named "aws_instance.foo" to "aws_instance.foo.0" and vice-versa.
-type EvalCountFixZeroOneBoundary struct {
-        Resource *config.Resource
+// evaluateResourceCountExpression is our standard mechanism for interpreting an
+// expression given for a "count" argument on a resource. This should be called
+// from the DynamicExpand of a node representing a resource in order to
+// determine the final count value.
+//
+// If the result is zero or positive and no error diagnostics are returned, then
+// the result is the literal count value to use.
+//
+// If the result is -1, this indicates that the given expression is nil and so
+// the "count" behavior should not be enabled for this resource at all.
+//
+// If error diagnostics are returned then the result is always the meaningless
+// placeholder value -1.
+func evaluateResourceCountExpression(expr hcl.Expression, ctx EvalContext) (int, tfdiags.Diagnostics) {
+        count, known, diags := evaluateResourceCountExpressionKnown(expr, ctx)
+        if !known {
+                // Currently this is a rather bad outcome from a UX standpoint, since we have
+                // no real mechanism to deal with this situation and all we can do is produce
+                // an error message.
+                // FIXME: In future, implement a built-in mechanism for deferring changes that
+                // can't yet be predicted, and use it to guide the user through several
+                // plan/apply steps until the desired configuration is eventually reached.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   `The "count" value depends on resource attributes that cannot be determined until apply, so Terraform cannot predict how many instances will be created. To work around this, use the -target argument to first apply only the resources that the count depends on.`,
+                        Subject:  expr.Range().Ptr(),
+                })
+        }
+        return count, diags
 }
 
-// TODO: test
-func (n *EvalCountFixZeroOneBoundary) Eval(ctx EvalContext) (interface{}, error) {
-        // Get the count, important for knowing whether we're supposed to
-        // be adding the zero, or trimming it.
-        count, err := n.Resource.Count()
-        if err != nil {
-                return nil, err
+// evaluateResourceCountExpressionKnown is like evaluateResourceCountExpression
+// except that it handles an unknown result by returning count = 0 and
+// a known = false, rather than by reporting the unknown value as an error
+// diagnostic.
+func evaluateResourceCountExpressionKnown(expr hcl.Expression, ctx EvalContext) (count int, known bool, diags tfdiags.Diagnostics) {
+        if expr == nil {
+                return -1, true, nil
         }
 
-        // Figure what to look for and what to replace it with
-        hunt := n.Resource.Id()
-        replace := hunt + ".0"
-        if count < 2 {
-                hunt, replace = replace, hunt
+        countVal, countDiags := ctx.EvaluateExpr(expr, cty.Number, nil)
+        diags = diags.Append(countDiags)
+        if diags.HasErrors() {
+                return -1, true, diags
         }
 
-        state, lock := ctx.State()
-
-        // Get a lock so we can access this instance and potentially make
-        // changes to it.
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Look for the module state. If we don't have one, then it doesn't matter.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                return nil, nil
+        switch {
+        case countVal.IsNull():
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   `The given "count" argument value is null. An integer is required.`,
+                        Subject:  expr.Range().Ptr(),
+                })
+                return -1, true, diags
+        case !countVal.IsKnown():
+                return 0, false, diags
         }
 
-        // Look for the resource state. If we don't have one, then it is okay.
-        rs, ok := mod.Resources[hunt]
-        if !ok {
-                return nil, nil
+        err := gocty.FromCtyValue(countVal, &count)
+        if err != nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   fmt.Sprintf(`The given "count" argument value is unsuitable: %s.`, err),
+                        Subject:  expr.Range().Ptr(),
+                })
+                return -1, true, diags
         }
-
-        // If the replacement key exists, we just keep both
-        if _, ok := mod.Resources[replace]; ok {
-                return nil, nil
+        if count < 0 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   `The given "count" argument value is unsuitable: negative numbers are not supported.`,
+                        Subject:  expr.Range().Ptr(),
+                })
+                return -1, true, diags
         }
 
-        mod.Resources[replace] = rs
-        delete(mod.Resources, hunt)
+        return count, true, diags
+}
 
-        return nil, nil
+// fixResourceCountSetTransition is a helper function to fix up the state when a
+// resource transitions its "count" from being set to unset or vice-versa,
+// treating a 0-key and a no-key instance as aliases for one another across
+// the transition.
+//
+// The correct time to call this function is in the DynamicExpand method for
+// a node representing a resource, just after evaluating the count with
+// evaluateResourceCountExpression, and before any other analysis of the
+// state such as orphan detection.
+//
+// This function calls methods on the given EvalContext to update the current
+// state in-place, if necessary. It is a no-op if there is no count transition
+// taking place.
+//
+// Since the state is modified in-place, this function must take a writer lock
+// on the state. The caller must therefore not also be holding a state lock,
+// or this function will block forever awaiting the lock.
+func fixResourceCountSetTransition(ctx EvalContext, addr addrs.AbsResource, countEnabled bool) {
+        state := ctx.State()
+        changed := state.MaybeFixUpResourceInstanceAddressForCount(addr, countEnabled)
+        if changed {
+                log.Printf("[TRACE] renamed first %s instance in transient state due to count argument change", addr)
+        }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_count_boundary.go b/vendor/github.com/hashicorp/terraform/terraform/eval_count_boundary.go
index 91e2b90..647c58d 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_count_boundary.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_count_boundary.go
@@ -1,7 +1,11 @@
 package terraform
 
 import (
+        "fmt"
         "log"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
 )
 
 // EvalCountFixZeroOneBoundaryGlobal is an EvalNode that fixes up the state
@@ -9,22 +13,34 @@ import (
 // a resource named "aws_instance.foo" to "aws_instance.foo.0" and vice-versa.
 //
 // This works on the global state.
-type EvalCountFixZeroOneBoundaryGlobal struct{}
+type EvalCountFixZeroOneBoundaryGlobal struct {
+        Config *configs.Config
+}
 
 // TODO: test
 func (n *EvalCountFixZeroOneBoundaryGlobal) Eval(ctx EvalContext) (interface{}, error) {
-        // Get the state and lock it since we'll potentially modify it
-        state, lock := ctx.State()
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Prune the state since we require a clean state to work
-        state.prune()
-
-        // Go through each modules since the boundaries are restricted to a
-        // module scope.
+        // We'll temporarily lock the state to grab the modules, then work on each
+        // one separately while taking a lock again for each separate resource.
+        // This means that if another caller concurrently adds a module here while
+        // we're working then we won't update it, but that's no worse than the
+        // concurrent writer blocking for our entire fixup process and _then_
+        // adding a new module, and in practice the graph node associated with
+        // this eval depends on everything else in the graph anyway, so there
+        // should not be concurrent writers.
+        state := ctx.State().Lock()
+        moduleAddrs := make([]addrs.ModuleInstance, 0, len(state.Modules))
         for _, m := range state.Modules {
-                if err := n.fixModule(m); err != nil {
+                moduleAddrs = append(moduleAddrs, m.Addr)
+        }
+        ctx.State().Unlock()
+
+        for _, addr := range moduleAddrs {
+                cfg := n.Config.DescendentForInstance(addr)
+                if cfg == nil {
+                        log.Printf("[WARN] Not fixing up EachModes for %s because it has no config", addr)
+                        continue
+                }
+                if err := n.fixModule(ctx, addr); err != nil {
                         return nil, err
                 }
         }
@@ -32,46 +48,29 @@ func (n *EvalCountFixZeroOneBoundaryGlobal) Eval(ctx EvalContext) (interface{},
         return nil, nil
 }
 
-func (n *EvalCountFixZeroOneBoundaryGlobal) fixModule(m *ModuleState) error {
-        // Counts keeps track of keys and their counts
-        counts := make(map[string]int)
-        for k, _ := range m.Resources {
-                // Parse the key
-                key, err := ParseResourceStateKey(k)
-                if err != nil {
-                        return err
-                }
-
-                // Set the index to -1 so that we can keep count
-                key.Index = -1
-
-                // Increment
-                counts[key.String()]++
+func (n *EvalCountFixZeroOneBoundaryGlobal) fixModule(ctx EvalContext, moduleAddr addrs.ModuleInstance) error {
+        ms := ctx.State().Module(moduleAddr)
+        cfg := n.Config.DescendentForInstance(moduleAddr)
+        if ms == nil {
+                // Theoretically possible for a concurrent writer to delete a module
+                // while we're running, but in practice the graph node that called us
+                // depends on everything else in the graph and so there can never
+                // be a concurrent writer.
+                return fmt.Errorf("[WARN] no state found for %s while trying to fix up EachModes", moduleAddr)
+        }
+        if cfg == nil {
+                return fmt.Errorf("[WARN] no config found for %s while trying to fix up EachModes", moduleAddr)
         }
 
-        // Go through the counts and do the fixup for each resource
-        for raw, count := range counts {
-                // Search and replace this resource
-                search := raw
-                replace := raw + ".0"
-                if count < 2 {
-                        search, replace = replace, search
-                }
-                log.Printf("[TRACE] EvalCountFixZeroOneBoundaryGlobal: count %d, search %q, replace %q", count, search, replace)
-
-                // Look for the resource state. If we don't have one, then it is okay.
-                rs, ok := m.Resources[search]
-                if !ok {
-                        continue
-                }
-
-                // If the replacement key exists, we just keep both
-                if _, ok := m.Resources[replace]; ok {
+        for _, r := range ms.Resources {
+                addr := r.Addr.Absolute(moduleAddr)
+                rCfg := cfg.Module.ResourceByAddr(r.Addr)
+                if rCfg == nil {
+                        log.Printf("[WARN] Not fixing up EachModes for %s because it has no config", addr)
                         continue
                 }
-
-                m.Resources[replace] = rs
-                delete(m.Resources, search)
+                hasCount := rCfg.Count != nil
+                fixResourceCountSetTransition(ctx, addr, hasCount)
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go b/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
index 26205ce..b7acfb0 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
@@ -1,92 +1,114 @@
 package terraform
 
 import (
+        "bytes"
         "fmt"
         "log"
+        "reflect"
         "strings"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/plans/objchange"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
-// EvalCompareDiff is an EvalNode implementation that compares two diffs
-// and errors if the diffs are not equal.
-type EvalCompareDiff struct {
-        Info     *InstanceInfo
-        One, Two **InstanceDiff
+// EvalCheckPlannedChange is an EvalNode implementation that produces errors
+// if the _actual_ expected value is not compatible with what was recorded
+// in the plan.
+//
+// Errors here are most often indicative of a bug in the provider, so our
+// error messages will report with that in mind. It's also possible that
+// there's a bug in Terraform's Core's own "proposed new value" code in
+// EvalDiff.
+type EvalCheckPlannedChange struct {
+        Addr           addrs.ResourceInstance
+        ProviderAddr   addrs.AbsProviderConfig
+        ProviderSchema **ProviderSchema
+
+        // We take ResourceInstanceChange objects here just because that's what's
+        // convenient to pass in from the evaltree implementation, but we really
+        // only look at the "After" value of each change.
+        Planned, Actual **plans.ResourceInstanceChange
 }
 
-// TODO: test
-func (n *EvalCompareDiff) Eval(ctx EvalContext) (interface{}, error) {
-        one, two := *n.One, *n.Two
-
-        // If either are nil, let them be empty
-        if one == nil {
-                one = new(InstanceDiff)
-                one.init()
-        }
-        if two == nil {
-                two = new(InstanceDiff)
-                two.init()
-        }
-        oneId, _ := one.GetAttribute("id")
-        twoId, _ := two.GetAttribute("id")
-        one.DelAttribute("id")
-        two.DelAttribute("id")
-        defer func() {
-                if oneId != nil {
-                        one.SetAttribute("id", oneId)
-                }
-                if twoId != nil {
-                        two.SetAttribute("id", twoId)
-                }
-        }()
-
-        if same, reason := one.Same(two); !same {
-                log.Printf("[ERROR] %s: diffs didn't match", n.Info.Id)
-                log.Printf("[ERROR] %s: reason: %s", n.Info.Id, reason)
-                log.Printf("[ERROR] %s: diff one: %#v", n.Info.Id, one)
-                log.Printf("[ERROR] %s: diff two: %#v", n.Info.Id, two)
-                return nil, fmt.Errorf(
-                        "%s: diffs didn't match during apply. This is a bug with "+
-                                "Terraform and should be reported as a GitHub Issue.\n"+
-                                "\n"+
-                                "Please include the following information in your report:\n"+
-                                "\n"+
-                                "    Terraform Version: %s\n"+
-                                "    Resource ID: %s\n"+
-                                "    Mismatch reason: %s\n"+
-                                "    Diff One (usually from plan): %#v\n"+
-                                "    Diff Two (usually from apply): %#v\n"+
-                                "\n"+
-                                "Also include as much context as you can about your config, state, "+
-                                "and the steps you performed to trigger this error.\n",
-                        n.Info.Id, version.Version, n.Info.Id, reason, one, two)
+func (n *EvalCheckPlannedChange) Eval(ctx EvalContext) (interface{}, error) {
+        providerSchema := *n.ProviderSchema
+        plannedChange := *n.Planned
+        actualChange := *n.Actual
+
+        schema, _ := providerSchema.SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support %q", n.Addr.Resource.Type)
+        }
+
+        var diags tfdiags.Diagnostics
+        absAddr := n.Addr.Absolute(ctx.Path())
+
+        log.Printf("[TRACE] EvalCheckPlannedChange: Verifying that actual change (action %s) matches planned change (action %s)", actualChange.Action, plannedChange.Action)
+
+        if plannedChange.Action != actualChange.Action {
+                switch {
+                case plannedChange.Action == plans.Update && actualChange.Action == plans.NoOp:
+                        // It's okay for an update to become a NoOp once we've filled in
+                        // all of the unknown values, since the final values might actually
+                        // match what was there before after all.
+                        log.Printf("[DEBUG] After incorporating new values learned so far during apply, %s change has become NoOp", absAddr)
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Provider produced inconsistent final plan",
+                                fmt.Sprintf(
+                                        "When expanding the plan for %s to include new values learned so far during apply, provider %q changed the planned action from %s to %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                        absAddr, n.ProviderAddr.ProviderConfig.Type,
+                                        plannedChange.Action, actualChange.Action,
+                                ),
+                        ))
+                }
         }
 
-        return nil, nil
+        errs := objchange.AssertObjectCompatible(schema, plannedChange.After, actualChange.After)
+        for _, err := range errs {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced inconsistent final plan",
+                        fmt.Sprintf(
+                                "When expanding the plan for %s to include new values learned so far during apply, provider %q produced an invalid new value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                absAddr, n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatError(err),
+                        ),
+                ))
+        }
+        return nil, diags.Err()
 }
 
-// EvalDiff is an EvalNode implementation that does a refresh for
-// a resource.
+// EvalDiff is an EvalNode implementation that detects changes for a given
+// resource instance.
 type EvalDiff struct {
-        Name        string
-        Info        *InstanceInfo
-        Config      **ResourceConfig
-        Provider    *ResourceProvider
-        Diff        **InstanceDiff
-        State       **InstanceState
-        OutputDiff  **InstanceDiff
-        OutputState **InstanceState
-
-        // Resource is needed to fetch the ignore_changes list so we can
-        // filter user-requested ignored attributes from the diff.
-        Resource *config.Resource
-
-        // Stub is used to flag the generated InstanceDiff as a stub. This is used to
-        // ensure that the node exists to perform interpolations and generate
-        // computed paths off of, but not as an actual diff where resouces should be
-        // counted, and not as a diff that should be acted on.
+        Addr           addrs.ResourceInstance
+        Config         *configs.Resource
+        Provider       *providers.Interface
+        ProviderAddr   addrs.AbsProviderConfig
+        ProviderSchema **ProviderSchema
+        State          **states.ResourceInstanceObject
+        PreviousDiff   **plans.ResourceInstanceChange
+
+        // CreateBeforeDestroy is set if either the resource's own config sets
+        // create_before_destroy explicitly or if dependencies have forced the
+        // resource to be handled as create_before_destroy in order to avoid
+        // a dependency cycle.
+        CreateBeforeDestroy bool
+
+        OutputChange **plans.ResourceInstanceChange
+        OutputValue  *cty.Value
+        OutputState  **states.ResourceInstanceObject
+
         Stub bool
 }
 
@@ -95,81 +117,303 @@ func (n *EvalDiff) Eval(ctx EvalContext) (interface{}, error) {
         state := *n.State
         config := *n.Config
         provider := *n.Provider
+        providerSchema := *n.ProviderSchema
+
+        if providerSchema == nil {
+                return nil, fmt.Errorf("provider schema is unavailable for %s", n.Addr)
+        }
+        if n.ProviderAddr.ProviderConfig.Type == "" {
+                panic(fmt.Sprintf("EvalDiff for %s does not have ProviderAddr set", n.Addr.Absolute(ctx.Path())))
+        }
+
+        var diags tfdiags.Diagnostics
+
+        // Evaluate the configuration
+        schema, _ := providerSchema.SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support resource type %q", n.Addr.Resource.Type)
+        }
+        keyData := EvalDataForInstanceKey(n.Addr.Key)
+        configVal, _, configDiags := ctx.EvaluateBlock(config.Config, schema, nil, keyData)
+        diags = diags.Append(configDiags)
+        if configDiags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        absAddr := n.Addr.Absolute(ctx.Path())
+        var priorVal cty.Value
+        var priorValTainted cty.Value
+        var priorPrivate []byte
+        if state != nil {
+                if state.Status != states.ObjectTainted {
+                        priorVal = state.Value
+                        priorPrivate = state.Private
+                } else {
+                        // If the prior state is tainted then we'll proceed below like
+                        // we're creating an entirely new object, but then turn it into
+                        // a synthetic "Replace" change at the end, creating the same
+                        // result as if the provider had marked at least one argument
+                        // change as "requires replacement".
+                        priorValTainted = state.Value
+                        priorVal = cty.NullVal(schema.ImpliedType())
+                }
+        } else {
+                priorVal = cty.NullVal(schema.ImpliedType())
+        }
+
+        proposedNewVal := objchange.ProposedNewObject(schema, priorVal, configVal)
 
         // Call pre-diff hook
         if !n.Stub {
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PreDiff(n.Info, state)
+                        return h.PreDiff(absAddr, states.CurrentGen, priorVal, proposedNewVal)
                 })
                 if err != nil {
                         return nil, err
                 }
         }
 
-        // The state for the diff must never be nil
-        diffState := state
-        if diffState == nil {
-                diffState = new(InstanceState)
+        // The provider gets an opportunity to customize the proposed new value,
+        // which in turn produces the _planned_ new value.
+        resp := provider.PlanResourceChange(providers.PlanResourceChangeRequest{
+                TypeName:         n.Addr.Resource.Type,
+                Config:           configVal,
+                PriorState:       priorVal,
+                ProposedNewState: proposedNewVal,
+                PriorPrivate:     priorPrivate,
+        })
+        diags = diags.Append(resp.Diagnostics.InConfigBody(config.Config))
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        plannedNewVal := resp.PlannedState
+        plannedPrivate := resp.PlannedPrivate
+
+        if plannedNewVal == cty.NilVal {
+                // Should never happen. Since real-world providers return via RPC a nil
+                // is always a bug in the client-side stub. This is more likely caused
+                // by an incompletely-configured mock provider in tests, though.
+                panic(fmt.Sprintf("PlanResourceChange of %s produced nil value", absAddr.String()))
+        }
+
+        // We allow the planned new value to disagree with configuration _values_
+        // here, since that allows the provider to do special logic like a
+        // DiffSuppressFunc, but we still require that the provider produces
+        // a value whose type conforms to the schema.
+        for _, err := range plannedNewVal.Type().TestConformance(schema.ImpliedType()) {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced invalid plan",
+                        fmt.Sprintf(
+                                "Provider %q planned an invalid value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatErrorPrefixed(err, absAddr.String()),
+                        ),
+                ))
+        }
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        if errs := objchange.AssertPlanValid(schema, priorVal, configVal, plannedNewVal); len(errs) > 0 {
+                if resp.LegacyTypeSystem {
+                        // The shimming of the old type system in the legacy SDK is not precise
+                        // enough to pass this consistency check, so we'll give it a pass here,
+                        // but we will generate a warning about it so that we are more likely
+                        // to notice in the logs if an inconsistency beyond the type system
+                        // leads to a downstream provider failure.
+                        var buf strings.Builder
+                        fmt.Fprintf(&buf, "[WARN] Provider %q produced an invalid plan for %s, but we are tolerating it because it is using the legacy plugin SDK.\n    The following problems may be the cause of any confusing errors from downstream operations:", n.ProviderAddr.ProviderConfig.Type, absAddr)
+                        for _, err := range errs {
+                                fmt.Fprintf(&buf, "\n      - %s", tfdiags.FormatError(err))
+                        }
+                        log.Print(buf.String())
+                } else {
+                        for _, err := range errs {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Provider produced invalid plan",
+                                        fmt.Sprintf(
+                                                "Provider %q planned an invalid value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                                n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatErrorPrefixed(err, absAddr.String()),
+                                        ),
+                                ))
+                        }
+                        return nil, diags.Err()
+                }
         }
-        diffState.init()
 
-        // Diff!
-        diff, err := provider.Diff(n.Info, diffState, config)
-        if err != nil {
-                return nil, err
-        }
-        if diff == nil {
-                diff = new(InstanceDiff)
+        {
+                var moreDiags tfdiags.Diagnostics
+                plannedNewVal, moreDiags = n.processIgnoreChanges(priorVal, plannedNewVal)
+                diags = diags.Append(moreDiags)
+                if moreDiags.HasErrors() {
+                        return nil, diags.Err()
+                }
         }
 
-        // Set DestroyDeposed if we have deposed instances
-        _, err = readInstanceFromState(ctx, n.Name, nil, func(rs *ResourceState) (*InstanceState, error) {
-                if len(rs.Deposed) > 0 {
-                        diff.DestroyDeposed = true
-                }
+        // The provider produces a list of paths to attributes whose changes mean
+        // that we must replace rather than update an existing remote object.
+        // However, we only need to do that if the identified attributes _have_
+        // actually changed -- particularly after we may have undone some of the
+        // changes in processIgnoreChanges -- so now we'll filter that list to
+        // include only where changes are detected.
+        reqRep := cty.NewPathSet()
+        if len(resp.RequiresReplace) > 0 {
+                for _, path := range resp.RequiresReplace {
+                        if priorVal.IsNull() {
+                                // If prior is null then we don't expect any RequiresReplace at all,
+                                // because this is a Create action.
+                                continue
+                        }
 
-                return nil, nil
-        })
-        if err != nil {
-                return nil, err
-        }
+                        priorChangedVal, priorPathDiags := hcl.ApplyPath(priorVal, path, nil)
+                        plannedChangedVal, plannedPathDiags := hcl.ApplyPath(plannedNewVal, path, nil)
+                        if plannedPathDiags.HasErrors() && priorPathDiags.HasErrors() {
+                                // This means the path was invalid in both the prior and new
+                                // values, which is an error with the provider itself.
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Provider produced invalid plan",
+                                        fmt.Sprintf(
+                                                "Provider %q has indicated \"requires replacement\" on %s for a non-existent attribute path %#v.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                                n.ProviderAddr.ProviderConfig.Type, absAddr, path,
+                                        ),
+                                ))
+                                continue
+                        }
 
-        // Preserve the DestroyTainted flag
-        if n.Diff != nil {
-                diff.SetTainted((*n.Diff).GetDestroyTainted())
-        }
+                        // Make sure we have valid Values for both values.
+                        // Note: if the opposing value was of the type
+                        // cty.DynamicPseudoType, the type assigned here may not exactly
+                        // match the schema. This is fine here, since we're only going to
+                        // check for equality, but if the NullVal is to be used, we need to
+                        // check the schema for th true type.
+                        switch {
+                        case priorChangedVal == cty.NilVal && plannedChangedVal == cty.NilVal:
+                                // this should never happen without ApplyPath errors above
+                                panic("requires replace path returned 2 nil values")
+                        case priorChangedVal == cty.NilVal:
+                                priorChangedVal = cty.NullVal(plannedChangedVal.Type())
+                        case plannedChangedVal == cty.NilVal:
+                                plannedChangedVal = cty.NullVal(priorChangedVal.Type())
+                        }
 
-        // Require a destroy if there is an ID and it requires new.
-        if diff.RequiresNew() && state != nil && state.ID != "" {
-                diff.SetDestroy(true)
+                        eqV := plannedChangedVal.Equals(priorChangedVal)
+                        if !eqV.IsKnown() || eqV.False() {
+                                reqRep.Add(path)
+                        }
+                }
+                if diags.HasErrors() {
+                        return nil, diags.Err()
+                }
         }
 
-        // If we're creating a new resource, compute its ID
-        if diff.RequiresNew() || state == nil || state.ID == "" {
-                var oldID string
-                if state != nil {
-                        oldID = state.Attributes["id"]
+        eqV := plannedNewVal.Equals(priorVal)
+        eq := eqV.IsKnown() && eqV.True()
+
+        var action plans.Action
+        switch {
+        case priorVal.IsNull():
+                action = plans.Create
+        case eq:
+                action = plans.NoOp
+        case !reqRep.Empty():
+                // If there are any "requires replace" paths left _after our filtering
+                // above_ then this is a replace action.
+                if n.CreateBeforeDestroy {
+                        action = plans.CreateThenDelete
+                } else {
+                        action = plans.DeleteThenCreate
                 }
-
-                // Add diff to compute new ID
-                diff.init()
-                diff.SetAttribute("id", &ResourceAttrDiff{
-                        Old:         oldID,
-                        NewComputed: true,
-                        RequiresNew: true,
-                        Type:        DiffAttrOutput,
+        default:
+                action = plans.Update
+                // "Delete" is never chosen here, because deletion plans are always
+                // created more directly elsewhere, such as in "orphan" handling.
+        }
+
+        if action.IsReplace() {
+                // In this strange situation we want to produce a change object that
+                // shows our real prior object but has a _new_ object that is built
+                // from a null prior object, since we're going to delete the one
+                // that has all the computed values on it.
+                //
+                // Therefore we'll ask the provider to plan again here, giving it
+                // a null object for the prior, and then we'll meld that with the
+                // _actual_ prior state to produce a correctly-shaped replace change.
+                // The resulting change should show any computed attributes changing
+                // from known prior values to unknown values, unless the provider is
+                // able to predict new values for any of these computed attributes.
+                nullPriorVal := cty.NullVal(schema.ImpliedType())
+
+                // create a new proposed value from the null state and the config
+                proposedNewVal = objchange.ProposedNewObject(schema, nullPriorVal, configVal)
+
+                resp = provider.PlanResourceChange(providers.PlanResourceChangeRequest{
+                        TypeName:         n.Addr.Resource.Type,
+                        Config:           configVal,
+                        PriorState:       nullPriorVal,
+                        ProposedNewState: proposedNewVal,
+                        PriorPrivate:     plannedPrivate,
                 })
+                // We need to tread carefully here, since if there are any warnings
+                // in here they probably also came out of our previous call to
+                // PlanResourceChange above, and so we don't want to repeat them.
+                // Consequently, we break from the usual pattern here and only
+                // append these new diagnostics if there's at least one error inside.
+                if resp.Diagnostics.HasErrors() {
+                        diags = diags.Append(resp.Diagnostics.InConfigBody(config.Config))
+                        return nil, diags.Err()
+                }
+                plannedNewVal = resp.PlannedState
+                plannedPrivate = resp.PlannedPrivate
+                for _, err := range plannedNewVal.Type().TestConformance(schema.ImpliedType()) {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Provider produced invalid plan",
+                                fmt.Sprintf(
+                                        "Provider %q planned an invalid value for %s%s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                        n.ProviderAddr.ProviderConfig.Type, absAddr, tfdiags.FormatError(err),
+                                ),
+                        ))
+                }
+                if diags.HasErrors() {
+                        return nil, diags.Err()
+                }
         }
 
-        // filter out ignored resources
-        if err := n.processIgnoreChanges(diff); err != nil {
-                return nil, err
+        // If our prior value was tainted then we actually want this to appear
+        // as a replace change, even though so far we've been treating it as a
+        // create.
+        if action == plans.Create && priorValTainted != cty.NilVal {
+                if n.CreateBeforeDestroy {
+                        action = plans.CreateThenDelete
+                } else {
+                        action = plans.DeleteThenCreate
+                }
+                priorVal = priorValTainted
+        }
+
+        // As a special case, if we have a previous diff (presumably from the plan
+        // phases, whereas we're now in the apply phase) and it was for a replace,
+        // we've already deleted the original object from state by the time we
+        // get here and so we would've ended up with a _create_ action this time,
+        // which we now need to paper over to get a result consistent with what
+        // we originally intended.
+        if n.PreviousDiff != nil {
+                prevChange := *n.PreviousDiff
+                if prevChange.Action.IsReplace() && action == plans.Create {
+                        log.Printf("[TRACE] EvalDiff: %s treating Create change as %s change to match with earlier plan", absAddr, prevChange.Action)
+                        action = prevChange.Action
+                        priorVal = prevChange.Before
+                }
         }
 
         // Call post-refresh hook
         if !n.Stub {
-                err = ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PostDiff(n.Info, diff)
+                err := ctx.Hook(func(h Hook) (HookAction, error) {
+                        return h.PostDiff(absAddr, states.CurrentGen, action, priorVal, plannedNewVal)
                 })
                 if err != nil {
                         return nil, err
@@ -177,30 +421,135 @@ func (n *EvalDiff) Eval(ctx EvalContext) (interface{}, error) {
         }
 
         // Update our output if we care
-        if n.OutputDiff != nil {
-                *n.OutputDiff = diff
+        if n.OutputChange != nil {
+                *n.OutputChange = &plans.ResourceInstanceChange{
+                        Addr:         absAddr,
+                        Private:      plannedPrivate,
+                        ProviderAddr: n.ProviderAddr,
+                        Change: plans.Change{
+                                Action: action,
+                                Before: priorVal,
+                                After:  plannedNewVal,
+                        },
+                        RequiredReplace: reqRep,
+                }
+        }
+
+        if n.OutputValue != nil {
+                *n.OutputValue = configVal
         }
 
         // Update the state if we care
         if n.OutputState != nil {
-                *n.OutputState = state
-
-                // Merge our state so that the state is updated with our plan
-                if !diff.Empty() && n.OutputState != nil {
-                        *n.OutputState = state.MergeDiff(diff)
+                *n.OutputState = &states.ResourceInstanceObject{
+                        // We use the special "planned" status here to note that this
+                        // object's value is not yet complete. Objects with this status
+                        // cannot be used during expression evaluation, so the caller
+                        // must _also_ record the returned change in the active plan,
+                        // which the expression evaluator will use in preference to this
+                        // incomplete value recorded in the state.
+                        Status: states.ObjectPlanned,
+                        Value:  plannedNewVal,
                 }
         }
 
         return nil, nil
 }
 
-func (n *EvalDiff) processIgnoreChanges(diff *InstanceDiff) error {
-        if diff == nil || n.Resource == nil || n.Resource.Id() == "" {
+func (n *EvalDiff) processIgnoreChanges(prior, proposed cty.Value) (cty.Value, tfdiags.Diagnostics) {
+        // ignore_changes only applies when an object already exists, since we
+        // can't ignore changes to a thing we've not created yet.
+        if prior.IsNull() {
+                return proposed, nil
+        }
+
+        ignoreChanges := n.Config.Managed.IgnoreChanges
+        ignoreAll := n.Config.Managed.IgnoreAllChanges
+
+        if len(ignoreChanges) == 0 && !ignoreAll {
+                return proposed, nil
+        }
+        if ignoreAll {
+                return prior, nil
+        }
+        if prior.IsNull() || proposed.IsNull() {
+                // Ignore changes doesn't apply when we're creating for the first time.
+                // Proposed should never be null here, but if it is then we'll just let it be.
+                return proposed, nil
+        }
+
+        return processIgnoreChangesIndividual(prior, proposed, ignoreChanges)
+}
+
+func processIgnoreChangesIndividual(prior, proposed cty.Value, ignoreChanges []hcl.Traversal) (cty.Value, tfdiags.Diagnostics) {
+        // When we walk below we will be using cty.Path values for comparison, so
+        // we'll convert our traversals here so we can compare more easily.
+        ignoreChangesPath := make([]cty.Path, len(ignoreChanges))
+        for i, traversal := range ignoreChanges {
+                path := make(cty.Path, len(traversal))
+                for si, step := range traversal {
+                        switch ts := step.(type) {
+                        case hcl.TraverseRoot:
+                                path[si] = cty.GetAttrStep{
+                                        Name: ts.Name,
+                                }
+                        case hcl.TraverseAttr:
+                                path[si] = cty.GetAttrStep{
+                                        Name: ts.Name,
+                                }
+                        case hcl.TraverseIndex:
+                                path[si] = cty.IndexStep{
+                                        Key: ts.Key,
+                                }
+                        default:
+                                panic(fmt.Sprintf("unsupported traversal step %#v", step))
+                        }
+                }
+                ignoreChangesPath[i] = path
+        }
+
+        var diags tfdiags.Diagnostics
+        ret, _ := cty.Transform(proposed, func(path cty.Path, v cty.Value) (cty.Value, error) {
+                // First we must see if this is a path that's being ignored at all.
+                // We're looking for an exact match here because this walk will visit
+                // leaf values first and then their containers, and we want to do
+                // the "ignore" transform once we reach the point indicated, throwing
+                // away any deeper values we already produced at that point.
+                var ignoreTraversal hcl.Traversal
+                for i, candidate := range ignoreChangesPath {
+                        if reflect.DeepEqual(path, candidate) {
+                                ignoreTraversal = ignoreChanges[i]
+                        }
+                }
+                if ignoreTraversal == nil {
+                        return v, nil
+                }
+
+                // If we're able to follow the same path through the prior value,
+                // we'll take the value there instead, effectively undoing the
+                // change that was planned.
+                priorV, diags := hcl.ApplyPath(prior, path, nil)
+                if diags.HasErrors() {
+                        // We just ignore the errors and move on here, since we assume it's
+                        // just because the prior value was a slightly-different shape.
+                        // It could potentially also be that the traversal doesn't match
+                        // the schema, but we should've caught that during the validate
+                        // walk if so.
+                        return v, nil
+                }
+                return priorV, nil
+        })
+        return ret, diags
+}
+
+func (n *EvalDiff) processIgnoreChangesOld(diff *InstanceDiff) error {
+        if diff == nil || n.Config == nil || n.Config.Managed == nil {
                 return nil
         }
-        ignoreChanges := n.Resource.Lifecycle.IgnoreChanges
+        ignoreChanges := n.Config.Managed.IgnoreChanges
+        ignoreAll := n.Config.Managed.IgnoreAllChanges
 
-        if len(ignoreChanges) == 0 {
+        if len(ignoreChanges) == 0 && !ignoreAll {
                 return nil
         }
 
@@ -220,9 +569,14 @@ func (n *EvalDiff) processIgnoreChanges(diff *InstanceDiff) error {
 
         // get the complete set of keys we want to ignore
         ignorableAttrKeys := make(map[string]bool)
-        for _, ignoredKey := range ignoreChanges {
-                for k := range attrs {
-                        if ignoredKey == "*" || strings.HasPrefix(k, ignoredKey) {
+        for k := range attrs {
+                if ignoreAll {
+                        ignorableAttrKeys[k] = true
+                        continue
+                }
+                for _, ignoredTraversal := range ignoreChanges {
+                        ignoredKey := legacyFlatmapKeyForTraversal(ignoredTraversal)
+                        if k == ignoredKey || strings.HasPrefix(k, ignoredKey+".") {
                                 ignorableAttrKeys[k] = true
                         }
                 }
@@ -285,14 +639,56 @@ func (n *EvalDiff) processIgnoreChanges(diff *InstanceDiff) error {
 
         // If we didn't hit any of our early exit conditions, we can filter the diff.
         for k := range ignorableAttrKeys {
-                log.Printf("[DEBUG] [EvalIgnoreChanges] %s - Ignoring diff attribute: %s",
-                        n.Resource.Id(), k)
+                log.Printf("[DEBUG] [EvalIgnoreChanges] %s: Ignoring diff attribute: %s", n.Addr.String(), k)
                 diff.DelAttribute(k)
         }
 
         return nil
 }
 
+// legacyFlagmapKeyForTraversal constructs a key string compatible with what
+// the flatmap package would generate for an attribute addressable by the given
+// traversal.
+//
+// This is used only to shim references to attributes within the diff and
+// state structures, which have not (at the time of writing) yet been updated
+// to use the newer HCL-based representations.
+func legacyFlatmapKeyForTraversal(traversal hcl.Traversal) string {
+        var buf bytes.Buffer
+        first := true
+        for _, step := range traversal {
+                if !first {
+                        buf.WriteByte('.')
+                }
+                switch ts := step.(type) {
+                case hcl.TraverseRoot:
+                        buf.WriteString(ts.Name)
+                case hcl.TraverseAttr:
+                        buf.WriteString(ts.Name)
+                case hcl.TraverseIndex:
+                        val := ts.Key
+                        switch val.Type() {
+                        case cty.Number:
+                                bf := val.AsBigFloat()
+                                buf.WriteString(bf.String())
+                        case cty.String:
+                                s := val.AsString()
+                                buf.WriteString(s)
+                        default:
+                                // should never happen, since no other types appear in
+                                // traversals in practice.
+                                buf.WriteByte('?')
+                        }
+                default:
+                        // should never happen, since we've covered all of the types
+                        // that show up in parsed traversals in practice.
+                        buf.WriteByte('?')
+                }
+                first = false
+        }
+        return buf.String()
+}
+
 // a group of key-*ResourceAttrDiff pairs from the same flatmapped container
 type flatAttrDiff map[string]*ResourceAttrDiff
 
@@ -343,159 +739,213 @@ func groupContainers(d *InstanceDiff) map[string]flatAttrDiff {
 // EvalDiffDestroy is an EvalNode implementation that returns a plain
 // destroy diff.
 type EvalDiffDestroy struct {
-        Info   *InstanceInfo
-        State  **InstanceState
-        Output **InstanceDiff
+        Addr         addrs.ResourceInstance
+        DeposedKey   states.DeposedKey
+        State        **states.ResourceInstanceObject
+        ProviderAddr addrs.AbsProviderConfig
+
+        Output      **plans.ResourceInstanceChange
+        OutputState **states.ResourceInstanceObject
 }
 
 // TODO: test
 func (n *EvalDiffDestroy) Eval(ctx EvalContext) (interface{}, error) {
+        absAddr := n.Addr.Absolute(ctx.Path())
         state := *n.State
 
-        // If there is no state or we don't have an ID, we're already destroyed
-        if state == nil || state.ID == "" {
+        if n.ProviderAddr.ProviderConfig.Type == "" {
+                if n.DeposedKey == "" {
+                        panic(fmt.Sprintf("EvalDiffDestroy for %s does not have ProviderAddr set", absAddr))
+                } else {
+                        panic(fmt.Sprintf("EvalDiffDestroy for %s (deposed %s) does not have ProviderAddr set", absAddr, n.DeposedKey))
+                }
+        }
+
+        // If there is no state or our attributes object is null then we're already
+        // destroyed.
+        if state == nil || state.Value.IsNull() {
                 return nil, nil
         }
 
         // Call pre-diff hook
         err := ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PreDiff(n.Info, state)
+                return h.PreDiff(
+                        absAddr, n.DeposedKey.Generation(),
+                        state.Value,
+                        cty.NullVal(cty.DynamicPseudoType),
+                )
         })
         if err != nil {
                 return nil, err
         }
 
-        // The diff
-        diff := &InstanceDiff{Destroy: true}
+        // Change is always the same for a destroy. We don't need the provider's
+        // help for this one.
+        // TODO: Should we give the provider an opportunity to veto this?
+        change := &plans.ResourceInstanceChange{
+                Addr:       absAddr,
+                DeposedKey: n.DeposedKey,
+                Change: plans.Change{
+                        Action: plans.Delete,
+                        Before: state.Value,
+                        After:  cty.NullVal(cty.DynamicPseudoType),
+                },
+                ProviderAddr: n.ProviderAddr,
+        }
 
         // Call post-diff hook
         err = ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PostDiff(n.Info, diff)
+                return h.PostDiff(
+                        absAddr,
+                        n.DeposedKey.Generation(),
+                        change.Action,
+                        change.Before,
+                        change.After,
+                )
         })
         if err != nil {
                 return nil, err
         }
 
         // Update our output
-        *n.Output = diff
-
-        return nil, nil
-}
-
-// EvalDiffDestroyModule is an EvalNode implementation that writes the diff to
-// the full diff.
-type EvalDiffDestroyModule struct {
-        Path []string
-}
-
-// TODO: test
-func (n *EvalDiffDestroyModule) Eval(ctx EvalContext) (interface{}, error) {
-        diff, lock := ctx.Diff()
-
-        // Acquire the lock so that we can do this safely concurrently
-        lock.Lock()
-        defer lock.Unlock()
+        *n.Output = change
 
-        // Write the diff
-        modDiff := diff.ModuleByPath(n.Path)
-        if modDiff == nil {
-                modDiff = diff.AddModule(n.Path)
+        if n.OutputState != nil {
+                // Record our proposed new state, which is nil because we're destroying.
+                *n.OutputState = nil
         }
-        modDiff.Destroy = true
 
         return nil, nil
 }
 
-// EvalFilterDiff is an EvalNode implementation that filters the diff
-// according to some filter.
-type EvalFilterDiff struct {
-        // Input and output
-        Diff   **InstanceDiff
-        Output **InstanceDiff
-
-        // Destroy, if true, will only include a destroy diff if it is set.
-        Destroy bool
+// EvalReduceDiff is an EvalNode implementation that takes a planned resource
+// instance change as might be produced by EvalDiff or EvalDiffDestroy and
+// "simplifies" it to a single atomic action to be performed by a specific
+// graph node.
+//
+// Callers must specify whether they are a destroy node or a regular apply
+// node.  If the result is NoOp then the given change requires no action for
+// the specific graph node calling this and so evaluation of the that graph
+// node should exit early and take no action.
+//
+// The object written to OutChange may either be identical to InChange or
+// a new change object derived from InChange. Because of the former case, the
+// caller must not mutate the object returned in OutChange.
+type EvalReduceDiff struct {
+        Addr      addrs.ResourceInstance
+        InChange  **plans.ResourceInstanceChange
+        Destroy   bool
+        OutChange **plans.ResourceInstanceChange
 }
 
-func (n *EvalFilterDiff) Eval(ctx EvalContext) (interface{}, error) {
-        if *n.Diff == nil {
-                return nil, nil
-        }
-
-        input := *n.Diff
-        result := new(InstanceDiff)
-
-        if n.Destroy {
-                if input.GetDestroy() || input.RequiresNew() {
-                        result.SetDestroy(true)
+// TODO: test
+func (n *EvalReduceDiff) Eval(ctx EvalContext) (interface{}, error) {
+        in := *n.InChange
+        out := in.Simplify(n.Destroy)
+        if n.OutChange != nil {
+                *n.OutChange = out
+        }
+        if out.Action != in.Action {
+                if n.Destroy {
+                        log.Printf("[TRACE] EvalReduceDiff: %s change simplified from %s to %s for destroy node", n.Addr, in.Action, out.Action)
+                } else {
+                        log.Printf("[TRACE] EvalReduceDiff: %s change simplified from %s to %s for apply node", n.Addr, in.Action, out.Action)
                 }
         }
-
-        if n.Output != nil {
-                *n.Output = result
-        }
-
         return nil, nil
 }
 
-// EvalReadDiff is an EvalNode implementation that writes the diff to
-// the full diff.
+// EvalReadDiff is an EvalNode implementation that retrieves the planned
+// change for a particular resource instance object.
 type EvalReadDiff struct {
-        Name string
-        Diff **InstanceDiff
+        Addr           addrs.ResourceInstance
+        DeposedKey     states.DeposedKey
+        ProviderSchema **ProviderSchema
+        Change         **plans.ResourceInstanceChange
 }
 
 func (n *EvalReadDiff) Eval(ctx EvalContext) (interface{}, error) {
-        diff, lock := ctx.Diff()
+        providerSchema := *n.ProviderSchema
+        changes := ctx.Changes()
+        addr := n.Addr.Absolute(ctx.Path())
 
-        // Acquire the lock so that we can do this safely concurrently
-        lock.Lock()
-        defer lock.Unlock()
+        schema, _ := providerSchema.SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support resource type %q", n.Addr.Resource.Type)
+        }
 
-        // Write the diff
-        modDiff := diff.ModuleByPath(ctx.Path())
-        if modDiff == nil {
+        gen := states.CurrentGen
+        if n.DeposedKey != states.NotDeposed {
+                gen = n.DeposedKey
+        }
+        csrc := changes.GetResourceInstanceChange(addr, gen)
+        if csrc == nil {
+                log.Printf("[TRACE] EvalReadDiff: No planned change recorded for %s", addr)
                 return nil, nil
         }
 
-        *n.Diff = modDiff.Resources[n.Name]
+        change, err := csrc.Decode(schema.ImpliedType())
+        if err != nil {
+                return nil, fmt.Errorf("failed to decode planned changes for %s: %s", addr, err)
+        }
+        if n.Change != nil {
+                *n.Change = change
+        }
+
+        log.Printf("[TRACE] EvalReadDiff: Read %s change from plan for %s", change.Action, addr)
 
         return nil, nil
 }
 
-// EvalWriteDiff is an EvalNode implementation that writes the diff to
-// the full diff.
+// EvalWriteDiff is an EvalNode implementation that saves a planned change
+// for an instance object into the set of global planned changes.
 type EvalWriteDiff struct {
-        Name string
-        Diff **InstanceDiff
+        Addr           addrs.ResourceInstance
+        DeposedKey     states.DeposedKey
+        ProviderSchema **ProviderSchema
+        Change         **plans.ResourceInstanceChange
 }
 
 // TODO: test
 func (n *EvalWriteDiff) Eval(ctx EvalContext) (interface{}, error) {
-        diff, lock := ctx.Diff()
-
-        // The diff to write, if its empty it should write nil
-        var diffVal *InstanceDiff
-        if n.Diff != nil {
-                diffVal = *n.Diff
+        changes := ctx.Changes()
+        addr := n.Addr.Absolute(ctx.Path())
+        if n.Change == nil || *n.Change == nil {
+                // Caller sets nil to indicate that we need to remove a change from
+                // the set of changes.
+                gen := states.CurrentGen
+                if n.DeposedKey != states.NotDeposed {
+                        gen = n.DeposedKey
+                }
+                changes.RemoveResourceInstanceChange(addr, gen)
+                return nil, nil
         }
-        if diffVal.Empty() {
-                diffVal = nil
+
+        providerSchema := *n.ProviderSchema
+        change := *n.Change
+
+        if change.Addr.String() != addr.String() || change.DeposedKey != n.DeposedKey {
+                // Should never happen, and indicates a bug in the caller.
+                panic("inconsistent address and/or deposed key in EvalWriteDiff")
         }
 
-        // Acquire the lock so that we can do this safely concurrently
-        lock.Lock()
-        defer lock.Unlock()
+        schema, _ := providerSchema.SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support resource type %q", n.Addr.Resource.Type)
+        }
 
-        // Write the diff
-        modDiff := diff.ModuleByPath(ctx.Path())
-        if modDiff == nil {
-                modDiff = diff.AddModule(ctx.Path())
+        csrc, err := change.Encode(schema.ImpliedType())
+        if err != nil {
+                return nil, fmt.Errorf("failed to encode planned changes for %s: %s", addr, err)
         }
-        if diffVal != nil {
-                modDiff.Resources[n.Name] = diffVal
+
+        changes.AppendResourceInstanceChange(csrc)
+        if n.DeposedKey == states.NotDeposed {
+                log.Printf("[TRACE] EvalWriteDiff: recorded %s change for %s", change.Action, addr)
         } else {
-                delete(modDiff.Resources, n.Name)
+                log.Printf("[TRACE] EvalWriteDiff: recorded %s change for %s deposed object %s", change.Action, addr, n.DeposedKey)
         }
 
         return nil, nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_import_state.go b/vendor/github.com/hashicorp/terraform/terraform/eval_import_state.go
index 62cc581..a60f4a0 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_import_state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_import_state.go
@@ -2,47 +2,63 @@ package terraform
 
 import (
         "fmt"
+        "log"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalImportState is an EvalNode implementation that performs an
 // ImportState operation on a provider. This will return the imported
 // states but won't modify any actual state.
 type EvalImportState struct {
-        Provider *ResourceProvider
-        Info     *InstanceInfo
-        Id       string
-        Output   *[]*InstanceState
+        Addr     addrs.ResourceInstance
+        Provider *providers.Interface
+        ID       string
+        Output   *[]providers.ImportedResource
 }
 
 // TODO: test
 func (n *EvalImportState) Eval(ctx EvalContext) (interface{}, error) {
+        absAddr := n.Addr.Absolute(ctx.Path())
         provider := *n.Provider
+        var diags tfdiags.Diagnostics
 
         {
                 // Call pre-import hook
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PreImportState(n.Info, n.Id)
+                        return h.PreImportState(absAddr, n.ID)
                 })
                 if err != nil {
                         return nil, err
                 }
         }
 
-        // Import!
-        state, err := provider.ImportState(n.Info, n.Id)
-        if err != nil {
-                return nil, fmt.Errorf(
-                        "import %s (id: %s): %s", n.Info.HumanId(), n.Id, err)
+        resp := provider.ImportResourceState(providers.ImportResourceStateRequest{
+                TypeName: n.Addr.Resource.Type,
+                ID:       n.ID,
+        })
+        diags = diags.Append(resp.Diagnostics)
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        imported := resp.ImportedResources
+
+        for _, obj := range imported {
+                log.Printf("[TRACE] EvalImportState: import %s %q produced instance object of type %s", absAddr.String(), n.ID, obj.TypeName)
         }
 
         if n.Output != nil {
-                *n.Output = state
+                *n.Output = imported
         }
 
         {
                 // Call post-import hook
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PostImportState(n.Info, state)
+                        return h.PostImportState(absAddr, imported)
                 })
                 if err != nil {
                         return nil, err
@@ -55,22 +71,25 @@ func (n *EvalImportState) Eval(ctx EvalContext) (interface{}, error) {
 // EvalImportStateVerify verifies the state after ImportState and
 // after the refresh to make sure it is non-nil and valid.
 type EvalImportStateVerify struct {
-        Info  *InstanceInfo
-        Id    string
-        State **InstanceState
+        Addr  addrs.ResourceInstance
+        State **states.ResourceInstanceObject
 }
 
 // TODO: test
 func (n *EvalImportStateVerify) Eval(ctx EvalContext) (interface{}, error) {
+        var diags tfdiags.Diagnostics
+
         state := *n.State
-        if state.Empty() {
-                return nil, fmt.Errorf(
-                        "import %s (id: %s): Terraform detected a resource with this ID doesn't\n"+
-                                "exist. Please verify the ID is correct. You cannot import non-existent\n"+
-                                "resources using Terraform import.",
-                        n.Info.HumanId(),
-                        n.Id)
+        if state.Value.IsNull() {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Cannot import non-existent remote object",
+                        fmt.Sprintf(
+                                "While attempting to import an existing object to %s, the provider detected that no object exists with the given id. Only pre-existing objects can be imported; check that the id is correct and that it is associated with the provider's configured region or endpoint, or use \"terraform apply\" to create a new remote object for this resource.",
+                                n.Addr.String(),
+                        ),
+                ))
         }
 
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_interpolate.go b/vendor/github.com/hashicorp/terraform/terraform/eval_interpolate.go
deleted file mode 100644
index 6a78a6b..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_interpolate.go
+++ /dev/null
@@ -1,56 +0,0 @@
-package terraform
-
-import (
-        "log"
-
-        "github.com/hashicorp/terraform/config"
-)
-
-// EvalInterpolate is an EvalNode implementation that takes a raw
-// configuration and interpolates it.
-type EvalInterpolate struct {
-        Config        *config.RawConfig
-        Resource      *Resource
-        Output        **ResourceConfig
-        ContinueOnErr bool
-}
-
-func (n *EvalInterpolate) Eval(ctx EvalContext) (interface{}, error) {
-        rc, err := ctx.Interpolate(n.Config, n.Resource)
-        if err != nil {
-                if n.ContinueOnErr {
-                        log.Printf("[WARN] Interpolation %q failed: %s", n.Config.Key, err)
-                        return nil, EvalEarlyExitError{}
-                }
-                return nil, err
-        }
-
-        if n.Output != nil {
-                *n.Output = rc
-        }
-
-        return nil, nil
-}
-
-// EvalInterpolateProvider is an EvalNode implementation that takes a
-// ProviderConfig and interpolates it. Provider configurations are the only
-// "inherited" type of configuration we have, and the original raw config may
-// have a different interpolation scope.
-type EvalInterpolateProvider struct {
-        Config   *config.ProviderConfig
-        Resource *Resource
-        Output   **ResourceConfig
-}
-
-func (n *EvalInterpolateProvider) Eval(ctx EvalContext) (interface{}, error) {
-        rc, err := ctx.InterpolateProvider(n.Config, n.Resource)
-        if err != nil {
-                return nil, err
-        }
-
-        if n.Output != nil {
-                *n.Output = rc
-        }
-
-        return nil, nil
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_lang.go b/vendor/github.com/hashicorp/terraform/terraform/eval_lang.go
new file mode 100644
index 0000000..0c051f7
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_lang.go
@@ -0,0 +1,61 @@
+package terraform
+
+import (
+        "log"
+
+        "github.com/hashicorp/terraform/addrs"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// EvalConfigBlock is an EvalNode implementation that takes a raw
+// configuration block and evaluates any expressions within it.
+//
+// ExpandedConfig is populated with the result of expanding any "dynamic"
+// blocks in the given body, which can be useful for extracting correct source
+// location information for specific attributes in the result.
+type EvalConfigBlock struct {
+        Config         *hcl.Body
+        Schema         *configschema.Block
+        SelfAddr       addrs.Referenceable
+        Output         *cty.Value
+        ExpandedConfig *hcl.Body
+        ContinueOnErr  bool
+}
+
+func (n *EvalConfigBlock) Eval(ctx EvalContext) (interface{}, error) {
+        val, body, diags := ctx.EvaluateBlock(*n.Config, n.Schema, n.SelfAddr, EvalDataForNoInstanceKey)
+        if diags.HasErrors() && n.ContinueOnErr {
+                log.Printf("[WARN] Block evaluation failed: %s", diags.Err())
+                return nil, EvalEarlyExitError{}
+        }
+
+        if n.Output != nil {
+                *n.Output = val
+        }
+        if n.ExpandedConfig != nil {
+                *n.ExpandedConfig = body
+        }
+
+        return nil, diags.ErrWithWarnings()
+}
+
+// EvalConfigExpr is an EvalNode implementation that takes a raw configuration
+// expression and evaluates it.
+type EvalConfigExpr struct {
+        Expr     hcl.Expression
+        SelfAddr addrs.Referenceable
+        Output   *cty.Value
+}
+
+func (n *EvalConfigExpr) Eval(ctx EvalContext) (interface{}, error) {
+        val, diags := ctx.EvaluateExpr(n.Expr, cty.DynamicPseudoType, n.SelfAddr)
+
+        if n.Output != nil {
+                *n.Output = val
+        }
+
+        return nil, diags.ErrWithWarnings()
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_local.go b/vendor/github.com/hashicorp/terraform/terraform/eval_local.go
index a4b2a50..bad9ac5 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_local.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_local.go
@@ -3,56 +3,55 @@ package terraform
 import (
         "fmt"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalLocal is an EvalNode implementation that evaluates the
 // expression for a local value and writes it into a transient part of
 // the state.
 type EvalLocal struct {
-        Name  string
-        Value *config.RawConfig
+        Addr addrs.LocalValue
+        Expr hcl.Expression
 }
 
 func (n *EvalLocal) Eval(ctx EvalContext) (interface{}, error) {
-        cfg, err := ctx.Interpolate(n.Value, nil)
-        if err != nil {
-                return nil, fmt.Errorf("local.%s: %s", n.Name, err)
+        var diags tfdiags.Diagnostics
+
+        // We ignore diags here because any problems we might find will be found
+        // again in EvaluateExpr below.
+        refs, _ := lang.ReferencesInExpr(n.Expr)
+        for _, ref := range refs {
+                if ref.Subject == n.Addr {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Self-referencing local value",
+                                Detail:   fmt.Sprintf("Local value %s cannot use its own result as part of its expression.", n.Addr),
+                                Subject:  ref.SourceRange.ToHCL().Ptr(),
+                                Context:  n.Expr.Range().Ptr(),
+                        })
+                }
         }
-
-        state, lock := ctx.State()
-        if state == nil {
-                return nil, fmt.Errorf("cannot write local value to nil state")
+        if diags.HasErrors() {
+                return nil, diags.Err()
         }
 
-        // Get a write lock so we can access the state
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Look for the module state. If we don't have one, create it.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                mod = state.AddModule(ctx.Path())
+        val, moreDiags := ctx.EvaluateExpr(n.Expr, cty.DynamicPseudoType, nil)
+        diags = diags.Append(moreDiags)
+        if moreDiags.HasErrors() {
+                return nil, diags.Err()
         }
 
-        // Get the value from the config
-        var valueRaw interface{} = config.UnknownVariableValue
-        if cfg != nil {
-                var ok bool
-                valueRaw, ok = cfg.Get("value")
-                if !ok {
-                        valueRaw = ""
-                }
-                if cfg.IsComputed("value") {
-                        valueRaw = config.UnknownVariableValue
-                }
+        state := ctx.State()
+        if state == nil {
+                return nil, fmt.Errorf("cannot write local value to nil state")
         }
 
-        if mod.Locals == nil {
-                // initialize
-                mod.Locals = map[string]interface{}{}
-        }
-        mod.Locals[n.Name] = valueRaw
+        state.SetLocalValue(n.Addr.Absolute(ctx.Path()), val)
 
         return nil, nil
 }
@@ -61,26 +60,15 @@ func (n *EvalLocal) Eval(ctx EvalContext) (interface{}, error) {
 // from the state. Locals aren't persisted, but we don't need to evaluate them
 // during destroy.
 type EvalDeleteLocal struct {
-        Name string
+        Addr addrs.LocalValue
 }
 
 func (n *EvalDeleteLocal) Eval(ctx EvalContext) (interface{}, error) {
-        state, lock := ctx.State()
+        state := ctx.State()
         if state == nil {
                 return nil, nil
         }
 
-        // Get a write lock so we can access this instance
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Look for the module state. If we don't have one, create it.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                return nil, nil
-        }
-
-        delete(mod.Locals, n.Name)
-
+        state.RemoveLocalValue(n.Addr.Absolute(ctx.Path()))
         return nil, nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_output.go b/vendor/github.com/hashicorp/terraform/terraform/eval_output.go
index a834627..1057397 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_output.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_output.go
@@ -4,131 +4,132 @@ import (
         "fmt"
         "log"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/states"
 )
 
 // EvalDeleteOutput is an EvalNode implementation that deletes an output
 // from the state.
 type EvalDeleteOutput struct {
-        Name string
+        Addr addrs.OutputValue
 }
 
 // TODO: test
 func (n *EvalDeleteOutput) Eval(ctx EvalContext) (interface{}, error) {
-        state, lock := ctx.State()
+        state := ctx.State()
         if state == nil {
                 return nil, nil
         }
 
-        // Get a write lock so we can access this instance
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Look for the module state. If we don't have one, create it.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                return nil, nil
-        }
-
-        delete(mod.Outputs, n.Name)
-
+        state.RemoveOutputValue(n.Addr.Absolute(ctx.Path()))
         return nil, nil
 }
 
 // EvalWriteOutput is an EvalNode implementation that writes the output
 // for the given name to the current state.
 type EvalWriteOutput struct {
-        Name      string
+        Addr      addrs.OutputValue
         Sensitive bool
-        Value     *config.RawConfig
+        Expr      hcl.Expression
         // ContinueOnErr allows interpolation to fail during Input
         ContinueOnErr bool
 }
 
 // TODO: test
 func (n *EvalWriteOutput) Eval(ctx EvalContext) (interface{}, error) {
-        // This has to run before we have a state lock, since interpolation also
+        addr := n.Addr.Absolute(ctx.Path())
+
+        // This has to run before we have a state lock, since evaluation also
         // reads the state
-        cfg, err := ctx.Interpolate(n.Value, nil)
-        // handle the error after we have the module from the state
+        val, diags := ctx.EvaluateExpr(n.Expr, cty.DynamicPseudoType, nil)
+        // We'll handle errors below, after we have loaded the module.
 
-        state, lock := ctx.State()
+        state := ctx.State()
         if state == nil {
-                return nil, fmt.Errorf("cannot write state to nil state")
+                return nil, nil
         }
 
-        // Get a write lock so we can access this instance
-        lock.Lock()
-        defer lock.Unlock()
-        // Look for the module state. If we don't have one, create it.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                mod = state.AddModule(ctx.Path())
-        }
+        changes := ctx.Changes() // may be nil, if we're not working on a changeset
 
         // handling the interpolation error
-        if err != nil {
+        if diags.HasErrors() {
                 if n.ContinueOnErr || flagWarnOutputErrors {
-                        log.Printf("[ERROR] Output interpolation %q failed: %s", n.Name, err)
+                        log.Printf("[ERROR] Output interpolation %q failed: %s", n.Addr.Name, diags.Err())
                         // if we're continuing, make sure the output is included, and
-                        // marked as unknown
-                        mod.Outputs[n.Name] = &OutputState{
-                                Type:  "string",
-                                Value: config.UnknownVariableValue,
-                        }
+                        // marked as unknown. If the evaluator was able to find a type
+                        // for the value in spite of the error then we'll use it.
+                        n.setValue(addr, state, changes, cty.UnknownVal(val.Type()))
                         return nil, EvalEarlyExitError{}
                 }
-                return nil, err
+                return nil, diags.Err()
         }
 
-        // Get the value from the config
-        var valueRaw interface{} = config.UnknownVariableValue
-        if cfg != nil {
-                var ok bool
-                valueRaw, ok = cfg.Get("value")
-                if !ok {
-                        valueRaw = ""
-                }
-                if cfg.IsComputed("value") {
-                        valueRaw = config.UnknownVariableValue
-                }
+        n.setValue(addr, state, changes, val)
+
+        return nil, nil
+}
+
+func (n *EvalWriteOutput) setValue(addr addrs.AbsOutputValue, state *states.SyncState, changes *plans.ChangesSync, val cty.Value) {
+        if val.IsKnown() && !val.IsNull() {
+                // The state itself doesn't represent unknown values, so we null them
+                // out here and then we'll save the real unknown value in the planned
+                // changeset below, if we have one on this graph walk.
+                log.Printf("[TRACE] EvalWriteOutput: Saving value for %s in state", addr)
+                stateVal := cty.UnknownAsNull(val)
+                state.SetOutputValue(addr, stateVal, n.Sensitive)
+        } else {
+                log.Printf("[TRACE] EvalWriteOutput: Removing %s from state (it is now null)", addr)
+                state.RemoveOutputValue(addr)
         }
 
-        switch valueTyped := valueRaw.(type) {
-        case string:
-                mod.Outputs[n.Name] = &OutputState{
-                        Type:      "string",
-                        Sensitive: n.Sensitive,
-                        Value:     valueTyped,
-                }
-        case []interface{}:
-                mod.Outputs[n.Name] = &OutputState{
-                        Type:      "list",
-                        Sensitive: n.Sensitive,
-                        Value:     valueTyped,
-                }
-        case map[string]interface{}:
-                mod.Outputs[n.Name] = &OutputState{
-                        Type:      "map",
-                        Sensitive: n.Sensitive,
-                        Value:     valueTyped,
-                }
-        case []map[string]interface{}:
-                // an HCL map is multi-valued, so if this was read out of a config the
-                // map may still be in a slice.
-                if len(valueTyped) == 1 {
-                        mod.Outputs[n.Name] = &OutputState{
-                                Type:      "map",
+        // If we also have an active changeset then we'll replicate the value in
+        // there. This is used in preference to the state where present, since it
+        // *is* able to represent unknowns, while the state cannot.
+        if changes != nil {
+                // For the moment we are not properly tracking changes to output
+                // values, and just marking them always as "Create" or "Destroy"
+                // actions. A future release will rework the output lifecycle so we
+                // can track their changes properly, in a similar way to how we work
+                // with resource instances.
+
+                var change *plans.OutputChange
+                if !val.IsNull() {
+                        change = &plans.OutputChange{
+                                Addr:      addr,
                                 Sensitive: n.Sensitive,
-                                Value:     valueTyped[0],
+                                Change: plans.Change{
+                                        Action: plans.Create,
+                                        Before: cty.NullVal(cty.DynamicPseudoType),
+                                        After:  val,
+                                },
+                        }
+                } else {
+                        change = &plans.OutputChange{
+                                Addr:      addr,
+                                Sensitive: n.Sensitive,
+                                Change: plans.Change{
+                                        // This is just a weird placeholder delete action since
+                                        // we don't have an actual prior value to indicate.
+                                        // FIXME: Generate real planned changes for output values
+                                        // that include the old values.
+                                        Action: plans.Delete,
+                                        Before: cty.NullVal(cty.DynamicPseudoType),
+                                        After:  cty.NullVal(cty.DynamicPseudoType),
+                                },
                         }
-                        break
                 }
-                return nil, fmt.Errorf("output %s type (%T) with %d values not valid for type map",
-                        n.Name, valueTyped, len(valueTyped))
-        default:
-                return nil, fmt.Errorf("output %s is not a valid type (%T)\n", n.Name, valueTyped)
-        }
 
-        return nil, nil
+                cs, err := change.Encode()
+                if err != nil {
+                        // Should never happen, since we just constructed this right above
+                        panic(fmt.Sprintf("planned change for %s could not be encoded: %s", addr, err))
+                }
+                log.Printf("[TRACE] EvalWriteOutput: Saving %s change for %s in changeset", change.Action, addr)
+                changes.RemoveOutputChange(addr) // remove any existing planned change, if present
+                changes.AppendOutputChange(cs)   // add the new planned change
+        }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_provider.go b/vendor/github.com/hashicorp/terraform/terraform/eval_provider.go
index 61f6ff9..7df6584 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_provider.go
@@ -2,50 +2,86 @@ package terraform
 
 import (
         "fmt"
+        "log"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/hcl2/hcl"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
-// EvalBuildProviderConfig outputs a *ResourceConfig that is properly
-// merged with parents and inputs on top of what is configured in the file.
-type EvalBuildProviderConfig struct {
-        Provider string
-        Config   **ResourceConfig
-        Output   **ResourceConfig
-}
+func buildProviderConfig(ctx EvalContext, addr addrs.ProviderConfig, config *configs.Provider) hcl.Body {
+        var configBody hcl.Body
+        if config != nil {
+                configBody = config.Config
+        }
 
-func (n *EvalBuildProviderConfig) Eval(ctx EvalContext) (interface{}, error) {
-        cfg := *n.Config
-
-        // If we have an Input configuration set, then merge that in
-        if input := ctx.ProviderInput(n.Provider); input != nil {
-                // "input" is a map of the subset of config values that were known
-                // during the input walk, set by EvalInputProvider. Note that
-                // in particular it does *not* include attributes that had
-                // computed values at input time; those appear *only* in
-                // "cfg" here.
-                rc, err := config.NewRawConfig(input)
-                if err != nil {
-                        return nil, err
-                }
-
-                merged := rc.Merge(cfg.raw)
-                cfg = NewResourceConfig(merged)
+        var inputBody hcl.Body
+        inputConfig := ctx.ProviderInput(addr)
+        if len(inputConfig) > 0 {
+                inputBody = configs.SynthBody("<input-prompt>", inputConfig)
         }
 
-        *n.Output = cfg
-        return nil, nil
+        switch {
+        case configBody != nil && inputBody != nil:
+                log.Printf("[TRACE] buildProviderConfig for %s: merging explicit config and input", addr)
+                // Note that the inputBody is the _base_ here, because configs.MergeBodies
+                // expects the base have all of the required fields, while these are
+                // forced to be optional for the override. The input process should
+                // guarantee that we have a value for each of the required arguments and
+                // that in practice the sets of attributes in each body will be
+                // disjoint.
+                return configs.MergeBodies(inputBody, configBody)
+        case configBody != nil:
+                log.Printf("[TRACE] buildProviderConfig for %s: using explicit config only", addr)
+                return configBody
+        case inputBody != nil:
+                log.Printf("[TRACE] buildProviderConfig for %s: using input only", addr)
+                return inputBody
+        default:
+                log.Printf("[TRACE] buildProviderConfig for %s: no configuration at all", addr)
+                return hcl.EmptyBody()
+        }
 }
 
 // EvalConfigProvider is an EvalNode implementation that configures
 // a provider that is already initialized and retrieved.
 type EvalConfigProvider struct {
-        Provider string
-        Config   **ResourceConfig
+        Addr     addrs.ProviderConfig
+        Provider *providers.Interface
+        Config   *configs.Provider
 }
 
 func (n *EvalConfigProvider) Eval(ctx EvalContext) (interface{}, error) {
-        return nil, ctx.ConfigureProvider(n.Provider, *n.Config)
+        if n.Provider == nil {
+                return nil, fmt.Errorf("EvalConfigProvider Provider is nil")
+        }
+
+        var diags tfdiags.Diagnostics
+        provider := *n.Provider
+        config := n.Config
+
+        configBody := buildProviderConfig(ctx, n.Addr, config)
+
+        resp := provider.GetSchema()
+        diags = diags.Append(resp.Diagnostics)
+        if diags.HasErrors() {
+                return nil, diags.NonFatalErr()
+        }
+
+        configSchema := resp.Provider.Block
+        configVal, configBody, evalDiags := ctx.EvaluateBlock(configBody, configSchema, nil, EvalDataForNoInstanceKey)
+        diags = diags.Append(evalDiags)
+        if evalDiags.HasErrors() {
+                return nil, diags.NonFatalErr()
+        }
+
+        configDiags := ctx.ConfigureProvider(n.Addr, configVal)
+        configDiags = configDiags.InConfigBody(configBody)
+
+        return nil, configDiags.ErrWithWarnings()
 }
 
 // EvalInitProvider is an EvalNode implementation that initializes a provider
@@ -53,85 +89,59 @@ func (n *EvalConfigProvider) Eval(ctx EvalContext) (interface{}, error) {
 // EvalGetProvider node.
 type EvalInitProvider struct {
         TypeName string
-        Name     string
+        Addr     addrs.ProviderConfig
 }
 
 func (n *EvalInitProvider) Eval(ctx EvalContext) (interface{}, error) {
-        return ctx.InitProvider(n.TypeName, n.Name)
+        return ctx.InitProvider(n.TypeName, n.Addr)
 }
 
 // EvalCloseProvider is an EvalNode implementation that closes provider
 // connections that aren't needed anymore.
 type EvalCloseProvider struct {
-        Name string
+        Addr addrs.ProviderConfig
 }
 
 func (n *EvalCloseProvider) Eval(ctx EvalContext) (interface{}, error) {
-        ctx.CloseProvider(n.Name)
+        ctx.CloseProvider(n.Addr)
         return nil, nil
 }
 
 // EvalGetProvider is an EvalNode implementation that retrieves an already
 // initialized provider instance for the given name.
+//
+// Unlike most eval nodes, this takes an _absolute_ provider configuration,
+// because providers can be passed into and inherited between modules.
+// Resource nodes must therefore know the absolute path of the provider they
+// will use, which is usually accomplished by implementing
+// interface GraphNodeProviderConsumer.
 type EvalGetProvider struct {
-        Name   string
-        Output *ResourceProvider
+        Addr   addrs.AbsProviderConfig
+        Output *providers.Interface
+
+        // If non-nil, Schema will be updated after eval to refer to the
+        // schema of the provider.
+        Schema **ProviderSchema
 }
 
 func (n *EvalGetProvider) Eval(ctx EvalContext) (interface{}, error) {
-        result := ctx.Provider(n.Name)
+        if n.Addr.ProviderConfig.Type == "" {
+                // Should never happen
+                panic("EvalGetProvider used with uninitialized provider configuration address")
+        }
+
+        result := ctx.Provider(n.Addr)
         if result == nil {
-                return nil, fmt.Errorf("provider %s not initialized", n.Name)
+                return nil, fmt.Errorf("provider %s not initialized", n.Addr)
         }
 
         if n.Output != nil {
                 *n.Output = result
         }
 
-        return nil, nil
-}
-
-// EvalInputProvider is an EvalNode implementation that asks for input
-// for the given provider configurations.
-type EvalInputProvider struct {
-        Name     string
-        Provider *ResourceProvider
-        Config   **ResourceConfig
-}
-
-func (n *EvalInputProvider) Eval(ctx EvalContext) (interface{}, error) {
-        rc := *n.Config
-        orig := rc.DeepCopy()
-
-        // Wrap the input into a namespace
-        input := &PrefixUIInput{
-                IdPrefix:    fmt.Sprintf("provider.%s", n.Name),
-                QueryPrefix: fmt.Sprintf("provider.%s.", n.Name),
-                UIInput:     ctx.Input(),
-        }
-
-        // Go through each provider and capture the input necessary
-        // to satisfy it.
-        config, err := (*n.Provider).Input(input, rc)
-        if err != nil {
-                return nil, fmt.Errorf(
-                        "Error configuring %s: %s", n.Name, err)
+        if n.Schema != nil {
+                *n.Schema = ctx.ProviderSchema(n.Addr)
         }
 
-        // We only store values that have changed through Input.
-        // The goal is to cache cache input responses, not to provide a complete
-        // config for other providers.
-        confMap := make(map[string]interface{})
-        if config != nil && len(config.Config) > 0 {
-                // any values that weren't in the original ResourcConfig will be cached
-                for k, v := range config.Config {
-                        if _, ok := orig.Config[k]; !ok {
-                                confMap[k] = v
-                        }
-                }
-        }
-
-        ctx.SetProviderInput(n.Name, confMap)
-
         return nil, nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_provisioner.go b/vendor/github.com/hashicorp/terraform/terraform/eval_provisioner.go
index 89579c0..bc6b5cc 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_provisioner.go
@@ -2,6 +2,9 @@ package terraform
 
 import (
         "fmt"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/provisioners"
 )
 
 // EvalInitProvisioner is an EvalNode implementation that initializes a provisioner
@@ -30,7 +33,8 @@ func (n *EvalCloseProvisioner) Eval(ctx EvalContext) (interface{}, error) {
 // initialized provisioner instance for the given name.
 type EvalGetProvisioner struct {
         Name   string
-        Output *ResourceProvisioner
+        Output *provisioners.Interface
+        Schema **configschema.Block
 }
 
 func (n *EvalGetProvisioner) Eval(ctx EvalContext) (interface{}, error) {
@@ -43,5 +47,9 @@ func (n *EvalGetProvisioner) Eval(ctx EvalContext) (interface{}, error) {
                 *n.Output = result
         }
 
+        if n.Schema != nil {
+                *n.Schema = ctx.ProvisionerSchema(n.Name)
+        }
+
         return result, nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_read_data.go b/vendor/github.com/hashicorp/terraform/terraform/eval_read_data.go
index fb85a28..34f2d60 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_read_data.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_read_data.go
@@ -2,105 +2,320 @@ package terraform
 
 import (
         "fmt"
+        "log"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/plans/objchange"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
-// EvalReadDataDiff is an EvalNode implementation that executes a data
-// resource's ReadDataDiff method to discover what attributes it exports.
-type EvalReadDataDiff struct {
-        Provider    *ResourceProvider
-        Output      **InstanceDiff
-        OutputState **InstanceState
-        Config      **ResourceConfig
-        Info        *InstanceInfo
-
-        // Set Previous when re-evaluating diff during apply, to ensure that
-        // the "Destroy" flag is preserved.
-        Previous **InstanceDiff
+// EvalReadData is an EvalNode implementation that deals with the main part
+// of the data resource lifecycle: either actually reading from the data source
+// or generating a plan to do so.
+type EvalReadData struct {
+        Addr           addrs.ResourceInstance
+        Config         *configs.Resource
+        Dependencies   []addrs.Referenceable
+        Provider       *providers.Interface
+        ProviderAddr   addrs.AbsProviderConfig
+        ProviderSchema **ProviderSchema
+
+        // Planned is set when dealing with data resources that were deferred to
+        // the apply walk, to let us see what was planned. If this is set, the
+        // evaluation of the config is required to produce a wholly-known
+        // configuration which is consistent with the partial object included
+        // in this planned change.
+        Planned **plans.ResourceInstanceChange
+
+        // ForcePlanRead, if true, overrides the usual behavior of immediately
+        // reading from the data source where possible, instead forcing us to
+        // _always_ generate a plan. This is used during the plan walk, since we
+        // mustn't actually apply anything there. (The resulting state doesn't
+        // get persisted)
+        ForcePlanRead bool
+
+        // The result from this EvalNode has a few different possibilities
+        // depending on the input:
+        // - If Planned is nil then we assume we're aiming to _produce_ the plan,
+        //   and so the following two outcomes are possible:
+        //     - OutputChange.Action is plans.NoOp and OutputState is the complete
+        //       result of reading from the data source. This is the easy path.
+        //     - OutputChange.Action is plans.Read and OutputState is a planned
+        //       object placeholder (states.ObjectPlanned). In this case, the
+        //       returned change must be recorded in the overral changeset and
+        //       eventually passed to another instance of this struct during the
+        //       apply walk.
+        // - If Planned is non-nil then we assume we're aiming to complete a
+        //   planned read from an earlier plan walk. In this case the only possible
+        //   non-error outcome is to set Output.Action (if non-nil) to a plans.NoOp
+        //   change and put the complete resulting state in OutputState, ready to
+        //   be saved in the overall state and used for expression evaluation.
+        OutputChange      **plans.ResourceInstanceChange
+        OutputValue       *cty.Value
+        OutputConfigValue *cty.Value
+        OutputState       **states.ResourceInstanceObject
 }
 
-func (n *EvalReadDataDiff) Eval(ctx EvalContext) (interface{}, error) {
-        // TODO: test
+func (n *EvalReadData) Eval(ctx EvalContext) (interface{}, error) {
+        absAddr := n.Addr.Absolute(ctx.Path())
+        log.Printf("[TRACE] EvalReadData: working on %s", absAddr)
 
-        err := ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PreDiff(n.Info, nil)
-        })
-        if err != nil {
-                return nil, err
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                return nil, fmt.Errorf("provider schema not available for %s", n.Addr)
         }
 
-        var diff *InstanceDiff
+        var diags tfdiags.Diagnostics
+        var change *plans.ResourceInstanceChange
+        var configVal cty.Value
 
-        if n.Previous != nil && *n.Previous != nil && (*n.Previous).GetDestroy() {
-                // If we're re-diffing for a diff that was already planning to
-                // destroy, then we'll just continue with that plan.
-                diff = &InstanceDiff{Destroy: true}
-        } else {
-                provider := *n.Provider
-                config := *n.Config
+        // TODO: Do we need to handle Delete changes here? EvalReadDataDiff and
+        // EvalReadDataApply did, but it seems like we should handle that via a
+        // separate mechanism since it boils down to just deleting the object from
+        // the state... and we do that on every plan anyway, forcing the data
+        // resource to re-read.
 
-                var err error
-                diff, err = provider.ReadDataDiff(n.Info, config)
+        config := *n.Config
+        provider := *n.Provider
+        providerSchema := *n.ProviderSchema
+        schema, _ := providerSchema.SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider %q does not support data source %q", n.ProviderAddr.ProviderConfig.Type, n.Addr.Resource.Type)
+        }
+
+        // We'll always start by evaluating the configuration. What we do after
+        // that will depend on the evaluation result along with what other inputs
+        // we were given.
+        objTy := schema.ImpliedType()
+        priorVal := cty.NullVal(objTy) // for data resources, prior is always null because we start fresh every time
+
+        keyData := EvalDataForInstanceKey(n.Addr.Key)
+
+        var configDiags tfdiags.Diagnostics
+        configVal, _, configDiags = ctx.EvaluateBlock(config.Config, schema, nil, keyData)
+        diags = diags.Append(configDiags)
+        if configDiags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        proposedNewVal := objchange.PlannedDataResourceObject(schema, configVal)
+
+        // If our configuration contains any unknown values then we must defer the
+        // read to the apply phase by producing a "Read" change for this resource,
+        // and a placeholder value for it in the state.
+        if n.ForcePlanRead || !configVal.IsWhollyKnown() {
+                // If the configuration is still unknown when we're applying a planned
+                // change then that indicates a bug in Terraform, since we should have
+                // everything resolved by now.
+                if n.Planned != nil && *n.Planned != nil {
+                        return nil, fmt.Errorf(
+                                "configuration for %s still contains unknown values during apply (this is a bug in Terraform; please report it!)",
+                                absAddr,
+                        )
+                }
+                if n.ForcePlanRead {
+                        log.Printf("[TRACE] EvalReadData: %s configuration is fully known, but we're forcing a read plan to be created", absAddr)
+                } else {
+                        log.Printf("[TRACE] EvalReadData: %s configuration not fully known yet, so deferring to apply phase", absAddr)
+                }
+
+                err := ctx.Hook(func(h Hook) (HookAction, error) {
+                        return h.PreDiff(absAddr, states.CurrentGen, priorVal, proposedNewVal)
+                })
                 if err != nil {
                         return nil, err
                 }
-                if diff == nil {
-                        diff = new(InstanceDiff)
+
+                change = &plans.ResourceInstanceChange{
+                        Addr:         absAddr,
+                        ProviderAddr: n.ProviderAddr,
+                        Change: plans.Change{
+                                Action: plans.Read,
+                                Before: priorVal,
+                                After:  proposedNewVal,
+                        },
                 }
 
-                // if id isn't explicitly set then it's always computed, because we're
-                // always "creating a new resource".
-                diff.init()
-                if _, ok := diff.Attributes["id"]; !ok {
-                        diff.SetAttribute("id", &ResourceAttrDiff{
-                                Old:         "",
-                                NewComputed: true,
-                                RequiresNew: true,
-                                Type:        DiffAttrOutput,
-                        })
+                err = ctx.Hook(func(h Hook) (HookAction, error) {
+                        return h.PostDiff(absAddr, states.CurrentGen, change.Action, priorVal, proposedNewVal)
+                })
+                if err != nil {
+                        return nil, err
+                }
+
+                if n.OutputChange != nil {
+                        *n.OutputChange = change
+                }
+                if n.OutputValue != nil {
+                        *n.OutputValue = change.After
+                }
+                if n.OutputConfigValue != nil {
+                        *n.OutputConfigValue = configVal
                 }
+                if n.OutputState != nil {
+                        state := &states.ResourceInstanceObject{
+                                Value:        change.After,
+                                Status:       states.ObjectPlanned, // because the partial value in the plan must be used for now
+                                Dependencies: n.Dependencies,
+                        }
+                        *n.OutputState = state
+                }
+
+                return nil, diags.ErrWithWarnings()
         }
 
-        err = ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PostDiff(n.Info, diff)
+        if n.Planned != nil && *n.Planned != nil && (*n.Planned).Action != plans.Read {
+                // If any other action gets in here then that's always a bug; this
+                // EvalNode only deals with reading.
+                return nil, fmt.Errorf(
+                        "invalid action %s for %s: only Read is supported (this is a bug in Terraform; please report it!)",
+                        (*n.Planned).Action, absAddr,
+                )
+        }
+
+        // If we get down here then our configuration is complete and we're read
+        // to actually call the provider to read the data.
+        log.Printf("[TRACE] EvalReadData: %s configuration is complete, so reading from provider", absAddr)
+
+        err := ctx.Hook(func(h Hook) (HookAction, error) {
+                // We don't have a state yet, so we'll just give the hook an
+                // empty one to work with.
+                return h.PreRefresh(absAddr, states.CurrentGen, cty.NullVal(cty.DynamicPseudoType))
         })
         if err != nil {
                 return nil, err
         }
 
-        *n.Output = diff
+        resp := provider.ReadDataSource(providers.ReadDataSourceRequest{
+                TypeName: n.Addr.Resource.Type,
+                Config:   configVal,
+        })
+        diags = diags.Append(resp.Diagnostics.InConfigBody(n.Config.Config))
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+        newVal := resp.State
+        if newVal == cty.NilVal {
+                // This can happen with incompletely-configured mocks. We'll allow it
+                // and treat it as an alias for a properly-typed null value.
+                newVal = cty.NullVal(schema.ImpliedType())
+        }
+
+        for _, err := range newVal.Type().TestConformance(schema.ImpliedType()) {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced invalid object",
+                        fmt.Sprintf(
+                                "Provider %q produced an invalid value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatErrorPrefixed(err, absAddr.String()),
+                        ),
+                ))
+        }
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        if newVal.IsNull() {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced null object",
+                        fmt.Sprintf(
+                                "Provider %q produced a null value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, absAddr,
+                        ),
+                ))
+        }
+        if !newVal.IsWhollyKnown() {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced invalid object",
+                        fmt.Sprintf(
+                                "Provider %q produced a value for %s that is not wholly known.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, absAddr,
+                        ),
+                ))
+
+                // We'll still save the object, but we need to eliminate any unknown
+                // values first because we can't serialize them in the state file.
+                // Note that this may cause set elements to be coalesced if they
+                // differed only by having unknown values, but we don't worry about
+                // that here because we're saving the value only for inspection
+                // purposes; the error we added above will halt the graph walk.
+                newVal = cty.UnknownAsNull(newVal)
+        }
+
+        // Since we've completed the read, we actually have no change to make, but
+        // we'll produce a NoOp one anyway to preserve the usual flow of the
+        // plan phase and allow it to produce a complete plan.
+        change = &plans.ResourceInstanceChange{
+                Addr:         absAddr,
+                ProviderAddr: n.ProviderAddr,
+                Change: plans.Change{
+                        Action: plans.NoOp,
+                        Before: newVal,
+                        After:  newVal,
+                },
+        }
+        state := &states.ResourceInstanceObject{
+                Value:        change.After,
+                Status:       states.ObjectReady, // because we completed the read from the provider
+                Dependencies: n.Dependencies,
+        }
+
+        err = ctx.Hook(func(h Hook) (HookAction, error) {
+                return h.PostRefresh(absAddr, states.CurrentGen, change.Before, newVal)
+        })
+        if err != nil {
+                return nil, err
+        }
 
+        if n.OutputChange != nil {
+                *n.OutputChange = change
+        }
+        if n.OutputValue != nil {
+                *n.OutputValue = change.After
+        }
+        if n.OutputConfigValue != nil {
+                *n.OutputConfigValue = configVal
+        }
         if n.OutputState != nil {
-                state := &InstanceState{}
                 *n.OutputState = state
-
-                // Apply the diff to the returned state, so the state includes
-                // any attribute values that are not computed.
-                if !diff.Empty() && n.OutputState != nil {
-                        *n.OutputState = state.MergeDiff(diff)
-                }
         }
 
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
 
 // EvalReadDataApply is an EvalNode implementation that executes a data
 // resource's ReadDataApply method to read data from the data source.
 type EvalReadDataApply struct {
-        Provider *ResourceProvider
-        Output   **InstanceState
-        Diff     **InstanceDiff
-        Info     *InstanceInfo
+        Addr            addrs.ResourceInstance
+        Provider        *providers.Interface
+        ProviderAddr    addrs.AbsProviderConfig
+        ProviderSchema  **ProviderSchema
+        Output          **states.ResourceInstanceObject
+        Config          *configs.Resource
+        Change          **plans.ResourceInstanceChange
+        StateReferences []addrs.Referenceable
 }
 
 func (n *EvalReadDataApply) Eval(ctx EvalContext) (interface{}, error) {
-        // TODO: test
         provider := *n.Provider
-        diff := *n.Diff
+        change := *n.Change
+        providerSchema := *n.ProviderSchema
+        absAddr := n.Addr.Absolute(ctx.Path())
+
+        var diags tfdiags.Diagnostics
 
         // If the diff is for *destroying* this resource then we'll
         // just drop its state and move on, since data resources don't
         // support an actual "destroy" action.
-        if diff != nil && diff.GetDestroy() {
+        if change != nil && change.Action == plans.Delete {
                 if n.Output != nil {
                         *n.Output = nil
                 }
@@ -113,27 +328,56 @@ func (n *EvalReadDataApply) Eval(ctx EvalContext) (interface{}, error) {
         err := ctx.Hook(func(h Hook) (HookAction, error) {
                 // We don't have a state yet, so we'll just give the hook an
                 // empty one to work with.
-                return h.PreRefresh(n.Info, &InstanceState{})
+                return h.PreRefresh(absAddr, states.CurrentGen, cty.NullVal(cty.DynamicPseudoType))
         })
         if err != nil {
                 return nil, err
         }
 
-        state, err := provider.ReadDataApply(n.Info, diff)
-        if err != nil {
-                return nil, fmt.Errorf("%s: %s", n.Info.Id, err)
+        resp := provider.ReadDataSource(providers.ReadDataSourceRequest{
+                TypeName: n.Addr.Resource.Type,
+                Config:   change.After,
+        })
+        diags = diags.Append(resp.Diagnostics.InConfigBody(n.Config.Config))
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        schema, _ := providerSchema.SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support data source %q", n.Addr.Resource.Type)
+        }
+
+        newVal := resp.State
+        for _, err := range newVal.Type().TestConformance(schema.ImpliedType()) {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced invalid object",
+                        fmt.Sprintf(
+                                "Provider %q planned an invalid value for %s. The result could not be saved.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatErrorPrefixed(err, absAddr.String()),
+                        ),
+                ))
+        }
+        if diags.HasErrors() {
+                return nil, diags.Err()
         }
 
         err = ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PostRefresh(n.Info, state)
+                return h.PostRefresh(absAddr, states.CurrentGen, change.Before, newVal)
         })
         if err != nil {
                 return nil, err
         }
 
         if n.Output != nil {
-                *n.Output = state
+                *n.Output = &states.ResourceInstanceObject{
+                        Value:        newVal,
+                        Status:       states.ObjectReady,
+                        Dependencies: n.StateReferences,
+                }
         }
 
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/eval_refresh.go
index fa2b812..03bc948 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_refresh.go
@@ -3,53 +3,102 @@ package terraform
 import (
         "fmt"
         "log"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalRefresh is an EvalNode implementation that does a refresh for
 // a resource.
 type EvalRefresh struct {
-        Provider *ResourceProvider
-        State    **InstanceState
-        Info     *InstanceInfo
-        Output   **InstanceState
+        Addr           addrs.ResourceInstance
+        ProviderAddr   addrs.AbsProviderConfig
+        Provider       *providers.Interface
+        ProviderSchema **ProviderSchema
+        State          **states.ResourceInstanceObject
+        Output         **states.ResourceInstanceObject
 }
 
 // TODO: test
 func (n *EvalRefresh) Eval(ctx EvalContext) (interface{}, error) {
-        provider := *n.Provider
         state := *n.State
+        absAddr := n.Addr.Absolute(ctx.Path())
+
+        var diags tfdiags.Diagnostics
 
         // If we have no state, we don't do any refreshing
         if state == nil {
-                log.Printf("[DEBUG] refresh: %s: no state, not refreshing", n.Info.Id)
-                return nil, nil
+                log.Printf("[DEBUG] refresh: %s: no state, so not refreshing", n.Addr.Absolute(ctx.Path()))
+                return nil, diags.ErrWithWarnings()
+        }
+
+        schema, _ := (*n.ProviderSchema).SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support resource type %q", n.Addr.Resource.Type)
         }
 
         // Call pre-refresh hook
         err := ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PreRefresh(n.Info, state)
+                return h.PreRefresh(absAddr, states.CurrentGen, state.Value)
         })
         if err != nil {
-                return nil, err
+                return nil, diags.ErrWithWarnings()
         }
 
         // Refresh!
-        state, err = provider.Refresh(n.Info, state)
-        if err != nil {
-                return nil, fmt.Errorf("%s: %s", n.Info.Id, err.Error())
+        priorVal := state.Value
+        req := providers.ReadResourceRequest{
+                TypeName:   n.Addr.Resource.Type,
+                PriorState: priorVal,
         }
 
+        provider := *n.Provider
+        resp := provider.ReadResource(req)
+        diags = diags.Append(resp.Diagnostics)
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        if resp.NewState == cty.NilVal {
+                // This ought not to happen in real cases since it's not possible to
+                // send NilVal over the plugin RPC channel, but it can come up in
+                // tests due to sloppy mocking.
+                panic("new state is cty.NilVal")
+        }
+
+        for _, err := range resp.NewState.Type().TestConformance(schema.ImpliedType()) {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced invalid object",
+                        fmt.Sprintf(
+                                "Provider %q planned an invalid value for %s during refresh: %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, absAddr, tfdiags.FormatError(err),
+                        ),
+                ))
+        }
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        newState := state.DeepCopy()
+        newState.Value = resp.NewState
+
         // Call post-refresh hook
         err = ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PostRefresh(n.Info, state)
+                return h.PostRefresh(absAddr, states.CurrentGen, priorVal, newState.Value)
         })
         if err != nil {
                 return nil, err
         }
 
         if n.Output != nil {
-                *n.Output = state
+                *n.Output = newState
         }
 
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_resource.go b/vendor/github.com/hashicorp/terraform/terraform/eval_resource.go
deleted file mode 100644
index 5eca678..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_resource.go
+++ /dev/null
@@ -1,13 +0,0 @@
-package terraform
-
-// EvalInstanceInfo is an EvalNode implementation that fills in the
-// InstanceInfo as much as it can.
-type EvalInstanceInfo struct {
-        Info *InstanceInfo
-}
-
-// TODO: test
-func (n *EvalInstanceInfo) Eval(ctx EvalContext) (interface{}, error) {
-        n.Info.ModulePath = ctx.Path()
-        return nil, nil
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_sequence.go b/vendor/github.com/hashicorp/terraform/terraform/eval_sequence.go
index 82d8178..3485e4f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_sequence.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_sequence.go
@@ -1,22 +1,37 @@
 package terraform
 
+import (
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
 // EvalSequence is an EvalNode that evaluates in sequence.
 type EvalSequence struct {
         Nodes []EvalNode
 }
 
 func (n *EvalSequence) Eval(ctx EvalContext) (interface{}, error) {
+        var diags tfdiags.Diagnostics
+
         for _, n := range n.Nodes {
                 if n == nil {
                         continue
                 }
 
                 if _, err := EvalRaw(n, ctx); err != nil {
-                        return nil, err
+                        if _, isEarlyExit := err.(EvalEarlyExitError); isEarlyExit {
+                                // In this path we abort early, losing any non-error
+                                // diagnostics we saw earlier.
+                                return nil, err
+                        }
+                        diags = diags.Append(err)
+                        if diags.HasErrors() {
+                                // Halt if we get some errors, but warnings are okay.
+                                break
+                        }
                 }
         }
 
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
 
 // EvalNodeFilterable impl.
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_state.go b/vendor/github.com/hashicorp/terraform/terraform/eval_state.go
index 1182690..d506ce3 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_state.go
@@ -2,91 +2,149 @@ package terraform
 
 import (
         "fmt"
+        "log"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalReadState is an EvalNode implementation that reads the
-// primary InstanceState for a specific resource out of the state.
+// current object for a specific instance in the state.
 type EvalReadState struct {
-        Name   string
-        Output **InstanceState
+        // Addr is the address of the instance to read state for.
+        Addr addrs.ResourceInstance
+
+        // ProviderSchema is the schema for the provider given in Provider.
+        ProviderSchema **ProviderSchema
+
+        // Provider is the provider that will subsequently perform actions on
+        // the the state object. This is used to perform any schema upgrades
+        // that might be required to prepare the stored data for use.
+        Provider *providers.Interface
+
+        // Output will be written with a pointer to the retrieved object.
+        Output **states.ResourceInstanceObject
 }
 
 func (n *EvalReadState) Eval(ctx EvalContext) (interface{}, error) {
-        return readInstanceFromState(ctx, n.Name, n.Output, func(rs *ResourceState) (*InstanceState, error) {
-                return rs.Primary, nil
-        })
+        if n.Provider == nil || *n.Provider == nil {
+                panic("EvalReadState used with no Provider object")
+        }
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                panic("EvalReadState used with no ProviderSchema object")
+        }
+
+        absAddr := n.Addr.Absolute(ctx.Path())
+        log.Printf("[TRACE] EvalReadState: reading state for %s", absAddr)
+
+        src := ctx.State().ResourceInstanceObject(absAddr, states.CurrentGen)
+        if src == nil {
+                // Presumably we only have deposed objects, then.
+                log.Printf("[TRACE] EvalReadState: no state present for %s", absAddr)
+                return nil, nil
+        }
+
+        schema, currentVersion := (*n.ProviderSchema).SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Shouldn't happen since we should've failed long ago if no schema is present
+                return nil, fmt.Errorf("no schema available for %s while reading state; this is a bug in Terraform and should be reported", absAddr)
+        }
+        var diags tfdiags.Diagnostics
+        src, diags = UpgradeResourceState(absAddr, *n.Provider, src, schema, currentVersion)
+        if diags.HasErrors() {
+                // Note that we don't have any channel to return warnings here. We'll
+                // accept that for now since warnings during a schema upgrade would
+                // be pretty weird anyway, since this operation is supposed to seem
+                // invisible to the user.
+                return nil, diags.Err()
+        }
+
+        obj, err := src.Decode(schema.ImpliedType())
+        if err != nil {
+                return nil, err
+        }
+
+        if n.Output != nil {
+                *n.Output = obj
+        }
+        return obj, nil
 }
 
 // EvalReadStateDeposed is an EvalNode implementation that reads the
 // deposed InstanceState for a specific resource out of the state
 type EvalReadStateDeposed struct {
-        Name   string
-        Output **InstanceState
-        // Index indicates which instance in the Deposed list to target, or -1 for
-        // the last item.
-        Index int
+        // Addr is the address of the instance to read state for.
+        Addr addrs.ResourceInstance
+
+        // Key identifies which deposed object we will read.
+        Key states.DeposedKey
+
+        // ProviderSchema is the schema for the provider given in Provider.
+        ProviderSchema **ProviderSchema
+
+        // Provider is the provider that will subsequently perform actions on
+        // the the state object. This is used to perform any schema upgrades
+        // that might be required to prepare the stored data for use.
+        Provider *providers.Interface
+
+        // Output will be written with a pointer to the retrieved object.
+        Output **states.ResourceInstanceObject
 }
 
 func (n *EvalReadStateDeposed) Eval(ctx EvalContext) (interface{}, error) {
-        return readInstanceFromState(ctx, n.Name, n.Output, func(rs *ResourceState) (*InstanceState, error) {
-                // Get the index. If it is negative, then we get the last one
-                idx := n.Index
-                if idx < 0 {
-                        idx = len(rs.Deposed) - 1
-                }
-                if idx >= 0 && idx < len(rs.Deposed) {
-                        return rs.Deposed[idx], nil
-                } else {
-                        return nil, fmt.Errorf("bad deposed index: %d, for resource: %#v", idx, rs)
-                }
-        })
-}
+        if n.Provider == nil || *n.Provider == nil {
+                panic("EvalReadStateDeposed used with no Provider object")
+        }
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                panic("EvalReadStateDeposed used with no ProviderSchema object")
+        }
 
-// Does the bulk of the work for the various flavors of ReadState eval nodes.
-// Each node just provides a reader function to get from the ResourceState to the
-// InstanceState, and this takes care of all the plumbing.
-func readInstanceFromState(
-        ctx EvalContext,
-        resourceName string,
-        output **InstanceState,
-        readerFn func(*ResourceState) (*InstanceState, error),
-) (*InstanceState, error) {
-        state, lock := ctx.State()
-
-        // Get a read lock so we can access this instance
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Look for the module state. If we don't have one, then it doesn't matter.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                return nil, nil
+        key := n.Key
+        if key == states.NotDeposed {
+                return nil, fmt.Errorf("EvalReadStateDeposed used with no instance key; this is a bug in Terraform and should be reported")
         }
+        absAddr := n.Addr.Absolute(ctx.Path())
+        log.Printf("[TRACE] EvalReadStateDeposed: reading state for %s deposed object %s", absAddr, n.Key)
 
-        // Look for the resource state. If we don't have one, then it is okay.
-        rs := mod.Resources[resourceName]
-        if rs == nil {
+        src := ctx.State().ResourceInstanceObject(absAddr, key)
+        if src == nil {
+                // Presumably we only have deposed objects, then.
+                log.Printf("[TRACE] EvalReadStateDeposed: no state present for %s deposed object %s", absAddr, n.Key)
                 return nil, nil
         }
 
-        // Use the delegate function to get the instance state from the resource state
-        is, err := readerFn(rs)
+        schema, currentVersion := (*n.ProviderSchema).SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Shouldn't happen since we should've failed long ago if no schema is present
+                return nil, fmt.Errorf("no schema available for %s while reading state; this is a bug in Terraform and should be reported", absAddr)
+        }
+        var diags tfdiags.Diagnostics
+        src, diags = UpgradeResourceState(absAddr, *n.Provider, src, schema, currentVersion)
+        if diags.HasErrors() {
+                // Note that we don't have any channel to return warnings here. We'll
+                // accept that for now since warnings during a schema upgrade would
+                // be pretty weird anyway, since this operation is supposed to seem
+                // invisible to the user.
+                return nil, diags.Err()
+        }
+
+        obj, err := src.Decode(schema.ImpliedType())
         if err != nil {
                 return nil, err
         }
-
-        // Write the result to the output pointer
-        if output != nil {
-                *output = is
+        if n.Output != nil {
+                *n.Output = obj
         }
-
-        return is, nil
+        return obj, nil
 }
 
-// EvalRequireState is an EvalNode implementation that early exits
-// if the state doesn't have an ID.
+// EvalRequireState is an EvalNode implementation that exits early if the given
+// object is null.
 type EvalRequireState struct {
-        State **InstanceState
+        State **states.ResourceInstanceObject
 }
 
 func (n *EvalRequireState) Eval(ctx EvalContext) (interface{}, error) {
@@ -95,7 +153,7 @@ func (n *EvalRequireState) Eval(ctx EvalContext) (interface{}, error) {
         }
 
         state := *n.State
-        if state == nil || state.ID == "" {
+        if state == nil || state.Value.IsNull() {
                 return nil, EvalEarlyExitError{}
         }
 
@@ -107,12 +165,14 @@ func (n *EvalRequireState) Eval(ctx EvalContext) (interface{}, error) {
 type EvalUpdateStateHook struct{}
 
 func (n *EvalUpdateStateHook) Eval(ctx EvalContext) (interface{}, error) {
-        state, lock := ctx.State()
-
-        // Get a full lock. Even calling something like WriteState can modify
-        // (prune) the state, so we need the full lock.
-        lock.Lock()
-        defer lock.Unlock()
+        // In principle we could grab the lock here just long enough to take a
+        // deep copy and then pass that to our hooks below, but we'll instead
+        // hold the hook for the duration to avoid the potential confusing
+        // situation of us racing to call PostStateUpdate concurrently with
+        // different state snapshots.
+        stateSync := ctx.State()
+        state := stateSync.Lock().DeepCopy()
+        defer stateSync.Unlock()
 
         // Call the hook
         err := ctx.Hook(func(h Hook) (HookAction, error) {
@@ -125,171 +185,285 @@ func (n *EvalUpdateStateHook) Eval(ctx EvalContext) (interface{}, error) {
         return nil, nil
 }
 
-// EvalWriteState is an EvalNode implementation that writes the
-// primary InstanceState for a specific resource into the state.
+// EvalWriteState is an EvalNode implementation that saves the given object
+// as the current object for the selected resource instance.
 type EvalWriteState struct {
-        Name         string
-        ResourceType string
-        Provider     string
-        Dependencies []string
-        State        **InstanceState
+        // Addr is the address of the instance to read state for.
+        Addr addrs.ResourceInstance
+
+        // State is the object state to save.
+        State **states.ResourceInstanceObject
+
+        // ProviderSchema is the schema for the provider given in ProviderAddr.
+        ProviderSchema **ProviderSchema
+
+        // ProviderAddr is the address of the provider configuration that
+        // produced the given object.
+        ProviderAddr addrs.AbsProviderConfig
 }
 
 func (n *EvalWriteState) Eval(ctx EvalContext) (interface{}, error) {
-        return writeInstanceToState(ctx, n.Name, n.ResourceType, n.Provider, n.Dependencies,
-                func(rs *ResourceState) error {
-                        rs.Primary = *n.State
-                        return nil
-                },
-        )
+        if n.State == nil {
+                // Note that a pointer _to_ nil is valid here, indicating the total
+                // absense of an object as we'd see during destroy.
+                panic("EvalWriteState used with no ResourceInstanceObject")
+        }
+
+        absAddr := n.Addr.Absolute(ctx.Path())
+        state := ctx.State()
+
+        if n.ProviderAddr.ProviderConfig.Type == "" {
+                return nil, fmt.Errorf("failed to write state for %s, missing provider type", absAddr)
+        }
+
+        obj := *n.State
+        if obj == nil || obj.Value.IsNull() {
+                // No need to encode anything: we'll just write it directly.
+                state.SetResourceInstanceCurrent(absAddr, nil, n.ProviderAddr)
+                log.Printf("[TRACE] EvalWriteState: removing state object for %s", absAddr)
+                return nil, nil
+        }
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                // Should never happen, unless our state object is nil
+                panic("EvalWriteState used with pointer to nil ProviderSchema object")
+        }
+
+        if obj != nil {
+                log.Printf("[TRACE] EvalWriteState: writing current state object for %s", absAddr)
+        } else {
+                log.Printf("[TRACE] EvalWriteState: removing current state object for %s", absAddr)
+        }
+
+        schema, currentVersion := (*n.ProviderSchema).SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // It shouldn't be possible to get this far in any real scenario
+                // without a schema, but we might end up here in contrived tests that
+                // fail to set up their world properly.
+                return nil, fmt.Errorf("failed to encode %s in state: no resource type schema available", absAddr)
+        }
+        src, err := obj.Encode(schema.ImpliedType(), currentVersion)
+        if err != nil {
+                return nil, fmt.Errorf("failed to encode %s in state: %s", absAddr, err)
+        }
+
+        state.SetResourceInstanceCurrent(absAddr, src, n.ProviderAddr)
+        return nil, nil
 }
 
 // EvalWriteStateDeposed is an EvalNode implementation that writes
 // an InstanceState out to the Deposed list of a resource in the state.
 type EvalWriteStateDeposed struct {
-        Name         string
-        ResourceType string
-        Provider     string
-        Dependencies []string
-        State        **InstanceState
-        // Index indicates which instance in the Deposed list to target, or -1 to append.
-        Index int
+        // Addr is the address of the instance to read state for.
+        Addr addrs.ResourceInstance
+
+        // Key indicates which deposed object to write to.
+        Key states.DeposedKey
+
+        // State is the object state to save.
+        State **states.ResourceInstanceObject
+
+        // ProviderSchema is the schema for the provider given in ProviderAddr.
+        ProviderSchema **ProviderSchema
+
+        // ProviderAddr is the address of the provider configuration that
+        // produced the given object.
+        ProviderAddr addrs.AbsProviderConfig
 }
 
 func (n *EvalWriteStateDeposed) Eval(ctx EvalContext) (interface{}, error) {
-        return writeInstanceToState(ctx, n.Name, n.ResourceType, n.Provider, n.Dependencies,
-                func(rs *ResourceState) error {
-                        if n.Index == -1 {
-                                rs.Deposed = append(rs.Deposed, *n.State)
-                        } else {
-                                rs.Deposed[n.Index] = *n.State
-                        }
-                        return nil
-                },
-        )
-}
+        if n.State == nil {
+                // Note that a pointer _to_ nil is valid here, indicating the total
+                // absense of an object as we'd see during destroy.
+                panic("EvalWriteStateDeposed used with no ResourceInstanceObject")
+        }
 
-// Pulls together the common tasks of the EvalWriteState nodes.  All the args
-// are passed directly down from the EvalNode along with a `writer` function
-// which is yielded the *ResourceState and is responsible for writing an
-// InstanceState to the proper field in the ResourceState.
-func writeInstanceToState(
-        ctx EvalContext,
-        resourceName string,
-        resourceType string,
-        provider string,
-        dependencies []string,
-        writerFn func(*ResourceState) error,
-) (*InstanceState, error) {
-        state, lock := ctx.State()
-        if state == nil {
-                return nil, fmt.Errorf("cannot write state to nil state")
-        }
-
-        // Get a write lock so we can access this instance
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Look for the module state. If we don't have one, create it.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                mod = state.AddModule(ctx.Path())
-        }
-
-        // Look for the resource state.
-        rs := mod.Resources[resourceName]
-        if rs == nil {
-                rs = &ResourceState{}
-                rs.init()
-                mod.Resources[resourceName] = rs
-        }
-        rs.Type = resourceType
-        rs.Dependencies = dependencies
-        rs.Provider = provider
-
-        if err := writerFn(rs); err != nil {
-                return nil, err
+        absAddr := n.Addr.Absolute(ctx.Path())
+        key := n.Key
+        state := ctx.State()
+
+        if key == states.NotDeposed {
+                // should never happen
+                return nil, fmt.Errorf("can't save deposed object for %s without a deposed key; this is a bug in Terraform that should be reported", absAddr)
+        }
+
+        obj := *n.State
+        if obj == nil {
+                // No need to encode anything: we'll just write it directly.
+                state.SetResourceInstanceDeposed(absAddr, key, nil, n.ProviderAddr)
+                log.Printf("[TRACE] EvalWriteStateDeposed: removing state object for %s deposed %s", absAddr, key)
+                return nil, nil
+        }
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                // Should never happen, unless our state object is nil
+                panic("EvalWriteStateDeposed used with no ProviderSchema object")
+        }
+
+        schema, currentVersion := (*n.ProviderSchema).SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // It shouldn't be possible to get this far in any real scenario
+                // without a schema, but we might end up here in contrived tests that
+                // fail to set up their world properly.
+                return nil, fmt.Errorf("failed to encode %s in state: no resource type schema available", absAddr)
+        }
+        src, err := obj.Encode(schema.ImpliedType(), currentVersion)
+        if err != nil {
+                return nil, fmt.Errorf("failed to encode %s in state: %s", absAddr, err)
         }
 
+        log.Printf("[TRACE] EvalWriteStateDeposed: writing state object for %s deposed %s", absAddr, key)
+        state.SetResourceInstanceDeposed(absAddr, key, src, n.ProviderAddr)
         return nil, nil
 }
 
-// EvalDeposeState is an EvalNode implementation that takes the primary
-// out of a state and makes it Deposed. This is done at the beginning of
-// create-before-destroy calls so that the create can create while preserving
-// the old state of the to-be-destroyed resource.
+// EvalDeposeState is an EvalNode implementation that moves the current object
+// for the given instance to instead be a deposed object, leaving the instance
+// with no current object.
+// This is used at the beginning of a create-before-destroy replace action so
+// that the create can create while preserving the old state of the
+// to-be-destroyed object.
 type EvalDeposeState struct {
-        Name string
+        Addr addrs.ResourceInstance
+
+        // ForceKey, if a value other than states.NotDeposed, will be used as the
+        // key for the newly-created deposed object that results from this action.
+        // If set to states.NotDeposed (the zero value), a new unique key will be
+        // allocated.
+        ForceKey states.DeposedKey
+
+        // OutputKey, if non-nil, will be written with the deposed object key that
+        // was generated for the object. This can then be passed to
+        // EvalUndeposeState.Key so it knows which deposed instance to forget.
+        OutputKey *states.DeposedKey
 }
 
 // TODO: test
 func (n *EvalDeposeState) Eval(ctx EvalContext) (interface{}, error) {
-        state, lock := ctx.State()
-
-        // Get a read lock so we can access this instance
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Look for the module state. If we don't have one, then it doesn't matter.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                return nil, nil
-        }
-
-        // Look for the resource state. If we don't have one, then it is okay.
-        rs := mod.Resources[n.Name]
-        if rs == nil {
-                return nil, nil
+        absAddr := n.Addr.Absolute(ctx.Path())
+        state := ctx.State()
+
+        var key states.DeposedKey
+        if n.ForceKey == states.NotDeposed {
+                key = state.DeposeResourceInstanceObject(absAddr)
+        } else {
+                key = n.ForceKey
+                state.DeposeResourceInstanceObjectForceKey(absAddr, key)
         }
+        log.Printf("[TRACE] EvalDeposeState: prior object for %s now deposed with key %s", absAddr, key)
 
-        // If we don't have a primary, we have nothing to depose
-        if rs.Primary == nil {
-                return nil, nil
+        if n.OutputKey != nil {
+                *n.OutputKey = key
         }
 
-        // Depose
-        rs.Deposed = append(rs.Deposed, rs.Primary)
-        rs.Primary = nil
-
         return nil, nil
 }
 
-// EvalUndeposeState is an EvalNode implementation that reads the
-// InstanceState for a specific resource out of the state.
-type EvalUndeposeState struct {
-        Name  string
-        State **InstanceState
+// EvalMaybeRestoreDeposedObject is an EvalNode implementation that will
+// restore a particular deposed object of the specified resource instance
+// to be the "current" object if and only if the instance doesn't currently
+// have a current object.
+//
+// This is intended for use when the create leg of a create before destroy
+// fails with no partial new object: if we didn't take any action, the user
+// would be left in the unfortunate situation of having no current object
+// and the previously-workign object now deposed. This EvalNode causes a
+// better outcome by restoring things to how they were before the replace
+// operation began.
+//
+// The create operation may have produced a partial result even though it
+// failed and it's important that we don't "forget" that state, so in that
+// situation the prior object remains deposed and the partial new object
+// remains the current object, allowing the situation to hopefully be
+// improved in a subsequent run.
+type EvalMaybeRestoreDeposedObject struct {
+        Addr addrs.ResourceInstance
+
+        // Key is a pointer to the deposed object key that should be forgotten
+        // from the state, which must be non-nil.
+        Key *states.DeposedKey
 }
 
 // TODO: test
-func (n *EvalUndeposeState) Eval(ctx EvalContext) (interface{}, error) {
-        state, lock := ctx.State()
+func (n *EvalMaybeRestoreDeposedObject) Eval(ctx EvalContext) (interface{}, error) {
+        absAddr := n.Addr.Absolute(ctx.Path())
+        dk := *n.Key
+        state := ctx.State()
+
+        restored := state.MaybeRestoreResourceInstanceDeposed(absAddr, dk)
+        if restored {
+                log.Printf("[TRACE] EvalMaybeRestoreDeposedObject: %s deposed object %s was restored as the current object", absAddr, dk)
+        } else {
+                log.Printf("[TRACE] EvalMaybeRestoreDeposedObject: %s deposed object %s remains deposed", absAddr, dk)
+        }
 
-        // Get a read lock so we can access this instance
-        lock.RLock()
-        defer lock.RUnlock()
+        return nil, nil
+}
 
-        // Look for the module state. If we don't have one, then it doesn't matter.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                return nil, nil
-        }
+// EvalWriteResourceState is an EvalNode implementation that ensures that
+// a suitable resource-level state record is present in the state, if that's
+// required for the "each mode" of that resource.
+//
+// This is important primarily for the situation where count = 0, since this
+// eval is the only change we get to set the resource "each mode" to list
+// in that case, allowing expression evaluation to see it as a zero-element
+// list rather than as not set at all.
+type EvalWriteResourceState struct {
+        Addr         addrs.Resource
+        Config       *configs.Resource
+        ProviderAddr addrs.AbsProviderConfig
+}
 
-        // Look for the resource state. If we don't have one, then it is okay.
-        rs := mod.Resources[n.Name]
-        if rs == nil {
-                return nil, nil
+// TODO: test
+func (n *EvalWriteResourceState) Eval(ctx EvalContext) (interface{}, error) {
+        var diags tfdiags.Diagnostics
+        absAddr := n.Addr.Absolute(ctx.Path())
+        state := ctx.State()
+
+        count, countDiags := evaluateResourceCountExpression(n.Config.Count, ctx)
+        diags = diags.Append(countDiags)
+        if countDiags.HasErrors() {
+                return nil, diags.Err()
         }
 
-        // If we don't have any desposed resource, then we don't have anything to do
-        if len(rs.Deposed) == 0 {
-                return nil, nil
+        // Currently we ony support NoEach and EachList, because for_each support
+        // is not fully wired up across Terraform. Once for_each support is added,
+        // we'll need to handle that here too, setting states.EachMap if the
+        // assigned expression is a map.
+        eachMode := states.NoEach
+        if count >= 0 { // -1 signals "count not set"
+                eachMode = states.EachList
         }
 
-        // Undepose
-        idx := len(rs.Deposed) - 1
-        rs.Primary = rs.Deposed[idx]
-        rs.Deposed[idx] = *n.State
+        // This method takes care of all of the business logic of updating this
+        // while ensuring that any existing instances are preserved, etc.
+        state.SetResourceMeta(absAddr, eachMode, n.ProviderAddr)
+
+        return nil, nil
+}
+
+// EvalForgetResourceState is an EvalNode implementation that prunes out an
+// empty resource-level state for a given resource address, or produces an
+// error if it isn't empty after all.
+//
+// This should be the last action taken for a resource that has been removed
+// from the configuration altogether, to clean up the leftover husk of the
+// resource in the state after other EvalNodes have destroyed and removed
+// all of the instances and instance objects beneath it.
+type EvalForgetResourceState struct {
+        Addr addrs.Resource
+}
+
+func (n *EvalForgetResourceState) Eval(ctx EvalContext) (interface{}, error) {
+        absAddr := n.Addr.Absolute(ctx.Path())
+        state := ctx.State()
+
+        pruned := state.RemoveResourceIfEmpty(absAddr)
+        if !pruned {
+                // If this produces an error, it indicates a bug elsewhere in Terraform
+                // -- probably missing graph nodes, graph edges, or
+                // incorrectly-implemented evaluation steps.
+                return nil, fmt.Errorf("orphan resource %s still has a non-empty state after apply; this is a bug in Terraform", absAddr)
+        }
+        log.Printf("[TRACE] EvalForgetResourceState: Pruned husk of %s from state", absAddr)
 
         return nil, nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_state_upgrade.go b/vendor/github.com/hashicorp/terraform/terraform/eval_state_upgrade.go
new file mode 100644
index 0000000..e194000
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_state_upgrade.go
@@ -0,0 +1,106 @@
+package terraform
+
+import (
+        "fmt"
+        "log"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// UpgradeResourceState will, if necessary, run the provider-defined upgrade
+// logic against the given state object to make it compliant with the
+// current schema version. This is a no-op if the given state object is
+// already at the latest version.
+//
+// If any errors occur during upgrade, error diagnostics are returned. In that
+// case it is not safe to proceed with using the original state object.
+func UpgradeResourceState(addr addrs.AbsResourceInstance, provider providers.Interface, src *states.ResourceInstanceObjectSrc, currentSchema *configschema.Block, currentVersion uint64) (*states.ResourceInstanceObjectSrc, tfdiags.Diagnostics) {
+        if addr.Resource.Resource.Mode != addrs.ManagedResourceMode {
+                // We only do state upgrading for managed resources.
+                return src, nil
+        }
+
+        stateIsFlatmap := len(src.AttrsJSON) == 0
+
+        providerType := addr.Resource.Resource.DefaultProviderConfig().Type
+        if src.SchemaVersion > currentVersion {
+                log.Printf("[TRACE] UpgradeResourceState: can't downgrade state for %s from version %d to %d", addr, src.SchemaVersion, currentVersion)
+                var diags tfdiags.Diagnostics
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Resource instance managed by newer provider version",
+                        // This is not a very good error message, but we don't retain enough
+                        // information in state to give good feedback on what provider
+                        // version might be required here. :(
+                        fmt.Sprintf("The current state of %s was created by a newer provider version than is currently selected. Upgrade the %s provider to work with this state.", addr, providerType),
+                ))
+                return nil, diags
+        }
+
+        // If we get down here then we need to upgrade the state, with the
+        // provider's help.
+        // If this state was originally created by a version of Terraform prior to
+        // v0.12, this also includes translating from legacy flatmap to new-style
+        // representation, since only the provider has enough information to
+        // understand a flatmap built against an older schema.
+        if src.SchemaVersion != currentVersion {
+                log.Printf("[TRACE] UpgradeResourceState: upgrading state for %s from version %d to %d using provider %q", addr, src.SchemaVersion, currentVersion, providerType)
+        } else {
+                log.Printf("[TRACE] UpgradeResourceState: schema version of %s is still %d; calling provider %q for any other minor fixups", addr, currentVersion, providerType)
+        }
+
+        req := providers.UpgradeResourceStateRequest{
+                TypeName: addr.Resource.Resource.Type,
+
+                // TODO: The internal schema version representations are all using
+                // uint64 instead of int64, but unsigned integers aren't friendly
+                // to all protobuf target languages so in practice we use int64
+                // on the wire. In future we will change all of our internal
+                // representations to int64 too.
+                Version: int64(src.SchemaVersion),
+        }
+
+        if stateIsFlatmap {
+                req.RawStateFlatmap = src.AttrsFlat
+        } else {
+                req.RawStateJSON = src.AttrsJSON
+        }
+
+        resp := provider.UpgradeResourceState(req)
+        diags := resp.Diagnostics
+        if diags.HasErrors() {
+                return nil, diags
+        }
+
+        // After upgrading, the new value must conform to the current schema. When
+        // going over RPC this is actually already ensured by the
+        // marshaling/unmarshaling of the new value, but we'll check it here
+        // anyway for robustness, e.g. for in-process providers.
+        newValue := resp.UpgradedState
+        if errs := newValue.Type().TestConformance(currentSchema.ImpliedType()); len(errs) > 0 {
+                for _, err := range errs {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid resource state upgrade",
+                                fmt.Sprintf("The %s provider upgraded the state for %s from a previous version, but produced an invalid result: %s.", providerType, addr, tfdiags.FormatError(err)),
+                        ))
+                }
+                return nil, diags
+        }
+
+        new, err := src.CompleteUpgrade(newValue, currentSchema.ImpliedType(), uint64(currentVersion))
+        if err != nil {
+                // We already checked for type conformance above, so getting into this
+                // codepath should be rare and is probably a bug somewhere under CompleteUpgrade.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to encode result of resource state upgrade",
+                        fmt.Sprintf("Failed to encode state for %s after resource schema upgrade: %s.", addr, tfdiags.FormatError(err)),
+                ))
+        }
+        return new, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go b/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
index 3e5a84c..0033e01 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
@@ -2,126 +2,163 @@ package terraform
 
 import (
         "fmt"
-
-        "github.com/hashicorp/terraform/config"
-        "github.com/mitchellh/mapstructure"
+        "log"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/gocty"
 )
 
-// EvalValidateError is the error structure returned if there were
-// validation errors.
-type EvalValidateError struct {
-        Warnings []string
-        Errors   []error
-}
-
-func (e *EvalValidateError) Error() string {
-        return fmt.Sprintf("Warnings: %s. Errors: %s", e.Warnings, e.Errors)
-}
-
 // EvalValidateCount is an EvalNode implementation that validates
 // the count of a resource.
 type EvalValidateCount struct {
-        Resource *config.Resource
+        Resource *configs.Resource
 }
 
 // TODO: test
 func (n *EvalValidateCount) Eval(ctx EvalContext) (interface{}, error) {
+        var diags tfdiags.Diagnostics
         var count int
-        var errs []error
         var err error
-        if _, err := ctx.Interpolate(n.Resource.RawCount, nil); err != nil {
-                errs = append(errs, fmt.Errorf(
-                        "Failed to interpolate count: %s", err))
+
+        val, valDiags := ctx.EvaluateExpr(n.Resource.Count, cty.Number, nil)
+        diags = diags.Append(valDiags)
+        if valDiags.HasErrors() {
                 goto RETURN
         }
-
-        count, err = n.Resource.Count()
-        if err != nil {
-                // If we can't get the count during validation, then
-                // just replace it with the number 1.
-                c := n.Resource.RawCount.Config()
-                c[n.Resource.RawCount.Key] = "1"
-                count = 1
+        if val.IsNull() || !val.IsKnown() {
+                goto RETURN
         }
-        err = nil
 
-        if count < 0 {
-                errs = append(errs, fmt.Errorf(
-                        "Count is less than zero: %d", count))
+        err = gocty.FromCtyValue(val, &count)
+        if err != nil {
+                // The EvaluateExpr call above already guaranteed us a number value,
+                // so if we end up here then we have something that is out of range
+                // for an int, and the error message will include a description of
+                // the valid range.
+                rawVal := val.AsBigFloat()
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count value",
+                        Detail:   fmt.Sprintf("The number %s is not a valid count value: %s.", rawVal, err),
+                        Subject:  n.Resource.Count.Range().Ptr(),
+                })
+        } else if count < 0 {
+                rawVal := val.AsBigFloat()
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count value",
+                        Detail:   fmt.Sprintf("The number %s is not a valid count value: count must not be negative.", rawVal),
+                        Subject:  n.Resource.Count.Range().Ptr(),
+                })
         }
 
 RETURN:
-        if len(errs) != 0 {
-                err = &EvalValidateError{
-                        Errors: errs,
-                }
-        }
-        return nil, err
+        return nil, diags.NonFatalErr()
 }
 
 // EvalValidateProvider is an EvalNode implementation that validates
-// the configuration of a resource.
+// a provider configuration.
 type EvalValidateProvider struct {
-        Provider *ResourceProvider
-        Config   **ResourceConfig
+        Addr     addrs.ProviderConfig
+        Provider *providers.Interface
+        Config   *configs.Provider
 }
 
 func (n *EvalValidateProvider) Eval(ctx EvalContext) (interface{}, error) {
+        var diags tfdiags.Diagnostics
         provider := *n.Provider
-        config := *n.Config
 
-        warns, errs := provider.Validate(config)
-        if len(warns) == 0 && len(errs) == 0 {
-                return nil, nil
+        configBody := buildProviderConfig(ctx, n.Addr, n.Config)
+
+        resp := provider.GetSchema()
+        diags = diags.Append(resp.Diagnostics)
+        if diags.HasErrors() {
+                return nil, diags.NonFatalErr()
         }
 
-        return nil, &EvalValidateError{
-                Warnings: warns,
-                Errors:   errs,
+        configSchema := resp.Provider.Block
+        if configSchema == nil {
+                // Should never happen in real code, but often comes up in tests where
+                // mock schemas are being used that tend to be incomplete.
+                log.Printf("[WARN] EvalValidateProvider: no config schema is available for %s, so using empty schema", n.Addr)
+                configSchema = &configschema.Block{}
         }
+
+        configVal, configBody, evalDiags := ctx.EvaluateBlock(configBody, configSchema, nil, EvalDataForNoInstanceKey)
+        diags = diags.Append(evalDiags)
+        if evalDiags.HasErrors() {
+                return nil, diags.NonFatalErr()
+        }
+
+        req := providers.PrepareProviderConfigRequest{
+                Config: configVal,
+        }
+
+        validateResp := provider.PrepareProviderConfig(req)
+        diags = diags.Append(validateResp.Diagnostics)
+
+        return nil, diags.NonFatalErr()
 }
 
 // EvalValidateProvisioner is an EvalNode implementation that validates
-// the configuration of a resource.
+// the configuration of a provisioner belonging to a resource. The provisioner
+// config is expected to contain the merged connection configurations.
 type EvalValidateProvisioner struct {
-        Provisioner *ResourceProvisioner
-        Config      **ResourceConfig
-        ConnConfig  **ResourceConfig
+        ResourceAddr     addrs.Resource
+        Provisioner      *provisioners.Interface
+        Schema           **configschema.Block
+        Config           *configs.Provisioner
+        ResourceHasCount bool
 }
 
 func (n *EvalValidateProvisioner) Eval(ctx EvalContext) (interface{}, error) {
         provisioner := *n.Provisioner
         config := *n.Config
-        var warns []string
-        var errs []error
+        schema := *n.Schema
+
+        var diags tfdiags.Diagnostics
 
         {
                 // Validate the provisioner's own config first
-                w, e := provisioner.Validate(config)
-                warns = append(warns, w...)
-                errs = append(errs, e...)
-        }
 
-        {
-                // Now validate the connection config, which might either be from
-                // the provisioner block itself or inherited from the resource's
-                // shared connection info.
-                w, e := n.validateConnConfig(*n.ConnConfig)
-                warns = append(warns, w...)
-                errs = append(errs, e...)
-        }
+                configVal, _, configDiags := n.evaluateBlock(ctx, config.Config, schema)
+                diags = diags.Append(configDiags)
+                if configDiags.HasErrors() {
+                        return nil, diags.Err()
+                }
 
-        if len(warns) == 0 && len(errs) == 0 {
-                return nil, nil
+                if configVal == cty.NilVal {
+                        // Should never happen for a well-behaved EvaluateBlock implementation
+                        return nil, fmt.Errorf("EvaluateBlock returned nil value")
+                }
+
+                req := provisioners.ValidateProvisionerConfigRequest{
+                        Config: configVal,
+                }
+
+                resp := provisioner.ValidateProvisionerConfig(req)
+                diags = diags.Append(resp.Diagnostics)
         }
 
-        return nil, &EvalValidateError{
-                Warnings: warns,
-                Errors:   errs,
+        {
+                // Now validate the connection config, which contains the merged bodies
+                // of the resource and provisioner connection blocks.
+                connDiags := n.validateConnConfig(ctx, config.Connection, n.ResourceAddr)
+                diags = diags.Append(connDiags)
         }
+
+        return nil, diags.NonFatalErr()
 }
 
-func (n *EvalValidateProvisioner) validateConnConfig(connConfig *ResourceConfig) (warns []string, errs []error) {
+func (n *EvalValidateProvisioner) validateConnConfig(ctx EvalContext, config *configs.Connection, self addrs.Referenceable) tfdiags.Diagnostics {
         // We can't comprehensively validate the connection config since its
         // final structure is decided by the communicator and we can't instantiate
         // that until we have a complete instance state. However, we *can* catch
@@ -129,103 +166,379 @@ func (n *EvalValidateProvisioner) validateConnConfig(connConfig *ResourceConfig)
         // typos early rather than waiting until we actually try to run one of
         // the resource's provisioners.
 
-        type connConfigSuperset struct {
-                // All attribute types are interface{} here because at this point we
-                // may still have unresolved interpolation expressions, which will
-                // appear as strings regardless of the final goal type.
+        var diags tfdiags.Diagnostics
 
-                Type       interface{} `mapstructure:"type"`
-                User       interface{} `mapstructure:"user"`
-                Password   interface{} `mapstructure:"password"`
-                Host       interface{} `mapstructure:"host"`
-                Port       interface{} `mapstructure:"port"`
-                Timeout    interface{} `mapstructure:"timeout"`
-                ScriptPath interface{} `mapstructure:"script_path"`
+        if config == nil || config.Config == nil {
+                // No block to validate
+                return diags
+        }
 
-                // For type=ssh only (enforced in ssh communicator)
-                PrivateKey        interface{} `mapstructure:"private_key"`
-                HostKey           interface{} `mapstructure:"host_key"`
-                Agent             interface{} `mapstructure:"agent"`
-                BastionHost       interface{} `mapstructure:"bastion_host"`
-                BastionHostKey    interface{} `mapstructure:"bastion_host_key"`
-                BastionPort       interface{} `mapstructure:"bastion_port"`
-                BastionUser       interface{} `mapstructure:"bastion_user"`
-                BastionPassword   interface{} `mapstructure:"bastion_password"`
-                BastionPrivateKey interface{} `mapstructure:"bastion_private_key"`
-                AgentIdentity     interface{} `mapstructure:"agent_identity"`
+        // We evaluate here just by evaluating the block and returning any
+        // diagnostics we get, since evaluation alone is enough to check for
+        // extraneous arguments and incorrectly-typed arguments.
+        _, _, configDiags := n.evaluateBlock(ctx, config.Config, connectionBlockSupersetSchema)
+        diags = diags.Append(configDiags)
 
-                // For type=winrm only (enforced in winrm communicator)
-                HTTPS    interface{} `mapstructure:"https"`
-                Insecure interface{} `mapstructure:"insecure"`
-                NTLM     interface{} `mapstructure:"use_ntlm"`
-                CACert   interface{} `mapstructure:"cacert"`
-        }
+        return diags
+}
 
-        var metadata mapstructure.Metadata
-        decoder, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{
-                Metadata: &metadata,
-                Result:   &connConfigSuperset{}, // result is disregarded; we only care about unused keys
-        })
-        if err != nil {
-                // should never happen
-                errs = append(errs, err)
-                return
-        }
+func (n *EvalValidateProvisioner) evaluateBlock(ctx EvalContext, body hcl.Body, schema *configschema.Block) (cty.Value, hcl.Body, tfdiags.Diagnostics) {
+        keyData := EvalDataForNoInstanceKey
+        selfAddr := n.ResourceAddr.Instance(addrs.NoKey)
 
-        if err := decoder.Decode(connConfig.Config); err != nil {
-                errs = append(errs, err)
-                return
-        }
+        if n.ResourceHasCount {
+                // For a resource that has count, we allow count.index but don't
+                // know at this stage what it will return.
+                keyData = InstanceKeyEvalData{
+                        CountIndex: cty.UnknownVal(cty.Number),
+                }
 
-        for _, attrName := range metadata.Unused {
-                errs = append(errs, fmt.Errorf("unknown 'connection' argument %q", attrName))
+                // "self" can't point to an unknown key, but we'll force it to be
+                // key 0 here, which should return an unknown value of the
+                // expected type since none of these elements are known at this
+                // point anyway.
+                selfAddr = n.ResourceAddr.Instance(addrs.IntKey(0))
         }
-        return
+
+        return ctx.EvaluateBlock(body, schema, selfAddr, keyData)
+}
+
+// connectionBlockSupersetSchema is a schema representing the superset of all
+// possible arguments for "connection" blocks across all supported connection
+// types.
+//
+// This currently lives here because we've not yet updated our communicator
+// subsystem to be aware of schema itself. Once that is done, we can remove
+// this and use a type-specific schema from the communicator to validate
+// exactly what is expected for a given connection type.
+var connectionBlockSupersetSchema = &configschema.Block{
+        Attributes: map[string]*configschema.Attribute{
+                // NOTE: "type" is not included here because it's treated special
+                // by the config loader and stored away in a separate field.
+
+                // Common attributes for both connection types
+                "host": {
+                        Type:     cty.String,
+                        Required: true,
+                },
+                "type": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "user": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "password": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "port": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "timeout": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "script_path": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+
+                // For type=ssh only (enforced in ssh communicator)
+                "private_key": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "certificate": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "host_key": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "agent": {
+                        Type:     cty.Bool,
+                        Optional: true,
+                },
+                "agent_identity": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "bastion_host": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "bastion_host_key": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "bastion_port": {
+                        Type:     cty.Number,
+                        Optional: true,
+                },
+                "bastion_user": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "bastion_password": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "bastion_private_key": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+
+                // For type=winrm only (enforced in winrm communicator)
+                "https": {
+                        Type:     cty.Bool,
+                        Optional: true,
+                },
+                "insecure": {
+                        Type:     cty.Bool,
+                        Optional: true,
+                },
+                "cacert": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "use_ntlm": {
+                        Type:     cty.Bool,
+                        Optional: true,
+                },
+        },
+}
+
+// connectionBlockSupersetSchema is a schema representing the superset of all
+// possible arguments for "connection" blocks across all supported connection
+// types.
+//
+// This currently lives here because we've not yet updated our communicator
+// subsystem to be aware of schema itself. It's exported only for use in the
+// configs/configupgrade package and should not be used from anywhere else.
+// The caller may not modify any part of the returned schema data structure.
+func ConnectionBlockSupersetSchema() *configschema.Block {
+        return connectionBlockSupersetSchema
 }
 
 // EvalValidateResource is an EvalNode implementation that validates
 // the configuration of a resource.
 type EvalValidateResource struct {
-        Provider     *ResourceProvider
-        Config       **ResourceConfig
-        ResourceName string
-        ResourceType string
-        ResourceMode config.ResourceMode
+        Addr           addrs.Resource
+        Provider       *providers.Interface
+        ProviderSchema **ProviderSchema
+        Config         *configs.Resource
 
         // IgnoreWarnings means that warnings will not be passed through. This allows
         // "just-in-time" passes of validation to continue execution through warnings.
         IgnoreWarnings bool
+
+        // ConfigVal, if non-nil, will be updated with the value resulting from
+        // evaluating the given configuration body. Since validation is performed
+        // very early, this value is likely to contain lots of unknown values,
+        // but its type will conform to the schema of the resource type associated
+        // with the resource instance being validated.
+        ConfigVal *cty.Value
 }
 
 func (n *EvalValidateResource) Eval(ctx EvalContext) (interface{}, error) {
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                return nil, fmt.Errorf("EvalValidateResource has nil schema for %s", n.Addr)
+        }
+
+        var diags tfdiags.Diagnostics
         provider := *n.Provider
         cfg := *n.Config
-        var warns []string
-        var errs []error
+        schema := *n.ProviderSchema
+        mode := cfg.Mode
+
+        keyData := EvalDataForNoInstanceKey
+        if n.Config.Count != nil {
+                // If the config block has count, we'll evaluate with an unknown
+                // number as count.index so we can still type check even though
+                // we won't expand count until the plan phase.
+                keyData = InstanceKeyEvalData{
+                        CountIndex: cty.UnknownVal(cty.Number),
+                }
+
+                // Basic type-checking of the count argument. More complete validation
+                // of this will happen when we DynamicExpand during the plan walk.
+                countDiags := n.validateCount(ctx, n.Config.Count)
+                diags = diags.Append(countDiags)
+        }
+
+        for _, traversal := range n.Config.DependsOn {
+                ref, refDiags := addrs.ParseRef(traversal)
+                diags = diags.Append(refDiags)
+                if len(ref.Remaining) != 0 {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid depends_on reference",
+                                Detail:   "References in depends_on must be to a whole object (resource, etc), not to an attribute of an object.",
+                                Subject:  ref.Remaining.SourceRange().Ptr(),
+                        })
+                }
+
+                // The ref must also refer to something that exists. To test that,
+                // we'll just eval it and count on the fact that our evaluator will
+                // detect references to non-existent objects.
+                if !diags.HasErrors() {
+                        scope := ctx.EvaluationScope(nil, EvalDataForNoInstanceKey)
+                        if scope != nil { // sometimes nil in tests, due to incomplete mocks
+                                _, refDiags = scope.EvalReference(ref, cty.DynamicPseudoType)
+                                diags = diags.Append(refDiags)
+                        }
+                }
+        }
+
         // Provider entry point varies depending on resource mode, because
         // managed resources and data resources are two distinct concepts
         // in the provider abstraction.
-        switch n.ResourceMode {
-        case config.ManagedResourceMode:
-                warns, errs = provider.ValidateResource(n.ResourceType, cfg)
-        case config.DataResourceMode:
-                warns, errs = provider.ValidateDataSource(n.ResourceType, cfg)
-        }
+        switch mode {
+        case addrs.ManagedResourceMode:
+                schema, _ := schema.SchemaForResourceType(mode, cfg.Type)
+                if schema == nil {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid resource type",
+                                Detail:   fmt.Sprintf("The provider %s does not support resource type %q.", cfg.ProviderConfigAddr(), cfg.Type),
+                                Subject:  &cfg.TypeRange,
+                        })
+                        return nil, diags.Err()
+                }
+
+                configVal, _, valDiags := ctx.EvaluateBlock(cfg.Config, schema, nil, keyData)
+                diags = diags.Append(valDiags)
+                if valDiags.HasErrors() {
+                        return nil, diags.Err()
+                }
+
+                if cfg.Managed != nil { // can be nil only in tests with poorly-configured mocks
+                        for _, traversal := range cfg.Managed.IgnoreChanges {
+                                moreDiags := schema.StaticValidateTraversal(traversal)
+                                diags = diags.Append(moreDiags)
+                        }
+                }
+
+                req := providers.ValidateResourceTypeConfigRequest{
+                        TypeName: cfg.Type,
+                        Config:   configVal,
+                }
+
+                resp := provider.ValidateResourceTypeConfig(req)
+                diags = diags.Append(resp.Diagnostics.InConfigBody(cfg.Config))
+
+                if n.ConfigVal != nil {
+                        *n.ConfigVal = configVal
+                }
+
+        case addrs.DataResourceMode:
+                schema, _ := schema.SchemaForResourceType(mode, cfg.Type)
+                if schema == nil {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid data source",
+                                Detail:   fmt.Sprintf("The provider %s does not support data source %q.", cfg.ProviderConfigAddr(), cfg.Type),
+                                Subject:  &cfg.TypeRange,
+                        })
+                        return nil, diags.Err()
+                }
+
+                configVal, _, valDiags := ctx.EvaluateBlock(cfg.Config, schema, nil, keyData)
+                diags = diags.Append(valDiags)
+                if valDiags.HasErrors() {
+                        return nil, diags.Err()
+                }
 
-        // If the resource name doesn't match the name regular
-        // expression, show an error.
-        if !config.NameRegexp.Match([]byte(n.ResourceName)) {
-                errs = append(errs, fmt.Errorf(
-                        "%s: resource name can only contain letters, numbers, "+
-                                "dashes, and underscores.", n.ResourceName))
+                req := providers.ValidateDataSourceConfigRequest{
+                        TypeName: cfg.Type,
+                        Config:   configVal,
+                }
+
+                resp := provider.ValidateDataSourceConfig(req)
+                diags = diags.Append(resp.Diagnostics.InConfigBody(cfg.Config))
         }
 
-        if (len(warns) == 0 || n.IgnoreWarnings) && len(errs) == 0 {
+        if n.IgnoreWarnings {
+                // If we _only_ have warnings then we'll return nil.
+                if diags.HasErrors() {
+                        return nil, diags.NonFatalErr()
+                }
                 return nil, nil
+        } else {
+                // We'll return an error if there are any diagnostics at all, even if
+                // some of them are warnings.
+                return nil, diags.NonFatalErr()
+        }
+}
+
+func (n *EvalValidateResource) validateCount(ctx EvalContext, expr hcl.Expression) tfdiags.Diagnostics {
+        if expr == nil {
+                return nil
+        }
+
+        var diags tfdiags.Diagnostics
+
+        countVal, countDiags := ctx.EvaluateExpr(expr, cty.Number, nil)
+        diags = diags.Append(countDiags)
+        if diags.HasErrors() {
+                return diags
+        }
+
+        if countVal.IsNull() {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   `The given "count" argument value is null. An integer is required.`,
+                        Subject:  expr.Range().Ptr(),
+                })
+                return diags
         }
 
-        return nil, &EvalValidateError{
-                Warnings: warns,
-                Errors:   errs,
+        var err error
+        countVal, err = convert.Convert(countVal, cty.Number)
+        if err != nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   fmt.Sprintf(`The given "count" argument value is unsuitable: %s.`, err),
+                        Subject:  expr.Range().Ptr(),
+                })
+                return diags
         }
+
+        // If the value isn't known then that's the best we can do for now, but
+        // we'll check more thoroughly during the plan walk.
+        if !countVal.IsKnown() {
+                return diags
+        }
+
+        // If we _do_ know the value, then we can do a few more checks here.
+        var count int
+        err = gocty.FromCtyValue(countVal, &count)
+        if err != nil {
+                // Isn't a whole number, etc.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   fmt.Sprintf(`The given "count" argument value is unsuitable: %s.`, err),
+                        Subject:  expr.Range().Ptr(),
+                })
+                return diags
+        }
+
+        if count < 0 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   `The given "count" argument value is unsuitable: count cannot be negative.`,
+                        Subject:  expr.Range().Ptr(),
+                })
+                return diags
+        }
+
+        return diags
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_validate_selfref.go b/vendor/github.com/hashicorp/terraform/terraform/eval_validate_selfref.go
index ae4436a..edd604f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_validate_selfref.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_validate_selfref.go
@@ -3,72 +3,65 @@ package terraform
 import (
         "fmt"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/hcl2/hcl"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
-// EvalValidateResourceSelfRef is an EvalNode implementation that validates that
-// a configuration doesn't contain a reference to the resource itself.
-//
-// This must be done prior to interpolating configuration in order to avoid
-// any infinite loop scenarios.
-type EvalValidateResourceSelfRef struct {
-        Addr   **ResourceAddress
-        Config **config.RawConfig
+// EvalValidateSelfRef is an EvalNode implementation that checks to ensure that
+// expressions within a particular referencable block do not reference that
+// same block.
+type EvalValidateSelfRef struct {
+        Addr           addrs.Referenceable
+        Config         hcl.Body
+        ProviderSchema **ProviderSchema
 }
 
-func (n *EvalValidateResourceSelfRef) Eval(ctx EvalContext) (interface{}, error) {
-        addr := *n.Addr
-        conf := *n.Config
-
-        // Go through the variables and find self references
-        var errs []error
-        for k, raw := range conf.Variables {
-                rv, ok := raw.(*config.ResourceVariable)
-                if !ok {
-                        continue
-                }
-
-                // Build an address from the variable
-                varAddr := &ResourceAddress{
-                        Path:         addr.Path,
-                        Mode:         rv.Mode,
-                        Type:         rv.Type,
-                        Name:         rv.Name,
-                        Index:        rv.Index,
-                        InstanceType: TypePrimary,
-                }
+func (n *EvalValidateSelfRef) Eval(ctx EvalContext) (interface{}, error) {
+        var diags tfdiags.Diagnostics
+        addr := n.Addr
 
-                // If the variable access is a multi-access (*), then we just
-                // match the index so that we'll match our own addr if everything
-                // else matches.
-                if rv.Multi && rv.Index == -1 {
-                        varAddr.Index = addr.Index
-                }
+        addrStrs := make([]string, 0, 1)
+        addrStrs = append(addrStrs, addr.String())
+        switch tAddr := addr.(type) {
+        case addrs.ResourceInstance:
+                // A resource instance may not refer to its containing resource either.
+                addrStrs = append(addrStrs, tAddr.ContainingResource().String())
+        }
 
-                // This is a weird thing where ResourceAddres has index "-1" when
-                // index isn't set at all. This means index "0" for resource access.
-                // So, if we have this scenario, just set our varAddr to -1 so it
-                // matches.
-                if addr.Index == -1 && varAddr.Index == 0 {
-                        varAddr.Index = -1
-                }
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                return nil, fmt.Errorf("provider schema unavailable while validating %s for self-references; this is a bug in Terraform and should be reported", addr)
+        }
 
-                // If the addresses match, then this is a self reference
-                if varAddr.Equals(addr) && varAddr.Index == addr.Index {
-                        errs = append(errs, fmt.Errorf(
-                                "%s: self reference not allowed: %q",
-                                addr, k))
-                }
+        providerSchema := *n.ProviderSchema
+        var schema *configschema.Block
+        switch tAddr := addr.(type) {
+        case addrs.Resource:
+                schema, _ = providerSchema.SchemaForResourceAddr(tAddr)
+        case addrs.ResourceInstance:
+                schema, _ = providerSchema.SchemaForResourceAddr(tAddr.ContainingResource())
         }
 
-        // If no errors, no errors!
-        if len(errs) == 0 {
-                return nil, nil
+        if schema == nil {
+                return nil, fmt.Errorf("no schema available for %s to validate for self-references; this is a bug in Terraform and should be reported", addr)
         }
 
-        // Wrap the errors in the proper wrapper so we can handle validation
-        // formatting properly upstream.
-        return nil, &EvalValidateError{
-                Errors: errs,
+        refs, _ := lang.ReferencesInBlock(n.Config, schema)
+        for _, ref := range refs {
+                for _, addrStr := range addrStrs {
+                        if ref.Subject.String() == addrStr {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Self-referential block",
+                                        Detail:   fmt.Sprintf("Configuration for %s may not refer to itself.", addrStr),
+                                        Subject:  ref.SourceRange.ToHCL().Ptr(),
+                                })
+                        }
+                }
         }
+
+        return nil, diags.NonFatalErr()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_variable.go b/vendor/github.com/hashicorp/terraform/terraform/eval_variable.go
index e39a33c..68adf76 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_variable.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_variable.go
@@ -4,12 +4,17 @@ import (
         "fmt"
         "log"
         "reflect"
-        "strconv"
         "strings"
 
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs"
+
+        "github.com/hashicorp/terraform/addrs"
+
         "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/config/module"
-        "github.com/hashicorp/terraform/helper/hilmapstructure"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
 )
 
 // EvalTypeCheckVariable is an EvalNode which ensures that the variable
@@ -93,166 +98,88 @@ func (n *EvalTypeCheckVariable) Eval(ctx EvalContext) (interface{}, error) {
         return nil, nil
 }
 
-// EvalSetVariables is an EvalNode implementation that sets the variables
-// explicitly for interpolation later.
-type EvalSetVariables struct {
-        Module    *string
-        Variables map[string]interface{}
+// EvalSetModuleCallArguments is an EvalNode implementation that sets values
+// for arguments of a child module call, for later retrieval during
+// expression evaluation.
+type EvalSetModuleCallArguments struct {
+        Module addrs.ModuleCallInstance
+        Values map[string]cty.Value
 }
 
 // TODO: test
-func (n *EvalSetVariables) Eval(ctx EvalContext) (interface{}, error) {
-        ctx.SetVariables(*n.Module, n.Variables)
+func (n *EvalSetModuleCallArguments) Eval(ctx EvalContext) (interface{}, error) {
+        ctx.SetModuleCallArguments(n.Module, n.Values)
         return nil, nil
 }
 
-// EvalVariableBlock is an EvalNode implementation that evaluates the
-// given configuration, and uses the final values as a way to set the
-// mapping.
-type EvalVariableBlock struct {
-        Config         **ResourceConfig
-        VariableValues map[string]interface{}
+// EvalModuleCallArgument is an EvalNode implementation that produces the value
+// for a particular variable as will be used by a child module instance.
+//
+// The result is written into the map given in Values, with its key
+// set to the local name of the variable, disregarding the module instance
+// address. Any existing values in that map are deleted first. This weird
+// interface is a result of trying to be convenient for use with
+// EvalContext.SetModuleCallArguments, which expects a map to merge in with
+// any existing arguments.
+type EvalModuleCallArgument struct {
+        Addr   addrs.InputVariable
+        Config *configs.Variable
+        Expr   hcl.Expression
+
+        // If this flag is set, any diagnostics are discarded and this operation
+        // will always succeed, though may produce an unknown value in the
+        // event of an error.
+        IgnoreDiagnostics bool
+
+        Values map[string]cty.Value
 }
 
-func (n *EvalVariableBlock) Eval(ctx EvalContext) (interface{}, error) {
+func (n *EvalModuleCallArgument) Eval(ctx EvalContext) (interface{}, error) {
         // Clear out the existing mapping
-        for k, _ := range n.VariableValues {
-                delete(n.VariableValues, k)
-        }
-
-        // Get our configuration
-        rc := *n.Config
-        for k, v := range rc.Config {
-                vKind := reflect.ValueOf(v).Type().Kind()
-
-                switch vKind {
-                case reflect.Slice:
-                        var vSlice []interface{}
-                        if err := hilmapstructure.WeakDecode(v, &vSlice); err == nil {
-                                n.VariableValues[k] = vSlice
-                                continue
-                        }
-                case reflect.Map:
-                        var vMap map[string]interface{}
-                        if err := hilmapstructure.WeakDecode(v, &vMap); err == nil {
-                                n.VariableValues[k] = vMap
-                                continue
-                        }
-                default:
-                        var vString string
-                        if err := hilmapstructure.WeakDecode(v, &vString); err == nil {
-                                n.VariableValues[k] = vString
-                                continue
-                        }
-                }
-
-                return nil, fmt.Errorf("Variable value for %s is not a string, list or map type", k)
-        }
-
-        for _, path := range rc.ComputedKeys {
-                log.Printf("[DEBUG] Setting Unknown Variable Value for computed key: %s", path)
-                err := n.setUnknownVariableValueForPath(path)
-                if err != nil {
-                        return nil, err
-                }
+        for k := range n.Values {
+                delete(n.Values, k)
         }
 
-        return nil, nil
-}
-
-func (n *EvalVariableBlock) setUnknownVariableValueForPath(path string) error {
-        pathComponents := strings.Split(path, ".")
-
-        if len(pathComponents) < 1 {
-                return fmt.Errorf("No path comoponents in %s", path)
+        wantType := n.Config.Type
+        name := n.Addr.Name
+        expr := n.Expr
+
+        if expr == nil {
+                // Should never happen, but we'll bail out early here rather than
+                // crash in case it does. We set no value at all in this case,
+                // making a subsequent call to EvalContext.SetModuleCallArguments
+                // a no-op.
+                log.Printf("[ERROR] attempt to evaluate %s with nil expression", n.Addr.String())
+                return nil, nil
         }
 
-        if len(pathComponents) == 1 {
-                // Special case the "top level" since we know the type
-                if _, ok := n.VariableValues[pathComponents[0]]; !ok {
-                        n.VariableValues[pathComponents[0]] = config.UnknownVariableValue
-                }
-                return nil
+        val, diags := ctx.EvaluateExpr(expr, cty.DynamicPseudoType, nil)
+
+        // We intentionally passed DynamicPseudoType to EvaluateExpr above because
+        // now we can do our own local type conversion and produce an error message
+        // with better context if it fails.
+        var convErr error
+        val, convErr = convert.Convert(val, wantType)
+        if convErr != nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid value for module argument",
+                        Detail: fmt.Sprintf(
+                                "The given value is not suitable for child module variable %q defined at %s: %s.",
+                                name, n.Config.DeclRange.String(), convErr,
+                        ),
+                        Subject: expr.Range().Ptr(),
+                })
+                // We'll return a placeholder unknown value to avoid producing
+                // redundant downstream errors.
+                val = cty.UnknownVal(wantType)
         }
 
-        // Otherwise find the correct point in the tree and then set to unknown
-        var current interface{} = n.VariableValues[pathComponents[0]]
-        for i := 1; i < len(pathComponents); i++ {
-                switch tCurrent := current.(type) {
-                case []interface{}:
-                        index, err := strconv.Atoi(pathComponents[i])
-                        if err != nil {
-                                return fmt.Errorf("Cannot convert %s to slice index in path %s",
-                                        pathComponents[i], path)
-                        }
-                        current = tCurrent[index]
-                case []map[string]interface{}:
-                        index, err := strconv.Atoi(pathComponents[i])
-                        if err != nil {
-                                return fmt.Errorf("Cannot convert %s to slice index in path %s",
-                                        pathComponents[i], path)
-                        }
-                        current = tCurrent[index]
-                case map[string]interface{}:
-                        if val, hasVal := tCurrent[pathComponents[i]]; hasVal {
-                                current = val
-                                continue
-                        }
-
-                        tCurrent[pathComponents[i]] = config.UnknownVariableValue
-                        break
-                }
+        n.Values[name] = val
+        if n.IgnoreDiagnostics {
+                return nil, nil
         }
-
-        return nil
-}
-
-// EvalCoerceMapVariable is an EvalNode implementation that recognizes a
-// specific ambiguous HCL parsing situation and resolves it. In HCL parsing, a
-// bare map literal is indistinguishable from a list of maps w/ one element.
-//
-// We take all the same inputs as EvalTypeCheckVariable above, since we need
-// both the target type and the proposed value in order to properly coerce.
-type EvalCoerceMapVariable struct {
-        Variables  map[string]interface{}
-        ModulePath []string
-        ModuleTree *module.Tree
-}
-
-// Eval implements the EvalNode interface. See EvalCoerceMapVariable for
-// details.
-func (n *EvalCoerceMapVariable) Eval(ctx EvalContext) (interface{}, error) {
-        currentTree := n.ModuleTree
-        for _, pathComponent := range n.ModulePath[1:] {
-                currentTree = currentTree.Children()[pathComponent]
-        }
-        targetConfig := currentTree.Config()
-
-        prototypes := make(map[string]config.VariableType)
-        for _, variable := range targetConfig.Variables {
-                prototypes[variable.Name] = variable.Type()
-        }
-
-        for name, declaredType := range prototypes {
-                if declaredType != config.VariableTypeMap {
-                        continue
-                }
-
-                proposedValue, ok := n.Variables[name]
-                if !ok {
-                        continue
-                }
-
-                if list, ok := proposedValue.([]interface{}); ok && len(list) == 1 {
-                        if m, ok := list[0].(map[string]interface{}); ok {
-                                log.Printf("[DEBUG] EvalCoerceMapVariable: "+
-                                        "Coercing single element list into map: %#v", m)
-                                n.Variables[name] = m
-                        }
-                }
-        }
-
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
 
 // hclTypeName returns the name of the type that would represent this value in
diff --git a/vendor/github.com/hashicorp/terraform/terraform/evaltree_provider.go b/vendor/github.com/hashicorp/terraform/terraform/evaltree_provider.go
index 0c3da48..6b4df67 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/evaltree_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/evaltree_provider.go
@@ -1,48 +1,34 @@
 package terraform
 
 import (
-        "strings"
-
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/providers"
 )
 
 // ProviderEvalTree returns the evaluation tree for initializing and
 // configuring providers.
-func ProviderEvalTree(n *NodeApplyableProvider, config *config.ProviderConfig) EvalNode {
-        var provider ResourceProvider
-        var resourceConfig *ResourceConfig
+func ProviderEvalTree(n *NodeApplyableProvider, config *configs.Provider) EvalNode {
+        var provider providers.Interface
 
-        typeName := strings.SplitN(n.NameValue, ".", 2)[0]
+        addr := n.Addr
+        relAddr := addr.ProviderConfig
 
         seq := make([]EvalNode, 0, 5)
         seq = append(seq, &EvalInitProvider{
-                TypeName: typeName,
-                Name:     n.Name(),
+                TypeName: relAddr.Type,
+                Addr:     addr.ProviderConfig,
         })
 
         // Input stuff
         seq = append(seq, &EvalOpFilter{
-                Ops: []walkOperation{walkInput, walkImport},
+                Ops: []walkOperation{walkImport},
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalGetProvider{
-                                        Name:   n.Name(),
+                                        Addr:   addr,
                                         Output: &provider,
                                 },
-                                &EvalInterpolateProvider{
-                                        Config: config,
-                                        Output: &resourceConfig,
-                                },
-                                &EvalBuildProviderConfig{
-                                        Provider: n.NameValue,
-                                        Config:   &resourceConfig,
-                                        Output:   &resourceConfig,
-                                },
-                                &EvalInputProvider{
-                                        Name:     n.NameValue,
-                                        Provider: &provider,
-                                        Config:   &resourceConfig,
-                                },
                         },
                 },
         })
@@ -52,21 +38,13 @@ func ProviderEvalTree(n *NodeApplyableProvider, config *config.ProviderConfig) E
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalGetProvider{
-                                        Name:   n.Name(),
+                                        Addr:   addr,
                                         Output: &provider,
                                 },
-                                &EvalInterpolateProvider{
-                                        Config: config,
-                                        Output: &resourceConfig,
-                                },
-                                &EvalBuildProviderConfig{
-                                        Provider: n.NameValue,
-                                        Config:   &resourceConfig,
-                                        Output:   &resourceConfig,
-                                },
                                 &EvalValidateProvider{
+                                        Addr:     relAddr,
                                         Provider: &provider,
-                                        Config:   &resourceConfig,
+                                        Config:   config,
                                 },
                         },
                 },
@@ -78,18 +56,9 @@ func ProviderEvalTree(n *NodeApplyableProvider, config *config.ProviderConfig) E
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalGetProvider{
-                                        Name:   n.Name(),
+                                        Addr:   addr,
                                         Output: &provider,
                                 },
-                                &EvalInterpolateProvider{
-                                        Config: config,
-                                        Output: &resourceConfig,
-                                },
-                                &EvalBuildProviderConfig{
-                                        Provider: n.NameValue,
-                                        Config:   &resourceConfig,
-                                        Output:   &resourceConfig,
-                                },
                         },
                 },
         })
@@ -101,8 +70,9 @@ func ProviderEvalTree(n *NodeApplyableProvider, config *config.ProviderConfig) E
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalConfigProvider{
-                                        Provider: n.Name(),
-                                        Config:   &resourceConfig,
+                                        Addr:     relAddr,
+                                        Provider: &provider,
+                                        Config:   config,
                                 },
                         },
                 },
@@ -113,6 +83,6 @@ func ProviderEvalTree(n *NodeApplyableProvider, config *config.ProviderConfig) E
 
 // CloseProviderEvalTree returns the evaluation tree for closing
 // provider connections that aren't needed anymore.
-func CloseProviderEvalTree(n string) EvalNode {
-        return &EvalCloseProvider{Name: n}
+func CloseProviderEvalTree(addr addrs.AbsProviderConfig) EvalNode {
+        return &EvalCloseProvider{Addr: addr.ProviderConfig}
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/evaluate.go b/vendor/github.com/hashicorp/terraform/terraform/evaluate.go
new file mode 100644
index 0000000..ab65d47
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/evaluate.go
@@ -0,0 +1,933 @@
+package terraform
+
+import (
+        "fmt"
+        "log"
+        "os"
+        "path/filepath"
+        "strconv"
+        "sync"
+
+        "github.com/agext/levenshtein"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// Evaluator provides the necessary contextual data for evaluating expressions
+// for a particular walk operation.
+type Evaluator struct {
+        // Operation defines what type of operation this evaluator is being used
+        // for.
+        Operation walkOperation
+
+        // Meta is contextual metadata about the current operation.
+        Meta *ContextMeta
+
+        // Config is the root node in the configuration tree.
+        Config *configs.Config
+
+        // VariableValues is a map from variable names to their associated values,
+        // within the module indicated by ModulePath. VariableValues is modified
+        // concurrently, and so it must be accessed only while holding
+        // VariableValuesLock.
+        //
+        // The first map level is string representations of addr.ModuleInstance
+        // values, while the second level is variable names.
+        VariableValues     map[string]map[string]cty.Value
+        VariableValuesLock *sync.Mutex
+
+        // Schemas is a repository of all of the schemas we should need to
+        // evaluate expressions. This must be constructed by the caller to
+        // include schemas for all of the providers, resource types, data sources
+        // and provisioners used by the given configuration and state.
+        //
+        // This must not be mutated during evaluation.
+        Schemas *Schemas
+
+        // State is the current state, embedded in a wrapper that ensures that
+        // it can be safely accessed and modified concurrently.
+        State *states.SyncState
+
+        // Changes is the set of proposed changes, embedded in a wrapper that
+        // ensures they can be safely accessed and modified concurrently.
+        Changes *plans.ChangesSync
+}
+
+// Scope creates an evaluation scope for the given module path and optional
+// resource.
+//
+// If the "self" argument is nil then the "self" object is not available
+// in evaluated expressions. Otherwise, it behaves as an alias for the given
+// address.
+func (e *Evaluator) Scope(data lang.Data, self addrs.Referenceable) *lang.Scope {
+        return &lang.Scope{
+                Data:     data,
+                SelfAddr: self,
+                PureOnly: e.Operation != walkApply && e.Operation != walkDestroy,
+                BaseDir:  ".", // Always current working directory for now.
+        }
+}
+
+// evaluationStateData is an implementation of lang.Data that resolves
+// references primarily (but not exclusively) using information from a State.
+type evaluationStateData struct {
+        Evaluator *Evaluator
+
+        // ModulePath is the path through the dynamic module tree to the module
+        // that references will be resolved relative to.
+        ModulePath addrs.ModuleInstance
+
+        // InstanceKeyData describes the values, if any, that are accessible due
+        // to repetition of a containing object using "count" or "for_each"
+        // arguments. (It is _not_ used for the for_each inside "dynamic" blocks,
+        // since the user specifies in that case which variable name to locally
+        // shadow.)
+        InstanceKeyData InstanceKeyEvalData
+
+        // Operation records the type of walk the evaluationStateData is being used
+        // for.
+        Operation walkOperation
+}
+
+// InstanceKeyEvalData is used during evaluation to specify which values,
+// if any, should be produced for count.index, each.key, and each.value.
+type InstanceKeyEvalData struct {
+        // CountIndex is the value for count.index, or cty.NilVal if evaluating
+        // in a context where the "count" argument is not active.
+        //
+        // For correct operation, this should always be of type cty.Number if not
+        // nil.
+        CountIndex cty.Value
+
+        // EachKey and EachValue are the values for each.key and each.value
+        // respectively, or cty.NilVal if evaluating in a context where the
+        // "for_each" argument is not active. These must either both be set
+        // or neither set.
+        //
+        // For correct operation, EachKey must always be either of type cty.String
+        // or cty.Number if not nil.
+        EachKey, EachValue cty.Value
+}
+
+// EvalDataForInstanceKey constructs a suitable InstanceKeyEvalData for
+// evaluating in a context that has the given instance key.
+func EvalDataForInstanceKey(key addrs.InstanceKey) InstanceKeyEvalData {
+        // At the moment we don't actually implement for_each, so we only
+        // ever populate CountIndex.
+        // (When we implement for_each later we may need to reorganize this some,
+        // so that we can resolve the ambiguity that an int key may either be
+        // a count.index or an each.key where for_each is over a list.)
+
+        var countIdx cty.Value
+        if intKey, ok := key.(addrs.IntKey); ok {
+                countIdx = cty.NumberIntVal(int64(intKey))
+        }
+
+        return InstanceKeyEvalData{
+                CountIndex: countIdx,
+        }
+}
+
+// EvalDataForNoInstanceKey is a value of InstanceKeyData that sets no instance
+// key values at all, suitable for use in contexts where no keyed instance
+// is relevant.
+var EvalDataForNoInstanceKey = InstanceKeyEvalData{}
+
+// evaluationStateData must implement lang.Data
+var _ lang.Data = (*evaluationStateData)(nil)
+
+func (d *evaluationStateData) GetCountAttr(addr addrs.CountAttr, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        switch addr.Name {
+
+        case "index":
+                idxVal := d.InstanceKeyData.CountIndex
+                if idxVal == cty.NilVal {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  `Reference to "count" in non-counted context`,
+                                Detail:   fmt.Sprintf(`The "count" object can be used only in "resource" and "data" blocks, and only when the "count" argument is set.`),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                        return cty.UnknownVal(cty.Number), diags
+                }
+                return idxVal, diags
+
+        default:
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid "count" attribute`,
+                        Detail:   fmt.Sprintf(`The "count" object does not have an attribute named %q. The only supported attribute is count.index, which is the index of each instance of a resource block that has the "count" argument set.`, addr.Name),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+}
+
+func (d *evaluationStateData) GetInputVariable(addr addrs.InputVariable, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // First we'll make sure the requested value is declared in configuration,
+        // so we can produce a nice message if not.
+        moduleConfig := d.Evaluator.Config.DescendentForInstance(d.ModulePath)
+        if moduleConfig == nil {
+                // should never happen, since we can't be evaluating in a module
+                // that wasn't mentioned in configuration.
+                panic(fmt.Sprintf("input variable read from %s, which has no configuration", d.ModulePath))
+        }
+
+        config := moduleConfig.Module.Variables[addr.Name]
+        if config == nil {
+                var suggestions []string
+                for k := range moduleConfig.Module.Variables {
+                        suggestions = append(suggestions, k)
+                }
+                suggestion := nameSuggestion(addr.Name, suggestions)
+                if suggestion != "" {
+                        suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+                } else {
+                        suggestion = fmt.Sprintf(" This variable can be declared with a variable %q {} block.", addr.Name)
+                }
+
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared input variable`,
+                        Detail:   fmt.Sprintf(`An input variable with the name %q has not been declared.%s`, addr.Name, suggestion),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        wantType := cty.DynamicPseudoType
+        if config.Type != cty.NilType {
+                wantType = config.Type
+        }
+
+        d.Evaluator.VariableValuesLock.Lock()
+        defer d.Evaluator.VariableValuesLock.Unlock()
+
+        // During the validate walk, input variables are always unknown so
+        // that we are validating the configuration for all possible input values
+        // rather than for a specific set. Checking against a specific set of
+        // input values then happens during the plan walk.
+        //
+        // This is important because otherwise the validation walk will tend to be
+        // overly strict, requiring expressions throughout the configuration to
+        // be complicated to accommodate all possible inputs, whereas returning
+        // known here allows for simpler patterns like using input values as
+        // guards to broadly enable/disable resources, avoid processing things
+        // that are disabled, etc. Terraform's static validation leans towards
+        // being liberal in what it accepts because the subsequent plan walk has
+        // more information available and so can be more conservative.
+        if d.Operation == walkValidate {
+                return cty.UnknownVal(wantType), diags
+        }
+
+        moduleAddrStr := d.ModulePath.String()
+        vals := d.Evaluator.VariableValues[moduleAddrStr]
+        if vals == nil {
+                return cty.UnknownVal(wantType), diags
+        }
+
+        val, isSet := vals[addr.Name]
+        if !isSet {
+                if config.Default != cty.NilVal {
+                        return config.Default, diags
+                }
+                return cty.UnknownVal(wantType), diags
+        }
+
+        var err error
+        val, err = convert.Convert(val, wantType)
+        if err != nil {
+                // We should never get here because this problem should've been caught
+                // during earlier validation, but we'll do something reasonable anyway.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Incorrect variable type`,
+                        Detail:   fmt.Sprintf(`The resolved value of variable %q is not appropriate: %s.`, addr.Name, err),
+                        Subject:  &config.DeclRange,
+                })
+                // Stub out our return value so that the semantic checker doesn't
+                // produce redundant downstream errors.
+                val = cty.UnknownVal(wantType)
+        }
+
+        return val, diags
+}
+
+func (d *evaluationStateData) GetLocalValue(addr addrs.LocalValue, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // First we'll make sure the requested value is declared in configuration,
+        // so we can produce a nice message if not.
+        moduleConfig := d.Evaluator.Config.DescendentForInstance(d.ModulePath)
+        if moduleConfig == nil {
+                // should never happen, since we can't be evaluating in a module
+                // that wasn't mentioned in configuration.
+                panic(fmt.Sprintf("local value read from %s, which has no configuration", d.ModulePath))
+        }
+
+        config := moduleConfig.Module.Locals[addr.Name]
+        if config == nil {
+                var suggestions []string
+                for k := range moduleConfig.Module.Locals {
+                        suggestions = append(suggestions, k)
+                }
+                suggestion := nameSuggestion(addr.Name, suggestions)
+                if suggestion != "" {
+                        suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+                }
+
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared local value`,
+                        Detail:   fmt.Sprintf(`A local value with the name %q has not been declared.%s`, addr.Name, suggestion),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        val := d.Evaluator.State.LocalValue(addr.Absolute(d.ModulePath))
+        if val == cty.NilVal {
+                // Not evaluated yet?
+                val = cty.DynamicVal
+        }
+
+        return val, diags
+}
+
+func (d *evaluationStateData) GetModuleInstance(addr addrs.ModuleCallInstance, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // Output results live in the module that declares them, which is one of
+        // the child module instances of our current module path.
+        moduleAddr := addr.ModuleInstance(d.ModulePath)
+
+        // We'll consult the configuration to see what output names we are
+        // expecting, so we can ensure the resulting object is of the expected
+        // type even if our data is incomplete for some reason.
+        moduleConfig := d.Evaluator.Config.DescendentForInstance(moduleAddr)
+        if moduleConfig == nil {
+                // should never happen, since this should've been caught during
+                // static validation.
+                panic(fmt.Sprintf("output value read from %s, which has no configuration", moduleAddr))
+        }
+        outputConfigs := moduleConfig.Module.Outputs
+
+        vals := map[string]cty.Value{}
+        for n := range outputConfigs {
+                addr := addrs.OutputValue{Name: n}.Absolute(moduleAddr)
+
+                // If a pending change is present in our current changeset then its value
+                // takes priority over what's in state. (It will usually be the same but
+                // will differ if the new value is unknown during planning.)
+                if changeSrc := d.Evaluator.Changes.GetOutputChange(addr); changeSrc != nil {
+                        change, err := changeSrc.Decode()
+                        if err != nil {
+                                // This should happen only if someone has tampered with a plan
+                                // file, so we won't bother with a pretty error for it.
+                                diags = diags.Append(fmt.Errorf("planned change for %s could not be decoded: %s", addr, err))
+                                vals[n] = cty.DynamicVal
+                                continue
+                        }
+                        // We care only about the "after" value, which is the value this output
+                        // will take on after the plan is applied.
+                        vals[n] = change.After
+                } else {
+                        os := d.Evaluator.State.OutputValue(addr)
+                        if os == nil {
+                                // Not evaluated yet?
+                                vals[n] = cty.DynamicVal
+                                continue
+                        }
+                        vals[n] = os.Value
+                }
+        }
+        return cty.ObjectVal(vals), diags
+}
+
+func (d *evaluationStateData) GetModuleInstanceOutput(addr addrs.ModuleCallOutput, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // Output results live in the module that declares them, which is one of
+        // the child module instances of our current module path.
+        absAddr := addr.AbsOutputValue(d.ModulePath)
+        moduleAddr := absAddr.Module
+
+        // First we'll consult the configuration to see if an output of this
+        // name is declared at all.
+        moduleConfig := d.Evaluator.Config.DescendentForInstance(moduleAddr)
+        if moduleConfig == nil {
+                // this doesn't happen in normal circumstances due to our validation
+                // pass, but it can turn up in some unusual situations, like in the
+                // "terraform console" repl where arbitrary expressions can be
+                // evaluated.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared module`,
+                        Detail:   fmt.Sprintf(`The configuration contains no %s.`, moduleAddr),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        config := moduleConfig.Module.Outputs[addr.Name]
+        if config == nil {
+                var suggestions []string
+                for k := range moduleConfig.Module.Outputs {
+                        suggestions = append(suggestions, k)
+                }
+                suggestion := nameSuggestion(addr.Name, suggestions)
+                if suggestion != "" {
+                        suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+                }
+
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared output value`,
+                        Detail:   fmt.Sprintf(`An output value with the name %q has not been declared in %s.%s`, addr.Name, moduleDisplayAddr(moduleAddr), suggestion),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        // If a pending change is present in our current changeset then its value
+        // takes priority over what's in state. (It will usually be the same but
+        // will differ if the new value is unknown during planning.)
+        if changeSrc := d.Evaluator.Changes.GetOutputChange(absAddr); changeSrc != nil {
+                change, err := changeSrc.Decode()
+                if err != nil {
+                        // This should happen only if someone has tampered with a plan
+                        // file, so we won't bother with a pretty error for it.
+                        diags = diags.Append(fmt.Errorf("planned change for %s could not be decoded: %s", absAddr, err))
+                        return cty.DynamicVal, diags
+                }
+                // We care only about the "after" value, which is the value this output
+                // will take on after the plan is applied.
+                return change.After, diags
+        }
+
+        os := d.Evaluator.State.OutputValue(absAddr)
+        if os == nil {
+                // Not evaluated yet?
+                return cty.DynamicVal, diags
+        }
+
+        return os.Value, diags
+}
+
+func (d *evaluationStateData) GetPathAttr(addr addrs.PathAttr, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        switch addr.Name {
+
+        case "cwd":
+                wd, err := os.Getwd()
+                if err != nil {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  `Failed to get working directory`,
+                                Detail:   fmt.Sprintf(`The value for path.cwd cannot be determined due to a system error: %s`, err),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                        return cty.DynamicVal, diags
+                }
+                return cty.StringVal(filepath.ToSlash(wd)), diags
+
+        case "module":
+                moduleConfig := d.Evaluator.Config.DescendentForInstance(d.ModulePath)
+                if moduleConfig == nil {
+                        // should never happen, since we can't be evaluating in a module
+                        // that wasn't mentioned in configuration.
+                        panic(fmt.Sprintf("module.path read from module %s, which has no configuration", d.ModulePath))
+                }
+                sourceDir := moduleConfig.Module.SourceDir
+                return cty.StringVal(filepath.ToSlash(sourceDir)), diags
+
+        case "root":
+                sourceDir := d.Evaluator.Config.Module.SourceDir
+                return cty.StringVal(filepath.ToSlash(sourceDir)), diags
+
+        default:
+                suggestion := nameSuggestion(addr.Name, []string{"cwd", "module", "root"})
+                if suggestion != "" {
+                        suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+                }
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid "path" attribute`,
+                        Detail:   fmt.Sprintf(`The "path" object does not have an attribute named %q.%s`, addr.Name, suggestion),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+}
+
+func (d *evaluationStateData) GetResourceInstance(addr addrs.ResourceInstance, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // Although we are giving a ResourceInstance address here, if it has
+        // a key of addrs.NoKey then it might actually be a request for all of
+        // the instances of a particular resource. The reference resolver can't
+        // resolve the ambiguity itself, so we must do it in here.
+
+        // First we'll consult the configuration to see if an resource of this
+        // name is declared at all.
+        moduleAddr := d.ModulePath
+        moduleConfig := d.Evaluator.Config.DescendentForInstance(moduleAddr)
+        if moduleConfig == nil {
+                // should never happen, since we can't be evaluating in a module
+                // that wasn't mentioned in configuration.
+                panic(fmt.Sprintf("resource value read from %s, which has no configuration", moduleAddr))
+        }
+
+        config := moduleConfig.Module.ResourceByAddr(addr.ContainingResource())
+        if config == nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared resource`,
+                        Detail:   fmt.Sprintf(`A resource %q %q has not been declared in %s`, addr.Resource.Type, addr.Resource.Name, moduleDisplayAddr(moduleAddr)),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        // First we'll find the state for the resource as a whole, and decide
+        // from there whether we're going to interpret the given address as a
+        // resource or a resource instance address.
+        rs := d.Evaluator.State.Resource(addr.ContainingResource().Absolute(d.ModulePath))
+
+        if rs == nil {
+                schema := d.getResourceSchema(addr.ContainingResource(), config.ProviderConfigAddr().Absolute(d.ModulePath))
+
+                // If it doesn't exist at all then we can't reliably determine whether
+                // single-instance or whole-resource interpretation was intended, but
+                // we can decide this partially...
+                if addr.Key != addrs.NoKey {
+                        // If there's an instance key then the user must be intending
+                        // single-instance interpretation, and so we can return a
+                        // properly-typed unknown value to help with type checking.
+                        return cty.UnknownVal(schema.ImpliedType()), diags
+                }
+
+                // otherwise we must return DynamicVal so that both interpretations
+                // can proceed without generating errors, and we'll deal with this
+                // in a later step where more information is gathered.
+                // (In practice we should only end up here during the validate walk,
+                // since later walks should have at least partial states populated
+                // for all resources in the configuration.)
+                return cty.DynamicVal, diags
+        }
+
+        // Break out early during validation, because resource may not be expanded
+        // yet and indexed references may show up as invalid.
+        if d.Operation == walkValidate {
+                return cty.DynamicVal, diags
+        }
+
+        schema := d.getResourceSchema(addr.ContainingResource(), rs.ProviderConfig)
+
+        // If we are able to automatically convert to the "right" type of instance
+        // key for this each mode then we'll do so, to match with how we generally
+        // treat values elsewhere in the language. This allows code below to
+        // assume that any possible conversions have already been dealt with and
+        // just worry about validation.
+        key := d.coerceInstanceKey(addr.Key, rs.EachMode)
+
+        multi := false
+
+        switch rs.EachMode {
+        case states.NoEach:
+                if key != addrs.NoKey {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid resource index",
+                                Detail:   fmt.Sprintf("Resource %s does not have either \"count\" or \"for_each\" set, so it cannot be indexed.", addr.ContainingResource()),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                        return cty.DynamicVal, diags
+                }
+        case states.EachList:
+                multi = key == addrs.NoKey
+                if _, ok := addr.Key.(addrs.IntKey); !multi && !ok {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid resource index",
+                                Detail:   fmt.Sprintf("Resource %s must be indexed with a number value.", addr.ContainingResource()),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                        return cty.DynamicVal, diags
+                }
+        case states.EachMap:
+                multi = key == addrs.NoKey
+                if _, ok := addr.Key.(addrs.IntKey); !multi && !ok {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid resource index",
+                                Detail:   fmt.Sprintf("Resource %s must be indexed with a string value.", addr.ContainingResource()),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                        return cty.DynamicVal, diags
+                }
+        }
+
+        if !multi {
+                log.Printf("[TRACE] GetResourceInstance: %s is a single instance", addr)
+                is := rs.Instance(key)
+                if is == nil {
+                        return cty.UnknownVal(schema.ImpliedType()), diags
+                }
+                return d.getResourceInstanceSingle(addr, rng, is, config, rs.ProviderConfig)
+        }
+
+        log.Printf("[TRACE] GetResourceInstance: %s has multiple keyed instances", addr)
+        return d.getResourceInstancesAll(addr.ContainingResource(), rng, config, rs, rs.ProviderConfig)
+}
+
+func (d *evaluationStateData) getResourceInstanceSingle(addr addrs.ResourceInstance, rng tfdiags.SourceRange, is *states.ResourceInstance, config *configs.Resource, providerAddr addrs.AbsProviderConfig) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        schema := d.getResourceSchema(addr.ContainingResource(), providerAddr)
+        if schema == nil {
+                // This shouldn't happen, since validation before we get here should've
+                // taken care of it, but we'll show a reasonable error message anyway.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Missing resource type schema`,
+                        Detail:   fmt.Sprintf("No schema is available for %s in %s. This is a bug in Terraform and should be reported.", addr, providerAddr),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        ty := schema.ImpliedType()
+        if is == nil || is.Current == nil {
+                // Assume we're dealing with an instance that hasn't been created yet.
+                return cty.UnknownVal(ty), diags
+        }
+
+        if is.Current.Status == states.ObjectPlanned {
+                // If there's a pending change for this instance in our plan, we'll prefer
+                // that. This is important because the state can't represent unknown values
+                // and so its data is inaccurate when changes are pending.
+                if change := d.Evaluator.Changes.GetResourceInstanceChange(addr.Absolute(d.ModulePath), states.CurrentGen); change != nil {
+                        val, err := change.After.Decode(ty)
+                        if err != nil {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid resource instance data in plan",
+                                        Detail:   fmt.Sprintf("Instance %s data could not be decoded from the plan: %s.", addr.Absolute(d.ModulePath), err),
+                                        Subject:  &config.DeclRange,
+                                })
+                                return cty.UnknownVal(ty), diags
+                        }
+                        return val, diags
+                } else {
+                        // If the object is in planned status then we should not
+                        // get here, since we should've found a pending value
+                        // in the plan above instead.
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing pending object in plan",
+                                Detail:   fmt.Sprintf("Instance %s is marked as having a change pending but that change is not recorded in the plan. This is a bug in Terraform; please report it.", addr),
+                                Subject:  &config.DeclRange,
+                        })
+                        return cty.UnknownVal(ty), diags
+                }
+        }
+
+        ios, err := is.Current.Decode(ty)
+        if err != nil {
+                // This shouldn't happen, since by the time we get here
+                // we should've upgraded the state data already.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid resource instance data in state",
+                        Detail:   fmt.Sprintf("Instance %s data could not be decoded from the state: %s.", addr.Absolute(d.ModulePath), err),
+                        Subject:  &config.DeclRange,
+                })
+                return cty.UnknownVal(ty), diags
+        }
+
+        return ios.Value, diags
+}
+
+func (d *evaluationStateData) getResourceInstancesAll(addr addrs.Resource, rng tfdiags.SourceRange, config *configs.Resource, rs *states.Resource, providerAddr addrs.AbsProviderConfig) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        schema := d.getResourceSchema(addr, providerAddr)
+        if schema == nil {
+                // This shouldn't happen, since validation before we get here should've
+                // taken care of it, but we'll show a reasonable error message anyway.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Missing resource type schema`,
+                        Detail:   fmt.Sprintf("No schema is available for %s in %s. This is a bug in Terraform and should be reported.", addr, providerAddr),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        switch rs.EachMode {
+
+        case states.EachList:
+                // We need to infer the length of our resulting tuple by searching
+                // for the max IntKey in our instances map.
+                length := 0
+                for k := range rs.Instances {
+                        if ik, ok := k.(addrs.IntKey); ok {
+                                if int(ik) >= length {
+                                        length = int(ik) + 1
+                                }
+                        }
+                }
+
+                vals := make([]cty.Value, length)
+                for i := 0; i < length; i++ {
+                        ty := schema.ImpliedType()
+                        key := addrs.IntKey(i)
+                        is, exists := rs.Instances[key]
+                        if exists {
+                                instAddr := addr.Instance(key).Absolute(d.ModulePath)
+
+                                // Prefer pending value in plan if present. See getResourceInstanceSingle
+                                // comment for the rationale.
+                                if is.Current.Status == states.ObjectPlanned {
+                                        if change := d.Evaluator.Changes.GetResourceInstanceChange(instAddr, states.CurrentGen); change != nil {
+                                                val, err := change.After.Decode(ty)
+                                                if err != nil {
+                                                        diags = diags.Append(&hcl.Diagnostic{
+                                                                Severity: hcl.DiagError,
+                                                                Summary:  "Invalid resource instance data in plan",
+                                                                Detail:   fmt.Sprintf("Instance %s data could not be decoded from the plan: %s.", instAddr, err),
+                                                                Subject:  &config.DeclRange,
+                                                        })
+                                                        continue
+                                                }
+                                                vals[i] = val
+                                                continue
+                                        } else {
+                                                // If the object is in planned status then we should not
+                                                // get here, since we should've found a pending value
+                                                // in the plan above instead.
+                                                diags = diags.Append(&hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Missing pending object in plan",
+                                                        Detail:   fmt.Sprintf("Instance %s is marked as having a change pending but that change is not recorded in the plan. This is a bug in Terraform; please report it.", instAddr),
+                                                        Subject:  &config.DeclRange,
+                                                })
+                                                continue
+                                        }
+                                }
+
+                                ios, err := is.Current.Decode(ty)
+                                if err != nil {
+                                        // This shouldn't happen, since by the time we get here
+                                        // we should've upgraded the state data already.
+                                        diags = diags.Append(&hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Invalid resource instance data in state",
+                                                Detail:   fmt.Sprintf("Instance %s data could not be decoded from the state: %s.", instAddr, err),
+                                                Subject:  &config.DeclRange,
+                                        })
+                                        continue
+                                }
+                                vals[i] = ios.Value
+                        } else {
+                                // There shouldn't normally be "gaps" in our list but we'll
+                                // allow it under the assumption that we're in a weird situation
+                                // where e.g. someone has run "terraform state mv" to reorder
+                                // a list and left a hole behind.
+                                vals[i] = cty.UnknownVal(schema.ImpliedType())
+                        }
+                }
+
+                // We use a tuple rather than a list here because resource schemas may
+                // include dynamically-typed attributes, which will then cause each
+                // instance to potentially have a different runtime type even though
+                // they all conform to the static schema.
+                return cty.TupleVal(vals), diags
+
+        case states.EachMap:
+                ty := schema.ImpliedType()
+                vals := make(map[string]cty.Value, len(rs.Instances))
+                for k, is := range rs.Instances {
+                        if sk, ok := k.(addrs.StringKey); ok {
+                                instAddr := addr.Instance(k).Absolute(d.ModulePath)
+
+                                // Prefer pending value in plan if present. See getResourceInstanceSingle
+                                // comment for the rationale.
+                                // Prefer pending value in plan if present. See getResourceInstanceSingle
+                                // comment for the rationale.
+                                if is.Current.Status == states.ObjectPlanned {
+                                        if change := d.Evaluator.Changes.GetResourceInstanceChange(instAddr, states.CurrentGen); change != nil {
+                                                val, err := change.After.Decode(ty)
+                                                if err != nil {
+                                                        diags = diags.Append(&hcl.Diagnostic{
+                                                                Severity: hcl.DiagError,
+                                                                Summary:  "Invalid resource instance data in plan",
+                                                                Detail:   fmt.Sprintf("Instance %s data could not be decoded from the plan: %s.", instAddr, err),
+                                                                Subject:  &config.DeclRange,
+                                                        })
+                                                        continue
+                                                }
+                                                vals[string(sk)] = val
+                                                continue
+                                        } else {
+                                                // If the object is in planned status then we should not
+                                                // get here, since we should've found a pending value
+                                                // in the plan above instead.
+                                                diags = diags.Append(&hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Missing pending object in plan",
+                                                        Detail:   fmt.Sprintf("Instance %s is marked as having a change pending but that change is not recorded in the plan. This is a bug in Terraform; please report it.", instAddr),
+                                                        Subject:  &config.DeclRange,
+                                                })
+                                                continue
+                                        }
+                                }
+
+                                ios, err := is.Current.Decode(ty)
+                                if err != nil {
+                                        // This shouldn't happen, since by the time we get here
+                                        // we should've upgraded the state data already.
+                                        diags = diags.Append(&hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Invalid resource instance data in state",
+                                                Detail:   fmt.Sprintf("Instance %s data could not be decoded from the state: %s.", instAddr, err),
+                                                Subject:  &config.DeclRange,
+                                        })
+                                        continue
+                                }
+                                vals[string(sk)] = ios.Value
+                        }
+                }
+
+                // We use an object rather than a map here because resource schemas may
+                // include dynamically-typed attributes, which will then cause each
+                // instance to potentially have a different runtime type even though
+                // they all conform to the static schema.
+                return cty.ObjectVal(vals), diags
+
+        default:
+                // Should never happen since caller should deal with other modes
+                panic(fmt.Sprintf("unsupported EachMode %s", rs.EachMode))
+        }
+}
+
+func (d *evaluationStateData) getResourceSchema(addr addrs.Resource, providerAddr addrs.AbsProviderConfig) *configschema.Block {
+        providerType := providerAddr.ProviderConfig.Type
+        schemas := d.Evaluator.Schemas
+        schema, _ := schemas.ResourceTypeConfig(providerType, addr.Mode, addr.Type)
+        return schema
+}
+
+// coerceInstanceKey attempts to convert the given key to the type expected
+// for the given EachMode.
+//
+// If the key is already of the correct type or if it cannot be converted then
+// it is returned verbatim. If conversion is required and possible, the
+// converted value is returned. Callers should not try to determine if
+// conversion was possible, should instead just check if the result is of
+// the expected type.
+func (d *evaluationStateData) coerceInstanceKey(key addrs.InstanceKey, mode states.EachMode) addrs.InstanceKey {
+        if key == addrs.NoKey {
+                // An absent key can't be converted
+                return key
+        }
+
+        switch mode {
+        case states.NoEach:
+                // No conversions possible at all
+                return key
+        case states.EachMap:
+                if intKey, isInt := key.(addrs.IntKey); isInt {
+                        return addrs.StringKey(strconv.Itoa(int(intKey)))
+                }
+                return key
+        case states.EachList:
+                if strKey, isStr := key.(addrs.StringKey); isStr {
+                        i, err := strconv.Atoi(string(strKey))
+                        if err != nil {
+                                return key
+                        }
+                        return addrs.IntKey(i)
+                }
+                return key
+        default:
+                return key
+        }
+}
+
+func (d *evaluationStateData) GetTerraformAttr(addr addrs.TerraformAttr, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        switch addr.Name {
+
+        case "workspace":
+                workspaceName := d.Evaluator.Meta.Env
+                return cty.StringVal(workspaceName), diags
+
+        case "env":
+                // Prior to Terraform 0.12 there was an attribute "env", which was
+                // an alias name for "workspace". This was deprecated and is now
+                // removed.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid "terraform" attribute`,
+                        Detail:   `The terraform.env attribute was deprecated in v0.10 and removed in v0.12. The "state environment" concept was rename to "workspace" in v0.12, and so the workspace name can now be accessed using the terraform.workspace attribute.`,
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+
+        default:
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid "terraform" attribute`,
+                        Detail:   fmt.Sprintf(`The "terraform" object does not have an attribute named %q. The only supported attribute is terraform.workspace, the name of the currently-selected workspace.`, addr.Name),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+}
+
+// nameSuggestion tries to find a name from the given slice of suggested names
+// that is close to the given name and returns it if found. If no suggestion
+// is close enough, returns the empty string.
+//
+// The suggestions are tried in order, so earlier suggestions take precedence
+// if the given string is similar to two or more suggestions.
+//
+// This function is intended to be used with a relatively-small number of
+// suggestions. It's not optimized for hundreds or thousands of them.
+func nameSuggestion(given string, suggestions []string) string {
+        for _, suggestion := range suggestions {
+                dist := levenshtein.Distance(given, suggestion, nil)
+                if dist < 3 { // threshold determined experimentally
+                        return suggestion
+                }
+        }
+        return ""
+}
+
+// moduleDisplayAddr returns a string describing the given module instance
+// address that is appropriate for returning to users in situations where the
+// root module is possible. Specifically, it returns "the root module" if the
+// root module instance is given, or a string representation of the module
+// address otherwise.
+func moduleDisplayAddr(addr addrs.ModuleInstance) string {
+        switch {
+        case addr.IsRoot():
+                return "the root module"
+        default:
+                return addr.String()
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/evaluate_valid.go b/vendor/github.com/hashicorp/terraform/terraform/evaluate_valid.go
new file mode 100644
index 0000000..4255102
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/evaluate_valid.go
@@ -0,0 +1,299 @@
+package terraform
+
+import (
+        "fmt"
+        "sort"
+
+        "github.com/hashicorp/hcl2/hcl"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/helper/didyoumean"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// StaticValidateReferences checks the given references against schemas and
+// other statically-checkable rules, producing error diagnostics if any
+// problems are found.
+//
+// If this method returns errors for a particular reference then evaluating
+// that reference is likely to generate a very similar error, so callers should
+// not run this method and then also evaluate the source expression(s) and
+// merge the two sets of diagnostics together, since this will result in
+// confusing redundant errors.
+//
+// This method can find more errors than can be found by evaluating an
+// expression with a partially-populated scope, since it checks the referenced
+// names directly against the schema rather than relying on evaluation errors.
+//
+// The result may include warning diagnostics if, for example, deprecated
+// features are referenced.
+func (d *evaluationStateData) StaticValidateReferences(refs []*addrs.Reference, self addrs.Referenceable) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+        for _, ref := range refs {
+                moreDiags := d.staticValidateReference(ref, self)
+                diags = diags.Append(moreDiags)
+        }
+        return diags
+}
+
+func (d *evaluationStateData) staticValidateReference(ref *addrs.Reference, self addrs.Referenceable) tfdiags.Diagnostics {
+        modCfg := d.Evaluator.Config.DescendentForInstance(d.ModulePath)
+        if modCfg == nil {
+                // This is a bug in the caller rather than a problem with the
+                // reference, but rather than crashing out here in an unhelpful way
+                // we'll just ignore it and trust a different layer to catch it.
+                return nil
+        }
+
+        if ref.Subject == addrs.Self {
+                // The "self" address is a special alias for the address given as
+                // our self parameter here, if present.
+                if self == nil {
+                        var diags tfdiags.Diagnostics
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  `Invalid "self" reference`,
+                                // This detail message mentions some current practice that
+                                // this codepath doesn't really "know about". If the "self"
+                                // object starts being supported in more contexts later then
+                                // we'll need to adjust this message.
+                                Detail:  `The "self" object is not available in this context. This object can be used only in resource provisioner and connection blocks.`,
+                                Subject: ref.SourceRange.ToHCL().Ptr(),
+                        })
+                        return diags
+                }
+
+                synthRef := *ref // shallow copy
+                synthRef.Subject = self
+                ref = &synthRef
+        }
+
+        switch addr := ref.Subject.(type) {
+
+        // For static validation we validate both resource and resource instance references the same way.
+        // We mostly disregard the index, though we do some simple validation of
+        // its _presence_ in staticValidateSingleResourceReference and
+        // staticValidateMultiResourceReference respectively.
+        case addrs.Resource:
+                var diags tfdiags.Diagnostics
+                diags = diags.Append(d.staticValidateSingleResourceReference(modCfg, addr, ref.Remaining, ref.SourceRange))
+                diags = diags.Append(d.staticValidateResourceReference(modCfg, addr, ref.Remaining, ref.SourceRange))
+                return diags
+        case addrs.ResourceInstance:
+                var diags tfdiags.Diagnostics
+                diags = diags.Append(d.staticValidateMultiResourceReference(modCfg, addr, ref.Remaining, ref.SourceRange))
+                diags = diags.Append(d.staticValidateResourceReference(modCfg, addr.ContainingResource(), ref.Remaining, ref.SourceRange))
+                return diags
+
+        // We also handle all module call references the same way, disregarding index.
+        case addrs.ModuleCall:
+                return d.staticValidateModuleCallReference(modCfg, addr, ref.Remaining, ref.SourceRange)
+        case addrs.ModuleCallInstance:
+                return d.staticValidateModuleCallReference(modCfg, addr.Call, ref.Remaining, ref.SourceRange)
+        case addrs.ModuleCallOutput:
+                // This one is a funny one because we will take the output name referenced
+                // and use it to fake up a "remaining" that would make sense for the
+                // module call itself, rather than for the specific output, and then
+                // we can just re-use our static module call validation logic.
+                remain := make(hcl.Traversal, len(ref.Remaining)+1)
+                copy(remain[1:], ref.Remaining)
+                remain[0] = hcl.TraverseAttr{
+                        Name: addr.Name,
+
+                        // Using the whole reference as the source range here doesn't exactly
+                        // match how HCL would normally generate an attribute traversal,
+                        // but is close enough for our purposes.
+                        SrcRange: ref.SourceRange.ToHCL(),
+                }
+                return d.staticValidateModuleCallReference(modCfg, addr.Call.Call, remain, ref.SourceRange)
+
+        default:
+                // Anything else we'll just permit through without any static validation
+                // and let it be caught during dynamic evaluation, in evaluate.go .
+                return nil
+        }
+}
+
+func (d *evaluationStateData) staticValidateSingleResourceReference(modCfg *configs.Config, addr addrs.Resource, remain hcl.Traversal, rng tfdiags.SourceRange) tfdiags.Diagnostics {
+        // If we have at least one step in "remain" and this resource has
+        // "count" set then we know for sure this in invalid because we have
+        // something like:
+        //     aws_instance.foo.bar
+        // ...when we really need
+        //     aws_instance.foo[count.index].bar
+
+        // It is _not_ safe to do this check when remain is empty, because that
+        // would also match aws_instance.foo[count.index].bar due to `count.index`
+        // not being statically-resolvable as part of a reference, and match
+        // direct references to the whole aws_instance.foo tuple.
+        if len(remain) == 0 {
+                return nil
+        }
+
+        var diags tfdiags.Diagnostics
+
+        cfg := modCfg.Module.ResourceByAddr(addr)
+        if cfg == nil {
+                // We'll just bail out here and catch this in our subsequent call to
+                // staticValidateResourceReference, then.
+                return diags
+        }
+
+        if cfg.Count != nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Missing resource instance key`,
+                        Detail:   fmt.Sprintf("Because %s has \"count\" set, its attributes must be accessed on specific instances.\n\nFor example, to correlate with indices of a referring resource, use:\n    %s[count.index]", addr, addr),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+        }
+        if cfg.ForEach != nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Missing resource instance key`,
+                        Detail:   fmt.Sprintf("Because %s has \"for_each\" set, its attributes must be accessed on specific instances.\n\nFor example, to correlate with indices of a referring resource, use:\n    %s[each.key]", addr, addr),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+        }
+
+        return diags
+}
+
+func (d *evaluationStateData) staticValidateMultiResourceReference(modCfg *configs.Config, addr addrs.ResourceInstance, remain hcl.Traversal, rng tfdiags.SourceRange) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        cfg := modCfg.Module.ResourceByAddr(addr.ContainingResource())
+        if cfg == nil {
+                // We'll just bail out here and catch this in our subsequent call to
+                // staticValidateResourceReference, then.
+                return diags
+        }
+
+        if addr.Key == addrs.NoKey {
+                // This is a different path into staticValidateSingleResourceReference
+                return d.staticValidateSingleResourceReference(modCfg, addr.ContainingResource(), remain, rng)
+        } else {
+                if cfg.Count == nil && cfg.ForEach == nil {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  `Unexpected resource instance key`,
+                                Detail:   fmt.Sprintf(`Because %s does not have "count" or "for_each" set, references to it must not include an index key. Remove the bracketed index to refer to the single instance of this resource.`, addr.ContainingResource()),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                }
+        }
+
+        return diags
+}
+
+func (d *evaluationStateData) staticValidateResourceReference(modCfg *configs.Config, addr addrs.Resource, remain hcl.Traversal, rng tfdiags.SourceRange) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        var modeAdjective string
+        switch addr.Mode {
+        case addrs.ManagedResourceMode:
+                modeAdjective = "managed"
+        case addrs.DataResourceMode:
+                modeAdjective = "data"
+        default:
+                // should never happen
+                modeAdjective = "<invalid-mode>"
+        }
+
+        cfg := modCfg.Module.ResourceByAddr(addr)
+        if cfg == nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared resource`,
+                        Detail:   fmt.Sprintf(`A %s resource %q %q has not been declared in %s.`, modeAdjective, addr.Type, addr.Name, moduleConfigDisplayAddr(modCfg.Path)),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return diags
+        }
+
+        // Normally accessing this directly is wrong because it doesn't take into
+        // account provider inheritance, etc but it's okay here because we're only
+        // paying attention to the type anyway.
+        providerType := cfg.ProviderConfigAddr().Type
+        schema, _ := d.Evaluator.Schemas.ResourceTypeConfig(providerType, addr.Mode, addr.Type)
+
+        if schema == nil {
+                // Prior validation should've taken care of a resource block with an
+                // unsupported type, so we should never get here but we'll handle it
+                // here anyway for robustness.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid resource type`,
+                        Detail:   fmt.Sprintf(`A %s resource type %q is not supported by provider %q.`, modeAdjective, addr.Type, providerType),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return diags
+        }
+
+        // As a special case we'll detect attempts to access an attribute called
+        // "count" and produce a special error for it, since versions of Terraform
+        // prior to v0.12 offered this as a weird special case that we can no
+        // longer support.
+        if len(remain) > 0 {
+                if step, ok := remain[0].(hcl.TraverseAttr); ok && step.Name == "count" {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  `Invalid resource count attribute`,
+                                Detail:   fmt.Sprintf(`The special "count" attribute is no longer supported after Terraform v0.12. Instead, use length(%s) to count resource instances.`, addr),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                        return diags
+                }
+        }
+
+        // If we got this far then we'll try to validate the remaining traversal
+        // steps against our schema.
+        moreDiags := schema.StaticValidateTraversal(remain)
+        diags = diags.Append(moreDiags)
+
+        return diags
+}
+
+func (d *evaluationStateData) staticValidateModuleCallReference(modCfg *configs.Config, addr addrs.ModuleCall, remain hcl.Traversal, rng tfdiags.SourceRange) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        // For now, our focus here is just in testing that the referenced module
+        // call exists. All other validation is deferred until evaluation time.
+        _, exists := modCfg.Module.ModuleCalls[addr.Name]
+        if !exists {
+                var suggestions []string
+                for name := range modCfg.Module.ModuleCalls {
+                        suggestions = append(suggestions, name)
+                }
+                sort.Strings(suggestions)
+                suggestion := didyoumean.NameSuggestion(addr.Name, suggestions)
+                if suggestion != "" {
+                        suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+                }
+
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared module`,
+                        Detail:   fmt.Sprintf(`No module call named %q is declared in %s.%s`, addr.Name, moduleConfigDisplayAddr(modCfg.Path), suggestion),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return diags
+        }
+
+        return diags
+}
+
+// moduleConfigDisplayAddr returns a string describing the given module
+// address that is appropriate for returning to users in situations where the
+// root module is possible. Specifically, it returns "the root module" if the
+// root module instance is given, or a string representation of the module
+// address otherwise.
+func moduleConfigDisplayAddr(addr addrs.Module) string {
+        switch {
+        case addr.IsRoot():
+                return "the root module"
+        default:
+                return addr.String()
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph.go b/vendor/github.com/hashicorp/terraform/terraform/graph.go
index 735ec4e..58d45a7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph.go
@@ -3,17 +3,13 @@ package terraform
 import (
         "fmt"
         "log"
-        "runtime/debug"
-        "strings"
 
-        "github.com/hashicorp/terraform/dag"
-)
+        "github.com/hashicorp/terraform/tfdiags"
 
-// RootModuleName is the name given to the root module implicitly.
-const RootModuleName = "root"
+        "github.com/hashicorp/terraform/addrs"
 
-// RootModulePath is the path for the root module.
-var RootModulePath = []string{RootModuleName}
+        "github.com/hashicorp/terraform/dag"
+)
 
 // Graph represents the graph that Terraform uses to represent resources
 // and their dependencies.
@@ -23,9 +19,7 @@ type Graph struct {
         dag.AcyclicGraph
 
         // Path is the path in the module tree that this Graph represents.
-        // The root is represented by a single element list containing
-        // RootModuleName
-        Path []string
+        Path addrs.ModuleInstance
 
         // debugName is a name for reference in the debug output. This is usually
         // to indicate what topmost builder was, and if this graph is a shadow or
@@ -40,71 +34,42 @@ func (g *Graph) DirectedGraph() dag.Grapher {
 // Walk walks the graph with the given walker for callbacks. The graph
 // will be walked with full parallelism, so the walker should expect
 // to be called in concurrently.
-func (g *Graph) Walk(walker GraphWalker) error {
+func (g *Graph) Walk(walker GraphWalker) tfdiags.Diagnostics {
         return g.walk(walker)
 }
 
-func (g *Graph) walk(walker GraphWalker) error {
+func (g *Graph) walk(walker GraphWalker) tfdiags.Diagnostics {
         // The callbacks for enter/exiting a graph
         ctx := walker.EnterPath(g.Path)
         defer walker.ExitPath(g.Path)
 
         // Get the path for logs
-        path := strings.Join(ctx.Path(), ".")
-
-        // Determine if our walker is a panic wrapper
-        panicwrap, ok := walker.(GraphWalkerPanicwrapper)
-        if !ok {
-                panicwrap = nil // just to be sure
-        }
+        path := ctx.Path().String()
 
         debugName := "walk-graph.json"
         if g.debugName != "" {
                 debugName = g.debugName + "-" + debugName
         }
 
-        debugBuf := dbug.NewFileWriter(debugName)
-        g.SetDebugWriter(debugBuf)
-        defer debugBuf.Close()
-
         // Walk the graph.
         var walkFn dag.WalkFunc
-        walkFn = func(v dag.Vertex) (rerr error) {
-                log.Printf("[TRACE] vertex '%s.%s': walking", path, dag.VertexName(v))
+        walkFn = func(v dag.Vertex) (diags tfdiags.Diagnostics) {
+                log.Printf("[TRACE] vertex %q: starting visit (%T)", dag.VertexName(v), v)
                 g.DebugVisitInfo(v, g.debugName)
 
-                // If we have a panic wrap GraphWalker and a panic occurs, recover
-                // and call that. We ensure the return value is an error, however,
-                // so that future nodes are not called.
                 defer func() {
-                        // If no panicwrap, do nothing
-                        if panicwrap == nil {
-                                return
-                        }
-
-                        // If no panic, do nothing
-                        err := recover()
-                        if err == nil {
-                                return
-                        }
-
-                        // Modify the return value to show the error
-                        rerr = fmt.Errorf("vertex %q captured panic: %s\n\n%s",
-                                dag.VertexName(v), err, debug.Stack())
-
-                        // Call the panic wrapper
-                        panicwrap.Panic(v, err)
+                        log.Printf("[TRACE] vertex %q: visit complete", dag.VertexName(v))
                 }()
 
                 walker.EnterVertex(v)
-                defer walker.ExitVertex(v, rerr)
+                defer walker.ExitVertex(v, diags)
 
                 // vertexCtx is the context that we use when evaluating. This
                 // is normally the context of our graph but can be overridden
                 // with a GraphNodeSubPath impl.
                 vertexCtx := ctx
                 if pn, ok := v.(GraphNodeSubPath); ok && len(pn.Path()) > 0 {
-                        vertexCtx = walker.EnterPath(normalizeModulePath(pn.Path()))
+                        vertexCtx = walker.EnterPath(pn.Path())
                         defer walker.ExitPath(pn.Path())
                 }
 
@@ -112,60 +77,64 @@ func (g *Graph) walk(walker GraphWalker) error {
                 if ev, ok := v.(GraphNodeEvalable); ok {
                         tree := ev.EvalTree()
                         if tree == nil {
-                                panic(fmt.Sprintf(
-                                        "%s.%s (%T): nil eval tree", path, dag.VertexName(v), v))
+                                panic(fmt.Sprintf("%q (%T): nil eval tree", dag.VertexName(v), v))
                         }
 
                         // Allow the walker to change our tree if needed. Eval,
                         // then callback with the output.
-                        log.Printf("[TRACE] vertex '%s.%s': evaluating", path, dag.VertexName(v))
+                        log.Printf("[TRACE] vertex %q: evaluating", dag.VertexName(v))
 
                         g.DebugVertexInfo(v, fmt.Sprintf("evaluating %T(%s)", v, path))
 
                         tree = walker.EnterEvalTree(v, tree)
                         output, err := Eval(tree, vertexCtx)
-                        if rerr = walker.ExitEvalTree(v, output, err); rerr != nil {
+                        diags = diags.Append(walker.ExitEvalTree(v, output, err))
+                        if diags.HasErrors() {
                                 return
                         }
                 }
 
                 // If the node is dynamically expanded, then expand it
                 if ev, ok := v.(GraphNodeDynamicExpandable); ok {
-                        log.Printf(
-                                "[TRACE] vertex '%s.%s': expanding/walking dynamic subgraph",
-                                path,
-                                dag.VertexName(v))
+                        log.Printf("[TRACE] vertex %q: expanding dynamic subgraph", dag.VertexName(v))
 
                         g.DebugVertexInfo(v, fmt.Sprintf("expanding %T(%s)", v, path))
 
                         g, err := ev.DynamicExpand(vertexCtx)
                         if err != nil {
-                                rerr = err
+                                diags = diags.Append(err)
                                 return
                         }
                         if g != nil {
                                 // Walk the subgraph
-                                if rerr = g.walk(walker); rerr != nil {
+                                log.Printf("[TRACE] vertex %q: entering dynamic subgraph", dag.VertexName(v))
+                                subDiags := g.walk(walker)
+                                diags = diags.Append(subDiags)
+                                if subDiags.HasErrors() {
+                                        log.Printf("[TRACE] vertex %q: dynamic subgraph encountered errors", dag.VertexName(v))
                                         return
                                 }
+                                log.Printf("[TRACE] vertex %q: dynamic subgraph completed successfully", dag.VertexName(v))
+                        } else {
+                                log.Printf("[TRACE] vertex %q: produced no dynamic subgraph", dag.VertexName(v))
                         }
                 }
 
                 // If the node has a subgraph, then walk the subgraph
                 if sn, ok := v.(GraphNodeSubgraph); ok {
-                        log.Printf(
-                                "[TRACE] vertex '%s.%s': walking subgraph",
-                                path,
-                                dag.VertexName(v))
+                        log.Printf("[TRACE] vertex %q: entering static subgraph", dag.VertexName(v))
 
                         g.DebugVertexInfo(v, fmt.Sprintf("subgraph: %T(%s)", v, path))
 
-                        if rerr = sn.Subgraph().(*Graph).walk(walker); rerr != nil {
+                        subDiags := sn.Subgraph().(*Graph).walk(walker)
+                        if subDiags.HasErrors() {
+                                log.Printf("[TRACE] vertex %q: static subgraph encountered errors", dag.VertexName(v))
                                 return
                         }
+                        log.Printf("[TRACE] vertex %q: static subgraph completed successfully", dag.VertexName(v))
                 }
 
-                return nil
+                return
         }
 
         return g.AcyclicGraph.Walk(walkFn)
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder.go
index 6374bb9..66b21f3 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder.go
@@ -4,6 +4,10 @@ import (
         "fmt"
         "log"
         "strings"
+
+        "github.com/hashicorp/terraform/tfdiags"
+
+        "github.com/hashicorp/terraform/addrs"
 )
 
 // GraphBuilder is an interface that can be implemented and used with
@@ -12,7 +16,7 @@ type GraphBuilder interface {
         // Build builds the graph for the given module path. It is up to
         // the interface implementation whether this build should expand
         // the graph or not.
-        Build(path []string) (*Graph, error)
+        Build(addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics)
 }
 
 // BasicGraphBuilder is a GraphBuilder that builds a graph out of a
@@ -25,21 +29,16 @@ type BasicGraphBuilder struct {
         Name string
 }
 
-func (b *BasicGraphBuilder) Build(path []string) (*Graph, error) {
+func (b *BasicGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
         g := &Graph{Path: path}
 
-        debugName := "graph.json"
-        if b.Name != "" {
-                debugName = b.Name + "-" + debugName
-        }
-        debugBuf := dbug.NewFileWriter(debugName)
-        g.SetDebugWriter(debugBuf)
-        defer debugBuf.Close()
-
+        var lastStepStr string
         for _, step := range b.Steps {
                 if step == nil {
                         continue
                 }
+                log.Printf("[TRACE] Executing graph transform %T", step)
 
                 stepName := fmt.Sprintf("%T", step)
                 dot := strings.LastIndex(stepName, ".")
@@ -56,12 +55,20 @@ func (b *BasicGraphBuilder) Build(path []string) (*Graph, error) {
                 }
                 debugOp.End(errMsg)
 
-                log.Printf(
-                        "[TRACE] Graph after step %T:\n\n%s",
-                        step, g.StringWithNodeTypes())
+                if thisStepStr := g.StringWithNodeTypes(); thisStepStr != lastStepStr {
+                        log.Printf("[TRACE] Completed graph transform %T with new graph:\n%s------", step, thisStepStr)
+                        lastStepStr = thisStepStr
+                } else {
+                        log.Printf("[TRACE] Completed graph transform %T (no changes)", step)
+                }
 
                 if err != nil {
-                        return g, err
+                        if nf, isNF := err.(tfdiags.NonFatalError); isNF {
+                                diags = diags.Append(nf.Diagnostics)
+                        } else {
+                                diags = diags.Append(err)
+                                return g, diags
+                        }
                 }
         }
 
@@ -69,9 +76,10 @@ func (b *BasicGraphBuilder) Build(path []string) (*Graph, error) {
         if b.Validate {
                 if err := g.Validate(); err != nil {
                         log.Printf("[ERROR] Graph validation failed. Graph:\n\n%s", g.String())
-                        return nil, err
+                        diags = diags.Append(err)
+                        return nil, diags
                 }
         }
 
-        return g, nil
+        return g, diags
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_apply.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_apply.go
index 0c2b233..7182dd7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_apply.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_apply.go
@@ -1,8 +1,12 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ApplyGraphBuilder implements GraphBuilder and is responsible for building
@@ -13,26 +17,28 @@ import (
 // that aren't explicitly in the diff. There are other scenarios where the
 // diff can be deviated, so this is just one layer of protection.
 type ApplyGraphBuilder struct {
-        // Module is the root module for the graph to build.
-        Module *module.Tree
+        // Config is the configuration tree that the diff was built from.
+        Config *configs.Config
 
-        // Diff is the diff to apply.
-        Diff *Diff
+        // Changes describes the changes that we need apply.
+        Changes *plans.Changes
 
         // State is the current state
-        State *State
+        State *states.State
 
-        // Providers is the list of providers supported.
-        Providers []string
+        // Components is a factory for the plug-in components (providers and
+        // provisioners) available for use.
+        Components contextComponentFactory
 
-        // Provisioners is the list of provisioners supported.
-        Provisioners []string
+        // Schemas is the repository of schemas we will draw from to analyse
+        // the configuration.
+        Schemas *Schemas
 
         // Targets are resources to target. This is only required to make sure
         // unnecessary outputs aren't included in the apply graph. The plan
         // builder successfully handles targeting resources. In the future,
         // outputs should go into the diff so that this is unnecessary.
-        Targets []string
+        Targets []addrs.Targetable
 
         // DisableReduce, if true, will not reduce the graph. Great for testing.
         DisableReduce bool
@@ -45,7 +51,7 @@ type ApplyGraphBuilder struct {
 }
 
 // See GraphBuilder
-func (b *ApplyGraphBuilder) Build(path []string) (*Graph, error) {
+func (b *ApplyGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
         return (&BasicGraphBuilder{
                 Steps:    b.Steps(),
                 Validate: b.Validate,
@@ -68,53 +74,99 @@ func (b *ApplyGraphBuilder) Steps() []GraphTransformer {
                 }
         }
 
+        concreteOrphanResource := func(a *NodeAbstractResource) dag.Vertex {
+                return &NodeDestroyResource{
+                        NodeAbstractResource: a,
+                }
+        }
+
+        concreteResourceInstance := func(a *NodeAbstractResourceInstance) dag.Vertex {
+                return &NodeApplyableResourceInstance{
+                        NodeAbstractResourceInstance: a,
+                }
+        }
+
         steps := []GraphTransformer{
-                // Creates all the nodes represented in the diff.
-                &DiffTransformer{
+                // Creates all the resources represented in the config. During apply,
+                // we use this just to ensure that the whole-resource metadata is
+                // updated to reflect things such as whether the count argument is
+                // set in config, or which provider configuration manages each resource.
+                &ConfigTransformer{
                         Concrete: concreteResource,
+                        Config:   b.Config,
+                },
 
-                        Diff:   b.Diff,
-                        Module: b.Module,
-                        State:  b.State,
+                // Creates all the resource instances represented in the diff, along
+                // with dependency edges against the whole-resource nodes added by
+                // ConfigTransformer above.
+                &DiffTransformer{
+                        Concrete: concreteResourceInstance,
+                        State:    b.State,
+                        Changes:  b.Changes,
+                },
+
+                // Creates extra cleanup nodes for any entire resources that are
+                // no longer present in config, so we can make sure we clean up the
+                // leftover empty resource states after the instances have been
+                // destroyed.
+                // (We don't track this particular type of change in the plan because
+                // it's just cleanup of our own state object, and so doesn't effect
+                // any real remote objects or consumable outputs.)
+                &OrphanResourceTransformer{
+                        Concrete: concreteOrphanResource,
+                        Config:   b.Config,
+                        State:    b.State,
                 },
 
                 // Create orphan output nodes
-                &OrphanOutputTransformer{Module: b.Module, State: b.State},
+                &OrphanOutputTransformer{Config: b.Config, State: b.State},
 
                 // Attach the configuration to any resources
-                &AttachResourceConfigTransformer{Module: b.Module},
+                &AttachResourceConfigTransformer{Config: b.Config},
 
                 // Attach the state
                 &AttachStateTransformer{State: b.State},
 
-                // add providers
-                TransformProviders(b.Providers, concreteProvider, b.Module),
-
                 // Destruction ordering
-                &DestroyEdgeTransformer{Module: b.Module, State: b.State},
+                &DestroyEdgeTransformer{
+                        Config:  b.Config,
+                        State:   b.State,
+                        Schemas: b.Schemas,
+                },
                 GraphTransformIf(
                         func() bool { return !b.Destroy },
-                        &CBDEdgeTransformer{Module: b.Module, State: b.State},
+                        &CBDEdgeTransformer{
+                                Config:  b.Config,
+                                State:   b.State,
+                                Schemas: b.Schemas,
+                        },
                 ),
 
                 // Provisioner-related transformations
-                &MissingProvisionerTransformer{Provisioners: b.Provisioners},
+                &MissingProvisionerTransformer{Provisioners: b.Components.ResourceProvisioners()},
                 &ProvisionerTransformer{},
 
                 // Add root variables
-                &RootVariableTransformer{Module: b.Module},
+                &RootVariableTransformer{Config: b.Config},
 
                 // Add the local values
-                &LocalTransformer{Module: b.Module},
+                &LocalTransformer{Config: b.Config},
 
                 // Add the outputs
-                &OutputTransformer{Module: b.Module},
+                &OutputTransformer{Config: b.Config},
 
                 // Add module variables
-                &ModuleVariableTransformer{Module: b.Module},
+                &ModuleVariableTransformer{Config: b.Config},
+
+                // add providers
+                TransformProviders(b.Components.ResourceProviders(), concreteProvider, b.Config),
 
                 // Remove modules no longer present in the config
-                &RemovedModuleTransformer{Module: b.Module, State: b.State},
+                &RemovedModuleTransformer{Config: b.Config, State: b.State},
+
+                // Must attach schemas before ReferenceTransformer so that we can
+                // analyze the configuration to find references.
+                &AttachSchemaTransformer{Schemas: b.Schemas},
 
                 // Connect references so ordering is correct
                 &ReferenceTransformer{},
@@ -135,7 +187,9 @@ func (b *ApplyGraphBuilder) Steps() []GraphTransformer {
                 ),
 
                 // Add the node to fix the state count boundaries
-                &CountBoundaryTransformer{},
+                &CountBoundaryTransformer{
+                        Config: b.Config,
+                },
 
                 // Target
                 &TargetsTransformer{Targets: b.Targets},
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_destroy_plan.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_destroy_plan.go
index 014b348..a6047a9 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_destroy_plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_destroy_plan.go
@@ -1,8 +1,11 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // DestroyPlanGraphBuilder implements GraphBuilder and is responsible for
@@ -11,21 +14,29 @@ import (
 // Planning a pure destroy operation is simple because we can ignore most
 // ordering configuration and simply reverse the state.
 type DestroyPlanGraphBuilder struct {
-        // Module is the root module for the graph to build.
-        Module *module.Tree
+        // Config is the configuration tree to build the plan from.
+        Config *configs.Config
 
         // State is the current state
-        State *State
+        State *states.State
+
+        // Components is a factory for the plug-in components (providers and
+        // provisioners) available for use.
+        Components contextComponentFactory
+
+        // Schemas is the repository of schemas we will draw from to analyse
+        // the configuration.
+        Schemas *Schemas
 
         // Targets are resources to target
-        Targets []string
+        Targets []addrs.Targetable
 
         // Validate will do structural validation of the graph.
         Validate bool
 }
 
 // See GraphBuilder
-func (b *DestroyPlanGraphBuilder) Build(path []string) (*Graph, error) {
+func (b *DestroyPlanGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
         return (&BasicGraphBuilder{
                 Steps:    b.Steps(),
                 Validate: b.Validate,
@@ -35,25 +46,44 @@ func (b *DestroyPlanGraphBuilder) Build(path []string) (*Graph, error) {
 
 // See GraphBuilder
 func (b *DestroyPlanGraphBuilder) Steps() []GraphTransformer {
-        concreteResource := func(a *NodeAbstractResource) dag.Vertex {
-                return &NodePlanDestroyableResource{
-                        NodeAbstractResource: a,
+        concreteResourceInstance := func(a *NodeAbstractResourceInstance) dag.Vertex {
+                return &NodePlanDestroyableResourceInstance{
+                        NodeAbstractResourceInstance: a,
+                }
+        }
+        concreteResourceInstanceDeposed := func(a *NodeAbstractResourceInstance, key states.DeposedKey) dag.Vertex {
+                return &NodePlanDeposedResourceInstanceObject{
+                        NodeAbstractResourceInstance: a,
+                        DeposedKey:                   key,
+                }
+        }
+
+        concreteProvider := func(a *NodeAbstractProvider) dag.Vertex {
+                return &NodeApplyableProvider{
+                        NodeAbstractProvider: a,
                 }
         }
 
         steps := []GraphTransformer{
-                // Creates all the nodes represented in the state.
+                // Creates nodes for the resource instances tracked in the state.
                 &StateTransformer{
-                        Concrete: concreteResource,
-                        State:    b.State,
+                        ConcreteCurrent: concreteResourceInstance,
+                        ConcreteDeposed: concreteResourceInstanceDeposed,
+                        State:           b.State,
                 },
 
                 // Attach the configuration to any resources
-                &AttachResourceConfigTransformer{Module: b.Module},
+                &AttachResourceConfigTransformer{Config: b.Config},
+
+                TransformProviders(b.Components.ResourceProviders(), concreteProvider, b.Config),
 
                 // Destruction ordering. We require this only so that
                 // targeting below will prune the correct things.
-                &DestroyEdgeTransformer{Module: b.Module, State: b.State},
+                &DestroyEdgeTransformer{
+                        Config:  b.Config,
+                        State:   b.State,
+                        Schemas: b.Schemas,
+                },
 
                 // Target. Note we don't set "Destroy: true" here since we already
                 // created proper destroy ordering.
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_eval.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_eval.go
new file mode 100644
index 0000000..eb6c897
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_eval.go
@@ -0,0 +1,108 @@
+package terraform
+
+import (
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// EvalGraphBuilder implements GraphBuilder and constructs a graph suitable
+// for evaluating in-memory values (input variables, local values, output
+// values) in the state without any other side-effects.
+//
+// This graph is used only in weird cases, such as the "terraform console"
+// CLI command, where we need to evaluate expressions against the state
+// without taking any other actions.
+//
+// The generated graph will include nodes for providers, resources, etc
+// just to allow indirect dependencies to be resolved, but these nodes will
+// not take any actions themselves since we assume that their parts of the
+// state, if any, are already complete.
+//
+// Although the providers are never configured, they must still be available
+// in order to obtain schema information used for type checking, etc.
+type EvalGraphBuilder struct {
+        // Config is the configuration tree.
+        Config *configs.Config
+
+        // State is the current state
+        State *states.State
+
+        // Components is a factory for the plug-in components (providers and
+        // provisioners) available for use.
+        Components contextComponentFactory
+
+        // Schemas is the repository of schemas we will draw from to analyse
+        // the configuration.
+        Schemas *Schemas
+}
+
+// See GraphBuilder
+func (b *EvalGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
+        return (&BasicGraphBuilder{
+                Steps:    b.Steps(),
+                Validate: true,
+                Name:     "EvalGraphBuilder",
+        }).Build(path)
+}
+
+// See GraphBuilder
+func (b *EvalGraphBuilder) Steps() []GraphTransformer {
+        concreteProvider := func(a *NodeAbstractProvider) dag.Vertex {
+                return &NodeEvalableProvider{
+                        NodeAbstractProvider: a,
+                }
+        }
+
+        steps := []GraphTransformer{
+                // Creates all the data resources that aren't in the state. This will also
+                // add any orphans from scaling in as destroy nodes.
+                &ConfigTransformer{
+                        Concrete: nil, // just use the abstract type
+                        Config:   b.Config,
+                        Unique:   true,
+                },
+
+                // Attach the state
+                &AttachStateTransformer{State: b.State},
+
+                // Attach the configuration to any resources
+                &AttachResourceConfigTransformer{Config: b.Config},
+
+                // Add root variables
+                &RootVariableTransformer{Config: b.Config},
+
+                // Add the local values
+                &LocalTransformer{Config: b.Config},
+
+                // Add the outputs
+                &OutputTransformer{Config: b.Config},
+
+                // Add module variables
+                &ModuleVariableTransformer{Config: b.Config},
+
+                TransformProviders(b.Components.ResourceProviders(), concreteProvider, b.Config),
+
+                // Must attach schemas before ReferenceTransformer so that we can
+                // analyze the configuration to find references.
+                &AttachSchemaTransformer{Schemas: b.Schemas},
+
+                // Connect so that the references are ready for targeting. We'll
+                // have to connect again later for providers and so on.
+                &ReferenceTransformer{},
+
+                // Although we don't configure providers, we do still start them up
+                // to get their schemas, and so we must shut them down again here.
+                &CloseProviderTransformer{},
+
+                // Single root
+                &RootTransformer{},
+
+                // Remove redundant edges to simplify the graph.
+                &TransitiveReductionTransformer{},
+        }
+
+        return steps
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_import.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_import.go
index 07a1eaf..7b0e39f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_import.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_import.go
@@ -1,8 +1,10 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ImportGraphBuilder implements GraphBuilder and is responsible for building
@@ -12,15 +14,19 @@ type ImportGraphBuilder struct {
         // ImportTargets are the list of resources to import.
         ImportTargets []*ImportTarget
 
-        // Module is the module to add to the graph. See ImportOpts.Module.
-        Module *module.Tree
+        // Module is a configuration to build the graph from. See ImportOpts.Config.
+        Config *configs.Config
 
-        // Providers is the list of providers supported.
-        Providers []string
+        // Components is the factory for our available plugin components.
+        Components contextComponentFactory
+
+        // Schemas is the repository of schemas we will draw from to analyse
+        // the configuration.
+        Schemas *Schemas
 }
 
 // Build builds the graph according to the steps returned by Steps.
-func (b *ImportGraphBuilder) Build(path []string) (*Graph, error) {
+func (b *ImportGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
         return (&BasicGraphBuilder{
                 Steps:    b.Steps(),
                 Validate: true,
@@ -33,9 +39,9 @@ func (b *ImportGraphBuilder) Build(path []string) (*Graph, error) {
 func (b *ImportGraphBuilder) Steps() []GraphTransformer {
         // Get the module. If we don't have one, we just use an empty tree
         // so that the transform still works but does nothing.
-        mod := b.Module
-        if mod == nil {
-                mod = module.NewEmptyTree()
+        config := b.Config
+        if config == nil {
+                config = configs.NewEmptyConfig()
         }
 
         // Custom factory for creating providers.
@@ -47,16 +53,36 @@ func (b *ImportGraphBuilder) Steps() []GraphTransformer {
 
         steps := []GraphTransformer{
                 // Create all our resources from the configuration and state
-                &ConfigTransformer{Module: mod},
+                &ConfigTransformer{Config: config},
 
                 // Add the import steps
                 &ImportStateTransformer{Targets: b.ImportTargets},
 
-                TransformProviders(b.Providers, concreteProvider, mod),
+                // Add root variables
+                &RootVariableTransformer{Config: b.Config},
+
+                TransformProviders(b.Components.ResourceProviders(), concreteProvider, config),
 
                 // This validates that the providers only depend on variables
                 &ImportProviderValidateTransformer{},
 
+                // Add the local values
+                &LocalTransformer{Config: b.Config},
+
+                // Add the outputs
+                &OutputTransformer{Config: b.Config},
+
+                // Add module variables
+                &ModuleVariableTransformer{Config: b.Config},
+
+                // Must attach schemas before ReferenceTransformer so that we can
+                // analyze the configuration to find references.
+                &AttachSchemaTransformer{Schemas: b.Schemas},
+
+                // Connect so that the references are ready for targeting. We'll
+                // have to connect again later for providers and so on.
+                &ReferenceTransformer{},
+
                 // Close opened plugin connections
                 &CloseProviderTransformer{},
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_input.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_input.go
deleted file mode 100644
index 0df48cd..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_input.go
+++ /dev/null
@@ -1,27 +0,0 @@
-package terraform
-
-import (
-        "github.com/hashicorp/terraform/dag"
-)
-
-// InputGraphBuilder creates the graph for the input operation.
-//
-// Unlike other graph builders, this is a function since it currently modifies
-// and is based on the PlanGraphBuilder. The PlanGraphBuilder passed in will be
-// modified and should not be used for any other operations.
-func InputGraphBuilder(p *PlanGraphBuilder) GraphBuilder {
-        // We're going to customize the concrete functions
-        p.CustomConcrete = true
-
-        // Set the provider to the normal provider. This will ask for input.
-        p.ConcreteProvider = func(a *NodeAbstractProvider) dag.Vertex {
-                return &NodeApplyableProvider{
-                        NodeAbstractProvider: a,
-                }
-        }
-
-        // We purposely don't set any more concrete fields since the remainder
-        // should be no-ops.
-
-        return p
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go
index f8dd0fc..17adfd2 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go
@@ -3,8 +3,11 @@ package terraform
 import (
         "sync"
 
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // PlanGraphBuilder implements GraphBuilder and is responsible for building
@@ -19,20 +22,22 @@ import (
 //     create-before-destroy can be completely ignored.
 //
 type PlanGraphBuilder struct {
-        // Module is the root module for the graph to build.
-        Module *module.Tree
+        // Config is the configuration tree to build a plan from.
+        Config *configs.Config
 
         // State is the current state
-        State *State
+        State *states.State
 
-        // Providers is the list of providers supported.
-        Providers []string
+        // Components is a factory for the plug-in components (providers and
+        // provisioners) available for use.
+        Components contextComponentFactory
 
-        // Provisioners is the list of provisioners supported.
-        Provisioners []string
+        // Schemas is the repository of schemas we will draw from to analyse
+        // the configuration.
+        Schemas *Schemas
 
         // Targets are resources to target
-        Targets []string
+        Targets []addrs.Targetable
 
         // DisableReduce, if true, will not reduce the graph. Great for testing.
         DisableReduce bool
@@ -46,13 +51,13 @@ type PlanGraphBuilder struct {
         CustomConcrete         bool
         ConcreteProvider       ConcreteProviderNodeFunc
         ConcreteResource       ConcreteResourceNodeFunc
-        ConcreteResourceOrphan ConcreteResourceNodeFunc
+        ConcreteResourceOrphan ConcreteResourceInstanceNodeFunc
 
         once sync.Once
 }
 
 // See GraphBuilder
-func (b *PlanGraphBuilder) Build(path []string) (*Graph, error) {
+func (b *PlanGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
         return (&BasicGraphBuilder{
                 Steps:    b.Steps(),
                 Validate: b.Validate,
@@ -64,66 +69,82 @@ func (b *PlanGraphBuilder) Build(path []string) (*Graph, error) {
 func (b *PlanGraphBuilder) Steps() []GraphTransformer {
         b.once.Do(b.init)
 
+        concreteResourceInstanceDeposed := func(a *NodeAbstractResourceInstance, key states.DeposedKey) dag.Vertex {
+                return &NodePlanDeposedResourceInstanceObject{
+                        NodeAbstractResourceInstance: a,
+                        DeposedKey:                   key,
+                }
+        }
+
         steps := []GraphTransformer{
                 // Creates all the resources represented in the config
                 &ConfigTransformer{
                         Concrete: b.ConcreteResource,
-                        Module:   b.Module,
+                        Config:   b.Config,
                 },
 
                 // Add the local values
-                &LocalTransformer{Module: b.Module},
+                &LocalTransformer{Config: b.Config},
 
                 // Add the outputs
-                &OutputTransformer{Module: b.Module},
+                &OutputTransformer{Config: b.Config},
 
                 // Add orphan resources
-                &OrphanResourceTransformer{
+                &OrphanResourceInstanceTransformer{
                         Concrete: b.ConcreteResourceOrphan,
                         State:    b.State,
-                        Module:   b.Module,
+                        Config:   b.Config,
+                },
+
+                // We also need nodes for any deposed instance objects present in the
+                // state, so we can plan to destroy them. (This intentionally
+                // skips creating nodes for _current_ objects, since ConfigTransformer
+                // created nodes that will do that during DynamicExpand.)
+                &StateTransformer{
+                        ConcreteDeposed: concreteResourceInstanceDeposed,
+                        State:           b.State,
                 },
 
                 // Create orphan output nodes
                 &OrphanOutputTransformer{
-                        Module: b.Module,
+                        Config: b.Config,
                         State:  b.State,
                 },
 
                 // Attach the configuration to any resources
-                &AttachResourceConfigTransformer{Module: b.Module},
+                &AttachResourceConfigTransformer{Config: b.Config},
 
                 // Attach the state
                 &AttachStateTransformer{State: b.State},
 
                 // Add root variables
-                &RootVariableTransformer{Module: b.Module},
-
-                TransformProviders(b.Providers, b.ConcreteProvider, b.Module),
+                &RootVariableTransformer{Config: b.Config},
 
-                // Provisioner-related transformations. Only add these if requested.
-                GraphTransformIf(
-                        func() bool { return b.Provisioners != nil },
-                        GraphTransformMulti(
-                                &MissingProvisionerTransformer{Provisioners: b.Provisioners},
-                                &ProvisionerTransformer{},
-                        ),
-                ),
+                &MissingProvisionerTransformer{Provisioners: b.Components.ResourceProvisioners()},
+                &ProvisionerTransformer{},
 
                 // Add module variables
                 &ModuleVariableTransformer{
-                        Module: b.Module,
+                        Config: b.Config,
                 },
 
+                TransformProviders(b.Components.ResourceProviders(), b.ConcreteProvider, b.Config),
+
                 // Remove modules no longer present in the config
-                &RemovedModuleTransformer{Module: b.Module, State: b.State},
+                &RemovedModuleTransformer{Config: b.Config, State: b.State},
+
+                // Must attach schemas before ReferenceTransformer so that we can
+                // analyze the configuration to find references.
+                &AttachSchemaTransformer{Schemas: b.Schemas},
 
                 // Connect so that the references are ready for targeting. We'll
                 // have to connect again later for providers and so on.
                 &ReferenceTransformer{},
 
                 // Add the node to fix the state count boundaries
-                &CountBoundaryTransformer{},
+                &CountBoundaryTransformer{
+                        Config: b.Config,
+                },
 
                 // Target
                 &TargetsTransformer{
@@ -136,6 +157,10 @@ func (b *PlanGraphBuilder) Steps() []GraphTransformer {
                         IgnoreIndices: true,
                 },
 
+                // Detect when create_before_destroy must be forced on for a particular
+                // node due to dependency edges, to avoid graph cycles during apply.
+                &ForcedCBDTransformer{},
+
                 // Close opened plugin connections
                 &CloseProviderTransformer{},
                 &CloseProvisionerTransformer{},
@@ -167,15 +192,13 @@ func (b *PlanGraphBuilder) init() {
 
         b.ConcreteResource = func(a *NodeAbstractResource) dag.Vertex {
                 return &NodePlannableResource{
-                        NodeAbstractCountResource: &NodeAbstractCountResource{
-                                NodeAbstractResource: a,
-                        },
+                        NodeAbstractResource: a,
                 }
         }
 
-        b.ConcreteResourceOrphan = func(a *NodeAbstractResource) dag.Vertex {
-                return &NodePlannableResourceOrphan{
-                        NodeAbstractResource: a,
+        b.ConcreteResourceOrphan = func(a *NodeAbstractResourceInstance) dag.Vertex {
+                return &NodePlannableResourceInstanceOrphan{
+                        NodeAbstractResourceInstance: a,
                 }
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go
index 9638d4c..0342cdb 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go
@@ -3,8 +3,11 @@ package terraform
 import (
         "log"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -21,17 +24,22 @@ import (
 //     create-before-destroy can be completely ignored.
 //
 type RefreshGraphBuilder struct {
-        // Module is the root module for the graph to build.
-        Module *module.Tree
+        // Config is the configuration tree.
+        Config *configs.Config
+
+        // State is the prior state
+        State *states.State
 
-        // State is the current state
-        State *State
+        // Components is a factory for the plug-in components (providers and
+        // provisioners) available for use.
+        Components contextComponentFactory
 
-        // Providers is the list of providers supported.
-        Providers []string
+        // Schemas is the repository of schemas we will draw from to analyse
+        // the configuration.
+        Schemas *Schemas
 
         // Targets are resources to target
-        Targets []string
+        Targets []addrs.Targetable
 
         // DisableReduce, if true, will not reduce the graph. Great for testing.
         DisableReduce bool
@@ -41,7 +49,7 @@ type RefreshGraphBuilder struct {
 }
 
 // See GraphBuilder
-func (b *RefreshGraphBuilder) Build(path []string) (*Graph, error) {
+func (b *RefreshGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
         return (&BasicGraphBuilder{
                 Steps:    b.Steps(),
                 Validate: b.Validate,
@@ -60,23 +68,27 @@ func (b *RefreshGraphBuilder) Steps() []GraphTransformer {
 
         concreteManagedResource := func(a *NodeAbstractResource) dag.Vertex {
                 return &NodeRefreshableManagedResource{
-                        NodeAbstractCountResource: &NodeAbstractCountResource{
-                                NodeAbstractResource: a,
-                        },
+                        NodeAbstractResource: a,
                 }
         }
 
-        concreteManagedResourceInstance := func(a *NodeAbstractResource) dag.Vertex {
+        concreteManagedResourceInstance := func(a *NodeAbstractResourceInstance) dag.Vertex {
                 return &NodeRefreshableManagedResourceInstance{
-                        NodeAbstractResource: a,
+                        NodeAbstractResourceInstance: a,
+                }
+        }
+
+        concreteResourceInstanceDeposed := func(a *NodeAbstractResourceInstance, key states.DeposedKey) dag.Vertex {
+                // The "Plan" node type also handles refreshing behavior.
+                return &NodePlanDeposedResourceInstanceObject{
+                        NodeAbstractResourceInstance: a,
+                        DeposedKey:                   key,
                 }
         }
 
         concreteDataResource := func(a *NodeAbstractResource) dag.Vertex {
                 return &NodeRefreshableDataResource{
-                        NodeAbstractCountResource: &NodeAbstractCountResource{
-                                NodeAbstractResource: a,
-                        },
+                        NodeAbstractResource: a,
                 }
         }
 
@@ -88,13 +100,13 @@ func (b *RefreshGraphBuilder) Steps() []GraphTransformer {
                         if b.State.HasResources() {
                                 return &ConfigTransformer{
                                         Concrete:   concreteManagedResource,
-                                        Module:     b.Module,
+                                        Config:     b.Config,
                                         Unique:     true,
                                         ModeFilter: true,
-                                        Mode:       config.ManagedResourceMode,
+                                        Mode:       addrs.ManagedResourceMode,
                                 }
                         }
-                        log.Println("[TRACE] No managed resources in state during refresh, skipping managed resource transformer")
+                        log.Println("[TRACE] No managed resources in state during refresh; skipping managed resource transformer")
                         return nil
                 }(),
 
@@ -102,40 +114,53 @@ func (b *RefreshGraphBuilder) Steps() []GraphTransformer {
                 // add any orphans from scaling in as destroy nodes.
                 &ConfigTransformer{
                         Concrete:   concreteDataResource,
-                        Module:     b.Module,
+                        Config:     b.Config,
                         Unique:     true,
                         ModeFilter: true,
-                        Mode:       config.DataResourceMode,
+                        Mode:       addrs.DataResourceMode,
                 },
 
                 // Add any fully-orphaned resources from config (ones that have been
                 // removed completely, not ones that are just orphaned due to a scaled-in
                 // count.
-                &OrphanResourceTransformer{
+                &OrphanResourceInstanceTransformer{
                         Concrete: concreteManagedResourceInstance,
                         State:    b.State,
-                        Module:   b.Module,
+                        Config:   b.Config,
+                },
+
+                // We also need nodes for any deposed instance objects present in the
+                // state, so we can check if they still exist. (This intentionally
+                // skips creating nodes for _current_ objects, since ConfigTransformer
+                // created nodes that will do that during DynamicExpand.)
+                &StateTransformer{
+                        ConcreteDeposed: concreteResourceInstanceDeposed,
+                        State:           b.State,
                 },
 
                 // Attach the state
                 &AttachStateTransformer{State: b.State},
 
                 // Attach the configuration to any resources
-                &AttachResourceConfigTransformer{Module: b.Module},
+                &AttachResourceConfigTransformer{Config: b.Config},
 
                 // Add root variables
-                &RootVariableTransformer{Module: b.Module},
-
-                TransformProviders(b.Providers, concreteProvider, b.Module),
+                &RootVariableTransformer{Config: b.Config},
 
                 // Add the local values
-                &LocalTransformer{Module: b.Module},
+                &LocalTransformer{Config: b.Config},
 
                 // Add the outputs
-                &OutputTransformer{Module: b.Module},
+                &OutputTransformer{Config: b.Config},
 
                 // Add module variables
-                &ModuleVariableTransformer{Module: b.Module},
+                &ModuleVariableTransformer{Config: b.Config},
+
+                TransformProviders(b.Components.ResourceProviders(), concreteProvider, b.Config),
+
+                // Must attach schemas before ReferenceTransformer so that we can
+                // analyze the configuration to find references.
+                &AttachSchemaTransformer{Schemas: b.Schemas},
 
                 // Connect so that the references are ready for targeting. We'll
                 // have to connect again later for providers and so on.
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_validate.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_validate.go
index 645ec7b..1881f95 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_validate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_validate.go
@@ -23,9 +23,7 @@ func ValidateGraphBuilder(p *PlanGraphBuilder) GraphBuilder {
 
         p.ConcreteResource = func(a *NodeAbstractResource) dag.Vertex {
                 return &NodeValidatableResource{
-                        NodeAbstractCountResource: &NodeAbstractCountResource{
-                                NodeAbstractResource: a,
-                        },
+                        NodeAbstractResource: a,
                 }
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_interface_subgraph.go b/vendor/github.com/hashicorp/terraform/terraform/graph_interface_subgraph.go
index 2897eb5..768590f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_interface_subgraph.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_interface_subgraph.go
@@ -1,7 +1,11 @@
 package terraform
 
+import (
+        "github.com/hashicorp/terraform/addrs"
+)
+
 // GraphNodeSubPath says that a node is part of a graph with a
 // different path, and the context should be adjusted accordingly.
 type GraphNodeSubPath interface {
-        Path() []string
+        Path() addrs.ModuleInstance
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_walk.go b/vendor/github.com/hashicorp/terraform/terraform/graph_walk.go
index 34ce6f6..e980e0c 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_walk.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_walk.go
@@ -1,60 +1,32 @@
 package terraform
 
 import (
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // GraphWalker is an interface that can be implemented that when used
 // with Graph.Walk will invoke the given callbacks under certain events.
 type GraphWalker interface {
-        EnterPath([]string) EvalContext
-        ExitPath([]string)
+        EnterPath(addrs.ModuleInstance) EvalContext
+        ExitPath(addrs.ModuleInstance)
         EnterVertex(dag.Vertex)
-        ExitVertex(dag.Vertex, error)
+        ExitVertex(dag.Vertex, tfdiags.Diagnostics)
         EnterEvalTree(dag.Vertex, EvalNode) EvalNode
-        ExitEvalTree(dag.Vertex, interface{}, error) error
+        ExitEvalTree(dag.Vertex, interface{}, error) tfdiags.Diagnostics
 }
 
-// GrpahWalkerPanicwrapper can be optionally implemented to catch panics
-// that occur while walking the graph. This is not generally recommended
-// since panics should crash Terraform and result in a bug report. However,
-// this is particularly useful for situations like the shadow graph where
-// you don't ever want to cause a panic.
-type GraphWalkerPanicwrapper interface {
-        GraphWalker
-
-        // Panic is called when a panic occurs. This will halt the panic from
-        // propogating so if the walker wants it to crash still it should panic
-        // again. This is called from within a defer so runtime/debug.Stack can
-        // be used to get the stack trace of the panic.
-        Panic(dag.Vertex, interface{})
-}
-
-// GraphWalkerPanicwrap wraps an existing Graphwalker to wrap and swallow
-// the panics. This doesn't lose the panics since the panics are still
-// returned as errors as part of a graph walk.
-func GraphWalkerPanicwrap(w GraphWalker) GraphWalkerPanicwrapper {
-        return &graphWalkerPanicwrapper{
-                GraphWalker: w,
-        }
-}
-
-type graphWalkerPanicwrapper struct {
-        GraphWalker
-}
-
-func (graphWalkerPanicwrapper) Panic(dag.Vertex, interface{}) {}
-
 // NullGraphWalker is a GraphWalker implementation that does nothing.
 // This can be embedded within other GraphWalker implementations for easily
 // implementing all the required functions.
 type NullGraphWalker struct{}
 
-func (NullGraphWalker) EnterPath([]string) EvalContext                  { return new(MockEvalContext) }
-func (NullGraphWalker) ExitPath([]string)                               {}
+func (NullGraphWalker) EnterPath(addrs.ModuleInstance) EvalContext      { return new(MockEvalContext) }
+func (NullGraphWalker) ExitPath(addrs.ModuleInstance)                   {}
 func (NullGraphWalker) EnterVertex(dag.Vertex)                          {}
-func (NullGraphWalker) ExitVertex(dag.Vertex, error)                    {}
+func (NullGraphWalker) ExitVertex(dag.Vertex, tfdiags.Diagnostics)      {}
 func (NullGraphWalker) EnterEvalTree(v dag.Vertex, n EvalNode) EvalNode { return n }
-func (NullGraphWalker) ExitEvalTree(dag.Vertex, interface{}, error) error {
+func (NullGraphWalker) ExitEvalTree(dag.Vertex, interface{}, error) tfdiags.Diagnostics {
         return nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_walk_context.go b/vendor/github.com/hashicorp/terraform/terraform/graph_walk_context.go
index 89f376e..03c192a 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_walk_context.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_walk_context.go
@@ -2,12 +2,19 @@ package terraform
 
 import (
         "context"
-        "fmt"
         "log"
         "sync"
 
-        "github.com/hashicorp/errwrap"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ContextGraphWalker is the GraphWalker implementation used with the
@@ -16,54 +23,56 @@ type ContextGraphWalker struct {
         NullGraphWalker
 
         // Configurable values
-        Context     *Context
-        Operation   walkOperation
-        StopContext context.Context
-
-        // Outputs, do not set these. Do not read these while the graph
-        // is being walked.
-        ValidationWarnings []string
-        ValidationErrors   []error
-
-        errorLock           sync.Mutex
-        once                sync.Once
-        contexts            map[string]*BuiltinEvalContext
-        contextLock         sync.Mutex
-        interpolaterVars    map[string]map[string]interface{}
-        interpolaterVarLock sync.Mutex
-        providerCache       map[string]ResourceProvider
-        providerLock        sync.Mutex
-        provisionerCache    map[string]ResourceProvisioner
-        provisionerLock     sync.Mutex
+        Context            *Context
+        State              *states.SyncState  // Used for safe concurrent access to state
+        Changes            *plans.ChangesSync // Used for safe concurrent writes to changes
+        Operation          walkOperation
+        StopContext        context.Context
+        RootVariableValues InputValues
+
+        // This is an output. Do not set this, nor read it while a graph walk
+        // is in progress.
+        NonFatalDiagnostics tfdiags.Diagnostics
+
+        errorLock          sync.Mutex
+        once               sync.Once
+        contexts           map[string]*BuiltinEvalContext
+        contextLock        sync.Mutex
+        variableValues     map[string]map[string]cty.Value
+        variableValuesLock sync.Mutex
+        providerCache      map[string]providers.Interface
+        providerSchemas    map[string]*ProviderSchema
+        providerLock       sync.Mutex
+        provisionerCache   map[string]provisioners.Interface
+        provisionerSchemas map[string]*configschema.Block
+        provisionerLock    sync.Mutex
 }
 
-func (w *ContextGraphWalker) EnterPath(path []string) EvalContext {
+func (w *ContextGraphWalker) EnterPath(path addrs.ModuleInstance) EvalContext {
         w.once.Do(w.init)
 
         w.contextLock.Lock()
         defer w.contextLock.Unlock()
 
         // If we already have a context for this path cached, use that
-        key := PathCacheKey(path)
+        key := path.String()
         if ctx, ok := w.contexts[key]; ok {
                 return ctx
         }
 
-        // Setup the variables for this interpolater
-        variables := make(map[string]interface{})
-        if len(path) <= 1 {
-                for k, v := range w.Context.variables {
-                        variables[k] = v
-                }
-        }
-        w.interpolaterVarLock.Lock()
-        if m, ok := w.interpolaterVars[key]; ok {
-                for k, v := range m {
-                        variables[k] = v
-                }
+        // Our evaluator shares some locks with the main context and the walker
+        // so that we can safely run multiple evaluations at once across
+        // different modules.
+        evaluator := &Evaluator{
+                Meta:               w.Context.meta,
+                Config:             w.Context.config,
+                Operation:          w.Operation,
+                State:              w.State,
+                Changes:            w.Changes,
+                Schemas:            w.Context.schemas,
+                VariableValues:     w.variableValues,
+                VariableValuesLock: &w.variableValuesLock,
         }
-        w.interpolaterVars[key] = variables
-        w.interpolaterVarLock.Unlock()
 
         ctx := &BuiltinEvalContext{
                 StopContext:         w.StopContext,
@@ -71,26 +80,17 @@ func (w *ContextGraphWalker) EnterPath(path []string) EvalContext {
                 Hooks:               w.Context.hooks,
                 InputValue:          w.Context.uiInput,
                 Components:          w.Context.components,
+                Schemas:             w.Context.schemas,
                 ProviderCache:       w.providerCache,
                 ProviderInputConfig: w.Context.providerInputConfig,
                 ProviderLock:        &w.providerLock,
                 ProvisionerCache:    w.provisionerCache,
                 ProvisionerLock:     &w.provisionerLock,
-                DiffValue:           w.Context.diff,
-                DiffLock:            &w.Context.diffLock,
-                StateValue:          w.Context.state,
-                StateLock:           &w.Context.stateLock,
-                Interpolater: &Interpolater{
-                        Operation:          w.Operation,
-                        Meta:               w.Context.meta,
-                        Module:             w.Context.module,
-                        State:              w.Context.state,
-                        StateLock:          &w.Context.stateLock,
-                        VariableValues:     variables,
-                        VariableValuesLock: &w.interpolaterVarLock,
-                },
-                InterpolaterVars:    w.interpolaterVars,
-                InterpolaterVarLock: &w.interpolaterVarLock,
+                ChangesValue:        w.Changes,
+                StateValue:          w.State,
+                Evaluator:           evaluator,
+                VariableValues:      w.variableValues,
+                VariableValuesLock:  &w.variableValuesLock,
         }
 
         w.contexts[key] = ctx
@@ -98,8 +98,7 @@ func (w *ContextGraphWalker) EnterPath(path []string) EvalContext {
 }
 
 func (w *ContextGraphWalker) EnterEvalTree(v dag.Vertex, n EvalNode) EvalNode {
-        log.Printf("[TRACE] [%s] Entering eval tree: %s",
-                w.Operation, dag.VertexName(v))
+        log.Printf("[TRACE] [%s] Entering eval tree: %s", w.Operation, dag.VertexName(v))
 
         // Acquire a lock on the semaphore
         w.Context.parallelSem.Acquire()
@@ -109,10 +108,8 @@ func (w *ContextGraphWalker) EnterEvalTree(v dag.Vertex, n EvalNode) EvalNode {
         return EvalFilter(n, EvalNodeFilterOp(w.Operation))
 }
 
-func (w *ContextGraphWalker) ExitEvalTree(
-        v dag.Vertex, output interface{}, err error) error {
-        log.Printf("[TRACE] [%s] Exiting eval tree: %s",
-                w.Operation, dag.VertexName(v))
+func (w *ContextGraphWalker) ExitEvalTree(v dag.Vertex, output interface{}, err error) tfdiags.Diagnostics {
+        log.Printf("[TRACE] [%s] Exiting eval tree: %s", w.Operation, dag.VertexName(v))
 
         // Release the semaphore
         w.Context.parallelSem.Release()
@@ -125,30 +122,36 @@ func (w *ContextGraphWalker) ExitEvalTree(
         w.errorLock.Lock()
         defer w.errorLock.Unlock()
 
-        // Try to get a validation error out of it. If its not a validation
-        // error, then just record the normal error.
-        verr, ok := err.(*EvalValidateError)
-        if !ok {
-                return err
-        }
-
-        for _, msg := range verr.Warnings {
-                w.ValidationWarnings = append(
-                        w.ValidationWarnings,
-                        fmt.Sprintf("%s: %s", dag.VertexName(v), msg))
-        }
-        for _, e := range verr.Errors {
-                w.ValidationErrors = append(
-                        w.ValidationErrors,
-                        errwrap.Wrapf(fmt.Sprintf("%s: {{err}}", dag.VertexName(v)), e))
+        // If the error is non-fatal then we'll accumulate its diagnostics in our
+        // non-fatal list, rather than returning it directly, so that the graph
+        // walk can continue.
+        if nferr, ok := err.(tfdiags.NonFatalError); ok {
+                log.Printf("[WARN] %s: %s", dag.VertexName(v), nferr)
+                w.NonFatalDiagnostics = w.NonFatalDiagnostics.Append(nferr.Diagnostics)
+                return nil
         }
 
-        return nil
+        // Otherwise, we'll let our usual diagnostics machinery figure out how to
+        // unpack this as one or more diagnostic messages and return that. If we
+        // get down here then the returned diagnostics will contain at least one
+        // error, causing the graph walk to halt.
+        var diags tfdiags.Diagnostics
+        diags = diags.Append(err)
+        return diags
 }
 
 func (w *ContextGraphWalker) init() {
-        w.contexts = make(map[string]*BuiltinEvalContext, 5)
-        w.providerCache = make(map[string]ResourceProvider, 5)
-        w.provisionerCache = make(map[string]ResourceProvisioner, 5)
-        w.interpolaterVars = make(map[string]map[string]interface{}, 5)
+        w.contexts = make(map[string]*BuiltinEvalContext)
+        w.providerCache = make(map[string]providers.Interface)
+        w.providerSchemas = make(map[string]*ProviderSchema)
+        w.provisionerCache = make(map[string]provisioners.Interface)
+        w.provisionerSchemas = make(map[string]*configschema.Block)
+        w.variableValues = make(map[string]map[string]cty.Value)
+
+        // Populate root module variable values. Other modules will be populated
+        // during the graph walk.
+        w.variableValues[""] = make(map[string]cty.Value)
+        for k, iv := range w.RootVariableValues {
+                w.variableValues[""][k] = iv.Value
+        }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_walk_operation.go b/vendor/github.com/hashicorp/terraform/terraform/graph_walk_operation.go
index 3fb3748..a3756e7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_walk_operation.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_walk_operation.go
@@ -7,7 +7,6 @@ type walkOperation byte
 
 const (
         walkInvalid walkOperation = iota
-        walkInput
         walkApply
         walkPlan
         walkPlanDestroy
@@ -15,4 +14,5 @@ const (
         walkValidate
         walkDestroy
         walkImport
+        walkEval // used just to prepare EvalContext for expression evaluation, with no other actions
 )
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graphtype_string.go b/vendor/github.com/hashicorp/terraform/terraform/graphtype_string.go
index 95ef4e9..b51e1a2 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graphtype_string.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graphtype_string.go
@@ -4,9 +4,23 @@ package terraform
 
 import "strconv"
 
-const _GraphType_name = "GraphTypeInvalidGraphTypeLegacyGraphTypeRefreshGraphTypePlanGraphTypePlanDestroyGraphTypeApplyGraphTypeInputGraphTypeValidate"
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[GraphTypeInvalid-0]
+        _ = x[GraphTypeLegacy-1]
+        _ = x[GraphTypeRefresh-2]
+        _ = x[GraphTypePlan-3]
+        _ = x[GraphTypePlanDestroy-4]
+        _ = x[GraphTypeApply-5]
+        _ = x[GraphTypeValidate-6]
+        _ = x[GraphTypeEval-7]
+}
+
+const _GraphType_name = "GraphTypeInvalidGraphTypeLegacyGraphTypeRefreshGraphTypePlanGraphTypePlanDestroyGraphTypeApplyGraphTypeValidateGraphTypeEval"
 
-var _GraphType_index = [...]uint8{0, 16, 31, 47, 60, 80, 94, 108, 125}
+var _GraphType_index = [...]uint8{0, 16, 31, 47, 60, 80, 94, 111, 124}
 
 func (i GraphType) String() string {
         if i >= GraphType(len(_GraphType_index)-1) {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/hook.go b/vendor/github.com/hashicorp/terraform/terraform/hook.go
index ab11e8e..c0bb23a 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/hook.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/hook.go
@@ -1,5 +1,14 @@
 package terraform
 
+import (
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+)
+
 // HookAction is an enum of actions that can be taken as a result of a hook
 // callback. This allows you to modify the behavior of Terraform at runtime.
 type HookAction byte
@@ -21,42 +30,56 @@ const (
 // NilHook into your struct, which implements all of the interface but does
 // nothing. Then, override only the functions you want to implement.
 type Hook interface {
-        // PreApply and PostApply are called before and after a single
-        // resource is applied. The error argument in PostApply is the
+        // PreApply and PostApply are called before and after an action for a
+        // single instance is applied. The error argument in PostApply is the
         // error, if any, that was returned from the provider Apply call itself.
-        PreApply(*InstanceInfo, *InstanceState, *InstanceDiff) (HookAction, error)
-        PostApply(*InstanceInfo, *InstanceState, error) (HookAction, error)
-
-        // PreDiff and PostDiff are called before and after a single resource
-        // resource is diffed.
-        PreDiff(*InstanceInfo, *InstanceState) (HookAction, error)
-        PostDiff(*InstanceInfo, *InstanceDiff) (HookAction, error)
-
-        // Provisioning hooks
+        PreApply(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error)
+        PostApply(addr addrs.AbsResourceInstance, gen states.Generation, newState cty.Value, err error) (HookAction, error)
+
+        // PreDiff and PostDiff are called before and after a provider is given
+        // the opportunity to customize the proposed new state to produce the
+        // planned new state.
+        PreDiff(addr addrs.AbsResourceInstance, gen states.Generation, priorState, proposedNewState cty.Value) (HookAction, error)
+        PostDiff(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error)
+
+        // The provisioning hooks signal both the overall start end end of
+        // provisioning for a particular instance and of each of the individual
+        // configured provisioners for each instance. The sequence of these
+        // for a given instance might look something like this:
         //
-        // All should be self-explanatory. ProvisionOutput is called with
-        // output sent back by the provisioners. This will be called multiple
-        // times as output comes in, but each call should represent a line of
-        // output. The ProvisionOutput method cannot control whether the
-        // hook continues running.
-        PreProvisionResource(*InstanceInfo, *InstanceState) (HookAction, error)
-        PostProvisionResource(*InstanceInfo, *InstanceState) (HookAction, error)
-        PreProvision(*InstanceInfo, string) (HookAction, error)
-        PostProvision(*InstanceInfo, string, error) (HookAction, error)
-        ProvisionOutput(*InstanceInfo, string, string)
+        //          PreProvisionInstance(aws_instance.foo[1], ...)
+        //      PreProvisionInstanceStep(aws_instance.foo[1], "file")
+        //     PostProvisionInstanceStep(aws_instance.foo[1], "file", nil)
+        //      PreProvisionInstanceStep(aws_instance.foo[1], "remote-exec")
+        //               ProvisionOutput(aws_instance.foo[1], "remote-exec", "Installing foo...")
+        //               ProvisionOutput(aws_instance.foo[1], "remote-exec", "Configuring bar...")
+        //     PostProvisionInstanceStep(aws_instance.foo[1], "remote-exec", nil)
+        //         PostProvisionInstance(aws_instance.foo[1], ...)
+        //
+        // ProvisionOutput is called with output sent back by the provisioners.
+        // This will be called multiple times as output comes in, with each call
+        // representing one line of output. It cannot control whether the
+        // provisioner continues running.
+        PreProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error)
+        PostProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error)
+        PreProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string) (HookAction, error)
+        PostProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string, err error) (HookAction, error)
+        ProvisionOutput(addr addrs.AbsResourceInstance, typeName string, line string)
 
         // PreRefresh and PostRefresh are called before and after a single
         // resource state is refreshed, respectively.
-        PreRefresh(*InstanceInfo, *InstanceState) (HookAction, error)
-        PostRefresh(*InstanceInfo, *InstanceState) (HookAction, error)
-
-        // PostStateUpdate is called after the state is updated.
-        PostStateUpdate(*State) (HookAction, error)
+        PreRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value) (HookAction, error)
+        PostRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value, newState cty.Value) (HookAction, error)
 
         // PreImportState and PostImportState are called before and after
-        // a single resource's state is being improted.
-        PreImportState(*InstanceInfo, string) (HookAction, error)
-        PostImportState(*InstanceInfo, []*InstanceState) (HookAction, error)
+        // (respectively) each state import operation for a given resource address.
+        PreImportState(addr addrs.AbsResourceInstance, importID string) (HookAction, error)
+        PostImportState(addr addrs.AbsResourceInstance, imported []providers.ImportedResource) (HookAction, error)
+
+        // PostStateUpdate is called each time the state is updated. It receives
+        // a deep copy of the state, which it may therefore access freely without
+        // any need for locks to protect from concurrent writes from the caller.
+        PostStateUpdate(new *states.State) (HookAction, error)
 }
 
 // NilHook is a Hook implementation that does nothing. It exists only to
@@ -64,59 +87,60 @@ type Hook interface {
 // and only implement the functions you are interested in.
 type NilHook struct{}
 
-func (*NilHook) PreApply(*InstanceInfo, *InstanceState, *InstanceDiff) (HookAction, error) {
+var _ Hook = (*NilHook)(nil)
+
+func (*NilHook) PreApply(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostApply(*InstanceInfo, *InstanceState, error) (HookAction, error) {
+func (*NilHook) PostApply(addr addrs.AbsResourceInstance, gen states.Generation, newState cty.Value, err error) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PreDiff(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (*NilHook) PreDiff(addr addrs.AbsResourceInstance, gen states.Generation, priorState, proposedNewState cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostDiff(*InstanceInfo, *InstanceDiff) (HookAction, error) {
+func (*NilHook) PostDiff(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PreProvisionResource(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (*NilHook) PreProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostProvisionResource(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (*NilHook) PostProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PreProvision(*InstanceInfo, string) (HookAction, error) {
+func (*NilHook) PreProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostProvision(*InstanceInfo, string, error) (HookAction, error) {
+func (*NilHook) PostProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string, err error) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) ProvisionOutput(
-        *InstanceInfo, string, string) {
+func (*NilHook) ProvisionOutput(addr addrs.AbsResourceInstance, typeName string, line string) {
 }
 
-func (*NilHook) PreRefresh(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (*NilHook) PreRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostRefresh(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (*NilHook) PostRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value, newState cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PreImportState(*InstanceInfo, string) (HookAction, error) {
+func (*NilHook) PreImportState(addr addrs.AbsResourceInstance, importID string) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostImportState(*InstanceInfo, []*InstanceState) (HookAction, error) {
+func (*NilHook) PostImportState(addr addrs.AbsResourceInstance, imported []providers.ImportedResource) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostStateUpdate(*State) (HookAction, error) {
+func (*NilHook) PostStateUpdate(new *states.State) (HookAction, error) {
         return HookActionContinue, nil
 }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/hook_mock.go b/vendor/github.com/hashicorp/terraform/terraform/hook_mock.go
index 0e46400..6efa319 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/hook_mock.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/hook_mock.go
@@ -1,245 +1,274 @@
 package terraform
 
-import "sync"
+import (
+        "sync"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+)
 
 // MockHook is an implementation of Hook that can be used for tests.
 // It records all of its function calls.
 type MockHook struct {
         sync.Mutex
 
-        PreApplyCalled bool
-        PreApplyInfo   *InstanceInfo
-        PreApplyDiff   *InstanceDiff
-        PreApplyState  *InstanceState
-        PreApplyReturn HookAction
-        PreApplyError  error
+        PreApplyCalled       bool
+        PreApplyAddr         addrs.AbsResourceInstance
+        PreApplyGen          states.Generation
+        PreApplyAction       plans.Action
+        PreApplyPriorState   cty.Value
+        PreApplyPlannedState cty.Value
+        PreApplyReturn       HookAction
+        PreApplyError        error
 
         PostApplyCalled      bool
-        PostApplyInfo        *InstanceInfo
-        PostApplyState       *InstanceState
+        PostApplyAddr        addrs.AbsResourceInstance
+        PostApplyGen         states.Generation
+        PostApplyNewState    cty.Value
         PostApplyError       error
         PostApplyReturn      HookAction
         PostApplyReturnError error
-        PostApplyFn          func(*InstanceInfo, *InstanceState, error) (HookAction, error)
-
-        PreDiffCalled bool
-        PreDiffInfo   *InstanceInfo
-        PreDiffState  *InstanceState
-        PreDiffReturn HookAction
-        PreDiffError  error
-
-        PostDiffCalled bool
-        PostDiffInfo   *InstanceInfo
-        PostDiffDiff   *InstanceDiff
-        PostDiffReturn HookAction
-        PostDiffError  error
-
-        PreProvisionResourceCalled bool
-        PreProvisionResourceInfo   *InstanceInfo
-        PreProvisionInstanceState  *InstanceState
-        PreProvisionResourceReturn HookAction
-        PreProvisionResourceError  error
-
-        PostProvisionResourceCalled bool
-        PostProvisionResourceInfo   *InstanceInfo
-        PostProvisionInstanceState  *InstanceState
-        PostProvisionResourceReturn HookAction
-        PostProvisionResourceError  error
-
-        PreProvisionCalled        bool
-        PreProvisionInfo          *InstanceInfo
-        PreProvisionProvisionerId string
-        PreProvisionReturn        HookAction
-        PreProvisionError         error
-
-        PostProvisionCalled        bool
-        PostProvisionInfo          *InstanceInfo
-        PostProvisionProvisionerId string
-        PostProvisionErrorArg      error
-        PostProvisionReturn        HookAction
-        PostProvisionError         error
-
-        ProvisionOutputCalled        bool
-        ProvisionOutputInfo          *InstanceInfo
-        ProvisionOutputProvisionerId string
-        ProvisionOutputMessage       string
-
-        PostRefreshCalled bool
-        PostRefreshInfo   *InstanceInfo
-        PostRefreshState  *InstanceState
-        PostRefreshReturn HookAction
-        PostRefreshError  error
-
-        PreRefreshCalled bool
-        PreRefreshInfo   *InstanceInfo
-        PreRefreshState  *InstanceState
-        PreRefreshReturn HookAction
-        PreRefreshError  error
+        PostApplyFn          func(addrs.AbsResourceInstance, states.Generation, cty.Value, error) (HookAction, error)
+
+        PreDiffCalled        bool
+        PreDiffAddr          addrs.AbsResourceInstance
+        PreDiffGen           states.Generation
+        PreDiffPriorState    cty.Value
+        PreDiffProposedState cty.Value
+        PreDiffReturn        HookAction
+        PreDiffError         error
+
+        PostDiffCalled       bool
+        PostDiffAddr         addrs.AbsResourceInstance
+        PostDiffGen          states.Generation
+        PostDiffAction       plans.Action
+        PostDiffPriorState   cty.Value
+        PostDiffPlannedState cty.Value
+        PostDiffReturn       HookAction
+        PostDiffError        error
+
+        PreProvisionInstanceCalled bool
+        PreProvisionInstanceAddr   addrs.AbsResourceInstance
+        PreProvisionInstanceState  cty.Value
+        PreProvisionInstanceReturn HookAction
+        PreProvisionInstanceError  error
+
+        PostProvisionInstanceCalled bool
+        PostProvisionInstanceAddr   addrs.AbsResourceInstance
+        PostProvisionInstanceState  cty.Value
+        PostProvisionInstanceReturn HookAction
+        PostProvisionInstanceError  error
+
+        PreProvisionInstanceStepCalled          bool
+        PreProvisionInstanceStepAddr            addrs.AbsResourceInstance
+        PreProvisionInstanceStepProvisionerType string
+        PreProvisionInstanceStepReturn          HookAction
+        PreProvisionInstanceStepError           error
+
+        PostProvisionInstanceStepCalled          bool
+        PostProvisionInstanceStepAddr            addrs.AbsResourceInstance
+        PostProvisionInstanceStepProvisionerType string
+        PostProvisionInstanceStepErrorArg        error
+        PostProvisionInstanceStepReturn          HookAction
+        PostProvisionInstanceStepError           error
+
+        ProvisionOutputCalled          bool
+        ProvisionOutputAddr            addrs.AbsResourceInstance
+        ProvisionOutputProvisionerType string
+        ProvisionOutputMessage         string
+
+        PreRefreshCalled     bool
+        PreRefreshAddr       addrs.AbsResourceInstance
+        PreRefreshGen        states.Generation
+        PreRefreshPriorState cty.Value
+        PreRefreshReturn     HookAction
+        PreRefreshError      error
+
+        PostRefreshCalled     bool
+        PostRefreshAddr       addrs.AbsResourceInstance
+        PostRefreshGen        states.Generation
+        PostRefreshPriorState cty.Value
+        PostRefreshNewState   cty.Value
+        PostRefreshReturn     HookAction
+        PostRefreshError      error
 
         PreImportStateCalled bool
-        PreImportStateInfo   *InstanceInfo
-        PreImportStateId     string
+        PreImportStateAddr   addrs.AbsResourceInstance
+        PreImportStateID     string
         PreImportStateReturn HookAction
         PreImportStateError  error
 
-        PostImportStateCalled bool
-        PostImportStateInfo   *InstanceInfo
-        PostImportStateState  []*InstanceState
-        PostImportStateReturn HookAction
-        PostImportStateError  error
+        PostImportStateCalled    bool
+        PostImportStateAddr      addrs.AbsResourceInstance
+        PostImportStateNewStates []providers.ImportedResource
+        PostImportStateReturn    HookAction
+        PostImportStateError     error
 
         PostStateUpdateCalled bool
-        PostStateUpdateState  *State
+        PostStateUpdateState  *states.State
         PostStateUpdateReturn HookAction
         PostStateUpdateError  error
 }
 
-func (h *MockHook) PreApply(n *InstanceInfo, s *InstanceState, d *InstanceDiff) (HookAction, error) {
+var _ Hook = (*MockHook)(nil)
+
+func (h *MockHook) PreApply(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PreApplyCalled = true
-        h.PreApplyInfo = n
-        h.PreApplyDiff = d
-        h.PreApplyState = s
+        h.PreApplyAddr = addr
+        h.PreApplyGen = gen
+        h.PreApplyAction = action
+        h.PreApplyPriorState = priorState
+        h.PreApplyPlannedState = plannedNewState
         return h.PreApplyReturn, h.PreApplyError
 }
 
-func (h *MockHook) PostApply(n *InstanceInfo, s *InstanceState, e error) (HookAction, error) {
+func (h *MockHook) PostApply(addr addrs.AbsResourceInstance, gen states.Generation, newState cty.Value, err error) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PostApplyCalled = true
-        h.PostApplyInfo = n
-        h.PostApplyState = s
-        h.PostApplyError = e
+        h.PostApplyAddr = addr
+        h.PostApplyGen = gen
+        h.PostApplyNewState = newState
+        h.PostApplyError = err
 
         if h.PostApplyFn != nil {
-                return h.PostApplyFn(n, s, e)
+                return h.PostApplyFn(addr, gen, newState, err)
         }
 
         return h.PostApplyReturn, h.PostApplyReturnError
 }
 
-func (h *MockHook) PreDiff(n *InstanceInfo, s *InstanceState) (HookAction, error) {
+func (h *MockHook) PreDiff(addr addrs.AbsResourceInstance, gen states.Generation, priorState, proposedNewState cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PreDiffCalled = true
-        h.PreDiffInfo = n
-        h.PreDiffState = s
+        h.PreDiffAddr = addr
+        h.PreDiffGen = gen
+        h.PreDiffPriorState = priorState
+        h.PreDiffProposedState = proposedNewState
         return h.PreDiffReturn, h.PreDiffError
 }
 
-func (h *MockHook) PostDiff(n *InstanceInfo, d *InstanceDiff) (HookAction, error) {
+func (h *MockHook) PostDiff(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PostDiffCalled = true
-        h.PostDiffInfo = n
-        h.PostDiffDiff = d
+        h.PostDiffAddr = addr
+        h.PostDiffGen = gen
+        h.PostDiffAction = action
+        h.PostDiffPriorState = priorState
+        h.PostDiffPlannedState = plannedNewState
         return h.PostDiffReturn, h.PostDiffError
 }
 
-func (h *MockHook) PreProvisionResource(n *InstanceInfo, s *InstanceState) (HookAction, error) {
+func (h *MockHook) PreProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
-        h.PreProvisionResourceCalled = true
-        h.PreProvisionResourceInfo = n
-        h.PreProvisionInstanceState = s
-        return h.PreProvisionResourceReturn, h.PreProvisionResourceError
+        h.PreProvisionInstanceCalled = true
+        h.PreProvisionInstanceAddr = addr
+        h.PreProvisionInstanceState = state
+        return h.PreProvisionInstanceReturn, h.PreProvisionInstanceError
 }
 
-func (h *MockHook) PostProvisionResource(n *InstanceInfo, s *InstanceState) (HookAction, error) {
+func (h *MockHook) PostProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
-        h.PostProvisionResourceCalled = true
-        h.PostProvisionResourceInfo = n
-        h.PostProvisionInstanceState = s
-        return h.PostProvisionResourceReturn, h.PostProvisionResourceError
+        h.PostProvisionInstanceCalled = true
+        h.PostProvisionInstanceAddr = addr
+        h.PostProvisionInstanceState = state
+        return h.PostProvisionInstanceReturn, h.PostProvisionInstanceError
 }
 
-func (h *MockHook) PreProvision(n *InstanceInfo, provId string) (HookAction, error) {
+func (h *MockHook) PreProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
-        h.PreProvisionCalled = true
-        h.PreProvisionInfo = n
-        h.PreProvisionProvisionerId = provId
-        return h.PreProvisionReturn, h.PreProvisionError
+        h.PreProvisionInstanceStepCalled = true
+        h.PreProvisionInstanceStepAddr = addr
+        h.PreProvisionInstanceStepProvisionerType = typeName
+        return h.PreProvisionInstanceStepReturn, h.PreProvisionInstanceStepError
 }
 
-func (h *MockHook) PostProvision(n *InstanceInfo, provId string, err error) (HookAction, error) {
+func (h *MockHook) PostProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string, err error) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
-        h.PostProvisionCalled = true
-        h.PostProvisionInfo = n
-        h.PostProvisionProvisionerId = provId
-        h.PostProvisionErrorArg = err
-        return h.PostProvisionReturn, h.PostProvisionError
+        h.PostProvisionInstanceStepCalled = true
+        h.PostProvisionInstanceStepAddr = addr
+        h.PostProvisionInstanceStepProvisionerType = typeName
+        h.PostProvisionInstanceStepErrorArg = err
+        return h.PostProvisionInstanceStepReturn, h.PostProvisionInstanceStepError
 }
 
-func (h *MockHook) ProvisionOutput(
-        n *InstanceInfo,
-        provId string,
-        msg string) {
+func (h *MockHook) ProvisionOutput(addr addrs.AbsResourceInstance, typeName string, line string) {
         h.Lock()
         defer h.Unlock()
 
         h.ProvisionOutputCalled = true
-        h.ProvisionOutputInfo = n
-        h.ProvisionOutputProvisionerId = provId
-        h.ProvisionOutputMessage = msg
+        h.ProvisionOutputAddr = addr
+        h.ProvisionOutputProvisionerType = typeName
+        h.ProvisionOutputMessage = line
 }
 
-func (h *MockHook) PreRefresh(n *InstanceInfo, s *InstanceState) (HookAction, error) {
+func (h *MockHook) PreRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PreRefreshCalled = true
-        h.PreRefreshInfo = n
-        h.PreRefreshState = s
+        h.PreRefreshAddr = addr
+        h.PreRefreshGen = gen
+        h.PreRefreshPriorState = priorState
         return h.PreRefreshReturn, h.PreRefreshError
 }
 
-func (h *MockHook) PostRefresh(n *InstanceInfo, s *InstanceState) (HookAction, error) {
+func (h *MockHook) PostRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value, newState cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PostRefreshCalled = true
-        h.PostRefreshInfo = n
-        h.PostRefreshState = s
+        h.PostRefreshAddr = addr
+        h.PostRefreshPriorState = priorState
+        h.PostRefreshNewState = newState
         return h.PostRefreshReturn, h.PostRefreshError
 }
 
-func (h *MockHook) PreImportState(info *InstanceInfo, id string) (HookAction, error) {
+func (h *MockHook) PreImportState(addr addrs.AbsResourceInstance, importID string) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PreImportStateCalled = true
-        h.PreImportStateInfo = info
-        h.PreImportStateId = id
+        h.PreImportStateAddr = addr
+        h.PreImportStateID = importID
         return h.PreImportStateReturn, h.PreImportStateError
 }
 
-func (h *MockHook) PostImportState(info *InstanceInfo, s []*InstanceState) (HookAction, error) {
+func (h *MockHook) PostImportState(addr addrs.AbsResourceInstance, imported []providers.ImportedResource) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PostImportStateCalled = true
-        h.PostImportStateInfo = info
-        h.PostImportStateState = s
+        h.PostImportStateAddr = addr
+        h.PostImportStateNewStates = imported
         return h.PostImportStateReturn, h.PostImportStateError
 }
 
-func (h *MockHook) PostStateUpdate(s *State) (HookAction, error) {
+func (h *MockHook) PostStateUpdate(new *states.State) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PostStateUpdateCalled = true
-        h.PostStateUpdateState = s
+        h.PostStateUpdateState = new
         return h.PostStateUpdateReturn, h.PostStateUpdateError
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/hook_stop.go b/vendor/github.com/hashicorp/terraform/terraform/hook_stop.go
index 104d009..811fb33 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/hook_stop.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/hook_stop.go
@@ -2,6 +2,13 @@ package terraform
 
 import (
         "sync/atomic"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
 )
 
 // stopHook is a private Hook implementation that Terraform uses to
@@ -10,63 +17,69 @@ type stopHook struct {
         stop uint32
 }
 
-func (h *stopHook) PreApply(*InstanceInfo, *InstanceState, *InstanceDiff) (HookAction, error) {
+var _ Hook = (*stopHook)(nil)
+
+func (h *stopHook) PreApply(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostApply(*InstanceInfo, *InstanceState, error) (HookAction, error) {
+func (h *stopHook) PostApply(addr addrs.AbsResourceInstance, gen states.Generation, newState cty.Value, err error) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PreDiff(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (h *stopHook) PreDiff(addr addrs.AbsResourceInstance, gen states.Generation, priorState, proposedNewState cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostDiff(*InstanceInfo, *InstanceDiff) (HookAction, error) {
+func (h *stopHook) PostDiff(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PreProvisionResource(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (h *stopHook) PreProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostProvisionResource(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (h *stopHook) PostProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PreProvision(*InstanceInfo, string) (HookAction, error) {
+func (h *stopHook) PreProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostProvision(*InstanceInfo, string, error) (HookAction, error) {
+func (h *stopHook) PostProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string, err error) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) ProvisionOutput(*InstanceInfo, string, string) {
+func (h *stopHook) ProvisionOutput(addr addrs.AbsResourceInstance, typeName string, line string) {
 }
 
-func (h *stopHook) PreRefresh(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (h *stopHook) PreRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostRefresh(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (h *stopHook) PostRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value, newState cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PreImportState(*InstanceInfo, string) (HookAction, error) {
+func (h *stopHook) PreImportState(addr addrs.AbsResourceInstance, importID string) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostImportState(*InstanceInfo, []*InstanceState) (HookAction, error) {
+func (h *stopHook) PostImportState(addr addrs.AbsResourceInstance, imported []providers.ImportedResource) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostStateUpdate(*State) (HookAction, error) {
+func (h *stopHook) PostStateUpdate(new *states.State) (HookAction, error) {
         return h.hook()
 }
 
 func (h *stopHook) hook() (HookAction, error) {
         if h.Stopped() {
+                // FIXME: This should really return an error since stopping partway
+                // through is not a successful run-to-completion, but we'll need to
+                // introduce that cautiously since existing automation solutions may
+                // be depending on this behavior.
                 return HookActionHalt, nil
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/instancetype_string.go b/vendor/github.com/hashicorp/terraform/terraform/instancetype_string.go
index b8e7d1f..95b7a98 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/instancetype_string.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/instancetype_string.go
@@ -4,6 +4,16 @@ package terraform
 
 import "strconv"
 
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[TypeInvalid-0]
+        _ = x[TypePrimary-1]
+        _ = x[TypeTainted-2]
+        _ = x[TypeDeposed-3]
+}
+
 const _InstanceType_name = "TypeInvalidTypePrimaryTypeTaintedTypeDeposed"
 
 var _InstanceType_index = [...]uint8{0, 11, 22, 33, 44}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/interpolate.go b/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
index 4f4e178..26c1857 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
@@ -45,65 +45,7 @@ type InterpolationScope struct {
 func (i *Interpolater) Values(
         scope *InterpolationScope,
         vars map[string]config.InterpolatedVariable) (map[string]ast.Variable, error) {
-        if scope == nil {
-                scope = &InterpolationScope{}
-        }
-
-        result := make(map[string]ast.Variable, len(vars))
-
-        // Copy the default variables
-        if i.Module != nil && scope != nil {
-                mod := i.Module
-                if len(scope.Path) > 1 {
-                        mod = i.Module.Child(scope.Path[1:])
-                }
-                for _, v := range mod.Config().Variables {
-                        // Set default variables
-                        if v.Default == nil {
-                                continue
-                        }
-
-                        n := fmt.Sprintf("var.%s", v.Name)
-                        variable, err := hil.InterfaceToVariable(v.Default)
-                        if err != nil {
-                                return nil, fmt.Errorf("invalid default map value for %s: %v", v.Name, v.Default)
-                        }
-
-                        result[n] = variable
-                }
-        }
-
-        for n, rawV := range vars {
-                var err error
-                switch v := rawV.(type) {
-                case *config.CountVariable:
-                        err = i.valueCountVar(scope, n, v, result)
-                case *config.ModuleVariable:
-                        err = i.valueModuleVar(scope, n, v, result)
-                case *config.PathVariable:
-                        err = i.valuePathVar(scope, n, v, result)
-                case *config.ResourceVariable:
-                        err = i.valueResourceVar(scope, n, v, result)
-                case *config.SelfVariable:
-                        err = i.valueSelfVar(scope, n, v, result)
-                case *config.SimpleVariable:
-                        err = i.valueSimpleVar(scope, n, v, result)
-                case *config.TerraformVariable:
-                        err = i.valueTerraformVar(scope, n, v, result)
-                case *config.LocalVariable:
-                        err = i.valueLocalVar(scope, n, v, result)
-                case *config.UserVariable:
-                        err = i.valueUserVar(scope, n, v, result)
-                default:
-                        err = fmt.Errorf("%s: unknown variable type: %T", n, rawV)
-                }
-
-                if err != nil {
-                        return nil, err
-                }
-        }
-
-        return result, nil
+        return nil, fmt.Errorf("type Interpolator is no longer supported; use the evaluator API instead")
 }
 
 func (i *Interpolater) valueCountVar(
@@ -153,7 +95,7 @@ func (i *Interpolater) valueModuleVar(
         defer i.StateLock.RUnlock()
 
         // Get the module where we're looking for the value
-        mod := i.State.ModuleByPath(path)
+        mod := i.State.ModuleByPath(normalizeModulePath(path))
         if mod == nil {
                 // If the module doesn't exist, then we can return an empty string.
                 // This happens usually only in Refresh() when we haven't populated
@@ -257,13 +199,13 @@ func (i *Interpolater) valueResourceVar(
         }
 
         if variable == nil {
-                // During the input walk we tolerate missing variables because
+                // During the refresh walk we tolerate missing variables because
                 // we haven't yet had a chance to refresh state, so dynamic data may
                 // not yet be complete.
                 // If it truly is missing, we'll catch it on a later walk.
                 // This applies only to graph nodes that interpolate during the
-                // config walk, e.g. providers.
-                if i.Operation == walkInput || i.Operation == walkRefresh {
+                // refresh walk, e.g. providers.
+                if i.Operation == walkRefresh {
                         result[n] = unknownVariable()
                         return nil
                 }
@@ -365,7 +307,7 @@ func (i *Interpolater) valueLocalVar(
         }
 
         // Get the relevant module
-        module := i.State.ModuleByPath(scope.Path)
+        module := i.State.ModuleByPath(normalizeModulePath(scope.Path))
         if module == nil {
                 result[n] = unknownVariable()
                 return nil
@@ -584,10 +526,7 @@ MISSING:
         //
         // For a Destroy, we're also fine with computed values, since our goal is
         // only to get destroy nodes for existing resources.
-        //
-        // For an input walk, computed values are okay to return because we're only
-        // looking for missing variables to prompt the user for.
-        if i.Operation == walkRefresh || i.Operation == walkPlanDestroy || i.Operation == walkInput {
+        if i.Operation == walkRefresh || i.Operation == walkPlanDestroy {
                 return &unknownVariable, nil
         }
 
@@ -607,13 +546,6 @@ func (i *Interpolater) computeResourceMultiVariable(
 
         unknownVariable := unknownVariable()
 
-        // If we're only looking for input, we don't need to expand a
-        // multi-variable. This prevents us from encountering things that should be
-        // known but aren't because the state has yet to be refreshed.
-        if i.Operation == walkInput {
-                return &unknownVariable, nil
-        }
-
         // Get the information about this resource variable, and verify
         // that it exists and such.
         module, cr, err := i.resourceVariableInfo(scope, v)
@@ -695,7 +627,7 @@ func (i *Interpolater) computeResourceMultiVariable(
                 //
                 // For an input walk, computed values are okay to return because we're only
                 // looking for missing variables to prompt the user for.
-                if i.Operation == walkRefresh || i.Operation == walkPlanDestroy || i.Operation == walkDestroy || i.Operation == walkInput {
+                if i.Operation == walkRefresh || i.Operation == walkPlanDestroy || i.Operation == walkDestroy {
                         return &unknownVariable, nil
                 }
 
@@ -776,7 +708,7 @@ func (i *Interpolater) resourceVariableInfo(
         }
 
         // Get the relevant module
-        module := i.State.ModuleByPath(scope.Path)
+        module := i.State.ModuleByPath(normalizeModulePath(scope.Path))
         return module, cr, nil
 }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go b/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go
index 4594cb6..66a68c7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go
@@ -1,84 +1,135 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        version "github.com/hashicorp/go-version"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/moduledeps"
         "github.com/hashicorp/terraform/plugin/discovery"
+        "github.com/hashicorp/terraform/states"
 )
 
-// ModuleTreeDependencies returns the dependencies of the tree of modules
-// described by the given configuration tree and state.
+// ConfigTreeDependencies returns the dependencies of the tree of modules
+// described by the given configuration and state.
 //
 // Both configuration and state are required because there can be resources
 // implied by instances in the state that no longer exist in config.
-//
-// This function will panic if any invalid version constraint strings are
-// present in the configuration. This is guaranteed not to happen for any
-// configuration that has passed a call to Config.Validate().
-func ModuleTreeDependencies(root *module.Tree, state *State) *moduledeps.Module {
+func ConfigTreeDependencies(root *configs.Config, state *states.State) *moduledeps.Module {
         // First we walk the configuration tree to build the overall structure
         // and capture the explicit/implicit/inherited provider dependencies.
-        deps := moduleTreeConfigDependencies(root, nil)
+        deps := configTreeConfigDependencies(root, nil)
 
         // Next we walk over the resources in the state to catch any additional
         // dependencies created by existing resources that are no longer in config.
         // Most things we find in state will already be present in 'deps', but
         // we're interested in the rare thing that isn't.
-        moduleTreeMergeStateDependencies(deps, state)
+        configTreeMergeStateDependencies(deps, state)
 
         return deps
 }
 
-func moduleTreeConfigDependencies(root *module.Tree, inheritProviders map[string]*config.ProviderConfig) *moduledeps.Module {
+func configTreeConfigDependencies(root *configs.Config, inheritProviders map[string]*configs.Provider) *moduledeps.Module {
         if root == nil {
                 // If no config is provided, we'll make a synthetic root.
                 // This isn't necessarily correct if we're called with a nil that
                 // *isn't* at the root, but in practice that can never happen.
                 return &moduledeps.Module{
-                        Name: "root",
+                        Name:      "root",
+                        Providers: make(moduledeps.Providers),
                 }
         }
 
+        name := "root"
+        if len(root.Path) != 0 {
+                name = root.Path[len(root.Path)-1]
+        }
+
         ret := &moduledeps.Module{
-                Name: root.Name(),
+                Name: name,
         }
 
-        cfg := root.Config()
-        providerConfigs := cfg.ProviderConfigsByFullName()
+        module := root.Module
 
         // Provider dependencies
         {
-                providers := make(moduledeps.Providers, len(providerConfigs))
+                providers := make(moduledeps.Providers)
 
-                // Any providerConfigs elements are *explicit* provider dependencies,
-                // which is the only situation where the user might provide an actual
-                // version constraint. We'll take care of these first.
-                for fullName, pCfg := range providerConfigs {
+                // The main way to declare a provider dependency is explicitly inside
+                // the "terraform" block, which allows declaring a requirement without
+                // also creating a configuration.
+                for fullName, constraints := range module.ProviderRequirements {
                         inst := moduledeps.ProviderInstance(fullName)
-                        versionSet := discovery.AllVersions
-                        if pCfg.Version != "" {
-                                versionSet = discovery.ConstraintStr(pCfg.Version).MustParse()
+
+                        // The handling here is a bit fiddly because the moduledeps package
+                        // was designed around the legacy (pre-0.12) configuration model
+                        // and hasn't yet been revised to handle the new model. As a result,
+                        // we need to do some translation here.
+                        // FIXME: Eventually we should adjust the underlying model so we
+                        // can also retain the source location of each constraint, for
+                        // more informative output from the "terraform providers" command.
+                        var rawConstraints version.Constraints
+                        for _, constraint := range constraints {
+                                rawConstraints = append(rawConstraints, constraint.Required...)
                         }
+                        discoConstraints := discovery.NewConstraints(rawConstraints)
+
                         providers[inst] = moduledeps.ProviderDependency{
-                                Constraints: versionSet,
+                                Constraints: discoConstraints,
                                 Reason:      moduledeps.ProviderDependencyExplicit,
                         }
                 }
 
+                // Provider configurations can also include version constraints,
+                // allowing for more terse declaration in situations where both a
+                // configuration and a constraint are defined in the same module.
+                for fullName, pCfg := range module.ProviderConfigs {
+                        inst := moduledeps.ProviderInstance(fullName)
+                        discoConstraints := discovery.AllVersions
+                        if pCfg.Version.Required != nil {
+                                discoConstraints = discovery.NewConstraints(pCfg.Version.Required)
+                        }
+                        if existing, exists := providers[inst]; exists {
+                                existing.Constraints = existing.Constraints.Append(discoConstraints)
+                        } else {
+                                providers[inst] = moduledeps.ProviderDependency{
+                                        Constraints: discoConstraints,
+                                        Reason:      moduledeps.ProviderDependencyExplicit,
+                                }
+                        }
+                }
+
                 // Each resource in the configuration creates an *implicit* provider
                 // dependency, though we'll only record it if there isn't already
                 // an explicit dependency on the same provider.
-                for _, rc := range cfg.Resources {
-                        fullName := rc.ProviderFullName()
-                        inst := moduledeps.ProviderInstance(fullName)
+                for _, rc := range module.ManagedResources {
+                        addr := rc.ProviderConfigAddr()
+                        inst := moduledeps.ProviderInstance(addr.StringCompact())
+                        if _, exists := providers[inst]; exists {
+                                // Explicit dependency already present
+                                continue
+                        }
+
+                        reason := moduledeps.ProviderDependencyImplicit
+                        if _, inherited := inheritProviders[addr.StringCompact()]; inherited {
+                                reason = moduledeps.ProviderDependencyInherited
+                        }
+
+                        providers[inst] = moduledeps.ProviderDependency{
+                                Constraints: discovery.AllVersions,
+                                Reason:      reason,
+                        }
+                }
+                for _, rc := range module.DataResources {
+                        addr := rc.ProviderConfigAddr()
+                        inst := moduledeps.ProviderInstance(addr.StringCompact())
                         if _, exists := providers[inst]; exists {
                                 // Explicit dependency already present
                                 continue
                         }
 
                         reason := moduledeps.ProviderDependencyImplicit
-                        if _, inherited := inheritProviders[fullName]; inherited {
+                        if _, inherited := inheritProviders[addr.String()]; inherited {
                                 reason = moduledeps.ProviderDependencyInherited
                         }
 
@@ -91,31 +142,31 @@ func moduleTreeConfigDependencies(root *module.Tree, inheritProviders map[string
                 ret.Providers = providers
         }
 
-        childInherit := make(map[string]*config.ProviderConfig)
+        childInherit := make(map[string]*configs.Provider)
         for k, v := range inheritProviders {
                 childInherit[k] = v
         }
-        for k, v := range providerConfigs {
+        for k, v := range module.ProviderConfigs {
                 childInherit[k] = v
         }
-        for _, c := range root.Children() {
-                ret.Children = append(ret.Children, moduleTreeConfigDependencies(c, childInherit))
+        for _, c := range root.Children {
+                ret.Children = append(ret.Children, configTreeConfigDependencies(c, childInherit))
         }
 
         return ret
 }
 
-func moduleTreeMergeStateDependencies(root *moduledeps.Module, state *State) {
+func configTreeMergeStateDependencies(root *moduledeps.Module, state *states.State) {
         if state == nil {
                 return
         }
 
-        findModule := func(path []string) *moduledeps.Module {
+        findModule := func(path addrs.ModuleInstance) *moduledeps.Module {
                 module := root
-                for _, name := range path[1:] { // skip initial "root"
+                for _, step := range path {
                         var next *moduledeps.Module
                         for _, cm := range module.Children {
-                                if cm.Name == name {
+                                if cm.Name == step.Name {
                                         next = cm
                                         break
                                 }
@@ -124,7 +175,8 @@ func moduleTreeMergeStateDependencies(root *moduledeps.Module, state *State) {
                         if next == nil {
                                 // If we didn't find a next node, we'll need to make one
                                 next = &moduledeps.Module{
-                                        Name: name,
+                                        Name:      step.Name,
+                                        Providers: make(moduledeps.Providers),
                                 }
                                 module.Children = append(module.Children, next)
                         }
@@ -135,15 +187,11 @@ func moduleTreeMergeStateDependencies(root *moduledeps.Module, state *State) {
         }
 
         for _, ms := range state.Modules {
-                module := findModule(ms.Path)
+                module := findModule(ms.Addr)
 
-                for _, is := range ms.Resources {
-                        fullName := config.ResourceProviderFullName(is.Type, is.Provider)
-                        inst := moduledeps.ProviderInstance(fullName)
+                for _, rs := range ms.Resources {
+                        inst := moduledeps.ProviderInstance(rs.ProviderConfig.ProviderConfig.StringCompact())
                         if _, exists := module.Providers[inst]; !exists {
-                                if module.Providers == nil {
-                                        module.Providers = make(moduledeps.Providers)
-                                }
                                 module.Providers[inst] = moduledeps.ProviderDependency{
                                         Constraints: discovery.AllVersions,
                                         Reason:      moduledeps.ProviderDependencyFromState,
@@ -151,5 +199,4 @@ func moduleTreeMergeStateDependencies(root *moduledeps.Module, state *State) {
                         }
                 }
         }
-
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_count_boundary.go b/vendor/github.com/hashicorp/terraform/terraform/node_count_boundary.go
index bd32c79..e495203 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_count_boundary.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_count_boundary.go
@@ -1,14 +1,22 @@
 package terraform
 
-// NodeCountBoundary fixes any "count boundarie" in the state: resources
-// that are named "foo.0" when they should be named "foo"
-type NodeCountBoundary struct{}
+import (
+        "github.com/hashicorp/terraform/configs"
+)
+
+// NodeCountBoundary fixes up any transitions between "each modes" in objects
+// saved in state, such as switching from NoEach to EachInt.
+type NodeCountBoundary struct {
+        Config *configs.Config
+}
 
 func (n *NodeCountBoundary) Name() string {
-        return "meta.count-boundary (count boundary fixup)"
+        return "meta.count-boundary (EachMode fixup)"
 }
 
 // GraphNodeEvalable
 func (n *NodeCountBoundary) EvalTree() EvalNode {
-        return &EvalCountFixZeroOneBoundaryGlobal{}
+        return &EvalCountFixZeroOneBoundaryGlobal{
+                Config: n.Config,
+        }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_data_destroy.go b/vendor/github.com/hashicorp/terraform/terraform/node_data_destroy.go
index e32cea8..6ba3990 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_data_destroy.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_data_destroy.go
@@ -1,22 +1,40 @@
 package terraform
 
-// NodeDestroyableDataResource represents a resource that is "plannable":
-// it is ready to be planned in order to create a diff.
-type NodeDestroyableDataResource struct {
-        *NodeAbstractResource
+import (
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+)
+
+// NodeDestroyableDataResourceInstance represents a resource that is "destroyable":
+// it is ready to be destroyed.
+type NodeDestroyableDataResourceInstance struct {
+        *NodeAbstractResourceInstance
 }
 
 // GraphNodeEvalable
-func (n *NodeDestroyableDataResource) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
+func (n *NodeDestroyableDataResourceInstance) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
 
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
+        var providerSchema *ProviderSchema
+        // We don't need the provider, but we're calling EvalGetProvider to load the
+        // schema.
+        var provider providers.Interface
 
         // Just destroy it.
-        var state *InstanceState
-        return &EvalWriteState{
-                Name:  stateId,
-                State: &state, // state is nil here
+        var state *states.ResourceInstanceObject
+        return &EvalSequence{
+                Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
+                        &EvalWriteState{
+                                Addr:           addr.Resource,
+                                State:          &state,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                        },
+                },
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go
index d5ca641..ab82163 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go
@@ -2,46 +2,71 @@ package terraform
 
 import (
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
 )
 
-// NodeRefreshableDataResource represents a resource that is "plannable":
-// it is ready to be planned in order to create a diff.
+// NodeRefreshableDataResource represents a resource that is "refreshable".
 type NodeRefreshableDataResource struct {
-        *NodeAbstractCountResource
+        *NodeAbstractResource
 }
 
+var (
+        _ GraphNodeSubPath              = (*NodeRefreshableDataResource)(nil)
+        _ GraphNodeDynamicExpandable    = (*NodeRefreshableDataResource)(nil)
+        _ GraphNodeReferenceable        = (*NodeRefreshableDataResource)(nil)
+        _ GraphNodeReferencer           = (*NodeRefreshableDataResource)(nil)
+        _ GraphNodeResource             = (*NodeRefreshableDataResource)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodeRefreshableDataResource)(nil)
+)
+
 // GraphNodeDynamicExpandable
 func (n *NodeRefreshableDataResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
-        // Grab the state which we read
-        state, lock := ctx.State()
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Expand the resource count which must be available by now from EvalTree
-        count, err := n.Config.Count()
-        if err != nil {
-                return nil, err
+        var diags tfdiags.Diagnostics
+
+        count, countKnown, countDiags := evaluateResourceCountExpressionKnown(n.Config.Count, ctx)
+        diags = diags.Append(countDiags)
+        if countDiags.HasErrors() {
+                return nil, diags.Err()
+        }
+        if !countKnown {
+                // If the count isn't known yet, we'll skip refreshing and try expansion
+                // again during the plan walk.
+                return nil, nil
         }
 
+        // Next we need to potentially rename an instance address in the state
+        // if we're transitioning whether "count" is set at all.
+        fixResourceCountSetTransition(ctx, n.ResourceAddr(), count != -1)
+
+        // Our graph transformers require access to the full state, so we'll
+        // temporarily lock it while we work on this.
+        state := ctx.State().Lock()
+        defer ctx.State().Unlock()
+
         // The concrete resource factory we'll use
-        concreteResource := func(a *NodeAbstractResource) dag.Vertex {
+        concreteResource := func(a *NodeAbstractResourceInstance) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
                 a.ResolvedProvider = n.ResolvedProvider
 
                 return &NodeRefreshableDataResourceInstance{
-                        NodeAbstractResource: a,
+                        NodeAbstractResourceInstance: a,
                 }
         }
 
         // We also need a destroyable resource for orphans that are a result of a
         // scaled-in count.
-        concreteResourceDestroyable := func(a *NodeAbstractResource) dag.Vertex {
-                // Add the config since we don't do that via transforms
+        concreteResourceDestroyable := func(a *NodeAbstractResourceInstance) dag.Vertex {
+                // Add the config and provider since we don't do that via transforms
                 a.Config = n.Config
+                a.ResolvedProvider = n.ResolvedProvider
 
-                return &NodeDestroyableDataResource{
-                        NodeAbstractResource: a,
+                return &NodeDestroyableDataResourceInstance{
+                        NodeAbstractResourceInstance: a,
                 }
         }
 
@@ -50,6 +75,7 @@ func (n *NodeRefreshableDataResource) DynamicExpand(ctx EvalContext) (*Graph, er
                 // Expand the count.
                 &ResourceCountTransformer{
                         Concrete: concreteResource,
+                        Schema:   n.Schema,
                         Count:    count,
                         Addr:     n.ResourceAddr(),
                 },
@@ -67,7 +93,7 @@ func (n *NodeRefreshableDataResource) DynamicExpand(ctx EvalContext) (*Graph, er
                 &AttachStateTransformer{State: state},
 
                 // Targeting
-                &TargetsTransformer{ParsedTargets: n.Targets},
+                &TargetsTransformer{Targets: n.Targets},
 
                 // Connect references so ordering is correct
                 &ReferenceTransformer{},
@@ -83,139 +109,118 @@ func (n *NodeRefreshableDataResource) DynamicExpand(ctx EvalContext) (*Graph, er
                 Name:     "NodeRefreshableDataResource",
         }
 
-        return b.Build(ctx.Path())
+        graph, diags := b.Build(ctx.Path())
+        return graph, diags.ErrWithWarnings()
 }
 
-// NodeRefreshableDataResourceInstance represents a _single_ resource instance
+// NodeRefreshableDataResourceInstance represents a single resource instance
 // that is refreshable.
 type NodeRefreshableDataResourceInstance struct {
-        *NodeAbstractResource
+        *NodeAbstractResourceInstance
 }
 
 // GraphNodeEvalable
 func (n *NodeRefreshableDataResourceInstance) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
-
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
-
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:   stateId,
-                Type: addr.Type,
-        }
-
-        // Get the state if we have it, if not we build it
-        rs := n.ResourceState
-        if rs == nil {
-                rs = &ResourceState{
-                        Provider: n.ResolvedProvider,
-                }
-        }
+        addr := n.ResourceInstanceAddr()
 
-        // If the config isn't empty we update the state
-        if n.Config != nil {
-                rs = &ResourceState{
-                        Type:         n.Config.Type,
-                        Provider:     n.Config.Provider,
-                        Dependencies: n.StateReferences(),
-                }
-        }
-
-        // Build the resource for eval
-        resource := &Resource{
-                Name:       addr.Name,
-                Type:       addr.Type,
-                CountIndex: addr.Index,
-        }
-        if resource.CountIndex < 0 {
-                resource.CountIndex = 0
-        }
-
-        // Declare a bunch of variables that are used for state during
-        // evaluation. Most of this are written to by-address below.
-        var config *ResourceConfig
-        var diff *InstanceDiff
-        var provider ResourceProvider
-        var state *InstanceState
+        // These variables are the state for the eval sequence below, and are
+        // updated through pointers.
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
+        var configVal cty.Value
 
         return &EvalSequence{
                 Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
+
                         // Always destroy the existing state first, since we must
                         // make sure that values from a previous read will not
                         // get interpolated if we end up needing to defer our
                         // loading until apply time.
                         &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: rs.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: rs.Dependencies,
-                                State:        &state, // state is nil here
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                State:          &state, // a pointer to nil, here
+                                ProviderSchema: &providerSchema,
                         },
 
-                        &EvalInterpolate{
-                                Config:   n.Config.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &config,
-                        },
-
-                        // The rest of this pass can proceed only if there are no
-                        // computed values in our config.
-                        // (If there are, we'll deal with this during the plan and
-                        // apply phases.)
                         &EvalIf{
                                 If: func(ctx EvalContext) (bool, error) {
-                                        if config.ComputedKeys != nil && len(config.ComputedKeys) > 0 {
-                                                return true, EvalEarlyExitError{}
-                                        }
-
                                         // If the config explicitly has a depends_on for this
                                         // data source, assume the intention is to prevent
-                                        // refreshing ahead of that dependency.
+                                        // refreshing ahead of that dependency, and therefore
+                                        // we need to deal with this resource during the apply
+                                        // phase..
                                         if len(n.Config.DependsOn) > 0 {
                                                 return true, EvalEarlyExitError{}
                                         }
 
                                         return true, nil
                                 },
-
                                 Then: EvalNoop{},
                         },
 
-                        // The remainder of this pass is the same as running
-                        // a "plan" pass immediately followed by an "apply" pass,
-                        // populating the state early so it'll be available to
-                        // provider configurations that need this data during
-                        // refresh/plan.
-                        &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
-                                Output: &provider,
-                        },
-
-                        &EvalReadDataDiff{
-                                Info:        info,
-                                Config:      &config,
-                                Provider:    &provider,
-                                Output:      &diff,
-                                OutputState: &state,
-                        },
-
-                        &EvalReadDataApply{
-                                Info:     info,
-                                Diff:     &diff,
-                                Provider: &provider,
-                                Output:   &state,
+                        // EvalReadData will _attempt_ to read the data source, but may
+                        // generate an incomplete planned object if the configuration
+                        // includes values that won't be known until apply.
+                        &EvalReadData{
+                                Addr:              addr.Resource,
+                                Config:            n.Config,
+                                Dependencies:      n.StateReferences(),
+                                Provider:          &provider,
+                                ProviderAddr:      n.ResolvedProvider,
+                                ProviderSchema:    &providerSchema,
+                                OutputChange:      &change,
+                                OutputConfigValue: &configVal,
+                                OutputState:       &state,
                         },
 
-                        &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: rs.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: rs.Dependencies,
-                                State:        &state,
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        return (*state).Status != states.ObjectPlanned, nil
+                                },
+                                Then: &EvalSequence{
+                                        Nodes: []EvalNode{
+                                                &EvalWriteState{
+                                                        Addr:           addr.Resource,
+                                                        ProviderAddr:   n.ResolvedProvider,
+                                                        State:          &state,
+                                                        ProviderSchema: &providerSchema,
+                                                },
+                                                &EvalUpdateStateHook{},
+                                        },
+                                },
+                                Else: &EvalSequence{
+                                        // We can't deal with this yet, so we'll repeat this step
+                                        // during the plan walk to produce a planned change to read
+                                        // this during the apply walk. However, we do still need to
+                                        // save the generated change and partial state so that
+                                        // results from it can be included in other data resources
+                                        // or provider configurations during the refresh walk.
+                                        // (The planned object we save in the state here will be
+                                        // pruned out at the end of the refresh walk, returning
+                                        // it back to being unset again for subsequent walks.)
+                                        Nodes: []EvalNode{
+                                                &EvalWriteDiff{
+                                                        Addr:           addr.Resource,
+                                                        Change:         &change,
+                                                        ProviderSchema: &providerSchema,
+                                                },
+                                                &EvalWriteState{
+                                                        Addr:           addr.Resource,
+                                                        ProviderAddr:   n.ResolvedProvider,
+                                                        State:          &state,
+                                                        ProviderSchema: &providerSchema,
+                                                },
+                                        },
+                                },
                         },
-
-                        &EvalUpdateStateHook{},
                 },
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_local.go b/vendor/github.com/hashicorp/terraform/terraform/node_local.go
index d387222..591eb30 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_local.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_local.go
@@ -1,10 +1,10 @@
 package terraform
 
 import (
-        "fmt"
-        "strings"
-
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/lang"
 )
 
 // NodeLocal represents a named local value in a particular module.
@@ -12,22 +12,26 @@ import (
 // Local value nodes only have one operation, common to all walk types:
 // evaluate the result and place it in state.
 type NodeLocal struct {
-        PathValue []string
-        Config    *config.Local
+        Addr   addrs.AbsLocalValue
+        Config *configs.Local
 }
 
-func (n *NodeLocal) Name() string {
-        result := fmt.Sprintf("local.%s", n.Config.Name)
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
-        }
+var (
+        _ GraphNodeSubPath       = (*NodeLocal)(nil)
+        _ RemovableIfNotTargeted = (*NodeLocal)(nil)
+        _ GraphNodeReferenceable = (*NodeLocal)(nil)
+        _ GraphNodeReferencer    = (*NodeLocal)(nil)
+        _ GraphNodeEvalable      = (*NodeLocal)(nil)
+        _ dag.GraphNodeDotter    = (*NodeLocal)(nil)
+)
 
-        return result
+func (n *NodeLocal) Name() string {
+        return n.Addr.String()
 }
 
 // GraphNodeSubPath
-func (n *NodeLocal) Path() []string {
-        return n.PathValue
+func (n *NodeLocal) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // RemovableIfNotTargeted
@@ -36,31 +40,31 @@ func (n *NodeLocal) RemoveIfNotTargeted() bool {
 }
 
 // GraphNodeReferenceable
-func (n *NodeLocal) ReferenceableName() []string {
-        name := fmt.Sprintf("local.%s", n.Config.Name)
-        return []string{name}
+func (n *NodeLocal) ReferenceableAddrs() []addrs.Referenceable {
+        return []addrs.Referenceable{n.Addr.LocalValue}
 }
 
 // GraphNodeReferencer
-func (n *NodeLocal) References() []string {
-        var result []string
-        result = append(result, ReferencesFromConfig(n.Config.RawConfig)...)
-        for _, v := range result {
-                split := strings.Split(v, "/")
-                for i, s := range split {
-                        split[i] = s + ".destroy"
-                }
-
-                result = append(result, strings.Join(split, "/"))
-        }
-
-        return result
+func (n *NodeLocal) References() []*addrs.Reference {
+        refs, _ := lang.ReferencesInExpr(n.Config.Expr)
+        return appendResourceDestroyReferences(refs)
 }
 
 // GraphNodeEvalable
 func (n *NodeLocal) EvalTree() EvalNode {
         return &EvalLocal{
-                Name:  n.Config.Name,
-                Value: n.Config.RawConfig,
+                Addr: n.Addr.LocalValue,
+                Expr: n.Config.Expr,
+        }
+}
+
+// dag.GraphNodeDotter impl.
+func (n *NodeLocal) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
+        return &dag.DotNode{
+                Name: name,
+                Attrs: map[string]string{
+                        "label": n.Name(),
+                        "shape": "note",
+                },
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_module_removed.go b/vendor/github.com/hashicorp/terraform/terraform/node_module_removed.go
index bb3e5ee..cb55a1a 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_module_removed.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_module_removed.go
@@ -2,76 +2,80 @@ package terraform
 
 import (
         "fmt"
-        "log"
-        "reflect"
+
+        "github.com/hashicorp/terraform/addrs"
 )
 
 // NodeModuleRemoved represents a module that is no longer in the
 // config.
 type NodeModuleRemoved struct {
-        PathValue []string
+        Addr addrs.ModuleInstance
 }
 
+var (
+        _ GraphNodeSubPath          = (*NodeModuleRemoved)(nil)
+        _ GraphNodeEvalable         = (*NodeModuleRemoved)(nil)
+        _ GraphNodeReferencer       = (*NodeModuleRemoved)(nil)
+        _ GraphNodeReferenceOutside = (*NodeModuleRemoved)(nil)
+)
+
 func (n *NodeModuleRemoved) Name() string {
-        return fmt.Sprintf("%s (removed)", modulePrefixStr(n.PathValue))
+        return fmt.Sprintf("%s (removed)", n.Addr.String())
 }
 
 // GraphNodeSubPath
-func (n *NodeModuleRemoved) Path() []string {
-        return n.PathValue
+func (n *NodeModuleRemoved) Path() addrs.ModuleInstance {
+        return n.Addr
 }
 
 // GraphNodeEvalable
 func (n *NodeModuleRemoved) EvalTree() EvalNode {
         return &EvalOpFilter{
                 Ops: []walkOperation{walkRefresh, walkApply, walkDestroy},
-                Node: &EvalDeleteModule{
-                        PathValue: n.PathValue,
+                Node: &EvalCheckModuleRemoved{
+                        Addr: n.Addr,
                 },
         }
 }
 
-func (n *NodeModuleRemoved) ReferenceGlobal() bool {
-        return true
+func (n *NodeModuleRemoved) ReferenceOutside() (selfPath, referencePath addrs.ModuleInstance) {
+        // Our "References" implementation indicates that this node depends on
+        // the call to the module it represents, which implicitly depends on
+        // everything inside the module. That reference must therefore be
+        // interpreted in terms of our parent module.
+        return n.Addr, n.Addr.Parent()
 }
 
-func (n *NodeModuleRemoved) References() []string {
-        return []string{modulePrefixStr(n.PathValue)}
-}
+func (n *NodeModuleRemoved) References() []*addrs.Reference {
+        // We depend on the call to the module we represent, because that
+        // implicitly then depends on everything inside that module.
+        // Our ReferenceOutside implementation causes this to be interpreted
+        // within the parent module.
 
-// EvalDeleteModule is an EvalNode implementation that removes an empty module
-// entry from the state.
-type EvalDeleteModule struct {
-        PathValue []string
-}
+        _, call := n.Addr.CallInstance()
+        return []*addrs.Reference{
+                {
+                        Subject: call,
 
-func (n *EvalDeleteModule) Eval(ctx EvalContext) (interface{}, error) {
-        state, lock := ctx.State()
-        if state == nil {
-                return nil, nil
+                        // No source range here, because there's nothing reasonable for
+                        // us to return.
+                },
         }
+}
 
-        // Get a write lock so we can access this instance
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Make sure we have a clean state
-        // Destroyed resources aren't deleted, they're written with an ID of "".
-        state.prune()
+// EvalCheckModuleRemoved is an EvalNode implementation that verifies that
+// a module has been removed from the state as expected.
+type EvalCheckModuleRemoved struct {
+        Addr addrs.ModuleInstance
+}
 
-        // find the module and delete it
-        for i, m := range state.Modules {
-                if reflect.DeepEqual(m.Path, n.PathValue) {
-                        if !m.Empty() {
-                                // a targeted apply may leave module resources even without a config,
-                                // so just log this and return.
-                                log.Printf("[DEBUG] cannot remove module %s, not empty", modulePrefixStr(n.PathValue))
-                                break
-                        }
-                        state.Modules = append(state.Modules[:i], state.Modules[i+1:]...)
-                        break
-                }
+func (n *EvalCheckModuleRemoved) Eval(ctx EvalContext) (interface{}, error) {
+        mod := ctx.State().Module(n.Addr)
+        if mod != nil {
+                // If we get here then that indicates a bug either in the states
+                // module or in an earlier step of the graph walk, since we should've
+                // pruned out the module when the last resource was removed from it.
+                return nil, fmt.Errorf("leftover module %s in state that should have been removed; this is a bug in Terraform and should be reported", n.Addr)
         }
-
         return nil, nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_module_variable.go b/vendor/github.com/hashicorp/terraform/terraform/node_module_variable.go
index 66ff7d5..aca5a6a 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_module_variable.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_module_variable.go
@@ -1,40 +1,43 @@
 package terraform
 
 import (
-        "fmt"
-
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // NodeApplyableModuleVariable represents a module variable input during
 // the apply step.
 type NodeApplyableModuleVariable struct {
-        PathValue []string
-        Config    *config.Variable  // Config is the var in the config
-        Value     *config.RawConfig // Value is the value that is set
-
-        Module *module.Tree // Antiquated, want to remove
+        Addr   addrs.AbsInputVariableInstance
+        Config *configs.Variable // Config is the var in the config
+        Expr   hcl.Expression    // Expr is the value expression given in the call
 }
 
-func (n *NodeApplyableModuleVariable) Name() string {
-        result := fmt.Sprintf("var.%s", n.Config.Name)
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
-        }
+// Ensure that we are implementing all of the interfaces we think we are
+// implementing.
+var (
+        _ GraphNodeSubPath          = (*NodeApplyableModuleVariable)(nil)
+        _ RemovableIfNotTargeted    = (*NodeApplyableModuleVariable)(nil)
+        _ GraphNodeReferenceOutside = (*NodeApplyableModuleVariable)(nil)
+        _ GraphNodeReferenceable    = (*NodeApplyableModuleVariable)(nil)
+        _ GraphNodeReferencer       = (*NodeApplyableModuleVariable)(nil)
+        _ GraphNodeEvalable         = (*NodeApplyableModuleVariable)(nil)
+        _ dag.GraphNodeDotter       = (*NodeApplyableModuleVariable)(nil)
+)
 
-        return result
+func (n *NodeApplyableModuleVariable) Name() string {
+        return n.Addr.String()
 }
 
 // GraphNodeSubPath
-func (n *NodeApplyableModuleVariable) Path() []string {
-        // We execute in the parent scope (above our own module) so that
-        // we can access the proper interpolations.
-        if len(n.PathValue) > 2 {
-                return n.PathValue[:len(n.PathValue)-1]
-        }
-
-        return rootModulePath
+func (n *NodeApplyableModuleVariable) Path() addrs.ModuleInstance {
+        // We execute in the parent scope (above our own module) because
+        // expressions in our value are resolved in that context.
+        return n.Addr.Module.Parent()
 }
 
 // RemovableIfNotTargeted
@@ -44,95 +47,96 @@ func (n *NodeApplyableModuleVariable) RemoveIfNotTargeted() bool {
         return true
 }
 
-// GraphNodeReferenceGlobal
-func (n *NodeApplyableModuleVariable) ReferenceGlobal() bool {
-        // We have to create fully qualified references because we cross
-        // boundaries here: our ReferenceableName is in one path and our
-        // References are from another path.
-        return true
+// GraphNodeReferenceOutside implementation
+func (n *NodeApplyableModuleVariable) ReferenceOutside() (selfPath, referencePath addrs.ModuleInstance) {
+
+        // Module input variables have their value expressions defined in the
+        // context of their calling (parent) module, and so references from
+        // a node of this type should be resolved in the parent module instance.
+        referencePath = n.Addr.Module.Parent()
+
+        // Input variables are _referenced_ from their own module, though.
+        selfPath = n.Addr.Module
+
+        return // uses named return values
 }
 
 // GraphNodeReferenceable
-func (n *NodeApplyableModuleVariable) ReferenceableName() []string {
-        return []string{n.Name()}
+func (n *NodeApplyableModuleVariable) ReferenceableAddrs() []addrs.Referenceable {
+        return []addrs.Referenceable{n.Addr.Variable}
 }
 
 // GraphNodeReferencer
-func (n *NodeApplyableModuleVariable) References() []string {
-        // If we have no value set, we depend on nothing
-        if n.Value == nil {
-                return nil
-        }
+func (n *NodeApplyableModuleVariable) References() []*addrs.Reference {
 
-        // Can't depend on anything if we're in the root
-        if len(n.PathValue) < 2 {
+        // If we have no value expression, we cannot depend on anything.
+        if n.Expr == nil {
                 return nil
         }
 
-        // Otherwise, we depend on anything that is in our value, but
-        // specifically in the namespace of the parent path.
-        // Create the prefix based on the path
-        var prefix string
-        if p := n.Path(); len(p) > 0 {
-                prefix = modulePrefixStr(p)
+        // Variables in the root don't depend on anything, because their values
+        // are gathered prior to the graph walk and recorded in the context.
+        if len(n.Addr.Module) == 0 {
+                return nil
         }
 
-        result := ReferencesFromConfig(n.Value)
-        return modulePrefixList(result, prefix)
+        // Otherwise, we depend on anything referenced by our value expression.
+        // We ignore diagnostics here under the assumption that we'll re-eval
+        // all these things later and catch them then; for our purposes here,
+        // we only care about valid references.
+        //
+        // Due to our GraphNodeReferenceOutside implementation, the addresses
+        // returned by this function are interpreted in the _parent_ module from
+        // where our associated variable was declared, which is correct because
+        // our value expression is assigned within a "module" block in the parent
+        // module.
+        refs, _ := lang.ReferencesInExpr(n.Expr)
+        return refs
 }
 
 // GraphNodeEvalable
 func (n *NodeApplyableModuleVariable) EvalTree() EvalNode {
         // If we have no value, do nothing
-        if n.Value == nil {
+        if n.Expr == nil {
                 return &EvalNoop{}
         }
 
         // Otherwise, interpolate the value of this variable and set it
         // within the variables mapping.
-        var config *ResourceConfig
-        variables := make(map[string]interface{})
+        vals := make(map[string]cty.Value)
+
+        _, call := n.Addr.Module.CallInstance()
 
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalOpFilter{
-                                Ops: []walkOperation{walkInput},
-                                Node: &EvalInterpolate{
-                                        Config:        n.Value,
-                                        Output:        &config,
-                                        ContinueOnErr: true,
-                                },
-                        },
-                        &EvalOpFilter{
                                 Ops: []walkOperation{walkRefresh, walkPlan, walkApply,
                                         walkDestroy, walkValidate},
-                                Node: &EvalInterpolate{
-                                        Config: n.Value,
-                                        Output: &config,
-                                },
-                        },
+                                Node: &EvalModuleCallArgument{
+                                        Addr:   n.Addr.Variable,
+                                        Config: n.Config,
+                                        Expr:   n.Expr,
+                                        Values: vals,
 
-                        &EvalVariableBlock{
-                                Config:         &config,
-                                VariableValues: variables,
-                        },
-
-                        &EvalCoerceMapVariable{
-                                Variables:  variables,
-                                ModulePath: n.PathValue,
-                                ModuleTree: n.Module,
+                                        IgnoreDiagnostics: false,
+                                },
                         },
 
-                        &EvalTypeCheckVariable{
-                                Variables:  variables,
-                                ModulePath: n.PathValue,
-                                ModuleTree: n.Module,
+                        &EvalSetModuleCallArguments{
+                                Module: call,
+                                Values: vals,
                         },
+                },
+        }
+}
 
-                        &EvalSetVariables{
-                                Module:    &n.PathValue[len(n.PathValue)-1],
-                                Variables: variables,
-                        },
+// dag.GraphNodeDotter impl.
+func (n *NodeApplyableModuleVariable) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
+        return &dag.DotNode{
+                Name: name,
+                Attrs: map[string]string{
+                        "label": n.Name(),
+                        "shape": "note",
                 },
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_output.go b/vendor/github.com/hashicorp/terraform/terraform/node_output.go
index 83e9925..bb3d065 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_output.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_output.go
@@ -2,31 +2,38 @@ package terraform
 
 import (
         "fmt"
-        "strings"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/lang"
 )
 
 // NodeApplyableOutput represents an output that is "applyable":
 // it is ready to be applied.
 type NodeApplyableOutput struct {
-        PathValue []string
-        Config    *config.Output // Config is the output in the config
+        Addr   addrs.AbsOutputValue
+        Config *configs.Output // Config is the output in the config
 }
 
-func (n *NodeApplyableOutput) Name() string {
-        result := fmt.Sprintf("output.%s", n.Config.Name)
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
-        }
+var (
+        _ GraphNodeSubPath          = (*NodeApplyableOutput)(nil)
+        _ RemovableIfNotTargeted    = (*NodeApplyableOutput)(nil)
+        _ GraphNodeTargetDownstream = (*NodeApplyableOutput)(nil)
+        _ GraphNodeReferenceable    = (*NodeApplyableOutput)(nil)
+        _ GraphNodeReferencer       = (*NodeApplyableOutput)(nil)
+        _ GraphNodeReferenceOutside = (*NodeApplyableOutput)(nil)
+        _ GraphNodeEvalable         = (*NodeApplyableOutput)(nil)
+        _ dag.GraphNodeDotter       = (*NodeApplyableOutput)(nil)
+)
 
-        return result
+func (n *NodeApplyableOutput) Name() string {
+        return n.Addr.String()
 }
 
 // GraphNodeSubPath
-func (n *NodeApplyableOutput) Path() []string {
-        return n.PathValue
+func (n *NodeApplyableOutput) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // RemovableIfNotTargeted
@@ -44,27 +51,64 @@ func (n *NodeApplyableOutput) TargetDownstream(targetedDeps, untargetedDeps *dag
         return true
 }
 
+func referenceOutsideForOutput(addr addrs.AbsOutputValue) (selfPath, referencePath addrs.ModuleInstance) {
+
+        // Output values have their expressions resolved in the context of the
+        // module where they are defined.
+        referencePath = addr.Module
+
+        // ...but they are referenced in the context of their calling module.
+        selfPath = addr.Module.Parent()
+
+        return // uses named return values
+
+}
+
+// GraphNodeReferenceOutside implementation
+func (n *NodeApplyableOutput) ReferenceOutside() (selfPath, referencePath addrs.ModuleInstance) {
+        return referenceOutsideForOutput(n.Addr)
+}
+
+func referenceableAddrsForOutput(addr addrs.AbsOutputValue) []addrs.Referenceable {
+        // An output in the root module can't be referenced at all.
+        if addr.Module.IsRoot() {
+                return nil
+        }
+
+        // Otherwise, we can be referenced via a reference to our output name
+        // on the parent module's call, or via a reference to the entire call.
+        // e.g. module.foo.bar or just module.foo .
+        // Note that our ReferenceOutside method causes these addresses to be
+        // relative to the calling module, not the module where the output
+        // was declared.
+        _, outp := addr.ModuleCallOutput()
+        _, call := addr.Module.CallInstance()
+        return []addrs.Referenceable{outp, call}
+
+}
+
 // GraphNodeReferenceable
-func (n *NodeApplyableOutput) ReferenceableName() []string {
-        name := fmt.Sprintf("output.%s", n.Config.Name)
-        return []string{name}
+func (n *NodeApplyableOutput) ReferenceableAddrs() []addrs.Referenceable {
+        return referenceableAddrsForOutput(n.Addr)
 }
 
-// GraphNodeReferencer
-func (n *NodeApplyableOutput) References() []string {
-        var result []string
-        result = append(result, n.Config.DependsOn...)
-        result = append(result, ReferencesFromConfig(n.Config.RawConfig)...)
-        for _, v := range result {
-                split := strings.Split(v, "/")
-                for i, s := range split {
-                        split[i] = s + ".destroy"
-                }
-
-                result = append(result, strings.Join(split, "/"))
+func referencesForOutput(c *configs.Output) []*addrs.Reference {
+        impRefs, _ := lang.ReferencesInExpr(c.Expr)
+        expRefs, _ := lang.References(c.DependsOn)
+        l := len(impRefs) + len(expRefs)
+        if l == 0 {
+                return nil
         }
+        refs := make([]*addrs.Reference, 0, l)
+        refs = append(refs, impRefs...)
+        refs = append(refs, expRefs...)
+        return refs
 
-        return result
+}
+
+// GraphNodeReferencer
+func (n *NodeApplyableOutput) References() []*addrs.Reference {
+        return appendResourceDestroyReferences(referencesForOutput(n.Config))
 }
 
 // GraphNodeEvalable
@@ -72,47 +116,51 @@ func (n *NodeApplyableOutput) EvalTree() EvalNode {
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalOpFilter{
-                                // Don't let interpolation errors stop Input, since it happens
-                                // before Refresh.
-                                Ops: []walkOperation{walkInput},
-                                Node: &EvalWriteOutput{
-                                        Name:          n.Config.Name,
-                                        Sensitive:     n.Config.Sensitive,
-                                        Value:         n.Config.RawConfig,
-                                        ContinueOnErr: true,
-                                },
-                        },
-                        &EvalOpFilter{
                                 Ops: []walkOperation{walkRefresh, walkPlan, walkApply, walkValidate, walkDestroy, walkPlanDestroy},
                                 Node: &EvalWriteOutput{
-                                        Name:      n.Config.Name,
+                                        Addr:      n.Addr.OutputValue,
                                         Sensitive: n.Config.Sensitive,
-                                        Value:     n.Config.RawConfig,
+                                        Expr:      n.Config.Expr,
                                 },
                         },
                 },
         }
 }
 
+// dag.GraphNodeDotter impl.
+func (n *NodeApplyableOutput) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
+        return &dag.DotNode{
+                Name: name,
+                Attrs: map[string]string{
+                        "label": n.Name(),
+                        "shape": "note",
+                },
+        }
+}
+
 // NodeDestroyableOutput represents an output that is "destroybale":
 // its application will remove the output from the state.
 type NodeDestroyableOutput struct {
-        PathValue []string
-        Config    *config.Output // Config is the output in the config
+        Addr   addrs.AbsOutputValue
+        Config *configs.Output // Config is the output in the config
 }
 
-func (n *NodeDestroyableOutput) Name() string {
-        result := fmt.Sprintf("output.%s (destroy)", n.Config.Name)
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
-        }
+var (
+        _ GraphNodeSubPath          = (*NodeDestroyableOutput)(nil)
+        _ RemovableIfNotTargeted    = (*NodeDestroyableOutput)(nil)
+        _ GraphNodeTargetDownstream = (*NodeDestroyableOutput)(nil)
+        _ GraphNodeReferencer       = (*NodeDestroyableOutput)(nil)
+        _ GraphNodeEvalable         = (*NodeDestroyableOutput)(nil)
+        _ dag.GraphNodeDotter       = (*NodeDestroyableOutput)(nil)
+)
 
-        return result
+func (n *NodeDestroyableOutput) Name() string {
+        return fmt.Sprintf("%s (destroy)", n.Addr.String())
 }
 
 // GraphNodeSubPath
-func (n *NodeDestroyableOutput) Path() []string {
-        return n.PathValue
+func (n *NodeDestroyableOutput) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // RemovableIfNotTargeted
@@ -129,25 +177,24 @@ func (n *NodeDestroyableOutput) TargetDownstream(targetedDeps, untargetedDeps *d
 }
 
 // GraphNodeReferencer
-func (n *NodeDestroyableOutput) References() []string {
-        var result []string
-        result = append(result, n.Config.DependsOn...)
-        result = append(result, ReferencesFromConfig(n.Config.RawConfig)...)
-        for _, v := range result {
-                split := strings.Split(v, "/")
-                for i, s := range split {
-                        split[i] = s + ".destroy"
-                }
-
-                result = append(result, strings.Join(split, "/"))
-        }
-
-        return result
+func (n *NodeDestroyableOutput) References() []*addrs.Reference {
+        return referencesForOutput(n.Config)
 }
 
 // GraphNodeEvalable
 func (n *NodeDestroyableOutput) EvalTree() EvalNode {
         return &EvalDeleteOutput{
-                Name: n.Config.Name,
+                Addr: n.Addr.OutputValue,
+        }
+}
+
+// dag.GraphNodeDotter impl.
+func (n *NodeDestroyableOutput) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
+        return &dag.DotNode{
+                Name: name,
+                Attrs: map[string]string{
+                        "label": n.Name(),
+                        "shape": "note",
+                },
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_output_orphan.go b/vendor/github.com/hashicorp/terraform/terraform/node_output_orphan.go
index 0fd1554..518b8aa 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_output_orphan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_output_orphan.go
@@ -2,31 +2,39 @@ package terraform
 
 import (
         "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
 )
 
 // NodeOutputOrphan represents an output that is an orphan.
 type NodeOutputOrphan struct {
-        OutputName string
-        PathValue  []string
+        Addr addrs.AbsOutputValue
 }
 
+var (
+        _ GraphNodeSubPath          = (*NodeOutputOrphan)(nil)
+        _ GraphNodeReferenceable    = (*NodeOutputOrphan)(nil)
+        _ GraphNodeReferenceOutside = (*NodeOutputOrphan)(nil)
+        _ GraphNodeEvalable         = (*NodeOutputOrphan)(nil)
+)
+
 func (n *NodeOutputOrphan) Name() string {
-        result := fmt.Sprintf("output.%s (orphan)", n.OutputName)
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
-        }
+        return fmt.Sprintf("%s (orphan)", n.Addr.String())
+}
 
-        return result
+// GraphNodeReferenceOutside implementation
+func (n *NodeOutputOrphan) ReferenceOutside() (selfPath, referencePath addrs.ModuleInstance) {
+        return referenceOutsideForOutput(n.Addr)
 }
 
 // GraphNodeReferenceable
-func (n *NodeOutputOrphan) ReferenceableName() []string {
-        return []string{"output." + n.OutputName}
+func (n *NodeOutputOrphan) ReferenceableAddrs() []addrs.Referenceable {
+        return referenceableAddrsForOutput(n.Addr)
 }
 
 // GraphNodeSubPath
-func (n *NodeOutputOrphan) Path() []string {
-        return n.PathValue
+func (n *NodeOutputOrphan) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // GraphNodeEvalable
@@ -34,7 +42,7 @@ func (n *NodeOutputOrphan) EvalTree() EvalNode {
         return &EvalOpFilter{
                 Ops: []walkOperation{walkRefresh, walkApply, walkDestroy},
                 Node: &EvalDeleteOutput{
-                        Name: n.OutputName,
+                        Addr: n.Addr.OutputValue,
                 },
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_provider_abstract.go b/vendor/github.com/hashicorp/terraform/terraform/node_provider_abstract.go
index 9e490f7..a0cdcfe 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_provider_abstract.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_provider_abstract.go
@@ -1,10 +1,10 @@
 package terraform
 
 import (
-        "fmt"
-        "strings"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
 
-        "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -15,37 +15,33 @@ type ConcreteProviderNodeFunc func(*NodeAbstractProvider) dag.Vertex
 // NodeAbstractProvider represents a provider that has no associated operations.
 // It registers all the common interfaces across operations for providers.
 type NodeAbstractProvider struct {
-        NameValue string
-        PathValue []string
+        Addr addrs.AbsProviderConfig
 
         // The fields below will be automatically set using the Attach
         // interfaces if you're running those transforms, but also be explicitly
         // set if you already have that information.
 
-        Config *config.ProviderConfig
+        Config *configs.Provider
+        Schema *configschema.Block
 }
 
-func ResolveProviderName(name string, path []string) string {
-        if strings.Contains(name, "provider.") {
-                // already resolved
-                return name
-        }
-
-        name = fmt.Sprintf("provider.%s", name)
-        if len(path) >= 1 {
-                name = fmt.Sprintf("%s.%s", modulePrefixStr(path), name)
-        }
-
-        return name
-}
+var (
+        _ GraphNodeSubPath                    = (*NodeAbstractProvider)(nil)
+        _ RemovableIfNotTargeted              = (*NodeAbstractProvider)(nil)
+        _ GraphNodeReferencer                 = (*NodeAbstractProvider)(nil)
+        _ GraphNodeProvider                   = (*NodeAbstractProvider)(nil)
+        _ GraphNodeAttachProvider             = (*NodeAbstractProvider)(nil)
+        _ GraphNodeAttachProviderConfigSchema = (*NodeAbstractProvider)(nil)
+        _ dag.GraphNodeDotter                 = (*NodeAbstractProvider)(nil)
+)
 
 func (n *NodeAbstractProvider) Name() string {
-        return ResolveProviderName(n.NameValue, n.PathValue)
+        return n.Addr.String()
 }
 
 // GraphNodeSubPath
-func (n *NodeAbstractProvider) Path() []string {
-        return n.PathValue
+func (n *NodeAbstractProvider) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // RemovableIfNotTargeted
@@ -56,21 +52,21 @@ func (n *NodeAbstractProvider) RemoveIfNotTargeted() bool {
 }
 
 // GraphNodeReferencer
-func (n *NodeAbstractProvider) References() []string {
-        if n.Config == nil {
+func (n *NodeAbstractProvider) References() []*addrs.Reference {
+        if n.Config == nil || n.Schema == nil {
                 return nil
         }
 
-        return ReferencesFromConfig(n.Config.RawConfig)
+        return ReferencesFromConfig(n.Config.Config, n.Schema)
 }
 
 // GraphNodeProvider
-func (n *NodeAbstractProvider) ProviderName() string {
-        return n.NameValue
+func (n *NodeAbstractProvider) ProviderAddr() addrs.AbsProviderConfig {
+        return n.Addr
 }
 
 // GraphNodeProvider
-func (n *NodeAbstractProvider) ProviderConfig() *config.ProviderConfig {
+func (n *NodeAbstractProvider) ProviderConfig() *configs.Provider {
         if n.Config == nil {
                 return nil
         }
@@ -79,10 +75,15 @@ func (n *NodeAbstractProvider) ProviderConfig() *config.ProviderConfig {
 }
 
 // GraphNodeAttachProvider
-func (n *NodeAbstractProvider) AttachProvider(c *config.ProviderConfig) {
+func (n *NodeAbstractProvider) AttachProvider(c *configs.Provider) {
         n.Config = c
 }
 
+// GraphNodeAttachProviderConfigSchema impl.
+func (n *NodeAbstractProvider) AttachProviderConfigSchema(schema *configschema.Block) {
+        n.Schema = schema
+}
+
 // GraphNodeDotter impl.
 func (n *NodeAbstractProvider) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
         return &dag.DotNode{
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_provider_disabled.go b/vendor/github.com/hashicorp/terraform/terraform/node_provider_disabled.go
index a00bc46..30d8813 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_provider_disabled.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_provider_disabled.go
@@ -2,6 +2,8 @@ package terraform
 
 import (
         "fmt"
+
+        "github.com/hashicorp/terraform/dag"
 )
 
 // NodeDisabledProvider represents a provider that is disabled. A disabled
@@ -11,24 +13,15 @@ type NodeDisabledProvider struct {
         *NodeAbstractProvider
 }
 
+var (
+        _ GraphNodeSubPath        = (*NodeDisabledProvider)(nil)
+        _ RemovableIfNotTargeted  = (*NodeDisabledProvider)(nil)
+        _ GraphNodeReferencer     = (*NodeDisabledProvider)(nil)
+        _ GraphNodeProvider       = (*NodeDisabledProvider)(nil)
+        _ GraphNodeAttachProvider = (*NodeDisabledProvider)(nil)
+        _ dag.GraphNodeDotter     = (*NodeDisabledProvider)(nil)
+)
+
 func (n *NodeDisabledProvider) Name() string {
         return fmt.Sprintf("%s (disabled)", n.NodeAbstractProvider.Name())
 }
-
-// GraphNodeEvalable
-func (n *NodeDisabledProvider) EvalTree() EvalNode {
-        var resourceConfig *ResourceConfig
-        return &EvalSequence{
-                Nodes: []EvalNode{
-                        &EvalInterpolateProvider{
-                                Config: n.ProviderConfig(),
-                                Output: &resourceConfig,
-                        },
-                        &EvalBuildProviderConfig{
-                                Provider: n.ProviderName(),
-                                Config:   &resourceConfig,
-                                Output:   &resourceConfig,
-                        },
-                },
-        }
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_provider_eval.go b/vendor/github.com/hashicorp/terraform/terraform/node_provider_eval.go
new file mode 100644
index 0000000..580e60c
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_provider_eval.go
@@ -0,0 +1,20 @@
+package terraform
+
+// NodeEvalableProvider represents a provider during an "eval" walk.
+// This special provider node type just initializes a provider and
+// fetches its schema, without configuring it or otherwise interacting
+// with it.
+type NodeEvalableProvider struct {
+        *NodeAbstractProvider
+}
+
+// GraphNodeEvalable
+func (n *NodeEvalableProvider) EvalTree() EvalNode {
+        addr := n.Addr
+        relAddr := addr.ProviderConfig
+
+        return &EvalInitProvider{
+                TypeName: relAddr.Type,
+                Addr:     addr.ProviderConfig,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_provisioner.go b/vendor/github.com/hashicorp/terraform/terraform/node_provisioner.go
index bb117c1..31ed1a8 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_provisioner.go
@@ -3,6 +3,7 @@ package terraform
 import (
         "fmt"
 
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/config"
 )
 
@@ -10,7 +11,7 @@ import (
 // It registers all the common interfaces across operations for providers.
 type NodeProvisioner struct {
         NameValue string
-        PathValue []string
+        PathValue addrs.ModuleInstance
 
         // The fields below will be automatically set using the Attach
         // interfaces if you're running those transforms, but also be explicitly
@@ -19,17 +20,23 @@ type NodeProvisioner struct {
         Config *config.ProviderConfig
 }
 
+var (
+        _ GraphNodeSubPath     = (*NodeProvisioner)(nil)
+        _ GraphNodeProvisioner = (*NodeProvisioner)(nil)
+        _ GraphNodeEvalable    = (*NodeProvisioner)(nil)
+)
+
 func (n *NodeProvisioner) Name() string {
         result := fmt.Sprintf("provisioner.%s", n.NameValue)
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
+        if len(n.PathValue) > 0 {
+                result = fmt.Sprintf("%s.%s", n.PathValue.String(), result)
         }
 
         return result
 }
 
 // GraphNodeSubPath
-func (n *NodeProvisioner) Path() []string {
+func (n *NodeProvisioner) Path() addrs.ModuleInstance {
         return n.PathValue
 }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go
index 73509c8..3a0570c 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go
@@ -2,10 +2,16 @@ package terraform
 
 import (
         "fmt"
-        "strings"
+        "log"
+        "sort"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ConcreteResourceNodeFunc is a callback type used to convert an
@@ -16,225 +22,420 @@ type ConcreteResourceNodeFunc func(*NodeAbstractResource) dag.Vertex
 // The type of operation cannot be assumed, only that this node represents
 // the given resource.
 type GraphNodeResource interface {
-        ResourceAddr() *ResourceAddress
+        ResourceAddr() addrs.AbsResource
+}
+
+// ConcreteResourceInstanceNodeFunc is a callback type used to convert an
+// abstract resource instance to a concrete one of some type.
+type ConcreteResourceInstanceNodeFunc func(*NodeAbstractResourceInstance) dag.Vertex
+
+// GraphNodeResourceInstance is implemented by any nodes that represent
+// a resource instance. A single resource may have multiple instances if,
+// for example, the "count" or "for_each" argument is used for it in
+// configuration.
+type GraphNodeResourceInstance interface {
+        ResourceInstanceAddr() addrs.AbsResourceInstance
 }
 
 // NodeAbstractResource represents a resource that has no associated
 // operations. It registers all the interfaces for a resource that common
 // across multiple operation types.
 type NodeAbstractResource struct {
-        Addr *ResourceAddress // Addr is the address for this resource
+        Addr addrs.AbsResource // Addr is the address for this resource
 
         // The fields below will be automatically set using the Attach
         // interfaces if you're running those transforms, but also be explicitly
         // set if you already have that information.
 
-        Config        *config.Resource // Config is the resource in the config
-        ResourceState *ResourceState   // ResourceState is the ResourceState for this
+        Schema        *configschema.Block // Schema for processing the configuration body
+        SchemaVersion uint64              // Schema version of "Schema", as decided by the provider
+        Config        *configs.Resource   // Config is the resource in the config
 
-        Targets []ResourceAddress // Set from GraphNodeTargetable
+        ProvisionerSchemas map[string]*configschema.Block
+
+        Targets []addrs.Targetable // Set from GraphNodeTargetable
 
         // The address of the provider this resource will use
-        ResolvedProvider string
+        ResolvedProvider addrs.AbsProviderConfig
+}
+
+var (
+        _ GraphNodeSubPath                 = (*NodeAbstractResource)(nil)
+        _ GraphNodeReferenceable           = (*NodeAbstractResource)(nil)
+        _ GraphNodeReferencer              = (*NodeAbstractResource)(nil)
+        _ GraphNodeProviderConsumer        = (*NodeAbstractResource)(nil)
+        _ GraphNodeProvisionerConsumer     = (*NodeAbstractResource)(nil)
+        _ GraphNodeResource                = (*NodeAbstractResource)(nil)
+        _ GraphNodeAttachResourceConfig    = (*NodeAbstractResource)(nil)
+        _ GraphNodeAttachResourceSchema    = (*NodeAbstractResource)(nil)
+        _ GraphNodeAttachProvisionerSchema = (*NodeAbstractResource)(nil)
+        _ GraphNodeTargetable              = (*NodeAbstractResource)(nil)
+        _ dag.GraphNodeDotter              = (*NodeAbstractResource)(nil)
+)
+
+// NewNodeAbstractResource creates an abstract resource graph node for
+// the given absolute resource address.
+func NewNodeAbstractResource(addr addrs.AbsResource) *NodeAbstractResource {
+        return &NodeAbstractResource{
+                Addr: addr,
+        }
+}
+
+// NodeAbstractResourceInstance represents a resource instance with no
+// associated operations. It embeds NodeAbstractResource but additionally
+// contains an instance key, used to identify one of potentially many
+// instances that were created from a resource in configuration, e.g. using
+// the "count" or "for_each" arguments.
+type NodeAbstractResourceInstance struct {
+        NodeAbstractResource
+        InstanceKey addrs.InstanceKey
+
+        // The fields below will be automatically set using the Attach
+        // interfaces if you're running those transforms, but also be explicitly
+        // set if you already have that information.
+
+        ResourceState *states.Resource
+}
+
+var (
+        _ GraphNodeSubPath                 = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeReferenceable           = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeReferencer              = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeProviderConsumer        = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeProvisionerConsumer     = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeResource                = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeResourceInstance        = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeAttachResourceState     = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeAttachResourceConfig    = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeAttachResourceSchema    = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeAttachProvisionerSchema = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeTargetable              = (*NodeAbstractResourceInstance)(nil)
+        _ dag.GraphNodeDotter              = (*NodeAbstractResourceInstance)(nil)
+)
+
+// NewNodeAbstractResourceInstance creates an abstract resource instance graph
+// node for the given absolute resource instance address.
+func NewNodeAbstractResourceInstance(addr addrs.AbsResourceInstance) *NodeAbstractResourceInstance {
+        // Due to the fact that we embed NodeAbstractResource, the given address
+        // actually ends up split between the resource address in the embedded
+        // object and the InstanceKey field in our own struct. The
+        // ResourceInstanceAddr method will stick these back together again on
+        // request.
+        return &NodeAbstractResourceInstance{
+                NodeAbstractResource: NodeAbstractResource{
+                        Addr: addr.ContainingResource(),
+                },
+                InstanceKey: addr.Resource.Key,
+        }
 }
 
 func (n *NodeAbstractResource) Name() string {
-        return n.Addr.String()
+        return n.ResourceAddr().String()
+}
+
+func (n *NodeAbstractResourceInstance) Name() string {
+        return n.ResourceInstanceAddr().String()
 }
 
 // GraphNodeSubPath
-func (n *NodeAbstractResource) Path() []string {
-        return n.Addr.Path
+func (n *NodeAbstractResource) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // GraphNodeReferenceable
-func (n *NodeAbstractResource) ReferenceableName() []string {
-        // We always are referenceable as "type.name" as long as
-        // we have a config or address. Determine what that value is.
-        var id string
-        if n.Config != nil {
-                id = n.Config.Id()
-        } else if n.Addr != nil {
-                addrCopy := n.Addr.Copy()
-                addrCopy.Path = nil // ReferenceTransformer handles paths
-                addrCopy.Index = -1 // We handle indexes below
-                id = addrCopy.String()
-        } else {
-                // No way to determine our type.name, just return
-                return nil
-        }
+func (n *NodeAbstractResource) ReferenceableAddrs() []addrs.Referenceable {
+        return []addrs.Referenceable{n.Addr.Resource}
+}
 
-        var result []string
+// GraphNodeReferenceable
+func (n *NodeAbstractResourceInstance) ReferenceableAddrs() []addrs.Referenceable {
+        addr := n.ResourceInstanceAddr()
+        return []addrs.Referenceable{
+                addr.Resource,
+
+                // A resource instance can also be referenced by the address of its
+                // containing resource, so that e.g. a reference to aws_instance.foo
+                // would match both aws_instance.foo[0] and aws_instance.foo[1].
+                addr.ContainingResource().Resource,
+        }
+}
 
-        // Always include our own ID. This is primarily for backwards
-        // compatibility with states that didn't yet support the more
-        // specific dep string.
-        result = append(result, id)
+// GraphNodeReferencer
+func (n *NodeAbstractResource) References() []*addrs.Reference {
+        // If we have a config then we prefer to use that.
+        if c := n.Config; c != nil {
+                var result []*addrs.Reference
+
+                for _, traversal := range c.DependsOn {
+                        ref, err := addrs.ParseRef(traversal)
+                        if err != nil {
+                                // We ignore this here, because this isn't a suitable place to return
+                                // errors. This situation should be caught and rejected during
+                                // validation.
+                                log.Printf("[ERROR] Can't parse %#v from depends_on as reference: %s", traversal, err)
+                                continue
+                        }
 
-        // We represent all multi-access
-        result = append(result, fmt.Sprintf("%s.*", id))
+                        result = append(result, ref)
+                }
 
-        // We represent either a specific number, or all numbers
-        suffix := "N"
-        if n.Addr != nil {
-                idx := n.Addr.Index
-                if idx == -1 {
-                        idx = 0
+                if n.Schema == nil {
+                        // Should never happens, but we'll log if it does so that we can
+                        // see this easily when debugging.
+                        log.Printf("[WARN] no schema is attached to %s, so config references cannot be detected", n.Name())
                 }
 
-                suffix = fmt.Sprintf("%d", idx)
+                refs, _ := lang.ReferencesInExpr(c.Count)
+                result = append(result, refs...)
+                refs, _ = lang.ReferencesInBlock(c.Config, n.Schema)
+                result = append(result, refs...)
+                if c.Managed != nil {
+                        for _, p := range c.Managed.Provisioners {
+                                if p.When != configs.ProvisionerWhenCreate {
+                                        continue
+                                }
+                                if p.Connection != nil {
+                                        refs, _ = lang.ReferencesInBlock(p.Connection.Config, connectionBlockSupersetSchema)
+                                        result = append(result, refs...)
+                                }
+
+                                schema := n.ProvisionerSchemas[p.Type]
+                                if schema == nil {
+                                        log.Printf("[WARN] no schema for provisioner %q is attached to %s, so provisioner block references cannot be detected", p.Type, n.Name())
+                                }
+                                refs, _ = lang.ReferencesInBlock(p.Config, schema)
+                                result = append(result, refs...)
+                        }
+                }
+                return result
         }
-        result = append(result, fmt.Sprintf("%s.%s", id, suffix))
 
-        return result
+        // Otherwise, we have no references.
+        return nil
 }
 
 // GraphNodeReferencer
-func (n *NodeAbstractResource) References() []string {
-        // If we have a config, that is our source of truth
-        if c := n.Config; c != nil {
-                // Grab all the references
-                var result []string
-                result = append(result, c.DependsOn...)
-                result = append(result, ReferencesFromConfig(c.RawCount)...)
-                result = append(result, ReferencesFromConfig(c.RawConfig)...)
-                for _, p := range c.Provisioners {
-                        if p.When == config.ProvisionerWhenCreate {
-                                result = append(result, ReferencesFromConfig(p.ConnInfo)...)
-                                result = append(result, ReferencesFromConfig(p.RawConfig)...)
-                        }
+func (n *NodeAbstractResourceInstance) References() []*addrs.Reference {
+        // If we have a configuration attached then we'll delegate to our
+        // embedded abstract resource, which knows how to extract dependencies
+        // from configuration.
+        if n.Config != nil {
+                if n.Schema == nil {
+                        // We'll produce a log message about this out here so that
+                        // we can include the full instance address, since the equivalent
+                        // message in NodeAbstractResource.References cannot see it.
+                        log.Printf("[WARN] no schema is attached to %s, so config references cannot be detected", n.Name())
+                        return nil
                 }
-
-                return uniqueStrings(result)
+                return n.NodeAbstractResource.References()
         }
 
-        // If we have state, that is our next source
-        if s := n.ResourceState; s != nil {
-                return s.Dependencies
+        // Otherwise, if we have state then we'll use the values stored in state
+        // as a fallback.
+        if rs := n.ResourceState; rs != nil {
+                if s := rs.Instance(n.InstanceKey); s != nil {
+                        // State is still storing dependencies as old-style strings, so we'll
+                        // need to do a little work here to massage this to the form we now
+                        // want.
+                        var result []*addrs.Reference
+                        for _, addr := range s.Current.Dependencies {
+                                if addr == nil {
+                                        // Should never happen; indicates a bug in the state loader
+                                        panic(fmt.Sprintf("dependencies for current object on %s contains nil address", n.ResourceInstanceAddr()))
+                                }
+
+                                // This is a little weird: we need to manufacture an addrs.Reference
+                                // with a fake range here because the state isn't something we can
+                                // make source references into.
+                                result = append(result, &addrs.Reference{
+                                        Subject: addr,
+                                        SourceRange: tfdiags.SourceRange{
+                                                Filename: "(state file)",
+                                        },
+                                })
+                        }
+                        return result
+                }
         }
 
+        // If we have neither config nor state then we have no references.
         return nil
 }
 
+// converts an instance address to the legacy dotted notation
+func dottedInstanceAddr(tr addrs.ResourceInstance) string {
+        // The legacy state format uses dot-separated instance keys,
+        // rather than bracketed as in our modern syntax.
+        var suffix string
+        switch tk := tr.Key.(type) {
+        case addrs.IntKey:
+                suffix = fmt.Sprintf(".%d", int(tk))
+        case addrs.StringKey:
+                suffix = fmt.Sprintf(".%s", string(tk))
+        }
+        return tr.Resource.String() + suffix
+}
+
 // StateReferences returns the dependencies to put into the state for
 // this resource.
-func (n *NodeAbstractResource) StateReferences() []string {
-        self := n.ReferenceableName()
-
-        // Determine what our "prefix" is for checking for references to
-        // ourself.
-        addrCopy := n.Addr.Copy()
-        addrCopy.Index = -1
-        selfPrefix := addrCopy.String() + "."
+func (n *NodeAbstractResourceInstance) StateReferences() []addrs.Referenceable {
+        selfAddrs := n.ReferenceableAddrs()
+
+        // Since we don't include the source location references in our
+        // results from this method, we'll also filter out duplicates:
+        // there's no point in listing the same object twice without
+        // that additional context.
+        seen := map[string]struct{}{}
+
+        // Pretend that we've already "seen" all of our own addresses so that we
+        // won't record self-references in the state. This can arise if, for
+        // example, a provisioner for a resource refers to the resource itself,
+        // which is valid (since provisioners always run after apply) but should
+        // not create an explicit dependency edge.
+        for _, selfAddr := range selfAddrs {
+                seen[selfAddr.String()] = struct{}{}
+                if riAddr, ok := selfAddr.(addrs.ResourceInstance); ok {
+                        seen[riAddr.ContainingResource().String()] = struct{}{}
+                }
+        }
 
         depsRaw := n.References()
-        deps := make([]string, 0, len(depsRaw))
+        deps := make([]addrs.Referenceable, 0, len(depsRaw))
         for _, d := range depsRaw {
-                // Ignore any variable dependencies
-                if strings.HasPrefix(d, "var.") {
-                        continue
+                subj := d.Subject
+                if mco, isOutput := subj.(addrs.ModuleCallOutput); isOutput {
+                        // For state dependencies, we simplify outputs to just refer
+                        // to the module as a whole. It's not really clear why we do this,
+                        // but this logic is preserved from before the 0.12 rewrite of
+                        // this function.
+                        subj = mco.Call
                 }
 
-                // If this has a backup ref, ignore those for now. The old state
-                // file never contained those and I'd rather store the rich types we
-                // add in the future.
-                if idx := strings.IndexRune(d, '/'); idx != -1 {
-                        d = d[:idx]
-                }
-
-                // If we're referencing ourself, then ignore it
-                found := false
-                for _, s := range self {
-                        if d == s {
-                                found = true
-                        }
-                }
-                if found {
+                k := subj.String()
+                if _, exists := seen[k]; exists {
                         continue
                 }
-
-                // If this is a reference to ourself and a specific index, we keep
-                // it. For example, if this resource is "foo.bar" and the reference
-                // is "foo.bar.0" then we keep it exact. Otherwise, we strip it.
-                if strings.HasSuffix(d, ".0") && !strings.HasPrefix(d, selfPrefix) {
-                        d = d[:len(d)-2]
-                }
-
-                // This is sad. The dependencies are currently in the format of
-                // "module.foo.bar" (the full field). This strips the field off.
-                if strings.HasPrefix(d, "module.") {
-                        parts := strings.SplitN(d, ".", 3)
-                        d = strings.Join(parts[0:2], ".")
+                seen[k] = struct{}{}
+                switch tr := subj.(type) {
+                case addrs.ResourceInstance:
+                        deps = append(deps, tr)
+                case addrs.Resource:
+                        deps = append(deps, tr)
+                case addrs.ModuleCallInstance:
+                        deps = append(deps, tr)
+                default:
+                        // No other reference types are recorded in the state.
                 }
-
-                deps = append(deps, d)
         }
 
+        // We'll also sort them, since that'll avoid creating changes in the
+        // serialized state that make no semantic difference.
+        sort.Slice(deps, func(i, j int) bool {
+                // Simple string-based sort because we just care about consistency,
+                // not user-friendliness.
+                return deps[i].String() < deps[j].String()
+        })
+
         return deps
 }
 
-func (n *NodeAbstractResource) SetProvider(p string) {
+func (n *NodeAbstractResource) SetProvider(p addrs.AbsProviderConfig) {
         n.ResolvedProvider = p
 }
 
 // GraphNodeProviderConsumer
-func (n *NodeAbstractResource) ProvidedBy() string {
+func (n *NodeAbstractResource) ProvidedBy() (addrs.AbsProviderConfig, bool) {
         // If we have a config we prefer that above all else
         if n.Config != nil {
-                return resourceProvider(n.Config.Type, n.Config.Provider)
+                relAddr := n.Config.ProviderConfigAddr()
+                return relAddr.Absolute(n.Path()), false
+        }
+
+        // Use our type and containing module path to guess a provider configuration address
+        return n.Addr.Resource.DefaultProviderConfig().Absolute(n.Addr.Module), false
+}
+
+// GraphNodeProviderConsumer
+func (n *NodeAbstractResourceInstance) ProvidedBy() (addrs.AbsProviderConfig, bool) {
+        // If we have a config we prefer that above all else
+        if n.Config != nil {
+                relAddr := n.Config.ProviderConfigAddr()
+                return relAddr.Absolute(n.Path()), false
         }
 
         // If we have state, then we will use the provider from there
-        if n.ResourceState != nil && n.ResourceState.Provider != "" {
-                return n.ResourceState.Provider
+        if n.ResourceState != nil {
+                // An address from the state must match exactly, since we must ensure
+                // we refresh/destroy a resource with the same provider configuration
+                // that created it.
+                return n.ResourceState.ProviderConfig, true
         }
 
-        // Use our type
-        return resourceProvider(n.Addr.Type, "")
+        // Use our type and containing module path to guess a provider configuration address
+        return n.Addr.Resource.DefaultProviderConfig().Absolute(n.Path()), false
 }
 
 // GraphNodeProvisionerConsumer
 func (n *NodeAbstractResource) ProvisionedBy() []string {
         // If we have no configuration, then we have no provisioners
-        if n.Config == nil {
+        if n.Config == nil || n.Config.Managed == nil {
                 return nil
         }
 
         // Build the list of provisioners we need based on the configuration.
         // It is okay to have duplicates here.
-        result := make([]string, len(n.Config.Provisioners))
-        for i, p := range n.Config.Provisioners {
+        result := make([]string, len(n.Config.Managed.Provisioners))
+        for i, p := range n.Config.Managed.Provisioners {
                 result[i] = p.Type
         }
 
         return result
 }
 
-// GraphNodeResource, GraphNodeAttachResourceState
-func (n *NodeAbstractResource) ResourceAddr() *ResourceAddress {
+// GraphNodeProvisionerConsumer
+func (n *NodeAbstractResource) AttachProvisionerSchema(name string, schema *configschema.Block) {
+        if n.ProvisionerSchemas == nil {
+                n.ProvisionerSchemas = make(map[string]*configschema.Block)
+        }
+        n.ProvisionerSchemas[name] = schema
+}
+
+// GraphNodeResource
+func (n *NodeAbstractResource) ResourceAddr() addrs.AbsResource {
         return n.Addr
 }
 
+// GraphNodeResourceInstance
+func (n *NodeAbstractResourceInstance) ResourceInstanceAddr() addrs.AbsResourceInstance {
+        return n.NodeAbstractResource.Addr.Instance(n.InstanceKey)
+}
+
 // GraphNodeAddressable, TODO: remove, used by target, should unify
 func (n *NodeAbstractResource) ResourceAddress() *ResourceAddress {
-        return n.ResourceAddr()
+        return NewLegacyResourceAddress(n.Addr)
 }
 
 // GraphNodeTargetable
-func (n *NodeAbstractResource) SetTargets(targets []ResourceAddress) {
+func (n *NodeAbstractResource) SetTargets(targets []addrs.Targetable) {
         n.Targets = targets
 }
 
 // GraphNodeAttachResourceState
-func (n *NodeAbstractResource) AttachResourceState(s *ResourceState) {
+func (n *NodeAbstractResourceInstance) AttachResourceState(s *states.Resource) {
         n.ResourceState = s
 }
 
 // GraphNodeAttachResourceConfig
-func (n *NodeAbstractResource) AttachResourceConfig(c *config.Resource) {
+func (n *NodeAbstractResource) AttachResourceConfig(c *configs.Resource) {
         n.Config = c
 }
 
+// GraphNodeAttachResourceSchema impl
+func (n *NodeAbstractResource) AttachResourceSchema(schema *configschema.Block, version uint64) {
+        n.Schema = schema
+        n.SchemaVersion = version
+}
+
 // GraphNodeDotter impl.
 func (n *NodeAbstractResource) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
         return &dag.DotNode{
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract_count.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract_count.go
deleted file mode 100644
index 573570d..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract_count.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package terraform
-
-// NodeAbstractCountResource should be embedded instead of NodeAbstractResource
-// if the resource has a `count` value that needs to be expanded.
-//
-// The embedder should implement `DynamicExpand` to process the count.
-type NodeAbstractCountResource struct {
-        *NodeAbstractResource
-
-        // Validate, if true, will perform the validation for the count.
-        // This should only be turned on for the "validate" operation.
-        Validate bool
-}
-
-// GraphNodeEvalable
-func (n *NodeAbstractCountResource) EvalTree() EvalNode {
-        // We only check if the count is computed if we're not validating.
-        // If we're validating we allow computed counts since they just turn
-        // into more computed values.
-        var evalCountCheckComputed EvalNode
-        if !n.Validate {
-                evalCountCheckComputed = &EvalCountCheckComputed{Resource: n.Config}
-        }
-
-        return &EvalSequence{
-                Nodes: []EvalNode{
-                        // The EvalTree for a plannable resource primarily involves
-                        // interpolating the count since it can contain variables
-                        // we only just received access to.
-                        //
-                        // With the interpolated count, we can then DynamicExpand
-                        // into the proper number of instances.
-                        &EvalInterpolate{Config: n.Config.RawCount},
-
-                        // Check if the count is computed
-                        evalCountCheckComputed,
-
-                        // If validation is enabled, perform the validation
-                        &EvalIf{
-                                If: func(ctx EvalContext) (bool, error) {
-                                        return n.Validate, nil
-                                },
-
-                                Then: &EvalValidateCount{Resource: n.Config},
-                        },
-
-                        &EvalCountFixZeroOneBoundary{Resource: n.Config},
-                },
-        }
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply.go
index 40ee1cf..3e2fff3 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply.go
@@ -1,400 +1,71 @@
 package terraform
 
 import (
-        "fmt"
+        "log"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/lang"
 )
 
 // NodeApplyableResource represents a resource that is "applyable":
-// it is ready to be applied and is represented by a diff.
+// it may need to have its record in the state adjusted to match configuration.
+//
+// Unlike in the plan walk, this resource node does not DynamicExpand. Instead,
+// it should be inserted into the same graph as any instances of the nodes
+// with dependency edges ensuring that the resource is evaluated before any
+// of its instances, which will turn ensure that the whole-resource record
+// in the state is suitably prepared to receive any updates to instances.
 type NodeApplyableResource struct {
         *NodeAbstractResource
 }
 
-// GraphNodeCreator
-func (n *NodeApplyableResource) CreateAddr() *ResourceAddress {
-        return n.NodeAbstractResource.Addr
-}
-
-// GraphNodeReferencer, overriding NodeAbstractResource
-func (n *NodeApplyableResource) References() []string {
-        result := n.NodeAbstractResource.References()
-
-        // The "apply" side of a resource generally also depends on the
-        // destruction of its dependencies as well. For example, if a LB
-        // references a set of VMs with ${vm.foo.*.id}, then we must wait for
-        // the destruction so we get the newly updated list of VMs.
-        //
-        // The exception here is CBD. When CBD is set, we don't do this since
-        // it would create a cycle. By not creating a cycle, we require two
-        // applies since the first apply the creation step will use the OLD
-        // values (pre-destroy) and the second step will update.
-        //
-        // This is how Terraform behaved with "legacy" graphs (TF <= 0.7.x).
-        // We mimic that behavior here now and can improve upon it in the future.
-        //
-        // This behavior is tested in graph_build_apply_test.go to test ordering.
-        cbd := n.Config != nil && n.Config.Lifecycle.CreateBeforeDestroy
-        if !cbd {
-                // The "apply" side of a resource always depends on the destruction
-                // of all its dependencies in addition to the creation.
-                for _, v := range result {
-                        result = append(result, v+".destroy")
-                }
-        }
+var (
+        _ GraphNodeResource             = (*NodeApplyableResource)(nil)
+        _ GraphNodeEvalable             = (*NodeApplyableResource)(nil)
+        _ GraphNodeProviderConsumer     = (*NodeApplyableResource)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodeApplyableResource)(nil)
+        _ GraphNodeReferencer           = (*NodeApplyableResource)(nil)
+)
 
-        return result
+func (n *NodeApplyableResource) Name() string {
+        return n.NodeAbstractResource.Name() + " (prepare state)"
 }
 
-// GraphNodeEvalable
-func (n *NodeApplyableResource) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
-
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
-
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:   stateId,
-                Type: addr.Type,
+func (n *NodeApplyableResource) References() []*addrs.Reference {
+        if n.Config == nil {
+                log.Printf("[WARN] NodeApplyableResource %q: no configuration, so can't determine References", dag.VertexName(n))
+                return nil
         }
 
-        // Build the resource for eval
-        resource := &Resource{
-                Name:       addr.Name,
-                Type:       addr.Type,
-                CountIndex: addr.Index,
-        }
-        if resource.CountIndex < 0 {
-                resource.CountIndex = 0
-        }
+        var result []*addrs.Reference
 
-        // Determine the dependencies for the state.
-        stateDeps := n.StateReferences()
+        // Since this node type only updates resource-level metadata, we only
+        // need to worry about the parts of the configuration that affect
+        // our "each mode": the count and for_each meta-arguments.
+        refs, _ := lang.ReferencesInExpr(n.Config.Count)
+        result = append(result, refs...)
+        refs, _ = lang.ReferencesInExpr(n.Config.ForEach)
+        result = append(result, refs...)
 
-        // Eval info is different depending on what kind of resource this is
-        switch n.Config.Mode {
-        case config.ManagedResourceMode:
-                return n.evalTreeManagedResource(
-                        stateId, info, resource, stateDeps,
-                )
-        case config.DataResourceMode:
-                return n.evalTreeDataResource(
-                        stateId, info, resource, stateDeps)
-        default:
-                panic(fmt.Errorf("unsupported resource mode %s", n.Config.Mode))
-        }
+        return result
 }
 
-func (n *NodeApplyableResource) evalTreeDataResource(
-        stateId string, info *InstanceInfo,
-        resource *Resource, stateDeps []string) EvalNode {
-        var provider ResourceProvider
-        var config *ResourceConfig
-        var diff *InstanceDiff
-        var state *InstanceState
-
-        return &EvalSequence{
-                Nodes: []EvalNode{
-                        // Build the instance info
-                        &EvalInstanceInfo{
-                                Info: info,
-                        },
-
-                        // Get the saved diff for apply
-                        &EvalReadDiff{
-                                Name: stateId,
-                                Diff: &diff,
-                        },
-
-                        // Stop here if we don't actually have a diff
-                        &EvalIf{
-                                If: func(ctx EvalContext) (bool, error) {
-                                        if diff == nil {
-                                                return true, EvalEarlyExitError{}
-                                        }
-
-                                        if diff.GetAttributesLen() == 0 {
-                                                return true, EvalEarlyExitError{}
-                                        }
-
-                                        return true, nil
-                                },
-                                Then: EvalNoop{},
-                        },
-
-                        // Normally we interpolate count as a preparation step before
-                        // a DynamicExpand, but an apply graph has pre-expanded nodes
-                        // and so the count would otherwise never be interpolated.
-                        //
-                        // This is redundant when there are multiple instances created
-                        // from the same config (count > 1) but harmless since the
-                        // underlying structures have mutexes to make this concurrency-safe.
-                        //
-                        // In most cases this isn't actually needed because we dealt with
-                        // all of the counts during the plan walk, but we do it here
-                        // for completeness because other code assumes that the
-                        // final count is always available during interpolation.
-                        //
-                        // Here we are just populating the interpolated value in-place
-                        // inside this RawConfig object, like we would in
-                        // NodeAbstractCountResource.
-                        &EvalInterpolate{
-                                Config:        n.Config.RawCount,
-                                ContinueOnErr: true,
-                        },
-
-                        // We need to re-interpolate the config here, rather than
-                        // just using the diff's values directly, because we've
-                        // potentially learned more variable values during the
-                        // apply pass that weren't known when the diff was produced.
-                        &EvalInterpolate{
-                                Config:   n.Config.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &config,
-                        },
-
-                        &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
-                                Output: &provider,
-                        },
-
-                        // Make a new diff with our newly-interpolated config.
-                        &EvalReadDataDiff{
-                                Info:     info,
-                                Config:   &config,
-                                Previous: &diff,
-                                Provider: &provider,
-                                Output:   &diff,
-                        },
-
-                        &EvalReadDataApply{
-                                Info:     info,
-                                Diff:     &diff,
-                                Provider: &provider,
-                                Output:   &state,
-                        },
-
-                        &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: n.Config.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: stateDeps,
-                                State:        &state,
-                        },
-
-                        // Clear the diff now that we've applied it, so
-                        // later nodes won't see a diff that's now a no-op.
-                        &EvalWriteDiff{
-                                Name: stateId,
-                                Diff: nil,
-                        },
-
-                        &EvalUpdateStateHook{},
-                },
+// GraphNodeEvalable
+func (n *NodeApplyableResource) EvalTree() EvalNode {
+        addr := n.ResourceAddr()
+        config := n.Config
+        providerAddr := n.ResolvedProvider
+
+        if config == nil {
+                // Nothing to do, then.
+                log.Printf("[TRACE] NodeApplyableResource: no configuration present for %s", addr)
+                return &EvalNoop{}
         }
-}
-
-func (n *NodeApplyableResource) evalTreeManagedResource(
-        stateId string, info *InstanceInfo,
-        resource *Resource, stateDeps []string) EvalNode {
-        // Declare a bunch of variables that are used for state during
-        // evaluation. Most of this are written to by-address below.
-        var provider ResourceProvider
-        var diff, diffApply *InstanceDiff
-        var state *InstanceState
-        var resourceConfig *ResourceConfig
-        var err error
-        var createNew bool
-        var createBeforeDestroyEnabled bool
-
-        return &EvalSequence{
-                Nodes: []EvalNode{
-                        // Build the instance info
-                        &EvalInstanceInfo{
-                                Info: info,
-                        },
-
-                        // Get the saved diff for apply
-                        &EvalReadDiff{
-                                Name: stateId,
-                                Diff: &diffApply,
-                        },
-
-                        // We don't want to do any destroys
-                        &EvalIf{
-                                If: func(ctx EvalContext) (bool, error) {
-                                        if diffApply == nil {
-                                                return true, EvalEarlyExitError{}
-                                        }
-
-                                        if diffApply.GetDestroy() && diffApply.GetAttributesLen() == 0 {
-                                                return true, EvalEarlyExitError{}
-                                        }
-
-                                        diffApply.SetDestroy(false)
-                                        return true, nil
-                                },
-                                Then: EvalNoop{},
-                        },
-
-                        &EvalIf{
-                                If: func(ctx EvalContext) (bool, error) {
-                                        destroy := false
-                                        if diffApply != nil {
-                                                destroy = diffApply.GetDestroy() || diffApply.RequiresNew()
-                                        }
-
-                                        createBeforeDestroyEnabled =
-                                                n.Config.Lifecycle.CreateBeforeDestroy &&
-                                                        destroy
-
-                                        return createBeforeDestroyEnabled, nil
-                                },
-                                Then: &EvalDeposeState{
-                                        Name: stateId,
-                                },
-                        },
-
-                        // Normally we interpolate count as a preparation step before
-                        // a DynamicExpand, but an apply graph has pre-expanded nodes
-                        // and so the count would otherwise never be interpolated.
-                        //
-                        // This is redundant when there are multiple instances created
-                        // from the same config (count > 1) but harmless since the
-                        // underlying structures have mutexes to make this concurrency-safe.
-                        //
-                        // In most cases this isn't actually needed because we dealt with
-                        // all of the counts during the plan walk, but we need to do this
-                        // in order to support interpolation of resource counts from
-                        // apply-time-interpolated expressions, such as those in
-                        // "provisioner" blocks.
-                        //
-                        // Here we are just populating the interpolated value in-place
-                        // inside this RawConfig object, like we would in
-                        // NodeAbstractCountResource.
-                        &EvalInterpolate{
-                                Config:        n.Config.RawCount,
-                                ContinueOnErr: true,
-                        },
-
-                        &EvalInterpolate{
-                                Config:   n.Config.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &resourceConfig,
-                        },
-                        &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
-                                Output: &provider,
-                        },
-                        &EvalReadState{
-                                Name:   stateId,
-                                Output: &state,
-                        },
-                        // Re-run validation to catch any errors we missed, e.g. type
-                        // mismatches on computed values.
-                        &EvalValidateResource{
-                                Provider:       &provider,
-                                Config:         &resourceConfig,
-                                ResourceName:   n.Config.Name,
-                                ResourceType:   n.Config.Type,
-                                ResourceMode:   n.Config.Mode,
-                                IgnoreWarnings: true,
-                        },
-                        &EvalDiff{
-                                Info:       info,
-                                Config:     &resourceConfig,
-                                Resource:   n.Config,
-                                Provider:   &provider,
-                                Diff:       &diffApply,
-                                State:      &state,
-                                OutputDiff: &diffApply,
-                        },
-
-                        // Get the saved diff
-                        &EvalReadDiff{
-                                Name: stateId,
-                                Diff: &diff,
-                        },
-
-                        // Compare the diffs
-                        &EvalCompareDiff{
-                                Info: info,
-                                One:  &diff,
-                                Two:  &diffApply,
-                        },
-
-                        &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
-                                Output: &provider,
-                        },
-                        &EvalReadState{
-                                Name:   stateId,
-                                Output: &state,
-                        },
-                        // Call pre-apply hook
-                        &EvalApplyPre{
-                                Info:  info,
-                                State: &state,
-                                Diff:  &diffApply,
-                        },
-                        &EvalApply{
-                                Info:      info,
-                                State:     &state,
-                                Diff:      &diffApply,
-                                Provider:  &provider,
-                                Output:    &state,
-                                Error:     &err,
-                                CreateNew: &createNew,
-                        },
-                        &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: n.Config.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: stateDeps,
-                                State:        &state,
-                        },
-                        &EvalApplyProvisioners{
-                                Info:           info,
-                                State:          &state,
-                                Resource:       n.Config,
-                                InterpResource: resource,
-                                CreateNew:      &createNew,
-                                Error:          &err,
-                                When:           config.ProvisionerWhenCreate,
-                        },
-                        &EvalIf{
-                                If: func(ctx EvalContext) (bool, error) {
-                                        return createBeforeDestroyEnabled && err != nil, nil
-                                },
-                                Then: &EvalUndeposeState{
-                                        Name:  stateId,
-                                        State: &state,
-                                },
-                                Else: &EvalWriteState{
-                                        Name:         stateId,
-                                        ResourceType: n.Config.Type,
-                                        Provider:     n.ResolvedProvider,
-                                        Dependencies: stateDeps,
-                                        State:        &state,
-                                },
-                        },
-
-                        // We clear the diff out here so that future nodes
-                        // don't see a diff that is already complete. There
-                        // is no longer a diff!
-                        &EvalWriteDiff{
-                                Name: stateId,
-                                Diff: nil,
-                        },
 
-                        &EvalApplyPost{
-                                Info:  info,
-                                State: &state,
-                                Error: &err,
-                        },
-                        &EvalUpdateStateHook{},
-                },
+        return &EvalWriteResourceState{
+                Addr:         addr.Resource,
+                Config:       config,
+                ProviderAddr: providerAddr,
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply_instance.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply_instance.go
new file mode 100644
index 0000000..dad7bfc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply_instance.go
@@ -0,0 +1,433 @@
+package terraform
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// NodeApplyableResourceInstance represents a resource instance that is
+// "applyable": it is ready to be applied and is represented by a diff.
+//
+// This node is for a specific instance of a resource. It will usually be
+// accompanied in the graph by a NodeApplyableResource representing its
+// containing resource, and should depend on that node to ensure that the
+// state is properly prepared to receive changes to instances.
+type NodeApplyableResourceInstance struct {
+        *NodeAbstractResourceInstance
+
+        destroyNode      GraphNodeDestroyerCBD
+        graphNodeDeposer // implementation of GraphNodeDeposer
+}
+
+var (
+        _ GraphNodeResource         = (*NodeApplyableResourceInstance)(nil)
+        _ GraphNodeResourceInstance = (*NodeApplyableResourceInstance)(nil)
+        _ GraphNodeCreator          = (*NodeApplyableResourceInstance)(nil)
+        _ GraphNodeReferencer       = (*NodeApplyableResourceInstance)(nil)
+        _ GraphNodeDeposer          = (*NodeApplyableResourceInstance)(nil)
+        _ GraphNodeEvalable         = (*NodeApplyableResourceInstance)(nil)
+)
+
+// GraphNodeAttachDestroyer
+func (n *NodeApplyableResourceInstance) AttachDestroyNode(d GraphNodeDestroyerCBD) {
+        n.destroyNode = d
+}
+
+// createBeforeDestroy checks this nodes config status and the status af any
+// companion destroy node for CreateBeforeDestroy.
+func (n *NodeApplyableResourceInstance) createBeforeDestroy() bool {
+        cbd := false
+
+        if n.Config != nil && n.Config.Managed != nil {
+                cbd = n.Config.Managed.CreateBeforeDestroy
+        }
+
+        if n.destroyNode != nil {
+                cbd = cbd || n.destroyNode.CreateBeforeDestroy()
+        }
+
+        return cbd
+}
+
+// GraphNodeCreator
+func (n *NodeApplyableResourceInstance) CreateAddr() *addrs.AbsResourceInstance {
+        addr := n.ResourceInstanceAddr()
+        return &addr
+}
+
+// GraphNodeReferencer, overriding NodeAbstractResourceInstance
+func (n *NodeApplyableResourceInstance) References() []*addrs.Reference {
+        // Start with the usual resource instance implementation
+        ret := n.NodeAbstractResourceInstance.References()
+
+        // Applying a resource must also depend on the destruction of any of its
+        // dependencies, since this may for example affect the outcome of
+        // evaluating an entire list of resources with "count" set (by reducing
+        // the count).
+        //
+        // However, we can't do this in create_before_destroy mode because that
+        // would create a dependency cycle. We make a compromise here of requiring
+        // changes to be updated across two applies in this case, since the first
+        // plan will use the old values.
+        if !n.createBeforeDestroy() {
+                for _, ref := range ret {
+                        switch tr := ref.Subject.(type) {
+                        case addrs.ResourceInstance:
+                                newRef := *ref // shallow copy so we can mutate
+                                newRef.Subject = tr.Phase(addrs.ResourceInstancePhaseDestroy)
+                                newRef.Remaining = nil // can't access attributes of something being destroyed
+                                ret = append(ret, &newRef)
+                        case addrs.Resource:
+                                newRef := *ref // shallow copy so we can mutate
+                                newRef.Subject = tr.Phase(addrs.ResourceInstancePhaseDestroy)
+                                newRef.Remaining = nil // can't access attributes of something being destroyed
+                                ret = append(ret, &newRef)
+                        }
+                }
+        }
+
+        return ret
+}
+
+// GraphNodeEvalable
+func (n *NodeApplyableResourceInstance) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
+
+        // State still uses legacy-style internal ids, so we need to shim to get
+        // a suitable key to use.
+        stateId := NewLegacyResourceInstanceAddress(addr).stateId()
+
+        // Determine the dependencies for the state.
+        stateDeps := n.StateReferences()
+
+        if n.Config == nil {
+                // This should not be possible, but we've got here in at least one
+                // case as discussed in the following issue:
+                //    https://github.com/hashicorp/terraform/issues/21258
+                // To avoid an outright crash here, we'll instead return an explicit
+                // error.
+                var diags tfdiags.Diagnostics
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Resource node has no configuration attached",
+                        fmt.Sprintf(
+                                "The graph node for %s has no configuration attached to it. This suggests a bug in Terraform's apply graph builder; please report it!",
+                                addr,
+                        ),
+                ))
+                err := diags.Err()
+                return &EvalReturnError{
+                        Error: &err,
+                }
+        }
+
+        // Eval info is different depending on what kind of resource this is
+        switch n.Config.Mode {
+        case addrs.ManagedResourceMode:
+                return n.evalTreeManagedResource(addr, stateId, stateDeps)
+        case addrs.DataResourceMode:
+                return n.evalTreeDataResource(addr, stateId, stateDeps)
+        default:
+                panic(fmt.Errorf("unsupported resource mode %s", n.Config.Mode))
+        }
+}
+
+func (n *NodeApplyableResourceInstance) evalTreeDataResource(addr addrs.AbsResourceInstance, stateId string, stateDeps []addrs.Referenceable) EvalNode {
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
+
+        return &EvalSequence{
+                Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
+
+                        // Get the saved diff for apply
+                        &EvalReadDiff{
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &change,
+                        },
+
+                        // Stop early if we don't actually have a diff
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        if change == nil {
+                                                return true, EvalEarlyExitError{}
+                                        }
+                                        return true, nil
+                                },
+                                Then: EvalNoop{},
+                        },
+
+                        // In this particular call to EvalReadData we include our planned
+                        // change, which signals that we expect this read to complete fully
+                        // with no unknown values; it'll produce an error if not.
+                        &EvalReadData{
+                                Addr:           addr.Resource,
+                                Config:         n.Config,
+                                Dependencies:   n.StateReferences(),
+                                Planned:        &change, // setting this indicates that the result must be complete
+                                Provider:       &provider,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                OutputState:    &state,
+                        },
+
+                        &EvalWriteState{
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                        },
+
+                        // Clear the diff now that we've applied it, so
+                        // later nodes won't see a diff that's now a no-op.
+                        &EvalWriteDiff{
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         nil,
+                        },
+
+                        &EvalUpdateStateHook{},
+                },
+        }
+}
+
+func (n *NodeApplyableResourceInstance) evalTreeManagedResource(addr addrs.AbsResourceInstance, stateId string, stateDeps []addrs.Referenceable) EvalNode {
+        // Declare a bunch of variables that are used for state during
+        // evaluation. Most of this are written to by-address below.
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var diff, diffApply *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
+        var err error
+        var createNew bool
+        var createBeforeDestroyEnabled bool
+        var configVal cty.Value
+        var deposedKey states.DeposedKey
+
+        return &EvalSequence{
+                Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
+
+                        // Get the saved diff for apply
+                        &EvalReadDiff{
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &diffApply,
+                        },
+
+                        // We don't want to do any destroys
+                        // (these are handled by NodeDestroyResourceInstance instead)
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        if diffApply == nil {
+                                                return true, EvalEarlyExitError{}
+                                        }
+                                        if diffApply.Action == plans.Delete {
+                                                return true, EvalEarlyExitError{}
+                                        }
+                                        return true, nil
+                                },
+                                Then: EvalNoop{},
+                        },
+
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        destroy := false
+                                        if diffApply != nil {
+                                                destroy = (diffApply.Action == plans.Delete || diffApply.Action.IsReplace())
+                                        }
+                                        if destroy && n.createBeforeDestroy() {
+                                                createBeforeDestroyEnabled = true
+                                        }
+                                        return createBeforeDestroyEnabled, nil
+                                },
+                                Then: &EvalDeposeState{
+                                        Addr:      addr.Resource,
+                                        ForceKey:  n.PreallocatedDeposedKey,
+                                        OutputKey: &deposedKey,
+                                },
+                        },
+
+                        &EvalReadState{
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
+                                Output: &state,
+                        },
+
+                        // Get the saved diff
+                        &EvalReadDiff{
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &diff,
+                        },
+
+                        // Make a new diff, in case we've learned new values in the state
+                        // during apply which we can now incorporate.
+                        &EvalDiff{
+                                Addr:           addr.Resource,
+                                Config:         n.Config,
+                                Provider:       &provider,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                                PreviousDiff:   &diff,
+                                OutputChange:   &diffApply,
+                                OutputValue:    &configVal,
+                                OutputState:    &state,
+                        },
+
+                        // Compare the diffs
+                        &EvalCheckPlannedChange{
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                Planned:        &diff,
+                                Actual:         &diffApply,
+                        },
+
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
+                        &EvalReadState{
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
+                                Output: &state,
+                        },
+
+                        &EvalReduceDiff{
+                                Addr:      addr.Resource,
+                                InChange:  &diffApply,
+                                Destroy:   false,
+                                OutChange: &diffApply,
+                        },
+
+                        // EvalReduceDiff may have simplified our planned change
+                        // into a NoOp if it only requires destroying, since destroying
+                        // is handled by NodeDestroyResourceInstance.
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        if diffApply == nil || diffApply.Action == plans.NoOp {
+                                                return true, EvalEarlyExitError{}
+                                        }
+                                        return true, nil
+                                },
+                                Then: EvalNoop{},
+                        },
+
+                        // Call pre-apply hook
+                        &EvalApplyPre{
+                                Addr:   addr.Resource,
+                                State:  &state,
+                                Change: &diffApply,
+                        },
+                        &EvalApply{
+                                Addr:           addr.Resource,
+                                Config:         n.Config,
+                                Dependencies:   n.StateReferences(),
+                                State:          &state,
+                                Change:         &diffApply,
+                                Provider:       &provider,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                Output:         &state,
+                                Error:          &err,
+                                CreateNew:      &createNew,
+                        },
+                        &EvalMaybeTainted{
+                                Addr:        addr.Resource,
+                                State:       &state,
+                                Change:      &diffApply,
+                                Error:       &err,
+                                StateOutput: &state,
+                        },
+                        &EvalWriteState{
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                        },
+                        &EvalApplyProvisioners{
+                                Addr:           addr.Resource,
+                                State:          &state, // EvalApplyProvisioners will skip if already tainted
+                                ResourceConfig: n.Config,
+                                CreateNew:      &createNew,
+                                Error:          &err,
+                                When:           configs.ProvisionerWhenCreate,
+                        },
+                        &EvalMaybeTainted{
+                                Addr:        addr.Resource,
+                                State:       &state,
+                                Change:      &diffApply,
+                                Error:       &err,
+                                StateOutput: &state,
+                        },
+                        &EvalWriteState{
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                        },
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        return createBeforeDestroyEnabled && err != nil, nil
+                                },
+                                Then: &EvalMaybeRestoreDeposedObject{
+                                        Addr: addr.Resource,
+                                        Key:  &deposedKey,
+                                },
+                        },
+
+                        // We clear the diff out here so that future nodes
+                        // don't see a diff that is already complete. There
+                        // is no longer a diff!
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        if !diff.Action.IsReplace() {
+                                                return true, nil
+                                        }
+                                        if !n.createBeforeDestroy() {
+                                                return true, nil
+                                        }
+                                        return false, nil
+                                },
+                                Then: &EvalWriteDiff{
+                                        Addr:           addr.Resource,
+                                        ProviderSchema: &providerSchema,
+                                        Change:         nil,
+                                },
+                        },
+
+                        &EvalApplyPost{
+                                Addr:  addr.Resource,
+                                State: &state,
+                                Error: &err,
+                        },
+                        &EvalUpdateStateHook{},
+                },
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy.go
index 657bbee..ca2267e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy.go
@@ -2,81 +2,114 @@ package terraform
 
 import (
         "fmt"
+        "log"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/states"
 )
 
-// NodeDestroyResource represents a resource that is to be destroyed.
-type NodeDestroyResource struct {
-        *NodeAbstractResource
+// NodeDestroyResourceInstance represents a resource instance that is to be
+// destroyed.
+type NodeDestroyResourceInstance struct {
+        *NodeAbstractResourceInstance
+
+        // If DeposedKey is set to anything other than states.NotDeposed then
+        // this node destroys a deposed object of the associated instance
+        // rather than its current object.
+        DeposedKey states.DeposedKey
+
+        CreateBeforeDestroyOverride *bool
 }
 
-func (n *NodeDestroyResource) Name() string {
-        return n.NodeAbstractResource.Name() + " (destroy)"
+var (
+        _ GraphNodeResource            = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeResourceInstance    = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeDestroyer           = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeDestroyerCBD        = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeReferenceable       = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeReferencer          = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeEvalable            = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeProviderConsumer    = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeProvisionerConsumer = (*NodeDestroyResourceInstance)(nil)
+)
+
+func (n *NodeDestroyResourceInstance) Name() string {
+        if n.DeposedKey != states.NotDeposed {
+                return fmt.Sprintf("%s (destroy deposed %s)", n.ResourceInstanceAddr(), n.DeposedKey)
+        }
+        return n.ResourceInstanceAddr().String() + " (destroy)"
 }
 
 // GraphNodeDestroyer
-func (n *NodeDestroyResource) DestroyAddr() *ResourceAddress {
-        return n.Addr
+func (n *NodeDestroyResourceInstance) DestroyAddr() *addrs.AbsResourceInstance {
+        addr := n.ResourceInstanceAddr()
+        return &addr
 }
 
 // GraphNodeDestroyerCBD
-func (n *NodeDestroyResource) CreateBeforeDestroy() bool {
+func (n *NodeDestroyResourceInstance) CreateBeforeDestroy() bool {
+        if n.CreateBeforeDestroyOverride != nil {
+                return *n.CreateBeforeDestroyOverride
+        }
+
         // If we have no config, we just assume no
-        if n.Config == nil {
+        if n.Config == nil || n.Config.Managed == nil {
                 return false
         }
 
-        return n.Config.Lifecycle.CreateBeforeDestroy
+        return n.Config.Managed.CreateBeforeDestroy
 }
 
 // GraphNodeDestroyerCBD
-func (n *NodeDestroyResource) ModifyCreateBeforeDestroy(v bool) error {
-        // If we have no config, do nothing since it won't affect the
-        // create step anyways.
-        if n.Config == nil {
-                return nil
-        }
-
-        // Set CBD to true
-        n.Config.Lifecycle.CreateBeforeDestroy = true
-
+func (n *NodeDestroyResourceInstance) ModifyCreateBeforeDestroy(v bool) error {
+        n.CreateBeforeDestroyOverride = &v
         return nil
 }
 
 // GraphNodeReferenceable, overriding NodeAbstractResource
-func (n *NodeDestroyResource) ReferenceableName() []string {
-        // We modify our referenceable name to have the suffix of ".destroy"
-        // since depending on the creation side doesn't necessarilly mean
-        // depending on destruction.
-        suffix := ".destroy"
-
-        // If we're CBD, we also append "-cbd". This is because CBD will setup
-        // its own edges (in CBDEdgeTransformer). Depending on the "destroy"
-        // side generally doesn't mean depending on CBD as well. See GH-11349
+func (n *NodeDestroyResourceInstance) ReferenceableAddrs() []addrs.Referenceable {
+        normalAddrs := n.NodeAbstractResourceInstance.ReferenceableAddrs()
+        destroyAddrs := make([]addrs.Referenceable, len(normalAddrs))
+
+        phaseType := addrs.ResourceInstancePhaseDestroy
         if n.CreateBeforeDestroy() {
-                suffix += "-cbd"
+                phaseType = addrs.ResourceInstancePhaseDestroyCBD
         }
 
-        result := n.NodeAbstractResource.ReferenceableName()
-        for i, v := range result {
-                result[i] = v + suffix
+        for i, normalAddr := range normalAddrs {
+                switch ta := normalAddr.(type) {
+                case addrs.Resource:
+                        destroyAddrs[i] = ta.Phase(phaseType)
+                case addrs.ResourceInstance:
+                        destroyAddrs[i] = ta.Phase(phaseType)
+                default:
+                        destroyAddrs[i] = normalAddr
+                }
         }
 
-        return result
+        return destroyAddrs
 }
 
 // GraphNodeReferencer, overriding NodeAbstractResource
-func (n *NodeDestroyResource) References() []string {
+func (n *NodeDestroyResourceInstance) References() []*addrs.Reference {
         // If we have a config, then we need to include destroy-time dependencies
-        if c := n.Config; c != nil {
-                var result []string
-                for _, p := range c.Provisioners {
-                        // We include conn info and config for destroy time provisioners
-                        // as dependencies that we have.
-                        if p.When == config.ProvisionerWhenDestroy {
-                                result = append(result, ReferencesFromConfig(p.ConnInfo)...)
-                                result = append(result, ReferencesFromConfig(p.RawConfig)...)
+        if c := n.Config; c != nil && c.Managed != nil {
+                var result []*addrs.Reference
+
+                // We include conn info and config for destroy time provisioners
+                // as dependencies that we have.
+                for _, p := range c.Managed.Provisioners {
+                        schema := n.ProvisionerSchemas[p.Type]
+
+                        if p.When == configs.ProvisionerWhenDestroy {
+                                if p.Connection != nil {
+                                        result = append(result, ReferencesFromConfig(p.Connection.Config, connectionBlockSupersetSchema)...)
+                                }
+                                result = append(result, ReferencesFromConfig(p.Config, schema)...)
                         }
                 }
 
@@ -86,117 +119,66 @@ func (n *NodeDestroyResource) References() []string {
         return nil
 }
 
-// GraphNodeDynamicExpandable
-func (n *NodeDestroyResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
-        // If we have no config we do nothing
-        if n.Addr == nil {
-                return nil, nil
-        }
-
-        state, lock := ctx.State()
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Start creating the steps
-        steps := make([]GraphTransformer, 0, 5)
-
-        // We want deposed resources in the state to be destroyed
-        steps = append(steps, &DeposedTransformer{
-                State:            state,
-                View:             n.Addr.stateId(),
-                ResolvedProvider: n.ResolvedProvider,
-        })
-
-        // Target
-        steps = append(steps, &TargetsTransformer{
-                ParsedTargets: n.Targets,
-        })
-
-        // Always end with the root being added
-        steps = append(steps, &RootTransformer{})
-
-        // Build the graph
-        b := &BasicGraphBuilder{
-                Steps: steps,
-                Name:  "NodeResourceDestroy",
-        }
-        return b.Build(ctx.Path())
-}
-
 // GraphNodeEvalable
-func (n *NodeDestroyResource) EvalTree() EvalNode {
-        // stateId is the ID to put into the state
-        stateId := n.Addr.stateId()
-
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:          stateId,
-                Type:        n.Addr.Type,
-                uniqueExtra: "destroy",
-        }
-
-        // Build the resource for eval
-        addr := n.Addr
-        resource := &Resource{
-                Name:       addr.Name,
-                Type:       addr.Type,
-                CountIndex: addr.Index,
-        }
-        if resource.CountIndex < 0 {
-                resource.CountIndex = 0
-        }
+func (n *NodeDestroyResourceInstance) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
 
         // Get our state
         rs := n.ResourceState
-        if rs == nil {
-                rs = &ResourceState{
-                        Provider: n.ResolvedProvider,
-                }
+        var is *states.ResourceInstance
+        if rs != nil {
+                is = rs.Instance(n.InstanceKey)
+        }
+        if is == nil {
+                log.Printf("[WARN] NodeDestroyResourceInstance for %s with no state", addr)
         }
 
-        var diffApply *InstanceDiff
-        var provider ResourceProvider
-        var state *InstanceState
+        var changeApply *plans.ResourceInstanceChange
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var state *states.ResourceInstanceObject
         var err error
         return &EvalOpFilter{
                 Ops: []walkOperation{walkApply, walkDestroy},
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
+                                &EvalGetProvider{
+                                        Addr:   n.ResolvedProvider,
+                                        Output: &provider,
+                                        Schema: &providerSchema,
+                                },
+
                                 // Get the saved diff for apply
                                 &EvalReadDiff{
-                                        Name: stateId,
-                                        Diff: &diffApply,
+                                        Addr:           addr.Resource,
+                                        ProviderSchema: &providerSchema,
+                                        Change:         &changeApply,
                                 },
 
-                                // Filter the diff so we only get the destroy
-                                &EvalFilterDiff{
-                                        Diff:    &diffApply,
-                                        Output:  &diffApply,
-                                        Destroy: true,
+                                &EvalReduceDiff{
+                                        Addr:      addr.Resource,
+                                        InChange:  &changeApply,
+                                        Destroy:   true,
+                                        OutChange: &changeApply,
                                 },
 
-                                // If we're not destroying, then compare diffs
+                                // EvalReduceDiff may have simplified our planned change
+                                // into a NoOp if it does not require destroying.
                                 &EvalIf{
                                         If: func(ctx EvalContext) (bool, error) {
-                                                if diffApply != nil && diffApply.GetDestroy() {
-                                                        return true, nil
+                                                if changeApply == nil || changeApply.Action == plans.NoOp {
+                                                        return true, EvalEarlyExitError{}
                                                 }
-
-                                                return true, EvalEarlyExitError{}
+                                                return true, nil
                                         },
                                         Then: EvalNoop{},
                                 },
 
-                                // Load the instance info so we have the module path set
-                                &EvalInstanceInfo{Info: info},
-
-                                &EvalGetProvider{
-                                        Name:   n.ResolvedProvider,
-                                        Output: &provider,
-                                },
                                 &EvalReadState{
-                                        Name:   stateId,
-                                        Output: &state,
+                                        Addr:           addr.Resource,
+                                        Output:         &state,
+                                        Provider:       &provider,
+                                        ProviderSchema: &providerSchema,
                                 },
                                 &EvalRequireState{
                                         State: &state,
@@ -204,15 +186,15 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
 
                                 // Call pre-apply hook
                                 &EvalApplyPre{
-                                        Info:  info,
-                                        State: &state,
-                                        Diff:  &diffApply,
+                                        Addr:   addr.Resource,
+                                        State:  &state,
+                                        Change: &changeApply,
                                 },
 
                                 // Run destroy provisioners if not tainted
                                 &EvalIf{
                                         If: func(ctx EvalContext) (bool, error) {
-                                                if state != nil && state.Tainted {
+                                                if state != nil && state.Status == states.ObjectTainted {
                                                         return false, nil
                                                 }
 
@@ -220,12 +202,11 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
                                         },
 
                                         Then: &EvalApplyProvisioners{
-                                                Info:           info,
+                                                Addr:           addr.Resource,
                                                 State:          &state,
-                                                Resource:       n.Config,
-                                                InterpResource: resource,
+                                                ResourceConfig: n.Config,
                                                 Error:          &err,
-                                                When:           config.ProvisionerWhenDestroy,
+                                                When:           configs.ProvisionerWhenDestroy,
                                         },
                                 },
 
@@ -237,7 +218,7 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
                                         },
 
                                         Then: &EvalApplyPost{
-                                                Info:  info,
+                                                Addr:  addr.Resource,
                                                 State: &state,
                                                 Error: &err,
                                         },
@@ -246,41 +227,38 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
                                 // Make sure we handle data sources properly.
                                 &EvalIf{
                                         If: func(ctx EvalContext) (bool, error) {
-                                                if n.Addr == nil {
-                                                        return false, fmt.Errorf("nil address")
-                                                }
-
-                                                if n.Addr.Mode == config.DataResourceMode {
-                                                        return true, nil
-                                                }
-
-                                                return false, nil
+                                                return addr.Resource.Resource.Mode == addrs.DataResourceMode, nil
                                         },
 
                                         Then: &EvalReadDataApply{
-                                                Info:     info,
-                                                Diff:     &diffApply,
-                                                Provider: &provider,
-                                                Output:   &state,
+                                                Addr:           addr.Resource,
+                                                Config:         n.Config,
+                                                Change:         &changeApply,
+                                                Provider:       &provider,
+                                                ProviderAddr:   n.ResolvedProvider,
+                                                ProviderSchema: &providerSchema,
+                                                Output:         &state,
                                         },
                                         Else: &EvalApply{
-                                                Info:     info,
-                                                State:    &state,
-                                                Diff:     &diffApply,
-                                                Provider: &provider,
-                                                Output:   &state,
-                                                Error:    &err,
+                                                Addr:           addr.Resource,
+                                                Config:         nil, // No configuration because we are destroying
+                                                State:          &state,
+                                                Change:         &changeApply,
+                                                Provider:       &provider,
+                                                ProviderAddr:   n.ResolvedProvider,
+                                                ProviderSchema: &providerSchema,
+                                                Output:         &state,
+                                                Error:          &err,
                                         },
                                 },
                                 &EvalWriteState{
-                                        Name:         stateId,
-                                        ResourceType: n.Addr.Type,
-                                        Provider:     n.ResolvedProvider,
-                                        Dependencies: rs.Dependencies,
-                                        State:        &state,
+                                        Addr:           addr.Resource,
+                                        ProviderAddr:   n.ResolvedProvider,
+                                        ProviderSchema: &providerSchema,
+                                        State:          &state,
                                 },
                                 &EvalApplyPost{
-                                        Info:  info,
+                                        Addr:  addr.Resource,
                                         State: &state,
                                         Error: &err,
                                 },
@@ -289,3 +267,55 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
                 },
         }
 }
+
+// NodeDestroyResourceInstance represents a resource that is to be destroyed.
+//
+// Destroying a resource is a state-only operation: it is the individual
+// instances being destroyed that affects remote objects. During graph
+// construction, NodeDestroyResource should always depend on any other node
+// related to the given resource, since it's just a final cleanup to avoid
+// leaving skeleton resource objects in state after their instances have
+// all been destroyed.
+type NodeDestroyResource struct {
+        *NodeAbstractResource
+}
+
+var (
+        _ GraphNodeResource      = (*NodeDestroyResource)(nil)
+        _ GraphNodeReferenceable = (*NodeDestroyResource)(nil)
+        _ GraphNodeReferencer    = (*NodeDestroyResource)(nil)
+        _ GraphNodeEvalable      = (*NodeDestroyResource)(nil)
+)
+
+func (n *NodeDestroyResource) Name() string {
+        return n.ResourceAddr().String() + " (clean up state)"
+}
+
+// GraphNodeReferenceable, overriding NodeAbstractResource
+func (n *NodeDestroyResource) ReferenceableAddrs() []addrs.Referenceable {
+        // NodeDestroyResource doesn't participate in references: the graph
+        // builder that created it should ensure directly that it already depends
+        // on every other node related to its resource, without relying on
+        // references.
+        return nil
+}
+
+// GraphNodeReferencer, overriding NodeAbstractResource
+func (n *NodeDestroyResource) References() []*addrs.Reference {
+        // NodeDestroyResource doesn't participate in references: the graph
+        // builder that created it should ensure directly that it already depends
+        // on every other node related to its resource, without relying on
+        // references.
+        return nil
+}
+
+// GraphNodeEvalable
+func (n *NodeDestroyResource) EvalTree() EvalNode {
+        // This EvalNode will produce an error if the resource isn't already
+        // empty by the time it is called, since it should just be pruning the
+        // leftover husk of a resource in state after all of the child instances
+        // and their objects were destroyed.
+        return &EvalForgetResourceState{
+                Addr: n.ResourceAddr().Resource,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy_deposed.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy_deposed.go
new file mode 100644
index 0000000..67c4691
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy_deposed.go
@@ -0,0 +1,313 @@
+package terraform
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+)
+
+// ConcreteResourceInstanceDeposedNodeFunc is a callback type used to convert
+// an abstract resource instance to a concrete one of some type that has
+// an associated deposed object key.
+type ConcreteResourceInstanceDeposedNodeFunc func(*NodeAbstractResourceInstance, states.DeposedKey) dag.Vertex
+
+type GraphNodeDeposedResourceInstanceObject interface {
+        DeposedInstanceObjectKey() states.DeposedKey
+}
+
+// NodePlanDeposedResourceInstanceObject represents deposed resource
+// instance objects during plan. These are distinct from the primary object
+// for each resource instance since the only valid operation to do with them
+// is to destroy them.
+//
+// This node type is also used during the refresh walk to ensure that the
+// record of a deposed object is up-to-date before we plan to destroy it.
+type NodePlanDeposedResourceInstanceObject struct {
+        *NodeAbstractResourceInstance
+        DeposedKey states.DeposedKey
+}
+
+var (
+        _ GraphNodeDeposedResourceInstanceObject = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeResource                      = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeResourceInstance              = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeReferenceable                 = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeReferencer                    = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeEvalable                      = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeProviderConsumer              = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeProvisionerConsumer           = (*NodePlanDeposedResourceInstanceObject)(nil)
+)
+
+func (n *NodePlanDeposedResourceInstanceObject) Name() string {
+        return fmt.Sprintf("%s (deposed %s)", n.ResourceInstanceAddr().String(), n.DeposedKey)
+}
+
+func (n *NodePlanDeposedResourceInstanceObject) DeposedInstanceObjectKey() states.DeposedKey {
+        return n.DeposedKey
+}
+
+// GraphNodeReferenceable implementation, overriding the one from NodeAbstractResourceInstance
+func (n *NodePlanDeposedResourceInstanceObject) ReferenceableAddrs() []addrs.Referenceable {
+        // Deposed objects don't participate in references.
+        return nil
+}
+
+// GraphNodeReferencer implementation, overriding the one from NodeAbstractResourceInstance
+func (n *NodePlanDeposedResourceInstanceObject) References() []*addrs.Reference {
+        // We don't evaluate configuration for deposed objects, so they effectively
+        // make no references.
+        return nil
+}
+
+// GraphNodeEvalable impl.
+func (n *NodePlanDeposedResourceInstanceObject) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
+
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var state *states.ResourceInstanceObject
+
+        seq := &EvalSequence{Nodes: make([]EvalNode, 0, 5)}
+
+        // During the refresh walk we will ensure that our record of the deposed
+        // object is up-to-date. If it was already deleted outside of Terraform
+        // then this will remove it from state and thus avoid us planning a
+        // destroy for it during the subsequent plan walk.
+        seq.Nodes = append(seq.Nodes, &EvalOpFilter{
+                Ops: []walkOperation{walkRefresh},
+                Node: &EvalSequence{
+                        Nodes: []EvalNode{
+                                &EvalGetProvider{
+                                        Addr:   n.ResolvedProvider,
+                                        Output: &provider,
+                                        Schema: &providerSchema,
+                                },
+                                &EvalReadStateDeposed{
+                                        Addr:           addr.Resource,
+                                        Provider:       &provider,
+                                        ProviderSchema: &providerSchema,
+                                        Key:            n.DeposedKey,
+                                        Output:         &state,
+                                },
+                                &EvalRefresh{
+                                        Addr:           addr.Resource,
+                                        ProviderAddr:   n.ResolvedProvider,
+                                        Provider:       &provider,
+                                        ProviderSchema: &providerSchema,
+                                        State:          &state,
+                                        Output:         &state,
+                                },
+                                &EvalWriteStateDeposed{
+                                        Addr:           addr.Resource,
+                                        Key:            n.DeposedKey,
+                                        ProviderAddr:   n.ResolvedProvider,
+                                        ProviderSchema: &providerSchema,
+                                        State:          &state,
+                                },
+                        },
+                },
+        })
+
+        // During the plan walk we always produce a planned destroy change, because
+        // destroying is the only supported action for deposed objects.
+        var change *plans.ResourceInstanceChange
+        seq.Nodes = append(seq.Nodes, &EvalOpFilter{
+                Ops: []walkOperation{walkPlan, walkPlanDestroy},
+                Node: &EvalSequence{
+                        Nodes: []EvalNode{
+                                &EvalGetProvider{
+                                        Addr:   n.ResolvedProvider,
+                                        Output: &provider,
+                                        Schema: &providerSchema,
+                                },
+                                &EvalReadStateDeposed{
+                                        Addr:           addr.Resource,
+                                        Output:         &state,
+                                        Key:            n.DeposedKey,
+                                        Provider:       &provider,
+                                        ProviderSchema: &providerSchema,
+                                },
+                                &EvalDiffDestroy{
+                                        Addr:         addr.Resource,
+                                        ProviderAddr: n.ResolvedProvider,
+                                        DeposedKey:   n.DeposedKey,
+                                        State:        &state,
+                                        Output:       &change,
+                                },
+                                &EvalWriteDiff{
+                                        Addr:           addr.Resource,
+                                        DeposedKey:     n.DeposedKey,
+                                        ProviderSchema: &providerSchema,
+                                        Change:         &change,
+                                },
+                                // Since deposed objects cannot be referenced by expressions
+                                // elsewhere, we don't need to also record the planned new
+                                // state in this case.
+                        },
+                },
+        })
+
+        return seq
+}
+
+// NodeDestroyDeposedResourceInstanceObject represents deposed resource
+// instance objects during apply. Nodes of this type are inserted by
+// DiffTransformer when the planned changeset contains "delete" changes for
+// deposed instance objects, and its only supported operation is to destroy
+// and then forget the associated object.
+type NodeDestroyDeposedResourceInstanceObject struct {
+        *NodeAbstractResourceInstance
+        DeposedKey states.DeposedKey
+}
+
+var (
+        _ GraphNodeDeposedResourceInstanceObject = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeResource                      = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeResourceInstance              = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeDestroyer                     = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeDestroyerCBD                  = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeReferenceable                 = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeReferencer                    = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeEvalable                      = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeProviderConsumer              = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeProvisionerConsumer           = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+)
+
+func (n *NodeDestroyDeposedResourceInstanceObject) Name() string {
+        return fmt.Sprintf("%s (destroy deposed %s)", n.Addr.String(), n.DeposedKey)
+}
+
+func (n *NodeDestroyDeposedResourceInstanceObject) DeposedInstanceObjectKey() states.DeposedKey {
+        return n.DeposedKey
+}
+
+// GraphNodeReferenceable implementation, overriding the one from NodeAbstractResourceInstance
+func (n *NodeDestroyDeposedResourceInstanceObject) ReferenceableAddrs() []addrs.Referenceable {
+        // Deposed objects don't participate in references.
+        return nil
+}
+
+// GraphNodeReferencer implementation, overriding the one from NodeAbstractResourceInstance
+func (n *NodeDestroyDeposedResourceInstanceObject) References() []*addrs.Reference {
+        // We don't evaluate configuration for deposed objects, so they effectively
+        // make no references.
+        return nil
+}
+
+// GraphNodeDestroyer
+func (n *NodeDestroyDeposedResourceInstanceObject) DestroyAddr() *addrs.AbsResourceInstance {
+        addr := n.ResourceInstanceAddr()
+        return &addr
+}
+
+// GraphNodeDestroyerCBD
+func (n *NodeDestroyDeposedResourceInstanceObject) CreateBeforeDestroy() bool {
+        // A deposed instance is always CreateBeforeDestroy by definition, since
+        // we use deposed only to handle create-before-destroy.
+        return true
+}
+
+// GraphNodeDestroyerCBD
+func (n *NodeDestroyDeposedResourceInstanceObject) ModifyCreateBeforeDestroy(v bool) error {
+        if !v {
+                // Should never happen: deposed instances are _always_ create_before_destroy.
+                return fmt.Errorf("can't deactivate create_before_destroy for a deposed instance")
+        }
+        return nil
+}
+
+// GraphNodeEvalable impl.
+func (n *NodeDestroyDeposedResourceInstanceObject) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
+
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var state *states.ResourceInstanceObject
+        var change *plans.ResourceInstanceChange
+        var err error
+
+        return &EvalSequence{
+                Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
+                        &EvalReadStateDeposed{
+                                Addr:           addr.Resource,
+                                Output:         &state,
+                                Key:            n.DeposedKey,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+                        },
+                        &EvalDiffDestroy{
+                                Addr:         addr.Resource,
+                                ProviderAddr: n.ResolvedProvider,
+                                State:        &state,
+                                Output:       &change,
+                        },
+                        // Call pre-apply hook
+                        &EvalApplyPre{
+                                Addr:   addr.Resource,
+                                State:  &state,
+                                Change: &change,
+                        },
+                        &EvalApply{
+                                Addr:           addr.Resource,
+                                Config:         nil, // No configuration because we are destroying
+                                State:          &state,
+                                Change:         &change,
+                                Provider:       &provider,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                Output:         &state,
+                                Error:          &err,
+                        },
+                        // Always write the resource back to the state deposed... if it
+                        // was successfully destroyed it will be pruned. If it was not, it will
+                        // be caught on the next run.
+                        &EvalWriteStateDeposed{
+                                Addr:           addr.Resource,
+                                Key:            n.DeposedKey,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                        },
+                        &EvalApplyPost{
+                                Addr:  addr.Resource,
+                                State: &state,
+                                Error: &err,
+                        },
+                        &EvalReturnError{
+                                Error: &err,
+                        },
+                        &EvalUpdateStateHook{},
+                },
+        }
+}
+
+// GraphNodeDeposer is an optional interface implemented by graph nodes that
+// might create a single new deposed object for a specific associated resource
+// instance, allowing a caller to optionally pre-allocate a DeposedKey for
+// it.
+type GraphNodeDeposer interface {
+        // SetPreallocatedDeposedKey will be called during graph construction
+        // if a particular node must use a pre-allocated deposed key if/when it
+        // "deposes" the current object of its associated resource instance.
+        SetPreallocatedDeposedKey(key states.DeposedKey)
+}
+
+// graphNodeDeposer is an embeddable implementation of GraphNodeDeposer.
+// Embed it in a node type to get automatic support for it, and then access
+// the field PreallocatedDeposedKey to access any pre-allocated key.
+type graphNodeDeposer struct {
+        PreallocatedDeposedKey states.DeposedKey
+}
+
+func (n *graphNodeDeposer) SetPreallocatedDeposedKey(key states.DeposedKey) {
+        n.PreallocatedDeposedKey = key
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go
index 1afae7a..633c1c4 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go
@@ -1,47 +1,119 @@
 package terraform
 
 import (
+        "log"
+
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // NodePlannableResource represents a resource that is "plannable":
 // it is ready to be planned in order to create a diff.
 type NodePlannableResource struct {
-        *NodeAbstractCountResource
+        *NodeAbstractResource
+
+        // ForceCreateBeforeDestroy might be set via our GraphNodeDestroyerCBD
+        // during graph construction, if dependencies require us to force this
+        // on regardless of what the configuration says.
+        ForceCreateBeforeDestroy *bool
+}
+
+var (
+        _ GraphNodeSubPath              = (*NodePlannableResource)(nil)
+        _ GraphNodeDestroyerCBD         = (*NodePlannableResource)(nil)
+        _ GraphNodeDynamicExpandable    = (*NodePlannableResource)(nil)
+        _ GraphNodeReferenceable        = (*NodePlannableResource)(nil)
+        _ GraphNodeReferencer           = (*NodePlannableResource)(nil)
+        _ GraphNodeResource             = (*NodePlannableResource)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodePlannableResource)(nil)
+)
+
+// GraphNodeEvalable
+func (n *NodePlannableResource) EvalTree() EvalNode {
+        addr := n.ResourceAddr()
+        config := n.Config
+
+        if config == nil {
+                // Nothing to do, then.
+                log.Printf("[TRACE] NodeApplyableResource: no configuration present for %s", addr)
+                return &EvalNoop{}
+        }
+
+        // this ensures we can reference the resource even if the count is 0
+        return &EvalWriteResourceState{
+                Addr:         addr.Resource,
+                Config:       config,
+                ProviderAddr: n.ResolvedProvider,
+        }
+}
+
+// GraphNodeDestroyerCBD
+func (n *NodePlannableResource) CreateBeforeDestroy() bool {
+        if n.ForceCreateBeforeDestroy != nil {
+                return *n.ForceCreateBeforeDestroy
+        }
+
+        // If we have no config, we just assume no
+        if n.Config == nil || n.Config.Managed == nil {
+                return false
+        }
+
+        return n.Config.Managed.CreateBeforeDestroy
+}
+
+// GraphNodeDestroyerCBD
+func (n *NodePlannableResource) ModifyCreateBeforeDestroy(v bool) error {
+        n.ForceCreateBeforeDestroy = &v
+        return nil
 }
 
 // GraphNodeDynamicExpandable
 func (n *NodePlannableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
-        // Grab the state which we read
-        state, lock := ctx.State()
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Expand the resource count which must be available by now from EvalTree
-        count, err := n.Config.Count()
-        if err != nil {
-                return nil, err
+        var diags tfdiags.Diagnostics
+
+        count, countDiags := evaluateResourceCountExpression(n.Config.Count, ctx)
+        diags = diags.Append(countDiags)
+        if countDiags.HasErrors() {
+                return nil, diags.Err()
         }
 
+        // Next we need to potentially rename an instance address in the state
+        // if we're transitioning whether "count" is set at all.
+        fixResourceCountSetTransition(ctx, n.ResourceAddr(), count != -1)
+
+        // Our graph transformers require access to the full state, so we'll
+        // temporarily lock it while we work on this.
+        state := ctx.State().Lock()
+        defer ctx.State().Unlock()
+
         // The concrete resource factory we'll use
-        concreteResource := func(a *NodeAbstractResource) dag.Vertex {
+        concreteResource := func(a *NodeAbstractResourceInstance) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
                 a.ResolvedProvider = n.ResolvedProvider
+                a.Schema = n.Schema
+                a.ProvisionerSchemas = n.ProvisionerSchemas
 
                 return &NodePlannableResourceInstance{
-                        NodeAbstractResource: a,
+                        NodeAbstractResourceInstance: a,
+
+                        // By the time we're walking, we've figured out whether we need
+                        // to force on CreateBeforeDestroy due to dependencies on other
+                        // nodes that have it.
+                        ForceCreateBeforeDestroy: n.CreateBeforeDestroy(),
                 }
         }
 
-        // The concrete resource factory we'll use for oprhans
-        concreteResourceOrphan := func(a *NodeAbstractResource) dag.Vertex {
+        // The concrete resource factory we'll use for orphans
+        concreteResourceOrphan := func(a *NodeAbstractResourceInstance) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
                 a.ResolvedProvider = n.ResolvedProvider
+                a.Schema = n.Schema
+                a.ProvisionerSchemas = n.ProvisionerSchemas
 
-                return &NodePlannableResourceOrphan{
-                        NodeAbstractResource: a,
+                return &NodePlannableResourceInstanceOrphan{
+                        NodeAbstractResourceInstance: a,
                 }
         }
 
@@ -50,6 +122,7 @@ func (n *NodePlannableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
                 // Expand the count.
                 &ResourceCountTransformer{
                         Concrete: concreteResource,
+                        Schema:   n.Schema,
                         Count:    count,
                         Addr:     n.ResourceAddr(),
                 },
@@ -66,7 +139,7 @@ func (n *NodePlannableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
                 &AttachStateTransformer{State: state},
 
                 // Targeting
-                &TargetsTransformer{ParsedTargets: n.Targets},
+                &TargetsTransformer{Targets: n.Targets},
 
                 // Connect references so ordering is correct
                 &ReferenceTransformer{},
@@ -81,5 +154,6 @@ func (n *NodePlannableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
                 Validate: true,
                 Name:     "NodePlannableResource",
         }
-        return b.Build(ctx.Path())
+        graph, diags := b.Build(ctx.Path())
+        return graph, diags.ErrWithWarnings()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_destroy.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_destroy.go
index 9b02362..38746f0 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_destroy.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_destroy.go
@@ -1,52 +1,87 @@
 package terraform
 
-// NodePlanDestroyableResource represents a resource that is "applyable":
-// it is ready to be applied and is represented by a diff.
-type NodePlanDestroyableResource struct {
-        *NodeAbstractResource
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+)
+
+// NodePlanDestroyableResourceInstance represents a resource that is ready
+// to be planned for destruction.
+type NodePlanDestroyableResourceInstance struct {
+        *NodeAbstractResourceInstance
 }
 
+var (
+        _ GraphNodeSubPath              = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeReferenceable        = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeReferencer           = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeDestroyer            = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeResource             = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeResourceInstance     = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeAttachResourceState  = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeEvalable             = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeProviderConsumer     = (*NodePlanDestroyableResourceInstance)(nil)
+)
+
 // GraphNodeDestroyer
-func (n *NodePlanDestroyableResource) DestroyAddr() *ResourceAddress {
-        return n.Addr
+func (n *NodePlanDestroyableResourceInstance) DestroyAddr() *addrs.AbsResourceInstance {
+        addr := n.ResourceInstanceAddr()
+        return &addr
 }
 
 // GraphNodeEvalable
-func (n *NodePlanDestroyableResource) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
+func (n *NodePlanDestroyableResourceInstance) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
 
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
+        // Declare a bunch of variables that are used for state during
+        // evaluation. These are written to by address in the EvalNodes we
+        // declare below.
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
 
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:   stateId,
-                Type: addr.Type,
+        if n.ResolvedProvider.ProviderConfig.Type == "" {
+                // Should never happen; indicates that the graph was not constructed
+                // correctly since we didn't get our provider attached.
+                panic(fmt.Sprintf("%T %q was not assigned a resolved provider", n, dag.VertexName(n)))
         }
 
-        // Declare a bunch of variables that are used for state during
-        // evaluation. Most of this are written to by-address below.
-        var diff *InstanceDiff
-        var state *InstanceState
-
         return &EvalSequence{
                 Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
                         &EvalReadState{
-                                Name:   stateId,
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
                                 Output: &state,
                         },
                         &EvalDiffDestroy{
-                                Info:   info,
-                                State:  &state,
-                                Output: &diff,
+                                Addr:         addr.Resource,
+                                ProviderAddr: n.ResolvedProvider,
+                                State:        &state,
+                                Output:       &change,
                         },
                         &EvalCheckPreventDestroy{
-                                Resource: n.Config,
-                                Diff:     &diff,
+                                Addr:   addr.Resource,
+                                Config: n.Config,
+                                Change: &change,
                         },
                         &EvalWriteDiff{
-                                Name: stateId,
-                                Diff: &diff,
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &change,
                         },
                 },
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go
index 7d9fcdd..75e0bcd 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go
@@ -3,187 +3,205 @@ package terraform
 import (
         "fmt"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // NodePlannableResourceInstance represents a _single_ resource
 // instance that is plannable. This means this represents a single
 // count index, for example.
 type NodePlannableResourceInstance struct {
-        *NodeAbstractResource
+        *NodeAbstractResourceInstance
+        ForceCreateBeforeDestroy bool
 }
 
+var (
+        _ GraphNodeSubPath              = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeReferenceable        = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeReferencer           = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeResource             = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeResourceInstance     = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeAttachResourceState  = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeEvalable             = (*NodePlannableResourceInstance)(nil)
+)
+
 // GraphNodeEvalable
 func (n *NodePlannableResourceInstance) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
-
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
+        addr := n.ResourceInstanceAddr()
 
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:         stateId,
-                Type:       addr.Type,
-                ModulePath: normalizeModulePath(addr.Path),
-        }
-
-        // Build the resource for eval
-        resource := &Resource{
-                Name:       addr.Name,
-                Type:       addr.Type,
-                CountIndex: addr.Index,
-        }
-        if resource.CountIndex < 0 {
-                resource.CountIndex = 0
-        }
+        // State still uses legacy-style internal ids, so we need to shim to get
+        // a suitable key to use.
+        stateId := NewLegacyResourceInstanceAddress(addr).stateId()
 
         // Determine the dependencies for the state.
         stateDeps := n.StateReferences()
 
         // Eval info is different depending on what kind of resource this is
-        switch n.Config.Mode {
-        case config.ManagedResourceMode:
-                return n.evalTreeManagedResource(
-                        stateId, info, resource, stateDeps,
-                )
-        case config.DataResourceMode:
-                return n.evalTreeDataResource(
-                        stateId, info, resource, stateDeps)
+        switch addr.Resource.Resource.Mode {
+        case addrs.ManagedResourceMode:
+                return n.evalTreeManagedResource(addr, stateId, stateDeps)
+        case addrs.DataResourceMode:
+                return n.evalTreeDataResource(addr, stateId, stateDeps)
         default:
                 panic(fmt.Errorf("unsupported resource mode %s", n.Config.Mode))
         }
 }
 
-func (n *NodePlannableResourceInstance) evalTreeDataResource(
-        stateId string, info *InstanceInfo,
-        resource *Resource, stateDeps []string) EvalNode {
-        var provider ResourceProvider
-        var config *ResourceConfig
-        var diff *InstanceDiff
-        var state *InstanceState
+func (n *NodePlannableResourceInstance) evalTreeDataResource(addr addrs.AbsResourceInstance, stateId string, stateDeps []addrs.Referenceable) EvalNode {
+        config := n.Config
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
+        var configVal cty.Value
 
         return &EvalSequence{
                 Nodes: []EvalNode{
-                        &EvalReadState{
-                                Name:   stateId,
-                                Output: &state,
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
                         },
 
-                        // We need to re-interpolate the config here because some
-                        // of the attributes may have become computed during
-                        // earlier planning, due to other resources having
-                        // "requires new resource" diffs.
-                        &EvalInterpolate{
-                                Config:   n.Config.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &config,
+                        &EvalReadState{
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
+                                Output: &state,
                         },
 
+                        // If we already have a non-planned state then we already dealt
+                        // with this during the refresh walk and so we have nothing to do
+                        // here.
                         &EvalIf{
                                 If: func(ctx EvalContext) (bool, error) {
-                                        computed := config.ComputedKeys != nil && len(config.ComputedKeys) > 0
-
-                                        // If the configuration is complete and we
-                                        // already have a state then we don't need to
-                                        // do any further work during apply, because we
-                                        // already populated the state during refresh.
-                                        if !computed && state != nil {
-                                                return true, EvalEarlyExitError{}
+                                        depChanges := false
+
+                                        // Check and see if any of our dependencies have changes.
+                                        changes := ctx.Changes()
+                                        for _, d := range n.StateReferences() {
+                                                ri, ok := d.(addrs.ResourceInstance)
+                                                if !ok {
+                                                        continue
+                                                }
+                                                change := changes.GetResourceInstanceChange(ri.Absolute(ctx.Path()), states.CurrentGen)
+                                                if change != nil && change.Action != plans.NoOp {
+                                                        depChanges = true
+                                                        break
+                                                }
                                         }
 
+                                        refreshed := state != nil && state.Status != states.ObjectPlanned
+
+                                        // If there are no dependency changes, and it's not a forced
+                                        // read because we there was no Refresh, then we don't need
+                                        // to re-read. If any dependencies have changes, it means
+                                        // our config may also have changes and we need to Read the
+                                        // data source again.
+                                        if !depChanges && refreshed {
+                                                return false, EvalEarlyExitError{}
+                                        }
                                         return true, nil
                                 },
                                 Then: EvalNoop{},
                         },
 
-                        &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
-                                Output: &provider,
+                        &EvalValidateSelfRef{
+                                Addr:           addr.Resource,
+                                Config:         config.Config,
+                                ProviderSchema: &providerSchema,
                         },
 
-                        &EvalReadDataDiff{
-                                Info:        info,
-                                Config:      &config,
-                                Provider:    &provider,
-                                Output:      &diff,
-                                OutputState: &state,
+                        &EvalReadData{
+                                Addr:           addr.Resource,
+                                Config:         n.Config,
+                                Dependencies:   n.StateReferences(),
+                                Provider:       &provider,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                ForcePlanRead:  true, // _always_ produce a Read change, even if the config seems ready
+                                OutputChange:   &change,
+                                OutputValue:    &configVal,
+                                OutputState:    &state,
                         },
 
                         &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: n.Config.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: stateDeps,
-                                State:        &state,
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
                         },
 
                         &EvalWriteDiff{
-                                Name: stateId,
-                                Diff: &diff,
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &change,
                         },
                 },
         }
 }
 
-func (n *NodePlannableResourceInstance) evalTreeManagedResource(
-        stateId string, info *InstanceInfo,
-        resource *Resource, stateDeps []string) EvalNode {
-        // Declare a bunch of variables that are used for state during
-        // evaluation. Most of this are written to by-address below.
-        var provider ResourceProvider
-        var diff *InstanceDiff
-        var state *InstanceState
-        var resourceConfig *ResourceConfig
+func (n *NodePlannableResourceInstance) evalTreeManagedResource(addr addrs.AbsResourceInstance, stateId string, stateDeps []addrs.Referenceable) EvalNode {
+        config := n.Config
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
 
         return &EvalSequence{
                 Nodes: []EvalNode{
-                        &EvalInterpolate{
-                                Config:   n.Config.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &resourceConfig,
-                        },
                         &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
+                                Addr:   n.ResolvedProvider,
                                 Output: &provider,
+                                Schema: &providerSchema,
                         },
-                        // Re-run validation to catch any errors we missed, e.g. type
-                        // mismatches on computed values.
-                        &EvalValidateResource{
-                                Provider:       &provider,
-                                Config:         &resourceConfig,
-                                ResourceName:   n.Config.Name,
-                                ResourceType:   n.Config.Type,
-                                ResourceMode:   n.Config.Mode,
-                                IgnoreWarnings: true,
-                        },
+
                         &EvalReadState{
-                                Name:   stateId,
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
                                 Output: &state,
                         },
+
+                        &EvalValidateSelfRef{
+                                Addr:           addr.Resource,
+                                Config:         config.Config,
+                                ProviderSchema: &providerSchema,
+                        },
+
                         &EvalDiff{
-                                Name:        stateId,
-                                Info:        info,
-                                Config:      &resourceConfig,
-                                Resource:    n.Config,
-                                Provider:    &provider,
-                                State:       &state,
-                                OutputDiff:  &diff,
-                                OutputState: &state,
+                                Addr:                addr.Resource,
+                                Config:              n.Config,
+                                CreateBeforeDestroy: n.ForceCreateBeforeDestroy,
+                                Provider:            &provider,
+                                ProviderAddr:        n.ResolvedProvider,
+                                ProviderSchema:      &providerSchema,
+                                State:               &state,
+                                OutputChange:        &change,
+                                OutputState:         &state,
                         },
                         &EvalCheckPreventDestroy{
-                                Resource: n.Config,
-                                Diff:     &diff,
+                                Addr:   addr.Resource,
+                                Config: n.Config,
+                                Change: &change,
                         },
                         &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: n.Config.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: stateDeps,
-                                State:        &state,
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                State:          &state,
+                                ProviderSchema: &providerSchema,
                         },
                         &EvalWriteDiff{
-                                Name: stateId,
-                                Diff: &diff,
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &change,
                         },
                 },
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_orphan.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_orphan.go
index 73d6e41..8416694 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_orphan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_orphan.go
@@ -1,53 +1,83 @@
 package terraform
 
-// NodePlannableResourceOrphan represents a resource that is "applyable":
+import (
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+)
+
+// NodePlannableResourceInstanceOrphan represents a resource that is "applyable":
 // it is ready to be applied and is represented by a diff.
-type NodePlannableResourceOrphan struct {
-        *NodeAbstractResource
+type NodePlannableResourceInstanceOrphan struct {
+        *NodeAbstractResourceInstance
 }
 
-func (n *NodePlannableResourceOrphan) Name() string {
-        return n.NodeAbstractResource.Name() + " (orphan)"
-}
+var (
+        _ GraphNodeSubPath              = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeReferenceable        = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeReferencer           = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeResource             = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeResourceInstance     = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeAttachResourceState  = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeEvalable             = (*NodePlannableResourceInstanceOrphan)(nil)
+)
 
-// GraphNodeEvalable
-func (n *NodePlannableResourceOrphan) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
+var (
+        _ GraphNodeEvalable = (*NodePlannableResourceInstanceOrphan)(nil)
+)
 
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
+func (n *NodePlannableResourceInstanceOrphan) Name() string {
+        return n.ResourceInstanceAddr().String() + " (orphan)"
+}
 
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:         stateId,
-                Type:       addr.Type,
-                ModulePath: normalizeModulePath(addr.Path),
-        }
+// GraphNodeEvalable
+func (n *NodePlannableResourceInstanceOrphan) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
 
         // Declare a bunch of variables that are used for state during
         // evaluation. Most of this are written to by-address below.
-        var diff *InstanceDiff
-        var state *InstanceState
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
 
         return &EvalSequence{
                 Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
                         &EvalReadState{
-                                Name:   stateId,
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
                                 Output: &state,
                         },
                         &EvalDiffDestroy{
-                                Info:   info,
-                                State:  &state,
-                                Output: &diff,
+                                Addr:         addr.Resource,
+                                State:        &state,
+                                ProviderAddr: n.ResolvedProvider,
+                                Output:       &change,
+                                OutputState:  &state, // Will point to a nil state after this complete, signalling destroyed
                         },
                         &EvalCheckPreventDestroy{
-                                Resource:   n.Config,
-                                ResourceId: stateId,
-                                Diff:       &diff,
+                                Addr:   addr.Resource,
+                                Config: n.Config,
+                                Change: &change,
                         },
                         &EvalWriteDiff{
-                                Name: stateId,
-                                Diff: &diff,
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &change,
+                        },
+                        &EvalWriteState{
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
                         },
                 },
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
index 697bd49..9506023 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
@@ -2,38 +2,60 @@ package terraform
 
 import (
         "fmt"
+        "log"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+
+        "github.com/hashicorp/terraform/states"
+
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // NodeRefreshableManagedResource represents a resource that is expanabled into
 // NodeRefreshableManagedResourceInstance. Resource count orphans are also added.
 type NodeRefreshableManagedResource struct {
-        *NodeAbstractCountResource
+        *NodeAbstractResource
 }
 
+var (
+        _ GraphNodeSubPath              = (*NodeRefreshableManagedResource)(nil)
+        _ GraphNodeDynamicExpandable    = (*NodeRefreshableManagedResource)(nil)
+        _ GraphNodeReferenceable        = (*NodeRefreshableManagedResource)(nil)
+        _ GraphNodeReferencer           = (*NodeRefreshableManagedResource)(nil)
+        _ GraphNodeResource             = (*NodeRefreshableManagedResource)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodeRefreshableManagedResource)(nil)
+)
+
 // GraphNodeDynamicExpandable
 func (n *NodeRefreshableManagedResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
-        // Grab the state which we read
-        state, lock := ctx.State()
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Expand the resource count which must be available by now from EvalTree
-        count, err := n.Config.Count()
-        if err != nil {
-                return nil, err
+        var diags tfdiags.Diagnostics
+
+        count, countDiags := evaluateResourceCountExpression(n.Config.Count, ctx)
+        diags = diags.Append(countDiags)
+        if countDiags.HasErrors() {
+                return nil, diags.Err()
         }
 
+        // Next we need to potentially rename an instance address in the state
+        // if we're transitioning whether "count" is set at all.
+        fixResourceCountSetTransition(ctx, n.ResourceAddr(), count != -1)
+
+        // Our graph transformers require access to the full state, so we'll
+        // temporarily lock it while we work on this.
+        state := ctx.State().Lock()
+        defer ctx.State().Unlock()
+
         // The concrete resource factory we'll use
-        concreteResource := func(a *NodeAbstractResource) dag.Vertex {
+        concreteResource := func(a *NodeAbstractResourceInstance) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
                 a.ResolvedProvider = n.ResolvedProvider
 
                 return &NodeRefreshableManagedResourceInstance{
-                        NodeAbstractResource: a,
+                        NodeAbstractResourceInstance: a,
                 }
         }
 
@@ -42,6 +64,7 @@ func (n *NodeRefreshableManagedResource) DynamicExpand(ctx EvalContext) (*Graph,
                 // Expand the count.
                 &ResourceCountTransformer{
                         Concrete: concreteResource,
+                        Schema:   n.Schema,
                         Count:    count,
                         Addr:     n.ResourceAddr(),
                 },
@@ -59,7 +82,7 @@ func (n *NodeRefreshableManagedResource) DynamicExpand(ctx EvalContext) (*Graph,
                 &AttachStateTransformer{State: state},
 
                 // Targeting
-                &TargetsTransformer{ParsedTargets: n.Targets},
+                &TargetsTransformer{Targets: n.Targets},
 
                 // Connect references so ordering is correct
                 &ReferenceTransformer{},
@@ -75,66 +98,76 @@ func (n *NodeRefreshableManagedResource) DynamicExpand(ctx EvalContext) (*Graph,
                 Name:     "NodeRefreshableManagedResource",
         }
 
-        return b.Build(ctx.Path())
+        graph, diags := b.Build(ctx.Path())
+        return graph, diags.ErrWithWarnings()
 }
 
 // NodeRefreshableManagedResourceInstance represents a resource that is "applyable":
 // it is ready to be applied and is represented by a diff.
 type NodeRefreshableManagedResourceInstance struct {
-        *NodeAbstractResource
+        *NodeAbstractResourceInstance
 }
 
+var (
+        _ GraphNodeSubPath              = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeReferenceable        = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeReferencer           = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeDestroyer            = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeResource             = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeResourceInstance     = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeAttachResourceState  = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeEvalable             = (*NodeRefreshableManagedResourceInstance)(nil)
+)
+
 // GraphNodeDestroyer
-func (n *NodeRefreshableManagedResourceInstance) DestroyAddr() *ResourceAddress {
-        return n.Addr
+func (n *NodeRefreshableManagedResourceInstance) DestroyAddr() *addrs.AbsResourceInstance {
+        addr := n.ResourceInstanceAddr()
+        return &addr
 }
 
 // GraphNodeEvalable
 func (n *NodeRefreshableManagedResourceInstance) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
+
         // Eval info is different depending on what kind of resource this is
-        switch mode := n.Addr.Mode; mode {
-        case config.ManagedResourceMode:
+        switch addr.Resource.Resource.Mode {
+        case addrs.ManagedResourceMode:
                 if n.ResourceState == nil {
+                        log.Printf("[TRACE] NodeRefreshableManagedResourceInstance: %s has no existing state to refresh", addr)
                         return n.evalTreeManagedResourceNoState()
                 }
+                log.Printf("[TRACE] NodeRefreshableManagedResourceInstance: %s will be refreshed", addr)
                 return n.evalTreeManagedResource()
 
-        case config.DataResourceMode:
+        case addrs.DataResourceMode:
                 // Get the data source node. If we don't have a configuration
                 // then it is an orphan so we destroy it (remove it from the state).
                 var dn GraphNodeEvalable
                 if n.Config != nil {
                         dn = &NodeRefreshableDataResourceInstance{
-                                NodeAbstractResource: n.NodeAbstractResource,
+                                NodeAbstractResourceInstance: n.NodeAbstractResourceInstance,
                         }
                 } else {
-                        dn = &NodeDestroyableDataResource{
-                                NodeAbstractResource: n.NodeAbstractResource,
+                        dn = &NodeDestroyableDataResourceInstance{
+                                NodeAbstractResourceInstance: n.NodeAbstractResourceInstance,
                         }
                 }
 
                 return dn.EvalTree()
         default:
-                panic(fmt.Errorf("unsupported resource mode %s", mode))
+                panic(fmt.Errorf("unsupported resource mode %s", addr.Resource.Resource.Mode))
         }
 }
 
 func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResource() EvalNode {
-        addr := n.NodeAbstractResource.Addr
-
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
-
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:   stateId,
-                Type: addr.Type,
-        }
+        addr := n.ResourceInstanceAddr()
 
         // Declare a bunch of variables that are used for state during
         // evaluation. Most of this are written to by-address below.
-        var provider ResourceProvider
-        var state *InstanceState
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var state *states.ResourceInstanceObject
 
         // This happened during initial development. All known cases were
         // fixed and tested but as a sanity check let's assert here.
@@ -150,25 +183,33 @@ func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResource() EvalN
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
+                                Addr:   n.ResolvedProvider,
                                 Output: &provider,
+                                Schema: &providerSchema,
                         },
+
                         &EvalReadState{
-                                Name:   stateId,
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
                                 Output: &state,
                         },
+
                         &EvalRefresh{
-                                Info:     info,
-                                Provider: &provider,
-                                State:    &state,
-                                Output:   &state,
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                                Output:         &state,
                         },
+
                         &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: n.ResourceState.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: n.ResourceState.Dependencies,
-                                State:        &state,
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
                         },
                 },
         }
@@ -186,80 +227,62 @@ func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResource() EvalN
 // plan, but nothing is done with the diff after it is created - it is dropped,
 // and its changes are not counted in the UI.
 func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResourceNoState() EvalNode {
+        addr := n.ResourceInstanceAddr()
+
         // Declare a bunch of variables that are used for state during
         // evaluation. Most of this are written to by-address below.
-        var provider ResourceProvider
-        var state *InstanceState
-        var resourceConfig *ResourceConfig
-
-        addr := n.NodeAbstractResource.Addr
-        stateID := addr.stateId()
-        info := &InstanceInfo{
-                Id:         stateID,
-                Type:       addr.Type,
-                ModulePath: normalizeModulePath(addr.Path),
-        }
-
-        // Build the resource for eval
-        resource := &Resource{
-                Name:       addr.Name,
-                Type:       addr.Type,
-                CountIndex: addr.Index,
-        }
-        if resource.CountIndex < 0 {
-                resource.CountIndex = 0
-        }
-
-        // Determine the dependencies for the state.
-        stateDeps := n.StateReferences()
-
-        // n.Config can be nil if the config and state don't match
-        var raw *config.RawConfig
-        if n.Config != nil {
-                raw = n.Config.RawConfig.Copy()
-        }
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
 
         return &EvalSequence{
                 Nodes: []EvalNode{
-                        &EvalInterpolate{
-                                Config:   raw,
-                                Resource: resource,
-                                Output:   &resourceConfig,
-                        },
                         &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
+                                Addr:   n.ResolvedProvider,
                                 Output: &provider,
+                                Schema: &providerSchema,
                         },
-                        // Re-run validation to catch any errors we missed, e.g. type
-                        // mismatches on computed values.
-                        &EvalValidateResource{
-                                Provider:       &provider,
-                                Config:         &resourceConfig,
-                                ResourceName:   n.Config.Name,
-                                ResourceType:   n.Config.Type,
-                                ResourceMode:   n.Config.Mode,
-                                IgnoreWarnings: true,
-                        },
+
                         &EvalReadState{
-                                Name:   stateID,
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
                                 Output: &state,
                         },
+
                         &EvalDiff{
-                                Name:        stateID,
-                                Info:        info,
-                                Config:      &resourceConfig,
-                                Resource:    n.Config,
-                                Provider:    &provider,
-                                State:       &state,
-                                OutputState: &state,
-                                Stub:        true,
+                                Addr:           addr.Resource,
+                                Config:         n.Config,
+                                Provider:       &provider,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                                OutputChange:   &change,
+                                OutputState:    &state,
+                                Stub:           true,
                         },
+
                         &EvalWriteState{
-                                Name:         stateID,
-                                ResourceType: n.Config.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: stateDeps,
-                                State:        &state,
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                        },
+
+                        // We must also save the planned change, so that expressions in
+                        // other nodes, such as provider configurations and data resources,
+                        // can work with the planned new value.
+                        //
+                        // This depends on the fact that Context.Refresh creates a
+                        // temporary new empty changeset for the duration of its graph
+                        // walk, and so this recorded change will be discarded immediately
+                        // after the refresh walk completes.
+                        &EvalWriteDiff{
+                                Addr:           addr.Resource,
+                                Change:         &change,
+                                ProviderSchema: &providerSchema,
                         },
                 },
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go
index 0df223d..734ec9e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go
@@ -1,158 +1,87 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // NodeValidatableResource represents a resource that is used for validation
 // only.
 type NodeValidatableResource struct {
-        *NodeAbstractCountResource
-}
-
-// GraphNodeEvalable
-func (n *NodeValidatableResource) EvalTree() EvalNode {
-        // Ensure we're validating
-        c := n.NodeAbstractCountResource
-        c.Validate = true
-        return c.EvalTree()
-}
-
-// GraphNodeDynamicExpandable
-func (n *NodeValidatableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
-        // Grab the state which we read
-        state, lock := ctx.State()
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Expand the resource count which must be available by now from EvalTree
-        count := 1
-        if n.Config.RawCount.Value() != unknownValue() {
-                var err error
-                count, err = n.Config.Count()
-                if err != nil {
-                        return nil, err
-                }
-        }
-
-        // The concrete resource factory we'll use
-        concreteResource := func(a *NodeAbstractResource) dag.Vertex {
-                // Add the config and state since we don't do that via transforms
-                a.Config = n.Config
-                a.ResolvedProvider = n.ResolvedProvider
-
-                return &NodeValidatableResourceInstance{
-                        NodeAbstractResource: a,
-                }
-        }
-
-        // Start creating the steps
-        steps := []GraphTransformer{
-                // Expand the count.
-                &ResourceCountTransformer{
-                        Concrete: concreteResource,
-                        Count:    count,
-                        Addr:     n.ResourceAddr(),
-                },
-
-                // Attach the state
-                &AttachStateTransformer{State: state},
-
-                // Targeting
-                &TargetsTransformer{ParsedTargets: n.Targets},
-
-                // Connect references so ordering is correct
-                &ReferenceTransformer{},
-
-                // Make sure there is a single root
-                &RootTransformer{},
-        }
-
-        // Build the graph
-        b := &BasicGraphBuilder{
-                Steps:    steps,
-                Validate: true,
-                Name:     "NodeValidatableResource",
-        }
-
-        return b.Build(ctx.Path())
-}
-
-// This represents a _single_ resource instance to validate.
-type NodeValidatableResourceInstance struct {
         *NodeAbstractResource
 }
 
-// GraphNodeEvalable
-func (n *NodeValidatableResourceInstance) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
+var (
+        _ GraphNodeSubPath              = (*NodeValidatableResource)(nil)
+        _ GraphNodeEvalable             = (*NodeValidatableResource)(nil)
+        _ GraphNodeReferenceable        = (*NodeValidatableResource)(nil)
+        _ GraphNodeReferencer           = (*NodeValidatableResource)(nil)
+        _ GraphNodeResource             = (*NodeValidatableResource)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodeValidatableResource)(nil)
+)
 
-        // Build the resource for eval
-        resource := &Resource{
-                Name:       addr.Name,
-                Type:       addr.Type,
-                CountIndex: addr.Index,
-        }
-        if resource.CountIndex < 0 {
-                resource.CountIndex = 0
-        }
+// GraphNodeEvalable
+func (n *NodeValidatableResource) EvalTree() EvalNode {
+        addr := n.ResourceAddr()
+        config := n.Config
 
-        // Declare a bunch of variables that are used for state during
-        // evaluation. Most of this are written to by-address below.
-        var config *ResourceConfig
-        var provider ResourceProvider
+        // Declare the variables will be used are used to pass values along
+        // the evaluation sequence below. These are written to via pointers
+        // passed to the EvalNodes.
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var configVal cty.Value
 
         seq := &EvalSequence{
                 Nodes: []EvalNode{
-                        &EvalValidateResourceSelfRef{
-                                Addr:   &addr,
-                                Config: &n.Config.RawConfig,
-                        },
                         &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
+                                Addr:   n.ResolvedProvider,
                                 Output: &provider,
-                        },
-                        &EvalInterpolate{
-                                Config:   n.Config.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &config,
+                                Schema: &providerSchema,
                         },
                         &EvalValidateResource{
-                                Provider:     &provider,
-                                Config:       &config,
-                                ResourceName: n.Config.Name,
-                                ResourceType: n.Config.Type,
-                                ResourceMode: n.Config.Mode,
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+                                Config:         config,
+                                ConfigVal:      &configVal,
                         },
                 },
         }
 
-        // Validate all the provisioners
-        for _, p := range n.Config.Provisioners {
-                var provisioner ResourceProvisioner
-                var connConfig *ResourceConfig
-                seq.Nodes = append(
-                        seq.Nodes,
-                        &EvalGetProvisioner{
-                                Name:   p.Type,
-                                Output: &provisioner,
-                        },
-                        &EvalInterpolate{
-                                Config:   p.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &config,
-                        },
-                        &EvalInterpolate{
-                                Config:   p.ConnInfo.Copy(),
-                                Resource: resource,
-                                Output:   &connConfig,
-                        },
-                        &EvalValidateProvisioner{
-                                Provisioner: &provisioner,
-                                Config:      &config,
-                                ConnConfig:  &connConfig,
-                        },
-                )
+        if managed := n.Config.Managed; managed != nil {
+                hasCount := n.Config.Count != nil
+
+                // Validate all the provisioners
+                for _, p := range managed.Provisioners {
+                        var provisioner provisioners.Interface
+                        var provisionerSchema *configschema.Block
+
+                        if p.Connection == nil {
+                                p.Connection = config.Managed.Connection
+                        } else if config.Managed.Connection != nil {
+                                p.Connection.Config = configs.MergeBodies(config.Managed.Connection.Config, p.Connection.Config)
+                        }
+
+                        seq.Nodes = append(
+                                seq.Nodes,
+                                &EvalGetProvisioner{
+                                        Name:   p.Type,
+                                        Output: &provisioner,
+                                        Schema: &provisionerSchema,
+                                },
+                                &EvalValidateProvisioner{
+                                        ResourceAddr:     addr.Resource,
+                                        Provisioner:      &provisioner,
+                                        Schema:           &provisionerSchema,
+                                        Config:           p,
+                                        ResourceHasCount: hasCount,
+                                },
+                        )
+                }
         }
 
         return seq
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_root_variable.go b/vendor/github.com/hashicorp/terraform/terraform/node_root_variable.go
index cb61a4e..1c30290 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_root_variable.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_root_variable.go
@@ -1,22 +1,44 @@
 package terraform
 
 import (
-        "fmt"
-
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/dag"
 )
 
 // NodeRootVariable represents a root variable input.
 type NodeRootVariable struct {
-        Config *config.Variable
+        Addr   addrs.InputVariable
+        Config *configs.Variable
 }
 
+var (
+        _ GraphNodeSubPath       = (*NodeRootVariable)(nil)
+        _ GraphNodeReferenceable = (*NodeRootVariable)(nil)
+        _ dag.GraphNodeDotter    = (*NodeApplyableModuleVariable)(nil)
+)
+
 func (n *NodeRootVariable) Name() string {
-        result := fmt.Sprintf("var.%s", n.Config.Name)
-        return result
+        return n.Addr.String()
+}
+
+// GraphNodeSubPath
+func (n *NodeRootVariable) Path() addrs.ModuleInstance {
+        return addrs.RootModuleInstance
 }
 
 // GraphNodeReferenceable
-func (n *NodeRootVariable) ReferenceableName() []string {
-        return []string{n.Name()}
+func (n *NodeRootVariable) ReferenceableAddrs() []addrs.Referenceable {
+        return []addrs.Referenceable{n.Addr}
+}
+
+// dag.GraphNodeDotter impl.
+func (n *NodeRootVariable) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
+        return &dag.DotNode{
+                Name: name,
+                Attrs: map[string]string{
+                        "label": n.Name(),
+                        "shape": "note",
+                },
+        }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/path.go b/vendor/github.com/hashicorp/terraform/terraform/path.go
index 51dd412..9757446 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/path.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/path.go
@@ -1,10 +1,17 @@
 package terraform
 
 import (
-        "strings"
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
 )
 
-// PathCacheKey returns a cache key for a module path.
-func PathCacheKey(path []string) string {
-        return strings.Join(path, "|")
+// PathObjectCacheKey is like PathCacheKey but includes an additional name
+// to be included in the key, for module-namespaced objects.
+//
+// The result of this function is guaranteed unique for any distinct pair
+// of path and name, but is not guaranteed to be in any particular format
+// and in particular should never be shown to end-users.
+func PathObjectCacheKey(path addrs.ModuleInstance, objectName string) string {
+        return fmt.Sprintf("%s|%s", path.String(), objectName)
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/plan.go b/vendor/github.com/hashicorp/terraform/terraform/plan.go
index 30db195..af04c6c 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/plan.go
@@ -3,14 +3,13 @@ package terraform
 import (
         "bytes"
         "encoding/gob"
-        "errors"
         "fmt"
         "io"
-        "log"
         "sync"
 
-        "github.com/hashicorp/terraform/config/module"
-        "github.com/hashicorp/terraform/version"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/configs"
 )
 
 func init() {
@@ -31,9 +30,9 @@ type Plan struct {
         // plan is applied.
         Diff *Diff
 
-        // Module represents the entire configuration that was present when this
+        // Config represents the entire configuration that was present when this
         // plan was created.
-        Module *module.Tree
+        Config *configs.Config
 
         // State is the Terraform state that was current when this plan was
         // created.
@@ -44,7 +43,7 @@ type Plan struct {
 
         // Vars retains the variables that were set when creating the plan, so
         // that the same variables can be applied during apply.
-        Vars map[string]interface{}
+        Vars map[string]cty.Value
 
         // Targets, if non-empty, contains a set of resource address strings that
         // identify graph nodes that were selected as targets for plan.
@@ -78,64 +77,6 @@ type Plan struct {
         once sync.Once
 }
 
-// Context returns a Context with the data encapsulated in this plan.
-//
-// The following fields in opts are overridden by the plan: Config,
-// Diff, Variables.
-//
-// If State is not provided, it is set from the plan. If it _is_ provided,
-// it must be Equal to the state stored in plan, but may have a newer
-// serial.
-func (p *Plan) Context(opts *ContextOpts) (*Context, error) {
-        var err error
-        opts, err = p.contextOpts(opts)
-        if err != nil {
-                return nil, err
-        }
-        return NewContext(opts)
-}
-
-// contextOpts mutates the given base ContextOpts in place to use input
-// objects obtained from the receiving plan.
-func (p *Plan) contextOpts(base *ContextOpts) (*ContextOpts, error) {
-        opts := base
-
-        opts.Diff = p.Diff
-        opts.Module = p.Module
-        opts.Targets = p.Targets
-        opts.ProviderSHA256s = p.ProviderSHA256s
-        opts.Destroy = p.Destroy
-
-        if opts.State == nil {
-                opts.State = p.State
-        } else if !opts.State.Equal(p.State) {
-                // Even if we're overriding the state, it should be logically equal
-                // to what's in plan. The only valid change to have made by the time
-                // we get here is to have incremented the serial.
-                //
-                // Due to the fact that serialization may change the representation of
-                // the state, there is little chance that these aren't actually equal.
-                // Log the error condition for reference, but continue with the state
-                // we have.
-                log.Println("[WARN] Plan state and ContextOpts state are not equal")
-        }
-
-        thisVersion := version.String()
-        if p.TerraformVersion != "" && p.TerraformVersion != thisVersion {
-                return nil, fmt.Errorf(
-                        "plan was created with a different version of Terraform (created with %s, but running %s)",
-                        p.TerraformVersion, thisVersion,
-                )
-        }
-
-        opts.Variables = make(map[string]interface{})
-        for k, v := range p.Vars {
-                opts.Variables[k] = v
-        }
-
-        return opts, nil
-}
-
 func (p *Plan) String() string {
         buf := new(bytes.Buffer)
         buf.WriteString("DIFF:\n\n")
@@ -158,7 +99,7 @@ func (p *Plan) init() {
                 }
 
                 if p.Vars == nil {
-                        p.Vars = make(map[string]interface{})
+                        p.Vars = make(map[string]cty.Value)
                 }
         })
 }
@@ -172,63 +113,10 @@ const planFormatVersion byte = 2
 // ReadPlan reads a plan structure out of a reader in the format that
 // was written by WritePlan.
 func ReadPlan(src io.Reader) (*Plan, error) {
-        var result *Plan
-        var err error
-        n := 0
-
-        // Verify the magic bytes
-        magic := make([]byte, len(planFormatMagic))
-        for n < len(magic) {
-                n, err = src.Read(magic[n:])
-                if err != nil {
-                        return nil, fmt.Errorf("error while reading magic bytes: %s", err)
-                }
-        }
-        if string(magic) != planFormatMagic {
-                return nil, fmt.Errorf("not a valid plan file")
-        }
-
-        // Verify the version is something we can read
-        var formatByte [1]byte
-        n, err = src.Read(formatByte[:])
-        if err != nil {
-                return nil, err
-        }
-        if n != len(formatByte) {
-                return nil, errors.New("failed to read plan version byte")
-        }
-
-        if formatByte[0] != planFormatVersion {
-                return nil, fmt.Errorf("unknown plan file version: %d", formatByte[0])
-        }
-
-        dec := gob.NewDecoder(src)
-        if err := dec.Decode(&result); err != nil {
-                return nil, err
-        }
-
-        return result, nil
+        return nil, fmt.Errorf("terraform.ReadPlan is no longer in use; use planfile.Open instead")
 }
 
 // WritePlan writes a plan somewhere in a binary format.
 func WritePlan(d *Plan, dst io.Writer) error {
-        // Write the magic bytes so we can determine the file format later
-        n, err := dst.Write([]byte(planFormatMagic))
-        if err != nil {
-                return err
-        }
-        if n != len(planFormatMagic) {
-                return errors.New("failed to write plan format magic bytes")
-        }
-
-        // Write a version byte so we can iterate on version at some point
-        n, err = dst.Write([]byte{planFormatVersion})
-        if err != nil {
-                return err
-        }
-        if n != 1 {
-                return errors.New("failed to write plan version byte")
-        }
-
-        return gob.NewEncoder(dst).Encode(d)
+        return fmt.Errorf("terraform.WritePlan is no longer in use; use planfile.Create instead")
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/provider_mock.go b/vendor/github.com/hashicorp/terraform/terraform/provider_mock.go
new file mode 100644
index 0000000..4ae346d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/provider_mock.go
@@ -0,0 +1,522 @@
+package terraform
+
+import (
+        "encoding/json"
+        "fmt"
+        "sync"
+
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+var _ providers.Interface = (*MockProvider)(nil)
+
+// MockProvider implements providers.Interface but mocks out all the
+// calls for testing purposes.
+type MockProvider struct {
+        sync.Mutex
+
+        // Anything you want, in case you need to store extra data with the mock.
+        Meta interface{}
+
+        GetSchemaCalled bool
+        GetSchemaReturn *ProviderSchema // This is using ProviderSchema directly rather than providers.GetSchemaResponse for compatibility with old tests
+
+        PrepareProviderConfigCalled   bool
+        PrepareProviderConfigResponse providers.PrepareProviderConfigResponse
+        PrepareProviderConfigRequest  providers.PrepareProviderConfigRequest
+        PrepareProviderConfigFn       func(providers.PrepareProviderConfigRequest) providers.PrepareProviderConfigResponse
+
+        ValidateResourceTypeConfigCalled   bool
+        ValidateResourceTypeConfigTypeName string
+        ValidateResourceTypeConfigResponse providers.ValidateResourceTypeConfigResponse
+        ValidateResourceTypeConfigRequest  providers.ValidateResourceTypeConfigRequest
+        ValidateResourceTypeConfigFn       func(providers.ValidateResourceTypeConfigRequest) providers.ValidateResourceTypeConfigResponse
+
+        ValidateDataSourceConfigCalled   bool
+        ValidateDataSourceConfigTypeName string
+        ValidateDataSourceConfigResponse providers.ValidateDataSourceConfigResponse
+        ValidateDataSourceConfigRequest  providers.ValidateDataSourceConfigRequest
+        ValidateDataSourceConfigFn       func(providers.ValidateDataSourceConfigRequest) providers.ValidateDataSourceConfigResponse
+
+        UpgradeResourceStateCalled   bool
+        UpgradeResourceStateTypeName string
+        UpgradeResourceStateResponse providers.UpgradeResourceStateResponse
+        UpgradeResourceStateRequest  providers.UpgradeResourceStateRequest
+        UpgradeResourceStateFn       func(providers.UpgradeResourceStateRequest) providers.UpgradeResourceStateResponse
+
+        ConfigureCalled   bool
+        ConfigureResponse providers.ConfigureResponse
+        ConfigureRequest  providers.ConfigureRequest
+        ConfigureNewFn    func(providers.ConfigureRequest) providers.ConfigureResponse // Named ConfigureNewFn so we can still have the legacy ConfigureFn declared below
+
+        StopCalled   bool
+        StopFn       func() error
+        StopResponse error
+
+        ReadResourceCalled   bool
+        ReadResourceResponse providers.ReadResourceResponse
+        ReadResourceRequest  providers.ReadResourceRequest
+        ReadResourceFn       func(providers.ReadResourceRequest) providers.ReadResourceResponse
+
+        PlanResourceChangeCalled   bool
+        PlanResourceChangeResponse providers.PlanResourceChangeResponse
+        PlanResourceChangeRequest  providers.PlanResourceChangeRequest
+        PlanResourceChangeFn       func(providers.PlanResourceChangeRequest) providers.PlanResourceChangeResponse
+
+        ApplyResourceChangeCalled   bool
+        ApplyResourceChangeResponse providers.ApplyResourceChangeResponse
+        ApplyResourceChangeRequest  providers.ApplyResourceChangeRequest
+        ApplyResourceChangeFn       func(providers.ApplyResourceChangeRequest) providers.ApplyResourceChangeResponse
+
+        ImportResourceStateCalled   bool
+        ImportResourceStateResponse providers.ImportResourceStateResponse
+        ImportResourceStateRequest  providers.ImportResourceStateRequest
+        ImportResourceStateFn       func(providers.ImportResourceStateRequest) providers.ImportResourceStateResponse
+        // Legacy return type for existing tests, which will be shimmed into an
+        // ImportResourceStateResponse if set
+        ImportStateReturn []*InstanceState
+
+        ReadDataSourceCalled   bool
+        ReadDataSourceResponse providers.ReadDataSourceResponse
+        ReadDataSourceRequest  providers.ReadDataSourceRequest
+        ReadDataSourceFn       func(providers.ReadDataSourceRequest) providers.ReadDataSourceResponse
+
+        CloseCalled bool
+        CloseError  error
+
+        // Legacy callbacks: if these are set, we will shim incoming calls for
+        // new-style methods to these old-fashioned terraform.ResourceProvider
+        // mock callbacks, for the benefit of older tests that were written against
+        // the old mock API.
+        ValidateFn  func(c *ResourceConfig) (ws []string, es []error)
+        ConfigureFn func(c *ResourceConfig) error
+        DiffFn      func(info *InstanceInfo, s *InstanceState, c *ResourceConfig) (*InstanceDiff, error)
+        ApplyFn     func(info *InstanceInfo, s *InstanceState, d *InstanceDiff) (*InstanceState, error)
+}
+
+func (p *MockProvider) GetSchema() providers.GetSchemaResponse {
+        p.Lock()
+        defer p.Unlock()
+        p.GetSchemaCalled = true
+        return p.getSchema()
+}
+
+func (p *MockProvider) getSchema() providers.GetSchemaResponse {
+        // This version of getSchema doesn't do any locking, so it's suitable to
+        // call from other methods of this mock as long as they are already
+        // holding the lock.
+
+        ret := providers.GetSchemaResponse{
+                Provider:      providers.Schema{},
+                DataSources:   map[string]providers.Schema{},
+                ResourceTypes: map[string]providers.Schema{},
+        }
+        if p.GetSchemaReturn != nil {
+                ret.Provider.Block = p.GetSchemaReturn.Provider
+                for n, s := range p.GetSchemaReturn.DataSources {
+                        ret.DataSources[n] = providers.Schema{
+                                Block: s,
+                        }
+                }
+                for n, s := range p.GetSchemaReturn.ResourceTypes {
+                        ret.ResourceTypes[n] = providers.Schema{
+                                Version: int64(p.GetSchemaReturn.ResourceTypeSchemaVersions[n]),
+                                Block:   s,
+                        }
+                }
+        }
+
+        return ret
+}
+
+func (p *MockProvider) PrepareProviderConfig(r providers.PrepareProviderConfigRequest) providers.PrepareProviderConfigResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.PrepareProviderConfigCalled = true
+        p.PrepareProviderConfigRequest = r
+        if p.PrepareProviderConfigFn != nil {
+                return p.PrepareProviderConfigFn(r)
+        }
+        return p.PrepareProviderConfigResponse
+}
+
+func (p *MockProvider) ValidateResourceTypeConfig(r providers.ValidateResourceTypeConfigRequest) providers.ValidateResourceTypeConfigResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ValidateResourceTypeConfigCalled = true
+        p.ValidateResourceTypeConfigRequest = r
+
+        if p.ValidateFn != nil {
+                resp := p.getSchema()
+                schema := resp.Provider.Block
+                rc := NewResourceConfigShimmed(r.Config, schema)
+                warns, errs := p.ValidateFn(rc)
+                ret := providers.ValidateResourceTypeConfigResponse{}
+                for _, warn := range warns {
+                        ret.Diagnostics = ret.Diagnostics.Append(tfdiags.SimpleWarning(warn))
+                }
+                for _, err := range errs {
+                        ret.Diagnostics = ret.Diagnostics.Append(err)
+                }
+        }
+        if p.ValidateResourceTypeConfigFn != nil {
+                return p.ValidateResourceTypeConfigFn(r)
+        }
+
+        return p.ValidateResourceTypeConfigResponse
+}
+
+func (p *MockProvider) ValidateDataSourceConfig(r providers.ValidateDataSourceConfigRequest) providers.ValidateDataSourceConfigResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ValidateDataSourceConfigCalled = true
+        p.ValidateDataSourceConfigRequest = r
+
+        if p.ValidateDataSourceConfigFn != nil {
+                return p.ValidateDataSourceConfigFn(r)
+        }
+
+        return p.ValidateDataSourceConfigResponse
+}
+
+func (p *MockProvider) UpgradeResourceState(r providers.UpgradeResourceStateRequest) providers.UpgradeResourceStateResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        schemas := p.getSchema()
+        schema := schemas.ResourceTypes[r.TypeName]
+        schemaType := schema.Block.ImpliedType()
+
+        p.UpgradeResourceStateCalled = true
+        p.UpgradeResourceStateRequest = r
+
+        if p.UpgradeResourceStateFn != nil {
+                return p.UpgradeResourceStateFn(r)
+        }
+
+        resp := p.UpgradeResourceStateResponse
+
+        if resp.UpgradedState == cty.NilVal {
+                switch {
+                case r.RawStateFlatmap != nil:
+                        v, err := hcl2shim.HCL2ValueFromFlatmap(r.RawStateFlatmap, schemaType)
+                        if err != nil {
+                                resp.Diagnostics = resp.Diagnostics.Append(err)
+                                return resp
+                        }
+                        resp.UpgradedState = v
+                case len(r.RawStateJSON) > 0:
+                        v, err := ctyjson.Unmarshal(r.RawStateJSON, schemaType)
+
+                        if err != nil {
+                                resp.Diagnostics = resp.Diagnostics.Append(err)
+                                return resp
+                        }
+                        resp.UpgradedState = v
+                }
+        }
+        return resp
+}
+
+func (p *MockProvider) Configure(r providers.ConfigureRequest) providers.ConfigureResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ConfigureCalled = true
+        p.ConfigureRequest = r
+
+        if p.ConfigureFn != nil {
+                resp := p.getSchema()
+                schema := resp.Provider.Block
+                rc := NewResourceConfigShimmed(r.Config, schema)
+                ret := providers.ConfigureResponse{}
+
+                err := p.ConfigureFn(rc)
+                if err != nil {
+                        ret.Diagnostics = ret.Diagnostics.Append(err)
+                }
+                return ret
+        }
+        if p.ConfigureNewFn != nil {
+                return p.ConfigureNewFn(r)
+        }
+
+        return p.ConfigureResponse
+}
+
+func (p *MockProvider) Stop() error {
+        // We intentionally don't lock in this one because the whole point of this
+        // method is to be called concurrently with another operation that can
+        // be cancelled.  The provider itself is responsible for handling
+        // any concurrency concerns in this case.
+
+        p.StopCalled = true
+        if p.StopFn != nil {
+                return p.StopFn()
+        }
+
+        return p.StopResponse
+}
+
+func (p *MockProvider) ReadResource(r providers.ReadResourceRequest) providers.ReadResourceResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ReadResourceCalled = true
+        p.ReadResourceRequest = r
+
+        if p.ReadResourceFn != nil {
+                return p.ReadResourceFn(r)
+        }
+
+        // make sure the NewState fits the schema
+        newState, err := p.GetSchemaReturn.ResourceTypes[r.TypeName].CoerceValue(p.ReadResourceResponse.NewState)
+        if err != nil {
+                panic(err)
+        }
+        resp := p.ReadResourceResponse
+        resp.NewState = newState
+
+        return resp
+}
+
+func (p *MockProvider) PlanResourceChange(r providers.PlanResourceChangeRequest) providers.PlanResourceChangeResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.PlanResourceChangeCalled = true
+        p.PlanResourceChangeRequest = r
+
+        if p.DiffFn != nil {
+                ps := p.getSchema()
+                if ps.ResourceTypes == nil || ps.ResourceTypes[r.TypeName].Block == nil {
+                        return providers.PlanResourceChangeResponse{
+                                Diagnostics: tfdiags.Diagnostics(nil).Append(fmt.Printf("mock provider has no schema for resource type %s", r.TypeName)),
+                        }
+                }
+                schema := ps.ResourceTypes[r.TypeName].Block
+                info := &InstanceInfo{
+                        Type: r.TypeName,
+                }
+                priorState := NewInstanceStateShimmedFromValue(r.PriorState, 0)
+                cfg := NewResourceConfigShimmed(r.Config, schema)
+
+                legacyDiff, err := p.DiffFn(info, priorState, cfg)
+
+                var res providers.PlanResourceChangeResponse
+                res.PlannedState = r.ProposedNewState
+                if err != nil {
+                        res.Diagnostics = res.Diagnostics.Append(err)
+                }
+                if legacyDiff != nil {
+                        newVal, err := legacyDiff.ApplyToValue(r.PriorState, schema)
+                        if err != nil {
+                                res.Diagnostics = res.Diagnostics.Append(err)
+                        }
+
+                        res.PlannedState = newVal
+
+                        var requiresNew []string
+                        for attr, d := range legacyDiff.Attributes {
+                                if d.RequiresNew {
+                                        requiresNew = append(requiresNew, attr)
+                                }
+                        }
+                        requiresReplace, err := hcl2shim.RequiresReplace(requiresNew, schema.ImpliedType())
+                        if err != nil {
+                                res.Diagnostics = res.Diagnostics.Append(err)
+                        }
+                        res.RequiresReplace = requiresReplace
+                }
+                return res
+        }
+        if p.PlanResourceChangeFn != nil {
+                return p.PlanResourceChangeFn(r)
+        }
+
+        return p.PlanResourceChangeResponse
+}
+
+func (p *MockProvider) ApplyResourceChange(r providers.ApplyResourceChangeRequest) providers.ApplyResourceChangeResponse {
+        p.Lock()
+        p.ApplyResourceChangeCalled = true
+        p.ApplyResourceChangeRequest = r
+        p.Unlock()
+
+        if p.ApplyFn != nil {
+                // ApplyFn is a special callback fashioned after our old provider
+                // interface, which expected to be given an actual diff rather than
+                // separate old/new values to apply. Therefore we need to approximate
+                // a diff here well enough that _most_ of our legacy ApplyFns in old
+                // tests still see the behavior they are expecting. New tests should
+                // not use this, and should instead use ApplyResourceChangeFn directly.
+                providerSchema := p.getSchema()
+                schema, ok := providerSchema.ResourceTypes[r.TypeName]
+                if !ok {
+                        return providers.ApplyResourceChangeResponse{
+                                Diagnostics: tfdiags.Diagnostics(nil).Append(fmt.Errorf("no mocked schema available for resource type %s", r.TypeName)),
+                        }
+                }
+
+                info := &InstanceInfo{
+                        Type: r.TypeName,
+                }
+
+                priorVal := r.PriorState
+                plannedVal := r.PlannedState
+                priorMap := hcl2shim.FlatmapValueFromHCL2(priorVal)
+                plannedMap := hcl2shim.FlatmapValueFromHCL2(plannedVal)
+                s := NewInstanceStateShimmedFromValue(priorVal, 0)
+                d := &InstanceDiff{
+                        Attributes: make(map[string]*ResourceAttrDiff),
+                }
+                if plannedMap == nil { // destroying, then
+                        d.Destroy = true
+                        // Destroy diffs don't have any attribute diffs
+                } else {
+                        if priorMap == nil { // creating, then
+                                // We'll just make an empty prior map to make things easier below.
+                                priorMap = make(map[string]string)
+                        }
+
+                        for k, new := range plannedMap {
+                                old := priorMap[k]
+                                newComputed := false
+                                if new == config.UnknownVariableValue {
+                                        new = ""
+                                        newComputed = true
+                                }
+                                d.Attributes[k] = &ResourceAttrDiff{
+                                        Old:         old,
+                                        New:         new,
+                                        NewComputed: newComputed,
+                                        Type:        DiffAttrInput, // not generally used in tests, so just hard-coded
+                                }
+                        }
+                        // Also need any attributes that were removed in "planned"
+                        for k, old := range priorMap {
+                                if _, ok := plannedMap[k]; ok {
+                                        continue
+                                }
+                                d.Attributes[k] = &ResourceAttrDiff{
+                                        Old:        old,
+                                        NewRemoved: true,
+                                        Type:       DiffAttrInput,
+                                }
+                        }
+                }
+                newState, err := p.ApplyFn(info, s, d)
+                resp := providers.ApplyResourceChangeResponse{}
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                }
+                if newState != nil {
+                        var newVal cty.Value
+                        if newState != nil {
+                                var err error
+                                newVal, err = newState.AttrsAsObjectValue(schema.Block.ImpliedType())
+                                if err != nil {
+                                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                                }
+                        } else {
+                                // If apply returned a nil new state then that's the old way to
+                                // indicate that the object was destroyed. Our new interface calls
+                                // for that to be signalled as a null value.
+                                newVal = cty.NullVal(schema.Block.ImpliedType())
+                        }
+                        resp.NewState = newVal
+                }
+
+                return resp
+        }
+        if p.ApplyResourceChangeFn != nil {
+                return p.ApplyResourceChangeFn(r)
+        }
+
+        return p.ApplyResourceChangeResponse
+}
+
+func (p *MockProvider) ImportResourceState(r providers.ImportResourceStateRequest) providers.ImportResourceStateResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        if p.ImportStateReturn != nil {
+                for _, is := range p.ImportStateReturn {
+                        if is.Attributes == nil {
+                                is.Attributes = make(map[string]string)
+                        }
+                        is.Attributes["id"] = is.ID
+
+                        typeName := is.Ephemeral.Type
+                        // Use the requested type if the resource has no type of it's own.
+                        // We still return the empty type, which will error, but this prevents a panic.
+                        if typeName == "" {
+                                typeName = r.TypeName
+                        }
+
+                        schema := p.GetSchemaReturn.ResourceTypes[typeName]
+                        if schema == nil {
+                                panic("no schema found for " + typeName)
+                        }
+
+                        private, err := json.Marshal(is.Meta)
+                        if err != nil {
+                                panic(err)
+                        }
+
+                        state, err := hcl2shim.HCL2ValueFromFlatmap(is.Attributes, schema.ImpliedType())
+                        if err != nil {
+                                panic(err)
+                        }
+
+                        state, err = schema.CoerceValue(state)
+                        if err != nil {
+                                panic(err)
+                        }
+
+                        p.ImportResourceStateResponse.ImportedResources = append(
+                                p.ImportResourceStateResponse.ImportedResources,
+                                providers.ImportedResource{
+                                        TypeName: is.Ephemeral.Type,
+                                        State:    state,
+                                        Private:  private,
+                                })
+                }
+        }
+
+        p.ImportResourceStateCalled = true
+        p.ImportResourceStateRequest = r
+        if p.ImportResourceStateFn != nil {
+                return p.ImportResourceStateFn(r)
+        }
+
+        return p.ImportResourceStateResponse
+}
+
+func (p *MockProvider) ReadDataSource(r providers.ReadDataSourceRequest) providers.ReadDataSourceResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ReadDataSourceCalled = true
+        p.ReadDataSourceRequest = r
+
+        if p.ReadDataSourceFn != nil {
+                return p.ReadDataSourceFn(r)
+        }
+
+        return p.ReadDataSourceResponse
+}
+
+func (p *MockProvider) Close() error {
+        p.CloseCalled = true
+        return p.CloseError
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/provisioner_mock.go b/vendor/github.com/hashicorp/terraform/terraform/provisioner_mock.go
new file mode 100644
index 0000000..f595891
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/provisioner_mock.go
@@ -0,0 +1,154 @@
+package terraform
+
+import (
+        "fmt"
+        "sync"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+
+        "github.com/hashicorp/terraform/provisioners"
+)
+
+var _ provisioners.Interface = (*MockProvisioner)(nil)
+
+// MockProvisioner implements provisioners.Interface but mocks out all the
+// calls for testing purposes.
+type MockProvisioner struct {
+        sync.Mutex
+        // Anything you want, in case you need to store extra data with the mock.
+        Meta interface{}
+
+        GetSchemaCalled   bool
+        GetSchemaResponse provisioners.GetSchemaResponse
+
+        ValidateProvisionerConfigCalled   bool
+        ValidateProvisionerConfigRequest  provisioners.ValidateProvisionerConfigRequest
+        ValidateProvisionerConfigResponse provisioners.ValidateProvisionerConfigResponse
+        ValidateProvisionerConfigFn       func(provisioners.ValidateProvisionerConfigRequest) provisioners.ValidateProvisionerConfigResponse
+
+        ProvisionResourceCalled   bool
+        ProvisionResourceRequest  provisioners.ProvisionResourceRequest
+        ProvisionResourceResponse provisioners.ProvisionResourceResponse
+        ProvisionResourceFn       func(provisioners.ProvisionResourceRequest) provisioners.ProvisionResourceResponse
+
+        StopCalled   bool
+        StopResponse error
+        StopFn       func() error
+
+        CloseCalled   bool
+        CloseResponse error
+        CloseFn       func() error
+
+        // Legacy callbacks: if these are set, we will shim incoming calls for
+        // new-style methods to these old-fashioned terraform.ResourceProvider
+        // mock callbacks, for the benefit of older tests that were written against
+        // the old mock API.
+        ApplyFn func(rs *InstanceState, c *ResourceConfig) error
+}
+
+func (p *MockProvisioner) GetSchema() provisioners.GetSchemaResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.GetSchemaCalled = true
+        return p.getSchema()
+}
+
+// getSchema is the implementation of GetSchema, which can be called from other
+// methods on MockProvisioner that may already be holding the lock.
+func (p *MockProvisioner) getSchema() provisioners.GetSchemaResponse {
+        return p.GetSchemaResponse
+}
+
+func (p *MockProvisioner) ValidateProvisionerConfig(r provisioners.ValidateProvisionerConfigRequest) provisioners.ValidateProvisionerConfigResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ValidateProvisionerConfigCalled = true
+        p.ValidateProvisionerConfigRequest = r
+        if p.ValidateProvisionerConfigFn != nil {
+                return p.ValidateProvisionerConfigFn(r)
+        }
+        return p.ValidateProvisionerConfigResponse
+}
+
+func (p *MockProvisioner) ProvisionResource(r provisioners.ProvisionResourceRequest) provisioners.ProvisionResourceResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ProvisionResourceCalled = true
+        p.ProvisionResourceRequest = r
+        if p.ApplyFn != nil {
+                if !r.Config.IsKnown() {
+                        panic(fmt.Sprintf("cannot provision with unknown value: %#v", r.Config))
+                }
+
+                schema := p.getSchema()
+                rc := NewResourceConfigShimmed(r.Config, schema.Provisioner)
+                connVal := r.Connection
+                connMap := map[string]string{}
+
+                if !connVal.IsNull() && connVal.IsKnown() {
+                        for it := connVal.ElementIterator(); it.Next(); {
+                                ak, av := it.Element()
+                                name := ak.AsString()
+
+                                if !av.IsKnown() || av.IsNull() {
+                                        continue
+                                }
+
+                                av, _ = convert.Convert(av, cty.String)
+                                connMap[name] = av.AsString()
+                        }
+                }
+
+                // We no longer pass the full instance state to a provisioner, so we'll
+                // construct a partial one that should be good enough for what existing
+                // test mocks need.
+                is := &InstanceState{
+                        Ephemeral: EphemeralState{
+                                ConnInfo: connMap,
+                        },
+                }
+                var resp provisioners.ProvisionResourceResponse
+                err := p.ApplyFn(is, rc)
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                }
+                return resp
+        }
+        if p.ProvisionResourceFn != nil {
+                fn := p.ProvisionResourceFn
+                p.Unlock()
+                return fn(r)
+        }
+
+        return p.ProvisionResourceResponse
+}
+
+func (p *MockProvisioner) Stop() error {
+        // We intentionally don't lock in this one because the whole point of this
+        // method is to be called concurrently with another operation that can
+        // be cancelled. The provisioner itself is responsible for handling
+        // any concurrency concerns in this case.
+
+        p.StopCalled = true
+        if p.StopFn != nil {
+                return p.StopFn()
+        }
+
+        return p.StopResponse
+}
+
+func (p *MockProvisioner) Close() error {
+        p.Lock()
+        defer p.Unlock()
+
+        p.CloseCalled = true
+        if p.CloseFn != nil {
+                return p.CloseFn()
+        }
+
+        return p.CloseResponse
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource.go b/vendor/github.com/hashicorp/terraform/terraform/resource.go
index 2f5ebb5..2cd6c5b 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource.go
@@ -7,9 +7,14 @@ import (
         "strconv"
         "strings"
 
-        "github.com/hashicorp/terraform/config"
         "github.com/mitchellh/copystructure"
         "github.com/mitchellh/reflectwalk"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/configs/configschema"
 )
 
 // ResourceProvisionerConfig is used to pair a provisioner
@@ -25,9 +30,10 @@ type ResourceProvisionerConfig struct {
         ConnInfo    *config.RawConfig
 }
 
-// Resource encapsulates a resource, its configuration, its provider,
-// its current state, and potentially a desired diff from the state it
-// wants to reach.
+// Resource is a legacy way to identify a particular resource instance.
+//
+// New code should use addrs.ResourceInstance instead. This is still here
+// only for codepaths that haven't been updated yet.
 type Resource struct {
         // These are all used by the new EvalNode stuff.
         Name       string
@@ -47,6 +53,31 @@ type Resource struct {
         Flags        ResourceFlag
 }
 
+// NewResource constructs a legacy Resource object from an
+// addrs.ResourceInstance value.
+//
+// This is provided to shim to old codepaths that haven't been updated away
+// from this type yet. Since this old type is not able to represent instances
+// that have string keys, this function will panic if given a resource address
+// that has a string key.
+func NewResource(addr addrs.ResourceInstance) *Resource {
+        ret := &Resource{
+                Name: addr.Resource.Name,
+                Type: addr.Resource.Type,
+        }
+
+        if addr.Key != addrs.NoKey {
+                switch tk := addr.Key.(type) {
+                case addrs.IntKey:
+                        ret.CountIndex = int(tk)
+                default:
+                        panic(fmt.Errorf("resource instance with key %#v is not supported", addr.Key))
+                }
+        }
+
+        return ret
+}
+
 // ResourceKind specifies what kind of instance we're working with, whether
 // its a primary instance, a tainted instance, or an orphan.
 type ResourceFlag byte
@@ -72,20 +103,53 @@ type InstanceInfo struct {
         uniqueExtra string
 }
 
-// HumanId is a unique Id that is human-friendly and useful for UI elements.
-func (i *InstanceInfo) HumanId() string {
-        if i == nil {
-                return "<nil>"
+// NewInstanceInfo constructs an InstanceInfo from an addrs.AbsResourceInstance.
+//
+// InstanceInfo is a legacy type, and uses of it should be gradually replaced
+// by direct use of addrs.AbsResource or addrs.AbsResourceInstance as
+// appropriate.
+//
+// The legacy InstanceInfo type cannot represent module instances with instance
+// keys, so this function will panic if given such a path. Uses of this type
+// should all be removed or replaced before implementing "count" and "for_each"
+// arguments on modules in order to avoid such panics.
+//
+// This legacy type also cannot represent resource instances with string
+// instance keys. It will panic if the given key is not either NoKey or an
+// IntKey.
+func NewInstanceInfo(addr addrs.AbsResourceInstance) *InstanceInfo {
+        // We need an old-style []string module path for InstanceInfo.
+        path := make([]string, len(addr.Module))
+        for i, step := range addr.Module {
+                if step.InstanceKey != addrs.NoKey {
+                        panic("NewInstanceInfo cannot convert module instance with key")
+                }
+                path[i] = step.Name
         }
 
-        if len(i.ModulePath) <= 1 {
-                return i.Id
+        // This is a funny old meaning of "id" that is no longer current. It should
+        // not be used for anything users might see. Note that it does not include
+        // a representation of the resource mode, and so it's impossible to
+        // determine from an InstanceInfo alone whether it is a managed or data
+        // resource that is being referred to.
+        id := fmt.Sprintf("%s.%s", addr.Resource.Resource.Type, addr.Resource.Resource.Name)
+        if addr.Resource.Resource.Mode == addrs.DataResourceMode {
+                id = "data." + id
+        }
+        if addr.Resource.Key != addrs.NoKey {
+                switch k := addr.Resource.Key.(type) {
+                case addrs.IntKey:
+                        id = id + fmt.Sprintf(".%d", int(k))
+                default:
+                        panic(fmt.Sprintf("NewInstanceInfo cannot convert resource instance with %T instance key", addr.Resource.Key))
+                }
         }
 
-        return fmt.Sprintf(
-                "module.%s.%s",
-                strings.Join(i.ModulePath[1:], "."),
-                i.Id)
+        return &InstanceInfo{
+                Id:         id,
+                ModulePath: path,
+                Type:       addr.Resource.Resource.Type,
+        }
 }
 
 // ResourceAddress returns the address of the resource that the receiver is describing.
@@ -128,18 +192,9 @@ func (i *InstanceInfo) ResourceAddress() *ResourceAddress {
         return addr
 }
 
-func (i *InstanceInfo) uniqueId() string {
-        prefix := i.HumanId()
-        if v := i.uniqueExtra; v != "" {
-                prefix += " " + v
-        }
-
-        return prefix
-}
-
-// ResourceConfig holds the configuration given for a resource. This is
-// done instead of a raw `map[string]interface{}` type so that rich
-// methods can be added to it to make dealing with it easier.
+// ResourceConfig is a legacy type that was formerly used to represent
+// interpolatable configuration blocks. It is now only used to shim to old
+// APIs that still use this type, via NewResourceConfigShimmed.
 type ResourceConfig struct {
         ComputedKeys []string
         Raw          map[string]interface{}
@@ -155,6 +210,85 @@ func NewResourceConfig(c *config.RawConfig) *ResourceConfig {
         return result
 }
 
+// NewResourceConfigShimmed wraps a cty.Value of object type in a legacy
+// ResourceConfig object, so that it can be passed to older APIs that expect
+// this wrapping.
+//
+// The returned ResourceConfig is already interpolated and cannot be
+// re-interpolated. It is, therefore, useful only to functions that expect
+// an already-populated ResourceConfig which they then treat as read-only.
+//
+// If the given value is not of an object type that conforms to the given
+// schema then this function will panic.
+func NewResourceConfigShimmed(val cty.Value, schema *configschema.Block) *ResourceConfig {
+        if !val.Type().IsObjectType() {
+                panic(fmt.Errorf("NewResourceConfigShimmed given %#v; an object type is required", val.Type()))
+        }
+        ret := &ResourceConfig{}
+
+        legacyVal := hcl2shim.ConfigValueFromHCL2Block(val, schema)
+        if legacyVal != nil {
+                ret.Config = legacyVal
+
+                // Now we need to walk through our structure and find any unknown values,
+                // producing the separate list ComputedKeys to represent these. We use the
+                // schema here so that we can preserve the expected invariant
+                // that an attribute is always either wholly known or wholly unknown, while
+                // a child block can be partially unknown.
+                ret.ComputedKeys = newResourceConfigShimmedComputedKeys(val, "")
+        } else {
+                ret.Config = make(map[string]interface{})
+        }
+        ret.Raw = ret.Config
+
+        return ret
+}
+
+// Record the any config values in ComputedKeys. This field had been unused in
+// helper/schema, but in the new protocol we're using this so that the SDK can
+// now handle having an unknown collection. The legacy diff code doesn't
+// properly handle the unknown, because it can't be expressed in the same way
+// between the config and diff.
+func newResourceConfigShimmedComputedKeys(val cty.Value, path string) []string {
+        var ret []string
+        ty := val.Type()
+
+        if val.IsNull() {
+                return ret
+        }
+
+        if !val.IsKnown() {
+                // we shouldn't have an entirely unknown resource, but prevent empty
+                // strings just in case
+                if len(path) > 0 {
+                        ret = append(ret, path)
+                }
+                return ret
+        }
+
+        if path != "" {
+                path += "."
+        }
+        switch {
+        case ty.IsListType(), ty.IsTupleType(), ty.IsSetType():
+                i := 0
+                for it := val.ElementIterator(); it.Next(); i++ {
+                        _, subVal := it.Element()
+                        keys := newResourceConfigShimmedComputedKeys(subVal, fmt.Sprintf("%s%d", path, i))
+                        ret = append(ret, keys...)
+                }
+
+        case ty.IsMapType(), ty.IsObjectType():
+                for it := val.ElementIterator(); it.Next(); {
+                        subK, subVal := it.Element()
+                        keys := newResourceConfigShimmedComputedKeys(subVal, fmt.Sprintf("%s%s", path, subK.AsString()))
+                        ret = append(ret, keys...)
+                }
+        }
+
+        return ret
+}
+
 // DeepCopy performs a deep copy of the configuration. This makes it safe
 // to modify any of the structures that are part of the resource config without
 // affecting the original configuration.
@@ -374,6 +508,14 @@ func (c *ResourceConfig) get(
 // refactor is complete.
 func (c *ResourceConfig) interpolateForce() {
         if c.raw == nil {
+                // If we don't have a lowercase "raw" but we _do_ have the uppercase
+                // Raw populated then this indicates that we're recieving a shim
+                // ResourceConfig created by NewResourceConfigShimmed, which is already
+                // fully evaluated and thus this function doesn't need to do anything.
+                if c.Raw != nil {
+                        return
+                }
+
                 var err error
                 c.raw, err = config.NewRawConfig(make(map[string]interface{}))
                 if err != nil {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_address.go b/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
index a64f5d8..156ecf5 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
@@ -7,8 +7,10 @@ import (
         "strconv"
         "strings"
 
+        "github.com/hashicorp/terraform/addrs"
+
         "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
 )
 
 // ResourceAddress is a way of identifying an individual resource (or,
@@ -109,30 +111,47 @@ func (r *ResourceAddress) WholeModuleAddress() *ResourceAddress {
         }
 }
 
-// MatchesConfig returns true if the receiver matches the given
-// configuration resource within the given configuration module.
+// MatchesResourceConfig returns true if the receiver matches the given
+// configuration resource within the given _static_ module path. Note that
+// the module path in a resource address is a _dynamic_ module path, and
+// multiple dynamic resource paths may map to a single static path if
+// count and for_each are in use on module calls.
 //
 // Since resource configuration blocks represent all of the instances of
 // a multi-instance resource, the index of the address (if any) is not
 // considered.
-func (r *ResourceAddress) MatchesConfig(mod *module.Tree, rc *config.Resource) bool {
+func (r *ResourceAddress) MatchesResourceConfig(path addrs.Module, rc *configs.Resource) bool {
         if r.HasResourceSpec() {
-                if r.Mode != rc.Mode || r.Type != rc.Type || r.Name != rc.Name {
+                // FIXME: Some ugliness while we are between worlds. Functionality
+                // in "addrs" should eventually replace this ResourceAddress idea
+                // completely, but for now we'll need to translate to the old
+                // way of representing resource modes.
+                switch r.Mode {
+                case config.ManagedResourceMode:
+                        if rc.Mode != addrs.ManagedResourceMode {
+                                return false
+                        }
+                case config.DataResourceMode:
+                        if rc.Mode != addrs.DataResourceMode {
+                                return false
+                        }
+                }
+                if r.Type != rc.Type || r.Name != rc.Name {
                         return false
                 }
         }
 
         addrPath := r.Path
-        cfgPath := mod.Path()
 
         // normalize
         if len(addrPath) == 0 {
                 addrPath = nil
         }
-        if len(cfgPath) == 0 {
-                cfgPath = nil
+        if len(path) == 0 {
+                path = nil
         }
-        return reflect.DeepEqual(addrPath, cfgPath)
+        rawPath := []string(path)
+        return reflect.DeepEqual(addrPath, rawPath)
 }
 
 // stateId returns the ID that this resource should be entered with
@@ -270,6 +289,144 @@ func ParseResourceAddressForInstanceDiff(path []string, key string) (*ResourceAd
         return addr, nil
 }
 
+// NewLegacyResourceAddress creates a ResourceAddress from a new-style
+// addrs.AbsResource value.
+//
+// This is provided for shimming purposes so that we can still easily call into
+// older functions that expect the ResourceAddress type.
+func NewLegacyResourceAddress(addr addrs.AbsResource) *ResourceAddress {
+        ret := &ResourceAddress{
+                Type: addr.Resource.Type,
+                Name: addr.Resource.Name,
+        }
+
+        switch addr.Resource.Mode {
+        case addrs.ManagedResourceMode:
+                ret.Mode = config.ManagedResourceMode
+        case addrs.DataResourceMode:
+                ret.Mode = config.DataResourceMode
+        default:
+                panic(fmt.Errorf("cannot shim %s to legacy config.ResourceMode value", addr.Resource.Mode))
+        }
+
+        path := make([]string, len(addr.Module))
+        for i, step := range addr.Module {
+                if step.InstanceKey != addrs.NoKey {
+                        // At the time of writing this can't happen because we don't
+                        // ket generate keyed module instances. This legacy codepath must
+                        // be removed before we can support "count" and "for_each" for
+                        // modules.
+                        panic(fmt.Errorf("cannot shim module instance step with key %#v to legacy ResourceAddress.Path", step.InstanceKey))
+                }
+
+                path[i] = step.Name
+        }
+        ret.Path = path
+        ret.Index = -1
+
+        return ret
+}
+
+// NewLegacyResourceInstanceAddress creates a ResourceAddress from a new-style
+// addrs.AbsResource value.
+//
+// This is provided for shimming purposes so that we can still easily call into
+// older functions that expect the ResourceAddress type.
+func NewLegacyResourceInstanceAddress(addr addrs.AbsResourceInstance) *ResourceAddress {
+        ret := &ResourceAddress{
+                Type: addr.Resource.Resource.Type,
+                Name: addr.Resource.Resource.Name,
+        }
+
+        switch addr.Resource.Resource.Mode {
+        case addrs.ManagedResourceMode:
+                ret.Mode = config.ManagedResourceMode
+        case addrs.DataResourceMode:
+                ret.Mode = config.DataResourceMode
+        default:
+                panic(fmt.Errorf("cannot shim %s to legacy config.ResourceMode value", addr.Resource.Resource.Mode))
+        }
+
+        path := make([]string, len(addr.Module))
+        for i, step := range addr.Module {
+                if step.InstanceKey != addrs.NoKey {
+                        // At the time of writing this can't happen because we don't
+                        // ket generate keyed module instances. This legacy codepath must
+                        // be removed before we can support "count" and "for_each" for
+                        // modules.
+                        panic(fmt.Errorf("cannot shim module instance step with key %#v to legacy ResourceAddress.Path", step.InstanceKey))
+                }
+
+                path[i] = step.Name
+        }
+        ret.Path = path
+
+        if addr.Resource.Key == addrs.NoKey {
+                ret.Index = -1
+        } else if ik, ok := addr.Resource.Key.(addrs.IntKey); ok {
+                ret.Index = int(ik)
+        } else {
+                panic(fmt.Errorf("cannot shim resource instance with key %#v to legacy ResourceAddress.Index", addr.Resource.Key))
+        }
+
+        return ret
+}
+
+// AbsResourceInstanceAddr converts the receiver, a legacy resource address, to
+// the new resource address type addrs.AbsResourceInstance.
+//
+// This method can be used only on an address that has a resource specification.
+// It will panic if called on a module-path-only ResourceAddress. Use
+// method HasResourceSpec to check before calling, in contexts where it is
+// unclear.
+//
+// addrs.AbsResourceInstance does not represent the "tainted" and "deposed"
+// states, and so if these are present on the receiver then they are discarded.
+//
+// This is provided for shimming purposes so that we can easily adapt functions
+// that are returning the legacy ResourceAddress type, for situations where
+// the new type is required.
+func (addr *ResourceAddress) AbsResourceInstanceAddr() addrs.AbsResourceInstance {
+        if !addr.HasResourceSpec() {
+                panic("AbsResourceInstanceAddr called on ResourceAddress with no resource spec")
+        }
+
+        ret := addrs.AbsResourceInstance{
+                Module: addr.ModuleInstanceAddr(),
+                Resource: addrs.ResourceInstance{
+                        Resource: addrs.Resource{
+                                Type: addr.Type,
+                                Name: addr.Name,
+                        },
+                },
+        }
+
+        switch addr.Mode {
+        case config.ManagedResourceMode:
+                ret.Resource.Resource.Mode = addrs.ManagedResourceMode
+        case config.DataResourceMode:
+                ret.Resource.Resource.Mode = addrs.DataResourceMode
+        default:
+                panic(fmt.Errorf("cannot shim %s to addrs.ResourceMode value", addr.Mode))
+        }
+
+        if addr.Index != -1 {
+                ret.Resource.Key = addrs.IntKey(addr.Index)
+        }
+
+        return ret
+}
+
+// ModuleInstanceAddr returns the module path portion of the receiver as a
+// addrs.ModuleInstance value.
+func (addr *ResourceAddress) ModuleInstanceAddr() addrs.ModuleInstance {
+        path := make(addrs.ModuleInstance, len(addr.Path))
+        for i, name := range addr.Path {
+                path[i] = addrs.ModuleInstanceStep{Name: name}
+        }
+        return path
+}
+
 // Contains returns true if and only if the given node is contained within
 // the receiver.
 //
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go b/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go
index 93fd14f..3455ad8 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go
@@ -3,8 +3,10 @@ package terraform
 import (
         "fmt"
 
-        multierror "github.com/hashicorp/go-multierror"
+        "github.com/hashicorp/terraform/tfdiags"
+
         "github.com/hashicorp/terraform/plugin/discovery"
+        "github.com/hashicorp/terraform/providers"
 )
 
 // ResourceProvider is an interface that must be implemented by any
@@ -30,13 +32,12 @@ type ResourceProvider interface {
         // resource or data source has the SchemaAvailable flag set.
         GetSchema(*ProviderSchemaRequest) (*ProviderSchema, error)
 
-        // Input is called to ask the provider to ask the user for input
-        // for completing the configuration if necesarry.
+        // Input was used prior to v0.12 to ask the provider to prompt the user
+        // for input to complete the configuration.
         //
-        // This may or may not be called, so resource provider writers shouldn't
-        // rely on this being available to set some default values for validate
-        // later. Example of a situation where this wouldn't be called is if
-        // the user is not using a TTY.
+        // From v0.12 onwards this method is never called because Terraform Core
+        // is able to handle the necessary input logic itself based on the
+        // schema returned from GetSchema.
         Input(UIInput, *ResourceConfig) (*ResourceConfig, error)
 
         // Validate is called once at the beginning with the raw configuration
@@ -170,18 +171,6 @@ type ResourceProvider interface {
         ReadDataApply(*InstanceInfo, *InstanceDiff) (*InstanceState, error)
 }
 
-// ResourceProviderError may be returned when creating a Context if the
-// required providers cannot be satisfied. This error can then be used to
-// format a more useful message for the user.
-type ResourceProviderError struct {
-        Errors []error
-}
-
-func (e *ResourceProviderError) Error() string {
-        // use multierror to format the default output
-        return multierror.Append(nil, e.Errors...).Error()
-}
-
 // ResourceProviderCloser is an interface that providers that can close
 // connections that aren't needed anymore must implement.
 type ResourceProviderCloser interface {
@@ -296,13 +285,35 @@ func ProviderHasDataSource(p ResourceProvider, n string) bool {
 // This should be called only with configurations that have passed calls
 // to config.Validate(), which ensures that all of the given version
 // constraints are valid. It will panic if any invalid constraints are present.
-func resourceProviderFactories(resolver ResourceProviderResolver, reqd discovery.PluginRequirements) (map[string]ResourceProviderFactory, error) {
+func resourceProviderFactories(resolver providers.Resolver, reqd discovery.PluginRequirements) (map[string]providers.Factory, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
         ret, errs := resolver.ResolveProviders(reqd)
         if errs != nil {
-                return nil, &ResourceProviderError{
-                        Errors: errs,
+                diags = diags.Append(
+                        tfdiags.Sourceless(tfdiags.Error,
+                                "Could not satisfy plugin requirements",
+                                errPluginInit,
+                        ),
+                )
+
+                for _, err := range errs {
+                        diags = diags.Append(err)
                 }
+
+                return nil, diags
         }
 
         return ret, nil
 }
+
+const errPluginInit = `
+Plugin reinitialization required. Please run "terraform init".
+
+Plugins are external binaries that Terraform uses to access and manipulate
+resources. The configuration provided requires plugins which can't be located,
+don't satisfy the version constraints, or are otherwise incompatible.
+
+Terraform automatically discovers provider requirements from your
+configuration, including providers used in child modules. To see the
+requirements and constraints from each module, run "terraform providers".
+`
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner.go b/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner.go
index 361ec1e..2743dd7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner.go
@@ -1,9 +1,21 @@
 package terraform
 
+import (
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/provisioners"
+)
+
 // ResourceProvisioner is an interface that must be implemented by any
 // resource provisioner: the thing that initializes resources in
 // a Terraform configuration.
 type ResourceProvisioner interface {
+        // GetConfigSchema returns the schema for the provisioner type's main
+        // configuration block. This is called prior to Validate to enable some
+        // basic structural validation to be performed automatically and to allow
+        // the configuration to be properly extracted from potentially-ambiguous
+        // configuration file formats.
+        GetConfigSchema() (*configschema.Block, error)
+
         // Validate is called once at the beginning with the raw
         // configuration (no interpolation done) and can return a list of warnings
         // and/or errors.
@@ -52,3 +64,7 @@ type ResourceProvisionerCloser interface {
 // ResourceProvisionerFactory is a function type that creates a new instance
 // of a resource provisioner.
 type ResourceProvisionerFactory func() (ResourceProvisioner, error)
+
+// ProvisionerFactory is a function type that creates a new instance
+// of a provisioners.Interface.
+type ProvisionerFactory = provisioners.Factory
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner_mock.go b/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner_mock.go
index f471a51..7b88cf7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner_mock.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner_mock.go
@@ -1,6 +1,10 @@
 package terraform
 
-import "sync"
+import (
+        "sync"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+)
 
 // MockResourceProvisioner implements ResourceProvisioner but mocks out all the
 // calls for testing purposes.
@@ -9,6 +13,10 @@ type MockResourceProvisioner struct {
         // Anything you want, in case you need to store extra data with the mock.
         Meta interface{}
 
+        GetConfigSchemaCalled       bool
+        GetConfigSchemaReturnSchema *configschema.Block
+        GetConfigSchemaReturnError  error
+
         ApplyCalled      bool
         ApplyOutput      UIOutput
         ApplyState       *InstanceState
@@ -27,6 +35,13 @@ type MockResourceProvisioner struct {
         StopReturnError error
 }
 
+var _ ResourceProvisioner = (*MockResourceProvisioner)(nil)
+
+func (p *MockResourceProvisioner) GetConfigSchema() (*configschema.Block, error) {
+        p.GetConfigSchemaCalled = true
+        return p.GetConfigSchemaReturnSchema, p.GetConfigSchemaReturnError
+}
+
 func (p *MockResourceProvisioner) Validate(c *ResourceConfig) ([]string, []error) {
         p.Lock()
         defer p.Unlock()
diff --git a/vendor/github.com/hashicorp/terraform/terraform/schemas.go b/vendor/github.com/hashicorp/terraform/terraform/schemas.go
index ec46efc..62991c8 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/schemas.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/schemas.go
@@ -1,18 +1,239 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/configschema"
+        "fmt"
+        "log"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
+// Schemas is a container for various kinds of schema that Terraform needs
+// during processing.
 type Schemas struct {
-        Providers ProviderSchemas
+        Providers    map[string]*ProviderSchema
+        Provisioners map[string]*configschema.Block
+}
+
+// ProviderSchema returns the entire ProviderSchema object that was produced
+// by the plugin for the given provider, or nil if no such schema is available.
+//
+// It's usually better to go use the more precise methods offered by type
+// Schemas to handle this detail automatically.
+func (ss *Schemas) ProviderSchema(typeName string) *ProviderSchema {
+        if ss.Providers == nil {
+                return nil
+        }
+        return ss.Providers[typeName]
+}
+
+// ProviderConfig returns the schema for the provider configuration of the
+// given provider type, or nil if no such schema is available.
+func (ss *Schemas) ProviderConfig(typeName string) *configschema.Block {
+        ps := ss.ProviderSchema(typeName)
+        if ps == nil {
+                return nil
+        }
+        return ps.Provider
+}
+
+// ResourceTypeConfig returns the schema for the configuration of a given
+// resource type belonging to a given provider type, or nil of no such
+// schema is available.
+//
+// In many cases the provider type is inferrable from the resource type name,
+// but this is not always true because users can override the provider for
+// a resource using the "provider" meta-argument. Therefore it's important to
+// always pass the correct provider name, even though it many cases it feels
+// redundant.
+func (ss *Schemas) ResourceTypeConfig(providerType string, resourceMode addrs.ResourceMode, resourceType string) (block *configschema.Block, schemaVersion uint64) {
+        ps := ss.ProviderSchema(providerType)
+        if ps == nil || ps.ResourceTypes == nil {
+                return nil, 0
+        }
+        return ps.SchemaForResourceType(resourceMode, resourceType)
+}
+
+// ProvisionerConfig returns the schema for the configuration of a given
+// provisioner, or nil of no such schema is available.
+func (ss *Schemas) ProvisionerConfig(name string) *configschema.Block {
+        return ss.Provisioners[name]
 }
 
-// ProviderSchemas is a map from provider names to provider schemas.
+// LoadSchemas searches the given configuration, state  and plan (any of which
+// may be nil) for constructs that have an associated schema, requests the
+// necessary schemas from the given component factory (which must _not_ be nil),
+// and returns a single object representing all of the necessary schemas.
 //
-// The names in this map are the direct plugin name (e.g. "aws") rather than
-// any alias name (e.g. "aws.foo"), since.
-type ProviderSchemas map[string]*ProviderSchema
+// If an error is returned, it may be a wrapped tfdiags.Diagnostics describing
+// errors across multiple separate objects. Errors here will usually indicate
+// either misbehavior on the part of one of the providers or of the provider
+// protocol itself. When returned with errors, the returned schemas object is
+// still valid but may be incomplete.
+func LoadSchemas(config *configs.Config, state *states.State, components contextComponentFactory) (*Schemas, error) {
+        schemas := &Schemas{
+                Providers:    map[string]*ProviderSchema{},
+                Provisioners: map[string]*configschema.Block{},
+        }
+        var diags tfdiags.Diagnostics
+
+        newDiags := loadProviderSchemas(schemas.Providers, config, state, components)
+        diags = diags.Append(newDiags)
+        newDiags = loadProvisionerSchemas(schemas.Provisioners, config, components)
+        diags = diags.Append(newDiags)
+
+        return schemas, diags.Err()
+}
+
+func loadProviderSchemas(schemas map[string]*ProviderSchema, config *configs.Config, state *states.State, components contextComponentFactory) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        ensure := func(typeName string) {
+                if _, exists := schemas[typeName]; exists {
+                        return
+                }
+
+                log.Printf("[TRACE] LoadSchemas: retrieving schema for provider type %q", typeName)
+                provider, err := components.ResourceProvider(typeName, "early/"+typeName)
+                if err != nil {
+                        // We'll put a stub in the map so we won't re-attempt this on
+                        // future calls.
+                        schemas[typeName] = &ProviderSchema{}
+                        diags = diags.Append(
+                                fmt.Errorf("Failed to instantiate provider %q to obtain schema: %s", typeName, err),
+                        )
+                        return
+                }
+                defer func() {
+                        provider.Close()
+                }()
+
+                resp := provider.GetSchema()
+                if resp.Diagnostics.HasErrors() {
+                        // We'll put a stub in the map so we won't re-attempt this on
+                        // future calls.
+                        schemas[typeName] = &ProviderSchema{}
+                        diags = diags.Append(
+                                fmt.Errorf("Failed to retrieve schema from provider %q: %s", typeName, resp.Diagnostics.Err()),
+                        )
+                        return
+                }
+
+                s := &ProviderSchema{
+                        Provider:      resp.Provider.Block,
+                        ResourceTypes: make(map[string]*configschema.Block),
+                        DataSources:   make(map[string]*configschema.Block),
+
+                        ResourceTypeSchemaVersions: make(map[string]uint64),
+                }
+
+                if resp.Provider.Version < 0 {
+                        // We're not using the version numbers here yet, but we'll check
+                        // for validity anyway in case we start using them in future.
+                        diags = diags.Append(
+                                fmt.Errorf("invalid negative schema version provider configuration for provider %q", typeName),
+                        )
+                }
+
+                for t, r := range resp.ResourceTypes {
+                        s.ResourceTypes[t] = r.Block
+                        s.ResourceTypeSchemaVersions[t] = uint64(r.Version)
+                        if r.Version < 0 {
+                                diags = diags.Append(
+                                        fmt.Errorf("invalid negative schema version for resource type %s in provider %q", t, typeName),
+                                )
+                        }
+                }
+
+                for t, d := range resp.DataSources {
+                        s.DataSources[t] = d.Block
+                        if d.Version < 0 {
+                                // We're not using the version numbers here yet, but we'll check
+                                // for validity anyway in case we start using them in future.
+                                diags = diags.Append(
+                                        fmt.Errorf("invalid negative schema version for data source %s in provider %q", t, typeName),
+                                )
+                        }
+                }
+
+                schemas[typeName] = s
+        }
+
+        if config != nil {
+                for _, typeName := range config.ProviderTypes() {
+                        ensure(typeName)
+                }
+        }
+
+        if state != nil {
+                needed := providers.AddressedTypesAbs(state.ProviderAddrs())
+                for _, typeName := range needed {
+                        ensure(typeName)
+                }
+        }
+
+        return diags
+}
+
+func loadProvisionerSchemas(schemas map[string]*configschema.Block, config *configs.Config, components contextComponentFactory) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        ensure := func(name string) {
+                if _, exists := schemas[name]; exists {
+                        return
+                }
+
+                log.Printf("[TRACE] LoadSchemas: retrieving schema for provisioner %q", name)
+                provisioner, err := components.ResourceProvisioner(name, "early/"+name)
+                if err != nil {
+                        // We'll put a stub in the map so we won't re-attempt this on
+                        // future calls.
+                        schemas[name] = &configschema.Block{}
+                        diags = diags.Append(
+                                fmt.Errorf("Failed to instantiate provisioner %q to obtain schema: %s", name, err),
+                        )
+                        return
+                }
+                defer func() {
+                        if closer, ok := provisioner.(ResourceProvisionerCloser); ok {
+                                closer.Close()
+                        }
+                }()
+
+                resp := provisioner.GetSchema()
+                if resp.Diagnostics.HasErrors() {
+                        // We'll put a stub in the map so we won't re-attempt this on
+                        // future calls.
+                        schemas[name] = &configschema.Block{}
+                        diags = diags.Append(
+                                fmt.Errorf("Failed to retrieve schema from provisioner %q: %s", name, resp.Diagnostics.Err()),
+                        )
+                        return
+                }
+
+                schemas[name] = resp.Provisioner
+        }
+
+        if config != nil {
+                for _, rc := range config.Module.ManagedResources {
+                        for _, pc := range rc.Managed.Provisioners {
+                                ensure(pc.Type)
+                        }
+                }
+
+                // Must also visit our child modules, recursively.
+                for _, cc := range config.Children {
+                        childDiags := loadProvisionerSchemas(schemas, cc, components)
+                        diags = diags.Append(childDiags)
+                }
+        }
+
+        return diags
+}
 
 // ProviderSchema represents the schema for a provider's own configuration
 // and the configuration for some or all of its resources and data sources.
@@ -24,6 +245,29 @@ type ProviderSchema struct {
         Provider      *configschema.Block
         ResourceTypes map[string]*configschema.Block
         DataSources   map[string]*configschema.Block
+
+        ResourceTypeSchemaVersions map[string]uint64
+}
+
+// SchemaForResourceType attempts to find a schema for the given mode and type.
+// Returns nil if no such schema is available.
+func (ps *ProviderSchema) SchemaForResourceType(mode addrs.ResourceMode, typeName string) (schema *configschema.Block, version uint64) {
+        switch mode {
+        case addrs.ManagedResourceMode:
+                return ps.ResourceTypes[typeName], ps.ResourceTypeSchemaVersions[typeName]
+        case addrs.DataResourceMode:
+                // Data resources don't have schema versions right now, since state is discarded for each refresh
+                return ps.DataSources[typeName], 0
+        default:
+                // Shouldn't happen, because the above cases are comprehensive.
+                return nil, 0
+        }
+}
+
+// SchemaForResourceAddr attempts to find a schema for the mode and type from
+// the given resource address. Returns nil if no such schema is available.
+func (ps *ProviderSchema) SchemaForResourceAddr(addr addrs.Resource) (schema *configschema.Block, version uint64) {
+        return ps.SchemaForResourceType(addr.Mode, addr.Type)
 }
 
 // ProviderSchemaRequest is used to describe to a ResourceProvider which
diff --git a/vendor/github.com/hashicorp/terraform/terraform/semantics.go b/vendor/github.com/hashicorp/terraform/terraform/semantics.go
deleted file mode 100644
index 20f1d8a..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/semantics.go
+++ /dev/null
@@ -1,132 +0,0 @@
-package terraform
-
-import (
-        "fmt"
-        "strings"
-
-        "github.com/hashicorp/go-multierror"
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/dag"
-)
-
-// GraphSemanticChecker is the interface that semantic checks across
-// the entire Terraform graph implement.
-//
-// The graph should NOT be modified by the semantic checker.
-type GraphSemanticChecker interface {
-        Check(*dag.Graph) error
-}
-
-// UnorderedSemanticCheckRunner is an implementation of GraphSemanticChecker
-// that runs a list of SemanticCheckers against the vertices of the graph
-// in no specified order.
-type UnorderedSemanticCheckRunner struct {
-        Checks []SemanticChecker
-}
-
-func (sc *UnorderedSemanticCheckRunner) Check(g *dag.Graph) error {
-        var err error
-        for _, v := range g.Vertices() {
-                for _, check := range sc.Checks {
-                        if e := check.Check(g, v); e != nil {
-                                err = multierror.Append(err, e)
-                        }
-                }
-        }
-
-        return err
-}
-
-// SemanticChecker is the interface that semantic checks across the
-// Terraform graph implement. Errors are accumulated. Even after an error
-// is returned, child vertices in the graph will still be visited.
-//
-// The graph should NOT be modified by the semantic checker.
-//
-// The order in which vertices are visited is left unspecified, so the
-// semantic checks should not rely on that.
-type SemanticChecker interface {
-        Check(*dag.Graph, dag.Vertex) error
-}
-
-// smcUserVariables does all the semantic checks to verify that the
-// variables given satisfy the configuration itself.
-func smcUserVariables(c *config.Config, vs map[string]interface{}) []error {
-        var errs []error
-
-        cvs := make(map[string]*config.Variable)
-        for _, v := range c.Variables {
-                cvs[v.Name] = v
-        }
-
-        // Check that all required variables are present
-        required := make(map[string]struct{})
-        for _, v := range c.Variables {
-                if v.Required() {
-                        required[v.Name] = struct{}{}
-                }
-        }
-        for k, _ := range vs {
-                delete(required, k)
-        }
-        if len(required) > 0 {
-                for k, _ := range required {
-                        errs = append(errs, fmt.Errorf(
-                                "Required variable not set: %s", k))
-                }
-        }
-
-        // Check that types match up
-        for name, proposedValue := range vs {
-                // Check for "map.key" fields. These stopped working with Terraform
-                // 0.7 but we do this to surface a better error message informing
-                // the user what happened.
-                if idx := strings.Index(name, "."); idx > 0 {
-                        key := name[:idx]
-                        if _, ok := cvs[key]; ok {
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: Overriding map keys with the format `name.key` is no "+
-                                                "longer allowed. You may still override keys by setting "+
-                                                "`name = { key = value }`. The maps will be merged. This "+
-                                                "behavior appeared in 0.7.0.", name))
-                                continue
-                        }
-                }
-
-                schema, ok := cvs[name]
-                if !ok {
-                        continue
-                }
-
-                declaredType := schema.Type()
-
-                switch declaredType {
-                case config.VariableTypeString:
-                        switch proposedValue.(type) {
-                        case string:
-                                continue
-                        }
-                case config.VariableTypeMap:
-                        switch v := proposedValue.(type) {
-                        case map[string]interface{}:
-                                continue
-                        case []map[string]interface{}:
-                                // if we have a list of 1 map, it will get coerced later as needed
-                                if len(v) == 1 {
-                                        continue
-                                }
-                        }
-                case config.VariableTypeList:
-                        switch proposedValue.(type) {
-                        case []interface{}:
-                                continue
-                        }
-                }
-                errs = append(errs, fmt.Errorf("variable %s should be type %s, got %s",
-                        name, declaredType.Printable(), hclTypeName(proposedValue)))
-        }
-
-        // TODO(mitchellh): variables that are unknown
-
-        return errs
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/state.go b/vendor/github.com/hashicorp/terraform/terraform/state.go
index 04b14a6..092b690 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/state.go
@@ -16,12 +16,23 @@ import (
         "strings"
         "sync"
 
-        "github.com/hashicorp/go-multierror"
-        "github.com/hashicorp/go-uuid"
-        "github.com/hashicorp/go-version"
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/errwrap"
+        multierror "github.com/hashicorp/go-multierror"
+        uuid "github.com/hashicorp/go-uuid"
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
         "github.com/mitchellh/copystructure"
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
 
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/tfdiags"
         tfversion "github.com/hashicorp/terraform/version"
 )
 
@@ -33,26 +44,38 @@ const (
 // rootModulePath is the path of the root module
 var rootModulePath = []string{"root"}
 
+// normalizeModulePath transforms a legacy module path (which may or may not
+// have a redundant "root" label at the start of it) into an
+// addrs.ModuleInstance representing the same module.
+//
+// For legacy reasons, different parts of Terraform disagree about whether the
+// root module has the path []string{} or []string{"root"}, and so this
+// function accepts both and trims off the "root". An implication of this is
+// that it's not possible to actually have a module call in the root module
+// that is itself named "root", since that would be ambiguous.
+//
 // normalizeModulePath takes a raw module path and returns a path that
 // has the rootModulePath prepended to it. If I could go back in time I
 // would've never had a rootModulePath (empty path would be root). We can
 // still fix this but thats a big refactor that my branch doesn't make sense
 // for. Instead, this function normalizes paths.
-func normalizeModulePath(p []string) []string {
-        k := len(rootModulePath)
+func normalizeModulePath(p []string) addrs.ModuleInstance {
+        // FIXME: Remove this once everyone is using addrs.ModuleInstance.
 
-        // If we already have a root module prefix, we're done
-        if len(p) >= len(rootModulePath) {
-                if reflect.DeepEqual(p[:k], rootModulePath) {
-                        return p
-                }
+        if len(p) > 0 && p[0] == "root" {
+                p = p[1:]
         }
 
-        // None? Prefix it
-        result := make([]string, len(rootModulePath)+len(p))
-        copy(result, rootModulePath)
-        copy(result[k:], p)
-        return result
+        ret := make(addrs.ModuleInstance, len(p))
+        for i, name := range p {
+                // For now we don't actually support modules with multiple instances
+                // identified by keys, so we just treat every path element as a
+                // step with no key.
+                ret[i] = addrs.ModuleInstanceStep{
+                        Name: name,
+                }
+        }
+        return ret
 }
 
 // State keeps track of a snapshot state-of-the-world that Terraform
@@ -138,21 +161,43 @@ func (s *State) children(path []string) []*ModuleState {
 //
 // This should be the preferred method to add module states since it
 // allows us to optimize lookups later as well as control sorting.
-func (s *State) AddModule(path []string) *ModuleState {
+func (s *State) AddModule(path addrs.ModuleInstance) *ModuleState {
         s.Lock()
         defer s.Unlock()
 
         return s.addModule(path)
 }
 
-func (s *State) addModule(path []string) *ModuleState {
+func (s *State) addModule(path addrs.ModuleInstance) *ModuleState {
         // check if the module exists first
         m := s.moduleByPath(path)
         if m != nil {
                 return m
         }
 
-        m = &ModuleState{Path: path}
+        // Lower the new-style address into a legacy-style address.
+        // This requires that none of the steps have instance keys, which is
+        // true for all addresses at the time of implementing this because
+        // "count" and "for_each" are not yet implemented for modules.
+        // For the purposes of state, the legacy address format also includes
+        // a redundant extra prefix element "root". It is important to include
+        // this because the "prune" method will remove any module that has a
+        // path length less than one, and other parts of the state code will
+        // trim off the first element indiscriminately.
+        legacyPath := make([]string, len(path)+1)
+        legacyPath[0] = "root"
+        for i, step := range path {
+                if step.InstanceKey != addrs.NoKey {
+                        // FIXME: Once the rest of Terraform is ready to use count and
+                        // for_each, remove all of this and just write the addrs.ModuleInstance
+                        // value itself into the ModuleState.
+                        panic("state cannot represent modules with count or for_each keys")
+                }
+
+                legacyPath[i+1] = step.Name
+        }
+
+        m = &ModuleState{Path: legacyPath}
         m.init()
         s.Modules = append(s.Modules, m)
         s.sort()
@@ -162,7 +207,7 @@ func (s *State) addModule(path []string) *ModuleState {
 // ModuleByPath is used to lookup the module state for the given path.
 // This should be the preferred lookup mechanism as it allows for future
 // lookup optimizations.
-func (s *State) ModuleByPath(path []string) *ModuleState {
+func (s *State) ModuleByPath(path addrs.ModuleInstance) *ModuleState {
         if s == nil {
                 return nil
         }
@@ -172,7 +217,7 @@ func (s *State) ModuleByPath(path []string) *ModuleState {
         return s.moduleByPath(path)
 }
 
-func (s *State) moduleByPath(path []string) *ModuleState {
+func (s *State) moduleByPath(path addrs.ModuleInstance) *ModuleState {
         for _, mod := range s.Modules {
                 if mod == nil {
                         continue
@@ -180,97 +225,14 @@ func (s *State) moduleByPath(path []string) *ModuleState {
                 if mod.Path == nil {
                         panic("missing module path")
                 }
-                if reflect.DeepEqual(mod.Path, path) {
+                modPath := normalizeModulePath(mod.Path)
+                if modPath.String() == path.String() {
                         return mod
                 }
         }
         return nil
 }
 
-// ModuleOrphans returns all the module orphans in this state by
-// returning their full paths. These paths can be used with ModuleByPath
-// to return the actual state.
-func (s *State) ModuleOrphans(path []string, c *config.Config) [][]string {
-        s.Lock()
-        defer s.Unlock()
-
-        return s.moduleOrphans(path, c)
-
-}
-
-func (s *State) moduleOrphans(path []string, c *config.Config) [][]string {
-        // direct keeps track of what direct children we have both in our config
-        // and in our state. childrenKeys keeps track of what isn't an orphan.
-        direct := make(map[string]struct{})
-        childrenKeys := make(map[string]struct{})
-        if c != nil {
-                for _, m := range c.Modules {
-                        childrenKeys[m.Name] = struct{}{}
-                        direct[m.Name] = struct{}{}
-                }
-        }
-
-        // Go over the direct children and find any that aren't in our keys.
-        var orphans [][]string
-        for _, m := range s.children(path) {
-                key := m.Path[len(m.Path)-1]
-
-                // Record that we found this key as a direct child. We use this
-                // later to find orphan nested modules.
-                direct[key] = struct{}{}
-
-                // If we have a direct child still in our config, it is not an orphan
-                if _, ok := childrenKeys[key]; ok {
-                        continue
-                }
-
-                orphans = append(orphans, m.Path)
-        }
-
-        // Find the orphans that are nested...
-        for _, m := range s.Modules {
-                if m == nil {
-                        continue
-                }
-
-                // We only want modules that are at least grandchildren
-                if len(m.Path) < len(path)+2 {
-                        continue
-                }
-
-                // If it isn't part of our tree, continue
-                if !reflect.DeepEqual(path, m.Path[:len(path)]) {
-                        continue
-                }
-
-                // If we have the direct child, then just skip it.
-                key := m.Path[len(path)]
-                if _, ok := direct[key]; ok {
-                        continue
-                }
-
-                orphanPath := m.Path[:len(path)+1]
-
-                // Don't double-add if we've already added this orphan (which can happen if
-                // there are multiple nested sub-modules that get orphaned together).
-                alreadyAdded := false
-                for _, o := range orphans {
-                        if reflect.DeepEqual(o, orphanPath) {
-                                alreadyAdded = true
-                                break
-                        }
-                }
-                if alreadyAdded {
-                        continue
-                }
-
-                // Add this orphan
-                orphans = append(orphans, orphanPath)
-        }
-
-        return orphans
-}
-
 // Empty returns true if the state is empty.
 func (s *State) Empty() bool {
         if s == nil {
@@ -443,7 +405,7 @@ func (s *State) removeModule(path []string, v *ModuleState) {
 
 func (s *State) removeResource(path []string, v *ResourceState) {
         // Get the module this resource lives in. If it doesn't exist, we're done.
-        mod := s.moduleByPath(path)
+        mod := s.moduleByPath(normalizeModulePath(path))
         if mod == nil {
                 return
         }
@@ -487,7 +449,7 @@ func (s *State) removeInstance(path []string, r *ResourceState, v *InstanceState
 
 // RootModule returns the ModuleState for the root module
 func (s *State) RootModule() *ModuleState {
-        root := s.ModuleByPath(rootModulePath)
+        root := s.ModuleByPath(addrs.RootModuleInstance)
         if root == nil {
                 panic("missing root module")
         }
@@ -522,7 +484,7 @@ func (s *State) equal(other *State) bool {
         }
         for _, m := range s.Modules {
                 // This isn't very optimal currently but works.
-                otherM := other.moduleByPath(m.Path)
+                otherM := other.moduleByPath(normalizeModulePath(m.Path))
                 if otherM == nil {
                         return false
                 }
@@ -681,8 +643,8 @@ func (s *State) init() {
                 s.Version = StateVersion
         }
 
-        if s.moduleByPath(rootModulePath) == nil {
-                s.addModule(rootModulePath)
+        if s.moduleByPath(addrs.RootModuleInstance) == nil {
+                s.addModule(addrs.RootModuleInstance)
         }
         s.ensureHasLineage()
 
@@ -811,13 +773,9 @@ func (s *State) String() string {
 
 // BackendState stores the configuration to connect to a remote backend.
 type BackendState struct {
-        Type   string                 `json:"type"`   // Backend type
-        Config map[string]interface{} `json:"config"` // Backend raw config
-
-        // Hash is the hash code to uniquely identify the original source
-        // configuration. We use this to detect when there is a change in
-        // configuration even when "type" isn't changed.
-        Hash uint64 `json:"hash"`
+        Type      string          `json:"type"`   // Backend type
+        ConfigRaw json.RawMessage `json:"config"` // Backend raw config
+        Hash      uint64          `json:"hash"`   // Hash of portion of configuration from config files
 }
 
 // Empty returns true if BackendState has no state.
@@ -825,25 +783,50 @@ func (s *BackendState) Empty() bool {
         return s == nil || s.Type == ""
 }
 
-// Rehash returns a unique content hash for this backend's configuration
-// as a uint64 value.
-// The Hash stored in the backend state needs to match the config itself, but
-// we need to compare the backend config after it has been combined with all
-// options.
-// This function must match the implementation used by config.Backend.
-func (s *BackendState) Rehash() uint64 {
+// Config decodes the type-specific configuration object using the provided
+// schema and returns the result as a cty.Value.
+//
+// An error is returned if the stored configuration does not conform to the
+// given schema.
+func (s *BackendState) Config(schema *configschema.Block) (cty.Value, error) {
+        ty := schema.ImpliedType()
         if s == nil {
-                return 0
+                return cty.NullVal(ty), nil
         }
+        return ctyjson.Unmarshal(s.ConfigRaw, ty)
+}
 
-        cfg := config.Backend{
-                Type: s.Type,
-                RawConfig: &config.RawConfig{
-                        Raw: s.Config,
-                },
+// SetConfig replaces (in-place) the type-specific configuration object using
+// the provided value and associated schema.
+//
+// An error is returned if the given value does not conform to the implied
+// type of the schema.
+func (s *BackendState) SetConfig(val cty.Value, schema *configschema.Block) error {
+        ty := schema.ImpliedType()
+        buf, err := ctyjson.Marshal(val, ty)
+        if err != nil {
+                return err
         }
+        s.ConfigRaw = buf
+        return nil
+}
 
-        return cfg.Rehash()
+// ForPlan produces an alternative representation of the reciever that is
+// suitable for storing in a plan. The current workspace must additionally
+// be provided, to be stored alongside the backend configuration.
+//
+// The backend configuration schema is required in order to properly
+// encode the backend-specific configuration settings.
+func (s *BackendState) ForPlan(schema *configschema.Block, workspaceName string) (*plans.Backend, error) {
+        if s == nil {
+                return nil, nil
+        }
+
+        configVal, err := s.Config(schema)
+        if err != nil {
+                return nil, errwrap.Wrapf("failed to decode backend config: {{err}}", err)
+        }
+        return plans.NewBackend(s.Type, configVal, schema, workspaceName)
 }
 
 // RemoteState is used to track the information about a remote
@@ -1089,58 +1072,64 @@ func (m *ModuleState) IsDescendent(other *ModuleState) bool {
 // Orphans returns a list of keys of resources that are in the State
 // but aren't present in the configuration itself. Hence, these keys
 // represent the state of resources that are orphans.
-func (m *ModuleState) Orphans(c *config.Config) []string {
+func (m *ModuleState) Orphans(c *configs.Module) []addrs.ResourceInstance {
         m.Lock()
         defer m.Unlock()
 
-        keys := make(map[string]struct{})
-        for k := range m.Resources {
-                keys[k] = struct{}{}
-        }
-
+        inConfig := make(map[string]struct{})
         if c != nil {
-                for _, r := range c.Resources {
-                        delete(keys, r.Id())
-
-                        for k := range keys {
-                                if strings.HasPrefix(k, r.Id()+".") {
-                                        delete(keys, k)
-                                }
-                        }
+                for _, r := range c.ManagedResources {
+                        inConfig[r.Addr().String()] = struct{}{}
+                }
+                for _, r := range c.DataResources {
+                        inConfig[r.Addr().String()] = struct{}{}
                 }
         }
 
-        result := make([]string, 0, len(keys))
-        for k := range keys {
-                result = append(result, k)
-        }
+        var result []addrs.ResourceInstance
+        for k := range m.Resources {
+                // Since we've not yet updated state to use our new address format,
+                // we need to do some shimming here.
+                legacyAddr, err := parseResourceAddressInternal(k)
+                if err != nil {
+                        // Suggests that the user tampered with the state, since we always
+                        // generate valid internal addresses.
+                        log.Printf("ModuleState has invalid resource key %q. Ignoring.", k)
+                        continue
+                }
 
+                addr := legacyAddr.AbsResourceInstanceAddr().Resource
+                compareKey := addr.Resource.String() // compare by resource address, ignoring instance key
+                if _, exists := inConfig[compareKey]; !exists {
+                        result = append(result, addr)
+                }
+        }
         return result
 }
 
 // RemovedOutputs returns a list of outputs that are in the State but aren't
 // present in the configuration itself.
-func (m *ModuleState) RemovedOutputs(c *config.Config) []string {
-        m.Lock()
-        defer m.Unlock()
-
-        keys := make(map[string]struct{})
-        for k := range m.Outputs {
-                keys[k] = struct{}{}
+func (s *ModuleState) RemovedOutputs(outputs map[string]*configs.Output) []addrs.OutputValue {
+        if outputs == nil {
+                // If we got no output map at all then we'll just treat our set of
+                // configured outputs as empty, since that suggests that they've all
+                // been removed by removing their containing module.
+                outputs = make(map[string]*configs.Output)
         }
 
-        if c != nil {
-                for _, o := range c.Outputs {
-                        delete(keys, o.Name)
-                }
-        }
+        s.Lock()
+        defer s.Unlock()
 
-        result := make([]string, 0, len(keys))
-        for k := range keys {
-                result = append(result, k)
+        var ret []addrs.OutputValue
+        for n := range s.Outputs {
+                if _, declared := outputs[n]; !declared {
+                        ret = append(ret, addrs.OutputValue{
+                                Name: n,
+                        })
+                }
         }
 
-        return result
+        return ret
 }
 
 // View returns a view with the given resource prefix.
@@ -1543,6 +1532,24 @@ func (s *ResourceState) Untaint() {
         }
 }
 
+// ProviderAddr returns the provider address for the receiver, by parsing the
+// string representation saved in state. An error can be returned if the
+// value in state is corrupt.
+func (s *ResourceState) ProviderAddr() (addrs.AbsProviderConfig, error) {
+        var diags tfdiags.Diagnostics
+
+        str := s.Provider
+        traversal, travDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(travDiags)
+        if travDiags.HasErrors() {
+                return addrs.AbsProviderConfig{}, diags.Err()
+        }
+
+        addr, addrDiags := addrs.ParseAbsProviderConfig(traversal)
+        diags = diags.Append(addrDiags)
+        return addr, diags.Err()
+}
+
 func (s *ResourceState) init() {
         s.Lock()
         defer s.Unlock()
@@ -1651,6 +1658,51 @@ func (s *InstanceState) init() {
         s.Ephemeral.init()
 }
 
+// NewInstanceStateShimmedFromValue is a shim method to lower a new-style
+// object value representing the attributes of an instance object into the
+// legacy InstanceState representation.
+//
+// This is for shimming to old components only and should not be used in new code.
+func NewInstanceStateShimmedFromValue(state cty.Value, schemaVersion int) *InstanceState {
+        attrs := hcl2shim.FlatmapValueFromHCL2(state)
+        return &InstanceState{
+                ID:         attrs["id"],
+                Attributes: attrs,
+                Meta: map[string]interface{}{
+                        "schema_version": schemaVersion,
+                },
+        }
+}
+
+// AttrsAsObjectValue shims from the legacy InstanceState representation to
+// a new-style cty object value representation of the state attributes, using
+// the given type for guidance.
+//
+// The given type must be the implied type of the schema of the resource type
+// of the object whose state is being converted, or the result is undefined.
+//
+// This is for shimming from old components only and should not be used in
+// new code.
+func (s *InstanceState) AttrsAsObjectValue(ty cty.Type) (cty.Value, error) {
+        if s == nil {
+                // if the state is nil, we need to construct a complete cty.Value with
+                // null attributes, rather than a single cty.NullVal(ty)
+                s = &InstanceState{}
+        }
+
+        if s.Attributes == nil {
+                s.Attributes = map[string]string{}
+        }
+
+        // make sure ID is included in the attributes. The InstanceState.ID value
+        // takes precedence.
+        if s.ID != "" {
+                s.Attributes["id"] = s.ID
+        }
+
+        return hcl2shim.HCL2ValueFromFlatmap(s.Attributes, ty)
+}
+
 // Copy all the Fields from another InstanceState
 func (s *InstanceState) Set(from *InstanceState) {
         s.Lock()
@@ -1787,13 +1839,19 @@ func (s *InstanceState) MergeDiff(d *InstanceDiff) *InstanceState {
 }
 
 func (s *InstanceState) String() string {
+        notCreated := "<not created>"
+
+        if s == nil {
+                return notCreated
+        }
+
         s.Lock()
         defer s.Unlock()
 
         var buf bytes.Buffer
 
-        if s == nil || s.ID == "" {
-                return "<not created>"
+        if s.ID == "" {
+                return notCreated
         }
 
         buf.WriteString(fmt.Sprintf("ID = %s\n", s.ID))
@@ -2187,19 +2245,6 @@ func (s moduleStateSort) Swap(i, j int) {
         s[i], s[j] = s[j], s[i]
 }
 
-// StateCompatible returns an error if the state is not compatible with the
-// current version of terraform.
-func CheckStateVersion(state *State) error {
-        if state == nil {
-                return nil
-        }
-
-        if state.FromFutureTerraform() {
-                return fmt.Errorf(stateInvalidTerraformVersionErr, state.TFVersion)
-        }
-        return nil
-}
-
 const stateValidateErrMultiModule = `
 Multiple modules with the same path: %s
 
@@ -2208,11 +2253,3 @@ in your state file that point to the same module. This will cause Terraform
 to behave in unexpected and error prone ways and is invalid. Please back up
 and modify your state file manually to resolve this.
 `
-
-const stateInvalidTerraformVersionErr = `
-Terraform doesn't allow running any operations against a state
-that was written by a future Terraform version. The state is
-reporting it is written by Terraform '%s'
-
-Please run at least that version of Terraform to continue.
-`
diff --git a/vendor/github.com/hashicorp/terraform/terraform/state_add.go b/vendor/github.com/hashicorp/terraform/terraform/state_add.go
deleted file mode 100644
index 1163730..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/state_add.go
+++ /dev/null
@@ -1,374 +0,0 @@
-package terraform
-
-import "fmt"
-
-// Add adds the item in the state at the given address.
-//
-// The item can be a ModuleState, ResourceState, or InstanceState. Depending
-// on the item type, the address may or may not be valid. For example, a
-// module cannot be moved to a resource address, however a resource can be
-// moved to a module address (it retains the same name, under that resource).
-//
-// The item can also be a []*ModuleState, which is the case for nested
-// modules. In this case, Add will expect the zero-index to be the top-most
-// module to add and will only nest children from there. For semantics, this
-// is equivalent to module => module.
-//
-// The full semantics of Add:
-//
-//                      ┌───────────────────┬───────────────────┬───────────────────┐
-//                      │  Module Address   │ Resource Address  │ Instance Address  │
-//    ┌─────────────────┼───────────────────┼───────────────────┼───────────────────┤
-//    │   ModuleState   │         ✓         │         x         │         x         │
-//    ├─────────────────┼───────────────────┼───────────────────┼───────────────────┤
-//    │  ResourceState  │         ✓         │         ✓         │      maybe*       │
-//    ├─────────────────┼───────────────────┼───────────────────┼───────────────────┤
-//    │ Instance State  │         ✓         │         ✓         │         ✓         │
-//    └─────────────────┴───────────────────┴───────────────────┴───────────────────┘
-//
-// *maybe - Resources can be added at an instance address only if the resource
-//          represents a single instance (primary). Example:
-//          "aws_instance.foo" can be moved to "aws_instance.bar.tainted"
-//
-func (s *State) Add(fromAddrRaw string, toAddrRaw string, raw interface{}) error {
-        // Parse the address
-
-        toAddr, err := ParseResourceAddress(toAddrRaw)
-        if err != nil {
-                return err
-        }
-
-        // Parse the from address
-        fromAddr, err := ParseResourceAddress(fromAddrRaw)
-        if err != nil {
-                return err
-        }
-
-        // Determine the types
-        from := detectValueAddLoc(raw)
-        to := detectAddrAddLoc(toAddr)
-
-        // Find the function to do this
-        fromMap, ok := stateAddFuncs[from]
-        if !ok {
-                return fmt.Errorf("invalid source to add to state: %T", raw)
-        }
-        f, ok := fromMap[to]
-        if !ok {
-                return fmt.Errorf("invalid destination: %s (%d)", toAddr, to)
-        }
-
-        // Call the migrator
-        if err := f(s, fromAddr, toAddr, raw); err != nil {
-                return err
-        }
-
-        // Prune the state
-        s.prune()
-        return nil
-}
-
-func stateAddFunc_Module_Module(s *State, fromAddr, addr *ResourceAddress, raw interface{}) error {
-        // raw can be either *ModuleState or []*ModuleState. The former means
-        // we're moving just one module. The latter means we're moving a module
-        // and children.
-        root := raw
-        var rest []*ModuleState
-        if list, ok := raw.([]*ModuleState); ok {
-                // We need at least one item
-                if len(list) == 0 {
-                        return fmt.Errorf("module move with no value to: %s", addr)
-                }
-
-                // The first item is always the root
-                root = list[0]
-                if len(list) > 1 {
-                        rest = list[1:]
-                }
-        }
-
-        // Get the actual module state
-        src := root.(*ModuleState).deepcopy()
-
-        // If the target module exists, it is an error
-        path := append([]string{"root"}, addr.Path...)
-        if s.ModuleByPath(path) != nil {
-                return fmt.Errorf("module target is not empty: %s", addr)
-        }
-
-        // Create it and copy our outputs and dependencies
-        mod := s.AddModule(path)
-        mod.Outputs = src.Outputs
-        mod.Dependencies = src.Dependencies
-
-        // Go through the resources perform an add for each of those
-        for k, v := range src.Resources {
-                resourceKey, err := ParseResourceStateKey(k)
-                if err != nil {
-                        return err
-                }
-
-                // Update the resource address for this
-                addrCopy := *addr
-                addrCopy.Type = resourceKey.Type
-                addrCopy.Name = resourceKey.Name
-                addrCopy.Index = resourceKey.Index
-                addrCopy.Mode = resourceKey.Mode
-
-                // Perform an add
-                if err := s.Add(fromAddr.String(), addrCopy.String(), v); err != nil {
-                        return err
-                }
-        }
-
-        // Add all the children if we have them
-        for _, item := range rest {
-                // If item isn't a descendent of our root, then ignore it
-                if !src.IsDescendent(item) {
-                        continue
-                }
-
-                // It is! Strip the leading prefix and attach that to our address
-                extra := item.Path[len(src.Path):]
-                addrCopy := addr.Copy()
-                addrCopy.Path = append(addrCopy.Path, extra...)
-
-                // Add it
-                s.Add(fromAddr.String(), addrCopy.String(), item)
-        }
-
-        return nil
-}
-
-func stateAddFunc_Resource_Module(
-        s *State, from, to *ResourceAddress, raw interface{}) error {
-        // Build the more specific to addr
-        addr := *to
-        addr.Type = from.Type
-        addr.Name = from.Name
-
-        return s.Add(from.String(), addr.String(), raw)
-}
-
-func stateAddFunc_Resource_Resource(s *State, fromAddr, addr *ResourceAddress, raw interface{}) error {
-        // raw can be either *ResourceState or []*ResourceState. The former means
-        // we're moving just one resource. The latter means we're moving a count
-        // of resources.
-        if list, ok := raw.([]*ResourceState); ok {
-                // We need at least one item
-                if len(list) == 0 {
-                        return fmt.Errorf("resource move with no value to: %s", addr)
-                }
-
-                // If there is an index, this is an error since we can't assign
-                // a set of resources to a single index
-                if addr.Index >= 0 && len(list) > 1 {
-                        return fmt.Errorf(
-                                "multiple resources can't be moved to a single index: "+
-                                        "%s => %s", fromAddr, addr)
-                }
-
-                // Add each with a specific index
-                for i, rs := range list {
-                        addrCopy := addr.Copy()
-                        addrCopy.Index = i
-
-                        if err := s.Add(fromAddr.String(), addrCopy.String(), rs); err != nil {
-                                return err
-                        }
-                }
-
-                return nil
-        }
-
-        src := raw.(*ResourceState).deepcopy()
-
-        // Initialize the resource
-        resourceRaw, exists := stateAddInitAddr(s, addr)
-        if exists {
-                return fmt.Errorf("resource exists and not empty: %s", addr)
-        }
-        resource := resourceRaw.(*ResourceState)
-        resource.Type = src.Type
-        resource.Dependencies = src.Dependencies
-        resource.Provider = src.Provider
-
-        // Move the primary
-        if src.Primary != nil {
-                addrCopy := *addr
-                addrCopy.InstanceType = TypePrimary
-                addrCopy.InstanceTypeSet = true
-                if err := s.Add(fromAddr.String(), addrCopy.String(), src.Primary); err != nil {
-                        return err
-                }
-        }
-
-        // Move all deposed
-        if len(src.Deposed) > 0 {
-                resource.Deposed = src.Deposed
-        }
-
-        return nil
-}
-
-func stateAddFunc_Instance_Instance(s *State, fromAddr, addr *ResourceAddress, raw interface{}) error {
-        src := raw.(*InstanceState).DeepCopy()
-
-        // Create the instance
-        instanceRaw, _ := stateAddInitAddr(s, addr)
-        instance := instanceRaw.(*InstanceState)
-
-        // Set it
-        instance.Set(src)
-
-        return nil
-}
-
-func stateAddFunc_Instance_Module(
-        s *State, from, to *ResourceAddress, raw interface{}) error {
-        addr := *to
-        addr.Type = from.Type
-        addr.Name = from.Name
-
-        return s.Add(from.String(), addr.String(), raw)
-}
-
-func stateAddFunc_Instance_Resource(
-        s *State, from, to *ResourceAddress, raw interface{}) error {
-        addr := *to
-        addr.InstanceType = TypePrimary
-        addr.InstanceTypeSet = true
-
-        return s.Add(from.String(), addr.String(), raw)
-}
-
-// stateAddFunc is the type of function for adding an item to a state
-type stateAddFunc func(s *State, from, to *ResourceAddress, item interface{}) error
-
-// stateAddFuncs has the full matrix mapping of the state adders.
-var stateAddFuncs map[stateAddLoc]map[stateAddLoc]stateAddFunc
-
-func init() {
-        stateAddFuncs = map[stateAddLoc]map[stateAddLoc]stateAddFunc{
-                stateAddModule: {
-                        stateAddModule: stateAddFunc_Module_Module,
-                },
-                stateAddResource: {
-                        stateAddModule:   stateAddFunc_Resource_Module,
-                        stateAddResource: stateAddFunc_Resource_Resource,
-                },
-                stateAddInstance: {
-                        stateAddInstance: stateAddFunc_Instance_Instance,
-                        stateAddModule:   stateAddFunc_Instance_Module,
-                        stateAddResource: stateAddFunc_Instance_Resource,
-                },
-        }
-}
-
-// stateAddLoc is an enum to represent the location where state is being
-// moved from/to. We use this for quick lookups in a function map.
-type stateAddLoc uint
-
-const (
-        stateAddInvalid stateAddLoc = iota
-        stateAddModule
-        stateAddResource
-        stateAddInstance
-)
-
-// detectAddrAddLoc detects the state type for the given address. This
-// function is specifically not unit tested since we consider the State.Add
-// functionality to be comprehensive enough to cover this.
-func detectAddrAddLoc(addr *ResourceAddress) stateAddLoc {
-        if addr.Name == "" {
-                return stateAddModule
-        }
-
-        if !addr.InstanceTypeSet {
-                return stateAddResource
-        }
-
-        return stateAddInstance
-}
-
-// detectValueAddLoc determines the stateAddLoc value from the raw value
-// that is some State structure.
-func detectValueAddLoc(raw interface{}) stateAddLoc {
-        switch raw.(type) {
-        case *ModuleState:
-                return stateAddModule
-        case []*ModuleState:
-                return stateAddModule
-        case *ResourceState:
-                return stateAddResource
-        case []*ResourceState:
-                return stateAddResource
-        case *InstanceState:
-                return stateAddInstance
-        default:
-                return stateAddInvalid
-        }
-}
-
-// stateAddInitAddr takes a ResourceAddress and creates the non-existing
-// resources up to that point, returning the empty (or existing) interface
-// at that address.
-func stateAddInitAddr(s *State, addr *ResourceAddress) (interface{}, bool) {
-        addType := detectAddrAddLoc(addr)
-
-        // Get the module
-        path := append([]string{"root"}, addr.Path...)
-        exists := true
-        mod := s.ModuleByPath(path)
-        if mod == nil {
-                mod = s.AddModule(path)
-                exists = false
-        }
-        if addType == stateAddModule {
-                return mod, exists
-        }
-
-        // Add the resource
-        resourceKey := (&ResourceStateKey{
-                Name:  addr.Name,
-                Type:  addr.Type,
-                Index: addr.Index,
-                Mode:  addr.Mode,
-        }).String()
-        exists = true
-        resource, ok := mod.Resources[resourceKey]
-        if !ok {
-                resource = &ResourceState{Type: addr.Type}
-                resource.init()
-                mod.Resources[resourceKey] = resource
-                exists = false
-        }
-        if addType == stateAddResource {
-                return resource, exists
-        }
-
-        // Get the instance
-        exists = true
-        instance := &InstanceState{}
-        switch addr.InstanceType {
-        case TypePrimary, TypeTainted:
-                if v := resource.Primary; v != nil {
-                        instance = resource.Primary
-                } else {
-                        exists = false
-                }
-        case TypeDeposed:
-                idx := addr.Index
-                if addr.Index < 0 {
-                        idx = 0
-                }
-                if len(resource.Deposed) > idx {
-                        instance = resource.Deposed[idx]
-                } else {
-                        resource.Deposed = append(resource.Deposed, instance)
-                        exists = false
-                }
-        }
-
-        return instance, exists
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform.go b/vendor/github.com/hashicorp/terraform/terraform/transform.go
index 0e47f20..fd3f5c7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform.go
@@ -38,13 +38,18 @@ type graphTransformerMulti struct {
 }
 
 func (t *graphTransformerMulti) Transform(g *Graph) error {
+        var lastStepStr string
         for _, t := range t.Transforms {
+                log.Printf("[TRACE] (graphTransformerMulti) Executing graph transform %T", t)
                 if err := t.Transform(g); err != nil {
                         return err
                 }
-                log.Printf(
-                        "[TRACE] Graph after step %T:\n\n%s",
-                        t, g.StringWithNodeTypes())
+                if thisStepStr := g.StringWithNodeTypes(); thisStepStr != lastStepStr {
+                        log.Printf("[TRACE] (graphTransformerMulti) Completed graph transform %T with new graph:\n%s------", t, thisStepStr)
+                        lastStepStr = thisStepStr
+                } else {
+                        log.Printf("[TRACE] (graphTransformerMulti) Completed graph transform %T (no changes)", t)
+                }
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_provider.go b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_provider.go
index 39cf097..897a7e7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_provider.go
@@ -1,7 +1,8 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
 )
 
 // GraphNodeAttachProvider is an interface that must be implemented by nodes
@@ -11,8 +12,8 @@ type GraphNodeAttachProvider interface {
         GraphNodeSubPath
 
         // ProviderName with no module prefix. Example: "aws".
-        ProviderName() string
+        ProviderAddr() addrs.AbsProviderConfig
 
         // Sets the configuration
-        AttachProvider(*config.ProviderConfig)
+        AttachProvider(*configs.Provider)
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_resource.go b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_resource.go
index f2ee37e..03f8564 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_resource.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_resource.go
@@ -1,35 +1,32 @@
 package terraform
 
 import (
-        "fmt"
         "log"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/dag"
 )
 
 // GraphNodeAttachResourceConfig is an interface that must be implemented by nodes
 // that want resource configurations attached.
 type GraphNodeAttachResourceConfig interface {
-        // ResourceAddr is the address to the resource
-        ResourceAddr() *ResourceAddress
+        GraphNodeResource
 
         // Sets the configuration
-        AttachResourceConfig(*config.Resource)
+        AttachResourceConfig(*configs.Resource)
 }
 
 // AttachResourceConfigTransformer goes through the graph and attaches
-// resource configuration structures to nodes that implement the interfaces
-// above.
+// resource configuration structures to nodes that implement
+// GraphNodeAttachManagedResourceConfig or GraphNodeAttachDataResourceConfig.
 //
 // The attached configuration structures are directly from the configuration.
 // If they're going to be modified, a copy should be made.
 type AttachResourceConfigTransformer struct {
-        Module *module.Tree // Module is the root module for the config
+        Config *configs.Config // Config is the root node in the config tree
 }
 
 func (t *AttachResourceConfigTransformer) Transform(g *Graph) error {
-        log.Printf("[TRACE] AttachResourceConfigTransformer: Beginning...")
 
         // Go through and find GraphNodeAttachResource
         for _, v := range g.Vertices() {
@@ -41,36 +38,35 @@ func (t *AttachResourceConfigTransformer) Transform(g *Graph) error {
 
                 // Determine what we're looking for
                 addr := arn.ResourceAddr()
-                log.Printf(
-                        "[TRACE] AttachResourceConfigTransformer: Attach resource "+
-                                "config request: %s", addr)
 
                 // Get the configuration.
-                path := normalizeModulePath(addr.Path)
-                path = path[1:]
-                tree := t.Module.Child(path)
-                if tree == nil {
+                config := t.Config.DescendentForInstance(addr.Module)
+                if config == nil {
+                        log.Printf("[TRACE] AttachResourceConfigTransformer: %q (%T) has no configuration available", dag.VertexName(v), v)
                         continue
                 }
 
-                // Go through the resource configs to find the matching config
-                for _, r := range tree.Config().Resources {
-                        // Get a resource address so we can compare
-                        a, err := parseResourceAddressConfig(r)
-                        if err != nil {
-                                panic(fmt.Sprintf(
-                                        "Error parsing config address, this is a bug: %#v", r))
+                for _, r := range config.Module.ManagedResources {
+                        rAddr := r.Addr()
+
+                        if rAddr != addr.Resource {
+                                // Not the same resource
+                                continue
                         }
-                        a.Path = addr.Path
 
-                        // If this is not the same resource, then continue
-                        if !a.Equals(addr) {
+                        log.Printf("[TRACE] AttachResourceConfigTransformer: attaching to %q (%T) config from %s", dag.VertexName(v), v, r.DeclRange)
+                        arn.AttachResourceConfig(r)
+                }
+                for _, r := range config.Module.DataResources {
+                        rAddr := r.Addr()
+
+                        if rAddr != addr.Resource {
+                                // Not the same resource
                                 continue
                         }
 
-                        log.Printf("[TRACE] Attaching resource config: %#v", r)
+                        log.Printf("[TRACE] AttachResourceConfigTransformer: attaching to %q (%T) config from %#v", dag.VertexName(v), v, r.DeclRange)
                         arn.AttachResourceConfig(r)
-                        break
                 }
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_schema.go b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_schema.go
new file mode 100644
index 0000000..c7695dd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_schema.go
@@ -0,0 +1,99 @@
+package terraform
+
+import (
+        "fmt"
+        "log"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/dag"
+)
+
+// GraphNodeAttachResourceSchema is an interface implemented by node types
+// that need a resource schema attached.
+type GraphNodeAttachResourceSchema interface {
+        GraphNodeResource
+        GraphNodeProviderConsumer
+
+        AttachResourceSchema(schema *configschema.Block, version uint64)
+}
+
+// GraphNodeAttachProviderConfigSchema is an interface implemented by node types
+// that need a provider configuration schema attached.
+type GraphNodeAttachProviderConfigSchema interface {
+        GraphNodeProvider
+
+        AttachProviderConfigSchema(*configschema.Block)
+}
+
+// GraphNodeAttachProvisionerSchema is an interface implemented by node types
+// that need one or more provisioner schemas attached.
+type GraphNodeAttachProvisionerSchema interface {
+        ProvisionedBy() []string
+
+        // SetProvisionerSchema is called during transform for each provisioner
+        // type returned from ProvisionedBy, providing the configuration schema
+        // for each provisioner in turn. The implementer should save these for
+        // later use in evaluating provisioner configuration blocks.
+        AttachProvisionerSchema(name string, schema *configschema.Block)
+}
+
+// AttachSchemaTransformer finds nodes that implement
+// GraphNodeAttachResourceSchema, GraphNodeAttachProviderConfigSchema, or
+// GraphNodeAttachProvisionerSchema, looks up the needed schemas for each
+// and then passes them to a method implemented by the node.
+type AttachSchemaTransformer struct {
+        Schemas *Schemas
+}
+
+func (t *AttachSchemaTransformer) Transform(g *Graph) error {
+        if t.Schemas == nil {
+                // Should never happen with a reasonable caller, but we'll return a
+                // proper error here anyway so that we'll fail gracefully.
+                return fmt.Errorf("AttachSchemaTransformer used with nil Schemas")
+        }
+
+        for _, v := range g.Vertices() {
+
+                if tv, ok := v.(GraphNodeAttachResourceSchema); ok {
+                        addr := tv.ResourceAddr()
+                        mode := addr.Resource.Mode
+                        typeName := addr.Resource.Type
+                        providerAddr, _ := tv.ProvidedBy()
+                        providerType := providerAddr.ProviderConfig.Type
+
+                        schema, version := t.Schemas.ResourceTypeConfig(providerType, mode, typeName)
+                        if schema == nil {
+                                log.Printf("[ERROR] AttachSchemaTransformer: No resource schema available for %s", addr)
+                                continue
+                        }
+                        log.Printf("[TRACE] AttachSchemaTransformer: attaching resource schema to %s", dag.VertexName(v))
+                        tv.AttachResourceSchema(schema, version)
+                }
+
+                if tv, ok := v.(GraphNodeAttachProviderConfigSchema); ok {
+                        providerAddr := tv.ProviderAddr()
+                        schema := t.Schemas.ProviderConfig(providerAddr.ProviderConfig.Type)
+                        if schema == nil {
+                                log.Printf("[ERROR] AttachSchemaTransformer: No provider config schema available for %s", providerAddr)
+                                continue
+                        }
+                        log.Printf("[TRACE] AttachSchemaTransformer: attaching provider config schema to %s", dag.VertexName(v))
+                        tv.AttachProviderConfigSchema(schema)
+                }
+
+                if tv, ok := v.(GraphNodeAttachProvisionerSchema); ok {
+                        names := tv.ProvisionedBy()
+                        for _, name := range names {
+                                schema := t.Schemas.ProvisionerConfig(name)
+                                if schema == nil {
+                                        log.Printf("[ERROR] AttachSchemaTransformer: No schema available for provisioner %q on %q", name, dag.VertexName(v))
+                                        continue
+                                }
+                                log.Printf("[TRACE] AttachSchemaTransformer: attaching provisioner %q config schema to %s", name, dag.VertexName(v))
+                                tv.AttachProvisionerSchema(name, schema)
+                        }
+                }
+        }
+
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_state.go b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_state.go
index 564ff08..3af7b98 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_state.go
@@ -4,64 +4,64 @@ import (
         "log"
 
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
 )
 
 // GraphNodeAttachResourceState is an interface that can be implemented
 // to request that a ResourceState is attached to the node.
+//
+// Due to a historical naming inconsistency, the type ResourceState actually
+// represents the state for a particular _instance_, while InstanceState
+// represents the values for that instance during a particular phase
+// (e.g. primary vs. deposed). Consequently, GraphNodeAttachResourceState
+// is supported only for nodes that represent resource instances, even though
+// the name might suggest it is for containing resources.
 type GraphNodeAttachResourceState interface {
-        // The address to the resource for the state
-        ResourceAddr() *ResourceAddress
+        GraphNodeResourceInstance
 
         // Sets the state
-        AttachResourceState(*ResourceState)
+        AttachResourceState(*states.Resource)
 }
 
 // AttachStateTransformer goes through the graph and attaches
 // state to nodes that implement the interfaces above.
 type AttachStateTransformer struct {
-        State *State // State is the root state
+        State *states.State // State is the root state
 }
 
 func (t *AttachStateTransformer) Transform(g *Graph) error {
         // If no state, then nothing to do
         if t.State == nil {
-                log.Printf("[DEBUG] Not attaching any state: state is nil")
+                log.Printf("[DEBUG] Not attaching any node states: overall state is nil")
                 return nil
         }
 
-        filter := &StateFilter{State: t.State}
         for _, v := range g.Vertices() {
-                // Only care about nodes requesting we're adding state
+                // Nodes implement this interface to request state attachment.
                 an, ok := v.(GraphNodeAttachResourceState)
                 if !ok {
                         continue
                 }
-                addr := an.ResourceAddr()
+                addr := an.ResourceInstanceAddr()
 
-                // Get the module state
-                results, err := filter.Filter(addr.String())
-                if err != nil {
-                        return err
+                rs := t.State.Resource(addr.ContainingResource())
+                if rs == nil {
+                        log.Printf("[DEBUG] Resource state not found for node %q, instance %s", dag.VertexName(v), addr)
+                        continue
                 }
 
-                // Attach the first resource state we get
-                found := false
-                for _, result := range results {
-                        if rs, ok := result.Value.(*ResourceState); ok {
-                                log.Printf(
-                                        "[DEBUG] Attaching resource state to %q: %#v",
-                                        dag.VertexName(v), rs)
-                                an.AttachResourceState(rs)
-                                found = true
-                                break
-                        }
+                is := rs.Instance(addr.Resource.Key)
+                if is == nil {
+                        // We don't actually need this here, since we'll attach the whole
+                        // resource state, but we still check because it'd be weird
+                        // for the specific instance we're attaching to not to exist.
+                        log.Printf("[DEBUG] Resource instance state not found for node %q, instance %s", dag.VertexName(v), addr)
+                        continue
                 }
 
-                if !found {
-                        log.Printf(
-                                "[DEBUG] Resource state not found for %q: %s",
-                                dag.VertexName(v), addr)
-                }
+                // make sure to attach a copy of the state, so instances can modify the
+                // same ResourceState.
+                an.AttachResourceState(rs.DeepCopy())
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_config.go b/vendor/github.com/hashicorp/terraform/terraform/transform_config.go
index 61bce85..9d3b6f4 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_config.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_config.go
@@ -1,13 +1,11 @@
 package terraform
 
 import (
-        "errors"
-        "fmt"
         "log"
         "sync"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -26,14 +24,14 @@ type ConfigTransformer struct {
         Concrete ConcreteResourceNodeFunc
 
         // Module is the module to add resources from.
-        Module *module.Tree
+        Config *configs.Config
 
         // Unique will only add resources that aren't already present in the graph.
         Unique bool
 
         // Mode will only add resources that match the given mode
         ModeFilter bool
-        Mode       config.ResourceMode
+        Mode       addrs.ResourceMode
 
         l         sync.Mutex
         uniqueMap map[string]struct{}
@@ -44,16 +42,11 @@ func (t *ConfigTransformer) Transform(g *Graph) error {
         t.l.Lock()
         defer t.l.Unlock()
 
-        // If no module is given, we don't do anything
-        if t.Module == nil {
+        // If no configuration is available, we don't do anything
+        if t.Config == nil {
                 return nil
         }
 
-        // If the module isn't loaded, that is simply an error
-        if !t.Module.Loaded() {
-                return errors.New("module must be loaded for ConfigTransformer")
-        }
-
         // Reset the uniqueness map. If we're tracking uniques, then populate
         // it with addresses.
         t.uniqueMap = make(map[string]struct{})
@@ -67,22 +60,22 @@ func (t *ConfigTransformer) Transform(g *Graph) error {
         }
 
         // Start the transformation process
-        return t.transform(g, t.Module)
+        return t.transform(g, t.Config)
 }
 
-func (t *ConfigTransformer) transform(g *Graph, m *module.Tree) error {
+func (t *ConfigTransformer) transform(g *Graph, config *configs.Config) error {
         // If no config, do nothing
-        if m == nil {
+        if config == nil {
                 return nil
         }
 
         // Add our resources
-        if err := t.transformSingle(g, m); err != nil {
+        if err := t.transformSingle(g, config); err != nil {
                 return err
         }
 
         // Transform all the children.
-        for _, c := range m.Children() {
+        for _, c := range config.Children {
                 if err := t.transform(g, c); err != nil {
                         return err
                 }
@@ -91,43 +84,48 @@ func (t *ConfigTransformer) transform(g *Graph, m *module.Tree) error {
         return nil
 }
 
-func (t *ConfigTransformer) transformSingle(g *Graph, m *module.Tree) error {
-        log.Printf("[TRACE] ConfigTransformer: Starting for path: %v", m.Path())
-
-        // Get the configuration for this module
-        conf := m.Config()
-
-        // Build the path we're at
-        path := m.Path()
+func (t *ConfigTransformer) transformSingle(g *Graph, config *configs.Config) error {
+        path := config.Path
+        module := config.Module
+        log.Printf("[TRACE] ConfigTransformer: Starting for path: %v", path)
+
+        // For now we assume that each module call produces only one module
+        // instance with no key, since we don't yet support "count" and "for_each"
+        // on modules.
+        // FIXME: As part of supporting "count" and "for_each" on modules, rework
+        // this so that we'll "expand" the module call first and then create graph
+        // nodes for each module instance separately.
+        instPath := path.UnkeyedInstanceShim()
+
+        allResources := make([]*configs.Resource, 0, len(module.ManagedResources)+len(module.DataResources))
+        for _, r := range module.ManagedResources {
+                allResources = append(allResources, r)
+        }
+        for _, r := range module.DataResources {
+                allResources = append(allResources, r)
+        }
 
-        // Write all the resources out
-        for _, r := range conf.Resources {
-                // Build the resource address
-                addr, err := parseResourceAddressConfig(r)
-                if err != nil {
-                        panic(fmt.Sprintf(
-                                "Error parsing config address, this is a bug: %#v", r))
-                }
-                addr.Path = path
+        for _, r := range allResources {
+                relAddr := r.Addr()
 
-                // If this is already in our uniqueness map, don't add it again
-                if _, ok := t.uniqueMap[addr.String()]; ok {
+                if t.ModeFilter && relAddr.Mode != t.Mode {
+                        // Skip non-matching modes
                         continue
                 }
 
-                // Remove non-matching modes
-                if t.ModeFilter && addr.Mode != t.Mode {
+                addr := relAddr.Absolute(instPath)
+                if _, ok := t.uniqueMap[addr.String()]; ok {
+                        // We've already seen a resource with this address. This should
+                        // never happen, because we enforce uniqueness in the config loader.
                         continue
                 }
 
-                // Build the abstract node and the concrete one
                 abstract := &NodeAbstractResource{Addr: addr}
                 var node dag.Vertex = abstract
                 if f := t.Concrete; f != nil {
                         node = f(abstract)
                 }
 
-                // Add it to the graph
                 g.Add(node)
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_config_flat.go b/vendor/github.com/hashicorp/terraform/terraform/transform_config_flat.go
index 92f9888..866c917 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_config_flat.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_config_flat.go
@@ -1,9 +1,7 @@
 package terraform
 
 import (
-        "errors"
-
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -20,54 +18,47 @@ import (
 type FlatConfigTransformer struct {
         Concrete ConcreteResourceNodeFunc // What to turn resources into
 
-        Module *module.Tree
+        Config *configs.Config
 }
 
 func (t *FlatConfigTransformer) Transform(g *Graph) error {
-        // If no module, we do nothing
-        if t.Module == nil {
+        // We have nothing to do if there is no configuration.
+        if t.Config == nil {
                 return nil
         }
 
-        // If the module is not loaded, that is an error
-        if !t.Module.Loaded() {
-                return errors.New("module must be loaded")
-        }
-
-        return t.transform(g, t.Module)
+        return t.transform(g, t.Config)
 }
 
-func (t *FlatConfigTransformer) transform(g *Graph, m *module.Tree) error {
-        // If no module, no problem
-        if m == nil {
+func (t *FlatConfigTransformer) transform(g *Graph, config *configs.Config) error {
+        // If we have no configuration then there's nothing to do.
+        if config == nil {
                 return nil
         }
 
         // Transform all the children.
-        for _, c := range m.Children() {
+        for _, c := range config.Children {
                 if err := t.transform(g, c); err != nil {
                         return err
                 }
         }
 
-        // Get the configuration for this module
-        config := m.Config()
-
-        // Write all the resources out
-        for _, r := range config.Resources {
-                // Grab the address for this resource
-                addr, err := parseResourceAddressConfig(r)
-                if err != nil {
-                        return err
-                }
-                addr.Path = m.Path()
+        module := config.Module
+        // For now we assume that each module call produces only one module
+        // instance with no key, since we don't yet support "count" and "for_each"
+        // on modules.
+        // FIXME: As part of supporting "count" and "for_each" on modules, rework
+        // this so that we'll "expand" the module call first and then create graph
+        // nodes for each module instance separately.
+        instPath := config.Path.UnkeyedInstanceShim()
 
-                // Build the abstract resource. We have the config already so
-                // we'll just pre-populate that.
+        for _, r := range module.ManagedResources {
+                addr := r.Addr().Absolute(instPath)
                 abstract := &NodeAbstractResource{
                         Addr:   addr,
                         Config: r,
                 }
+                // Grab the address for this resource
                 var node dag.Vertex = abstract
                 if f := t.Concrete; f != nil {
                         node = f(abstract)
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_count_boundary.go b/vendor/github.com/hashicorp/terraform/terraform/transform_count_boundary.go
index 83415f3..01601bd 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_count_boundary.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_count_boundary.go
@@ -1,16 +1,21 @@
 package terraform
 
 import (
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
 )
 
 // CountBoundaryTransformer adds a node that depends on everything else
 // so that it runs last in order to clean up the state for nodes that
 // are on the "count boundary": "foo.0" when only one exists becomes "foo"
-type CountBoundaryTransformer struct{}
+type CountBoundaryTransformer struct {
+        Config *configs.Config
+}
 
 func (t *CountBoundaryTransformer) Transform(g *Graph) error {
-        node := &NodeCountBoundary{}
+        node := &NodeCountBoundary{
+                Config: t.Config,
+        }
         g.Add(node)
 
         // Depends on everything
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_deposed.go b/vendor/github.com/hashicorp/terraform/terraform/transform_deposed.go
deleted file mode 100644
index 87a1f9c..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_deposed.go
+++ /dev/null
@@ -1,178 +0,0 @@
-package terraform
-
-import "fmt"
-
-// DeposedTransformer is a GraphTransformer that adds deposed resources
-// to the graph.
-type DeposedTransformer struct {
-        // State is the global state. We'll automatically find the correct
-        // ModuleState based on the Graph.Path that is being transformed.
-        State *State
-
-        // View, if non-empty, is the ModuleState.View used around the state
-        // to find deposed resources.
-        View string
-
-        // The provider used by the resourced which were deposed
-        ResolvedProvider string
-}
-
-func (t *DeposedTransformer) Transform(g *Graph) error {
-        state := t.State.ModuleByPath(g.Path)
-        if state == nil {
-                // If there is no state for our module there can't be any deposed
-                // resources, since they live in the state.
-                return nil
-        }
-
-        // If we have a view, apply it now
-        if t.View != "" {
-                state = state.View(t.View)
-        }
-
-        // Go through all the resources in our state to look for deposed resources
-        for k, rs := range state.Resources {
-                // If we have no deposed resources, then move on
-                if len(rs.Deposed) == 0 {
-                        continue
-                }
-
-                deposed := rs.Deposed
-
-                for i, _ := range deposed {
-                        g.Add(&graphNodeDeposedResource{
-                                Index:            i,
-                                ResourceName:     k,
-                                ResourceType:     rs.Type,
-                                ProviderName:     rs.Provider,
-                                ResolvedProvider: t.ResolvedProvider,
-                        })
-                }
-        }
-
-        return nil
-}
-
-// graphNodeDeposedResource is the graph vertex representing a deposed resource.
-type graphNodeDeposedResource struct {
-        Index            int
-        ResourceName     string
-        ResourceType     string
-        ProviderName     string
-        ResolvedProvider string
-}
-
-func (n *graphNodeDeposedResource) Name() string {
-        return fmt.Sprintf("%s (deposed #%d)", n.ResourceName, n.Index)
-}
-
-func (n *graphNodeDeposedResource) ProvidedBy() string {
-        return resourceProvider(n.ResourceName, n.ProviderName)
-}
-
-func (n *graphNodeDeposedResource) SetProvider(p string) {
-        n.ResolvedProvider = p
-}
-
-// GraphNodeEvalable impl.
-func (n *graphNodeDeposedResource) EvalTree() EvalNode {
-        var provider ResourceProvider
-        var state *InstanceState
-
-        seq := &EvalSequence{Nodes: make([]EvalNode, 0, 5)}
-
-        // Build instance info
-        info := &InstanceInfo{Id: n.Name(), Type: n.ResourceType}
-        seq.Nodes = append(seq.Nodes, &EvalInstanceInfo{Info: info})
-
-        // Refresh the resource
-        seq.Nodes = append(seq.Nodes, &EvalOpFilter{
-                Ops: []walkOperation{walkRefresh},
-                Node: &EvalSequence{
-                        Nodes: []EvalNode{
-                                &EvalGetProvider{
-                                        Name:   n.ResolvedProvider,
-                                        Output: &provider,
-                                },
-                                &EvalReadStateDeposed{
-                                        Name:   n.ResourceName,
-                                        Output: &state,
-                                        Index:  n.Index,
-                                },
-                                &EvalRefresh{
-                                        Info:     info,
-                                        Provider: &provider,
-                                        State:    &state,
-                                        Output:   &state,
-                                },
-                                &EvalWriteStateDeposed{
-                                        Name:         n.ResourceName,
-                                        ResourceType: n.ResourceType,
-                                        Provider:     n.ResolvedProvider,
-                                        State:        &state,
-                                        Index:        n.Index,
-                                },
-                        },
-                },
-        })
-
-        // Apply
-        var diff *InstanceDiff
-        var err error
-        seq.Nodes = append(seq.Nodes, &EvalOpFilter{
-                Ops: []walkOperation{walkApply, walkDestroy},
-                Node: &EvalSequence{
-                        Nodes: []EvalNode{
-                                &EvalGetProvider{
-                                        Name:   n.ResolvedProvider,
-                                        Output: &provider,
-                                },
-                                &EvalReadStateDeposed{
-                                        Name:   n.ResourceName,
-                                        Output: &state,
-                                        Index:  n.Index,
-                                },
-                                &EvalDiffDestroy{
-                                        Info:   info,
-                                        State:  &state,
-                                        Output: &diff,
-                                },
-                                // Call pre-apply hook
-                                &EvalApplyPre{
-                                        Info:  info,
-                                        State: &state,
-                                        Diff:  &diff,
-                                },
-                                &EvalApply{
-                                        Info:     info,
-                                        State:    &state,
-                                        Diff:     &diff,
-                                        Provider: &provider,
-                                        Output:   &state,
-                                        Error:    &err,
-                                },
-                                // Always write the resource back to the state deposed... if it
-                                // was successfully destroyed it will be pruned. If it was not, it will
-                                // be caught on the next run.
-                                &EvalWriteStateDeposed{
-                                        Name:         n.ResourceName,
-                                        ResourceType: n.ResourceType,
-                                        Provider:     n.ResolvedProvider,
-                                        State:        &state,
-                                        Index:        n.Index,
-                                },
-                                &EvalApplyPost{
-                                        Info:  info,
-                                        State: &state,
-                                        Error: &err,
-                                },
-                                &EvalReturnError{
-                                        Error: &err,
-                                },
-                                &EvalUpdateStateHook{},
-                        },
-                },
-        })
-
-        return seq
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_cbd.go b/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_cbd.go
index edfb460..2f4d5ed 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_cbd.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_cbd.go
@@ -4,15 +4,15 @@ import (
         "fmt"
         "log"
 
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
 )
 
 // GraphNodeDestroyerCBD must be implemented by nodes that might be
-// create-before-destroy destroyers.
+// create-before-destroy destroyers, or might plan a create-before-destroy
+// action.
 type GraphNodeDestroyerCBD interface {
-        GraphNodeDestroyer
-
         // CreateBeforeDestroy returns true if this node represents a node
         // that is doing a CBD.
         CreateBeforeDestroy() bool
@@ -23,6 +23,89 @@ type GraphNodeDestroyerCBD interface {
         ModifyCreateBeforeDestroy(bool) error
 }
 
+// GraphNodeAttachDestroyer is implemented by applyable nodes that have a
+// companion destroy node. This allows the creation node to look up the status
+// of the destroy node and determine if it needs to depose the existing state,
+// or replace it.
+// If a node is not marked as create-before-destroy in the configuration, but a
+// dependency forces that status, only the destroy node will be aware of that
+// status.
+type GraphNodeAttachDestroyer interface {
+        // AttachDestroyNode takes a destroy node and saves a reference to that
+        // node in the receiver, so it can later check the status of
+        // CreateBeforeDestroy().
+        AttachDestroyNode(n GraphNodeDestroyerCBD)
+}
+
+// ForcedCBDTransformer detects when a particular CBD-able graph node has
+// dependencies with another that has create_before_destroy set that require
+// it to be forced on, and forces it on.
+//
+// This must be used in the plan graph builder to ensure that
+// create_before_destroy settings are properly propagated before constructing
+// the planned changes. This requires that the plannable resource nodes
+// implement GraphNodeDestroyerCBD.
+type ForcedCBDTransformer struct {
+}
+
+func (t *ForcedCBDTransformer) Transform(g *Graph) error {
+        for _, v := range g.Vertices() {
+                dn, ok := v.(GraphNodeDestroyerCBD)
+                if !ok {
+                        continue
+                }
+
+                if !dn.CreateBeforeDestroy() {
+                        // If there are no CBD decendent (dependent nodes), then we
+                        // do nothing here.
+                        if !t.hasCBDDescendent(g, v) {
+                                log.Printf("[TRACE] ForcedCBDTransformer: %q (%T) has no CBD descendent, so skipping", dag.VertexName(v), v)
+                                continue
+                        }
+
+                        // If this isn't naturally a CBD node, this means that an descendent is
+                        // and we need to auto-upgrade this node to CBD. We do this because
+                        // a CBD node depending on non-CBD will result in cycles. To avoid this,
+                        // we always attempt to upgrade it.
+                        log.Printf("[TRACE] ForcedCBDTransformer: forcing create_before_destroy on for %q (%T)", dag.VertexName(v), v)
+                        if err := dn.ModifyCreateBeforeDestroy(true); err != nil {
+                                return fmt.Errorf(
+                                        "%s: must have create before destroy enabled because "+
+                                                "a dependent resource has CBD enabled. However, when "+
+                                                "attempting to automatically do this, an error occurred: %s",
+                                        dag.VertexName(v), err)
+                        }
+                } else {
+                        log.Printf("[TRACE] ForcedCBDTransformer: %q (%T) already has create_before_destroy set", dag.VertexName(v), v)
+                }
+        }
+        return nil
+}
+
+// hasCBDDescendent returns true if any descendent (node that depends on this)
+// has CBD set.
+func (t *ForcedCBDTransformer) hasCBDDescendent(g *Graph, v dag.Vertex) bool {
+        s, _ := g.Descendents(v)
+        if s == nil {
+                return true
+        }
+
+        for _, ov := range s.List() {
+                dn, ok := ov.(GraphNodeDestroyerCBD)
+                if !ok {
+                        continue
+                }
+
+                if dn.CreateBeforeDestroy() {
+                        // some descendent is CreateBeforeDestroy, so we need to follow suit
+                        log.Printf("[TRACE] ForcedCBDTransformer: %q has CBD descendent %q", dag.VertexName(v), dag.VertexName(ov))
+                        return true
+                }
+        }
+
+        return false
+}
+
 // CBDEdgeTransformer modifies the edges of CBD nodes that went through
 // the DestroyEdgeTransformer to have the right dependencies. There are
 // two real tasks here:
@@ -35,16 +118,25 @@ type GraphNodeDestroyerCBD interface {
 //      update to A. Example: adding a web server updates the load balancer
 //      before deleting the old web server.
 //
+// This transformer requires that a previous transformer has already forced
+// create_before_destroy on for nodes that are depended on by explicit CBD
+// nodes. This is the logic in ForcedCBDTransformer, though in practice we
+// will get here by recording the CBD-ness of each change in the plan during
+// the plan walk and then forcing the nodes into the appropriate setting during
+// DiffTransformer when building the apply graph.
 type CBDEdgeTransformer struct {
         // Module and State are only needed to look up dependencies in
         // any way possible. Either can be nil if not availabile.
-        Module *module.Tree
-        State  *State
+        Config *configs.Config
+        State  *states.State
+
+        // If configuration is present then Schemas is required in order to
+        // obtain schema information from providers and provisioners so we can
+        // properly resolve implicit dependencies.
+        Schemas *Schemas
 }
 
 func (t *CBDEdgeTransformer) Transform(g *Graph) error {
-        log.Printf("[TRACE] CBDEdgeTransformer: Beginning CBD transformation...")
-
         // Go through and reverse any destroy edges
         destroyMap := make(map[string][]dag.Vertex)
         for _, v := range g.Vertices() {
@@ -52,25 +144,13 @@ func (t *CBDEdgeTransformer) Transform(g *Graph) error {
                 if !ok {
                         continue
                 }
+                dern, ok := v.(GraphNodeDestroyer)
+                if !ok {
+                        continue
+                }
 
                 if !dn.CreateBeforeDestroy() {
-                        // If there are no CBD ancestors (dependent nodes), then we
-                        // do nothing here.
-                        if !t.hasCBDAncestor(g, v) {
-                                continue
-                        }
-
-                        // If this isn't naturally a CBD node, this means that an ancestor is
-                        // and we need to auto-upgrade this node to CBD. We do this because
-                        // a CBD node depending on non-CBD will result in cycles. To avoid this,
-                        // we always attempt to upgrade it.
-                        if err := dn.ModifyCreateBeforeDestroy(true); err != nil {
-                                return fmt.Errorf(
-                                        "%s: must have create before destroy enabled because "+
-                                                "a dependent resource has CBD enabled. However, when "+
-                                                "attempting to automatically do this, an error occurred: %s",
-                                        dag.VertexName(v), err)
-                        }
+                        continue
                 }
 
                 // Find the destroy edge. There should only be one.
@@ -86,7 +166,9 @@ func (t *CBDEdgeTransformer) Transform(g *Graph) error {
 
                         // Found it! Invert.
                         g.RemoveEdge(de)
-                        g.Connect(&DestroyEdge{S: de.Target(), T: de.Source()})
+                        applyNode := de.Source()
+                        destroyNode := de.Target()
+                        g.Connect(&DestroyEdge{S: destroyNode, T: applyNode})
                 }
 
                 // If the address has an index, we strip that. Our depMap creation
@@ -94,15 +176,11 @@ func (t *CBDEdgeTransformer) Transform(g *Graph) error {
                 // dependencies. One day when we limit dependencies more exactly
                 // this will have to change. We have a test case covering this
                 // (depNonCBDCountBoth) so it'll be caught.
-                addr := dn.DestroyAddr()
-                if addr.Index >= 0 {
-                        addr = addr.Copy() // Copy so that we don't modify any pointers
-                        addr.Index = -1
-                }
+                addr := dern.DestroyAddr()
+                key := addr.ContainingResource().String()
 
                 // Add this to the list of nodes that we need to fix up
                 // the edges for (step 2 above in the docs).
-                key := addr.String()
                 destroyMap[key] = append(destroyMap[key], v)
         }
 
@@ -151,13 +229,9 @@ func (t *CBDEdgeTransformer) Transform(g *Graph) error {
                 // dependencies. One day when we limit dependencies more exactly
                 // this will have to change. We have a test case covering this
                 // (depNonCBDCount) so it'll be caught.
-                if addr.Index >= 0 {
-                        addr = addr.Copy() // Copy so that we don't modify any pointers
-                        addr.Index = -1
-                }
+                key := addr.ContainingResource().String()
 
                 // If there is nothing this resource should depend on, ignore it
-                key := addr.String()
                 dns, ok := depMap[key]
                 if !ok {
                         continue
@@ -174,21 +248,21 @@ func (t *CBDEdgeTransformer) Transform(g *Graph) error {
         return nil
 }
 
-func (t *CBDEdgeTransformer) depMap(
-        destroyMap map[string][]dag.Vertex) (map[string][]dag.Vertex, error) {
+func (t *CBDEdgeTransformer) depMap(destroyMap map[string][]dag.Vertex) (map[string][]dag.Vertex, error) {
         // Build the graph of our config, this ensures that all resources
         // are present in the graph.
-        g, err := (&BasicGraphBuilder{
+        g, diags := (&BasicGraphBuilder{
                 Steps: []GraphTransformer{
-                        &FlatConfigTransformer{Module: t.Module},
-                        &AttachResourceConfigTransformer{Module: t.Module},
+                        &FlatConfigTransformer{Config: t.Config},
+                        &AttachResourceConfigTransformer{Config: t.Config},
                         &AttachStateTransformer{State: t.State},
+                        &AttachSchemaTransformer{Schemas: t.Schemas},
                         &ReferenceTransformer{},
                 },
                 Name: "CBDEdgeTransformer",
         }).Build(nil)
-        if err != nil {
-                return nil, err
+        if diags.HasErrors() {
+                return nil, diags.Err()
         }
 
         // Using this graph, build the list of destroy nodes that each resource
@@ -232,26 +306,3 @@ func (t *CBDEdgeTransformer) depMap(
 
         return depMap, nil
 }
-
-// hasCBDAncestor returns true if any ancestor (node that depends on this)
-// has CBD set.
-func (t *CBDEdgeTransformer) hasCBDAncestor(g *Graph, v dag.Vertex) bool {
-        s, _ := g.Ancestors(v)
-        if s == nil {
-                return true
-        }
-
-        for _, v := range s.List() {
-                dn, ok := v.(GraphNodeDestroyerCBD)
-                if !ok {
-                        continue
-                }
-
-                if dn.CreateBeforeDestroy() {
-                        // some ancestor is CreateBeforeDestroy, so we need to follow suit
-                        return true
-                }
-        }
-
-        return false
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_edge.go b/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_edge.go
index a06ff29..7fb415b 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_edge.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_edge.go
@@ -3,7 +3,10 @@ package terraform
 import (
         "log"
 
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -11,16 +14,16 @@ import (
 type GraphNodeDestroyer interface {
         dag.Vertex
 
-        // ResourceAddr is the address of the resource that is being
+        // DestroyAddr is the address of the resource that is being
         // destroyed by this node. If this returns nil, then this node
         // is not destroying anything.
-        DestroyAddr() *ResourceAddress
+        DestroyAddr() *addrs.AbsResourceInstance
 }
 
 // GraphNodeCreator must be implemented by nodes that create OR update resources.
 type GraphNodeCreator interface {
-        // ResourceAddr is the address of the resource being created or updated
-        CreateAddr() *ResourceAddress
+        // CreateAddr is the address of the resource being created or updated
+        CreateAddr() *addrs.AbsResourceInstance
 }
 
 // DestroyEdgeTransformer is a GraphTransformer that creates the proper
@@ -40,33 +43,37 @@ type GraphNodeCreator interface {
 type DestroyEdgeTransformer struct {
         // These are needed to properly build the graph of dependencies
         // to determine what a destroy node depends on. Any of these can be nil.
-        Module *module.Tree
-        State  *State
+        Config *configs.Config
+        State  *states.State
+
+        // If configuration is present then Schemas is required in order to
+        // obtain schema information from providers and provisioners in order
+        // to properly resolve implicit dependencies.
+        Schemas *Schemas
 }
 
 func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
-        log.Printf("[TRACE] DestroyEdgeTransformer: Beginning destroy edge transformation...")
-
         // Build a map of what is being destroyed (by address string) to
-        // the list of destroyers. In general there will only be one destroyer
-        // but to make it more robust we support multiple.
+        // the list of destroyers. Usually there will be at most one destroyer
+        // per node, but we allow multiple if present for completeness.
         destroyers := make(map[string][]GraphNodeDestroyer)
+        destroyerAddrs := make(map[string]addrs.AbsResourceInstance)
         for _, v := range g.Vertices() {
                 dn, ok := v.(GraphNodeDestroyer)
                 if !ok {
                         continue
                 }
 
-                addr := dn.DestroyAddr()
-                if addr == nil {
+                addrP := dn.DestroyAddr()
+                if addrP == nil {
                         continue
                 }
+                addr := *addrP
 
                 key := addr.String()
-                log.Printf(
-                        "[TRACE] DestroyEdgeTransformer: %s destroying %q",
-                        dag.VertexName(dn), key)
+                log.Printf("[TRACE] DestroyEdgeTransformer: %q (%T) destroys %s", dag.VertexName(dn), v, key)
                 destroyers[key] = append(destroyers[key], dn)
+                destroyerAddrs[key] = addr
         }
 
         // If we aren't destroying anything, there will be no edges to make
@@ -100,10 +107,20 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
                         a := v
 
                         log.Printf(
-                                "[TRACE] DestroyEdgeTransformer: connecting creator/destroyer: %s, %s",
+                                "[TRACE] DestroyEdgeTransformer: connecting creator %q with destroyer %q",
                                 dag.VertexName(a), dag.VertexName(a_d))
 
                         g.Connect(&DestroyEdge{S: a, T: a_d})
+
+                        // Attach the destroy node to the creator
+                        // There really shouldn't be more than one destroyer, but even if
+                        // there are, any of them will represent the correct
+                        // CreateBeforeDestroy status.
+                        if n, ok := cn.(GraphNodeAttachDestroyer); ok {
+                                if d, ok := d.(GraphNodeDestroyerCBD); ok {
+                                        n.AttachDestroyNode(d)
+                                }
+                        }
                 }
         }
 
@@ -120,20 +137,24 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
         }
         steps := []GraphTransformer{
                 // Add the local values
-                &LocalTransformer{Module: t.Module},
+                &LocalTransformer{Config: t.Config},
 
                 // Add outputs and metadata
-                &OutputTransformer{Module: t.Module},
-                &AttachResourceConfigTransformer{Module: t.Module},
+                &OutputTransformer{Config: t.Config},
+                &AttachResourceConfigTransformer{Config: t.Config},
                 &AttachStateTransformer{State: t.State},
 
-                TransformProviders(nil, providerFn, t.Module),
-
                 // Add all the variables. We can depend on resources through
                 // variables due to module parameters, and we need to properly
                 // determine that.
-                &RootVariableTransformer{Module: t.Module},
-                &ModuleVariableTransformer{Module: t.Module},
+                &RootVariableTransformer{Config: t.Config},
+                &ModuleVariableTransformer{Config: t.Config},
+
+                TransformProviders(nil, providerFn, t.Config),
+
+                // Must attach schemas before ReferenceTransformer so that we can
+                // analyze the configuration to find references.
+                &AttachSchemaTransformer{Schemas: t.Schemas},
 
                 &ReferenceTransformer{},
         }
@@ -146,37 +167,36 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
         //
         var tempG Graph
         var tempDestroyed []dag.Vertex
-        for d, _ := range destroyers {
-                // d is what is being destroyed. We parse the resource address
-                // which it came from it is a panic if this fails.
-                addr, err := ParseResourceAddress(d)
-                if err != nil {
-                        panic(err)
-                }
+        for d := range destroyers {
+                // d is the string key for the resource being destroyed. We actually
+                // want the address value, which we stashed earlier.
+                addr := destroyerAddrs[d]
 
                 // This part is a little bit weird but is the best way to
                 // find the dependencies we need to: build a graph and use the
                 // attach config and state transformers then ask for references.
-                abstract := &NodeAbstractResource{Addr: addr}
+                abstract := NewNodeAbstractResourceInstance(addr)
                 tempG.Add(abstract)
                 tempDestroyed = append(tempDestroyed, abstract)
 
                 // We also add the destroy version here since the destroy can
                 // depend on things that the creation doesn't (destroy provisioners).
-                destroy := &NodeDestroyResource{NodeAbstractResource: abstract}
+                destroy := &NodeDestroyResourceInstance{NodeAbstractResourceInstance: abstract}
                 tempG.Add(destroy)
                 tempDestroyed = append(tempDestroyed, destroy)
         }
 
         // Run the graph transforms so we have the information we need to
         // build references.
+        log.Printf("[TRACE] DestroyEdgeTransformer: constructing temporary graph for analysis of references, starting from:\n%s", tempG.StringWithNodeTypes())
         for _, s := range steps {
+                log.Printf("[TRACE] DestroyEdgeTransformer: running %T on temporary graph", s)
                 if err := s.Transform(&tempG); err != nil {
+                        log.Printf("[TRACE] DestroyEdgeTransformer: %T failed: %s", s, err)
                         return err
                 }
         }
-
-        log.Printf("[TRACE] DestroyEdgeTransformer: reference graph: %s", tempG.String())
+        log.Printf("[TRACE] DestroyEdgeTransformer: temporary reference graph:\n%s", tempG.String())
 
         // Go through all the nodes in the graph and determine what they
         // depend on.
@@ -207,16 +227,13 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
 
                 // Get the destroy node for this. In the example of our struct,
                 // we are currently at B and we're looking for B_d.
-                rn, ok := v.(GraphNodeResource)
+                rn, ok := v.(GraphNodeResourceInstance)
                 if !ok {
+                        log.Printf("[TRACE] DestroyEdgeTransformer: skipping %s, since it's not a resource", dag.VertexName(v))
                         continue
                 }
 
-                addr := rn.ResourceAddr()
-                if addr == nil {
-                        continue
-                }
-
+                addr := rn.ResourceInstanceAddr()
                 dns := destroyers[addr.String()]
 
                 // We have dependencies, check if any are being destroyed
@@ -231,16 +248,12 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
                 // to see if A_d exists.
                 var depDestroyers []dag.Vertex
                 for _, v := range refs {
-                        rn, ok := v.(GraphNodeResource)
+                        rn, ok := v.(GraphNodeResourceInstance)
                         if !ok {
                                 continue
                         }
 
-                        addr := rn.ResourceAddr()
-                        if addr == nil {
-                                continue
-                        }
-
+                        addr := rn.ResourceInstanceAddr()
                         key := addr.String()
                         if ds, ok := destroyers[key]; ok {
                                 for _, d := range ds {
@@ -257,6 +270,7 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
                 for _, a_d := range dns {
                         for _, b_d := range depDestroyers {
                                 if b_d != a_d {
+                                        log.Printf("[TRACE] DestroyEdgeTransformer: %q depends on %q", dag.VertexName(b_d), dag.VertexName(a_d))
                                         g.Connect(dag.BasicEdge(b_d, a_d))
                                 }
                         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_diff.go b/vendor/github.com/hashicorp/terraform/terraform/transform_diff.go
index ad46d3c..6fb915f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_diff.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_diff.go
@@ -4,83 +4,189 @@ import (
         "fmt"
         "log"
 
-        "github.com/hashicorp/terraform/config/module"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
-// DiffTransformer is a GraphTransformer that adds the elements of
-// the diff to the graph.
-//
-// This transform is used for example by the ApplyGraphBuilder to ensure
-// that only resources that are being modified are represented in the graph.
-//
-// Module and State is still required for the DiffTransformer for annotations
-// since the Diff doesn't contain all the information required to build the
-// complete graph (such as create-before-destroy information). The graph
-// is built based on the diff first, though, ensuring that only resources
-// that are being modified are present in the graph.
+// DiffTransformer is a GraphTransformer that adds graph nodes representing
+// each of the resource changes described in the given Changes object.
 type DiffTransformer struct {
-        Concrete ConcreteResourceNodeFunc
-
-        Diff   *Diff
-        Module *module.Tree
-        State  *State
+        Concrete ConcreteResourceInstanceNodeFunc
+        State    *states.State
+        Changes  *plans.Changes
 }
 
 func (t *DiffTransformer) Transform(g *Graph) error {
-        // If the diff is nil or empty (nil is empty) then do nothing
-        if t.Diff.Empty() {
+        if t.Changes == nil || len(t.Changes.Resources) == 0 {
+                // Nothing to do!
                 return nil
         }
 
         // Go through all the modules in the diff.
-        log.Printf("[TRACE] DiffTransformer: starting")
-        var nodes []dag.Vertex
-        for _, m := range t.Diff.Modules {
-                log.Printf("[TRACE] DiffTransformer: Module: %s", m)
-                // TODO: If this is a destroy diff then add a module destroy node
-
-                // Go through all the resources in this module.
-                for name, inst := range m.Resources {
-                        log.Printf("[TRACE] DiffTransformer: Resource %q: %#v", name, inst)
-
-                        // We have changes! This is a create or update operation.
-                        // First grab the address so we have a unique way to
-                        // reference this resource.
-                        addr, err := parseResourceAddressInternal(name)
-                        if err != nil {
-                                panic(fmt.Sprintf(
-                                        "Error parsing internal name, this is a bug: %q", name))
-                        }
+        log.Printf("[TRACE] DiffTransformer starting")
+
+        var diags tfdiags.Diagnostics
+        state := t.State
+        changes := t.Changes
+
+        // DiffTransformer creates resource _instance_ nodes. If there are any
+        // whole-resource nodes already in the graph, we must ensure that they
+        // get evaluated before any of the corresponding instances by creating
+        // dependency edges, so we'll do some prep work here to ensure we'll only
+        // create connections to nodes that existed before we started here.
+        resourceNodes := map[string][]GraphNodeResource{}
+        for _, node := range g.Vertices() {
+                rn, ok := node.(GraphNodeResource)
+                if !ok {
+                        continue
+                }
+                // We ignore any instances that _also_ implement
+                // GraphNodeResourceInstance, since in the unlikely event that they
+                // do exist we'd probably end up creating cycles by connecting them.
+                if _, ok := node.(GraphNodeResourceInstance); ok {
+                        continue
+                }
+
+                addr := rn.ResourceAddr().String()
+                resourceNodes[addr] = append(resourceNodes[addr], rn)
+        }
+
+        for _, rc := range changes.Resources {
+                addr := rc.Addr
+                dk := rc.DeposedKey
+
+                log.Printf("[TRACE] DiffTransformer: found %s change for %s %s", rc.Action, addr, dk)
+
+                // Depending on the action we'll need some different combinations of
+                // nodes, because destroying uses a special node type separate from
+                // other actions.
+                var update, delete, createBeforeDestroy bool
+                switch rc.Action {
+                case plans.NoOp:
+                        continue
+                case plans.Delete:
+                        delete = true
+                case plans.DeleteThenCreate, plans.CreateThenDelete:
+                        update = true
+                        delete = true
+                        createBeforeDestroy = (rc.Action == plans.CreateThenDelete)
+                default:
+                        update = true
+                }
+
+                if dk != states.NotDeposed && update {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid planned change for deposed object",
+                                fmt.Sprintf("The plan contains a non-delete change for %s deposed object %s. The only valid action for a deposed object is to destroy it, so this is a bug in Terraform.", addr, dk),
+                        ))
+                        continue
+                }
 
-                        // Very important: add the module path for this resource to
-                        // the address. Remove "root" from it.
-                        addr.Path = m.Path[1:]
+                // If we're going to do a create_before_destroy Replace operation then
+                // we need to allocate a DeposedKey to use to retain the
+                // not-yet-destroyed prior object, so that the delete node can destroy
+                // _that_ rather than the newly-created node, which will be current
+                // by the time the delete node is visited.
+                if update && delete && createBeforeDestroy {
+                        // In this case, variable dk will be the _pre-assigned_ DeposedKey
+                        // that must be used if the update graph node deposes the current
+                        // instance, which will then align with the same key we pass
+                        // into the destroy node to ensure we destroy exactly the deposed
+                        // object we expect.
+                        if state != nil {
+                                ris := state.ResourceInstance(addr)
+                                if ris == nil {
+                                        // Should never happen, since we don't plan to replace an
+                                        // instance that doesn't exist yet.
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Invalid planned change",
+                                                fmt.Sprintf("The plan contains a replace change for %s, which doesn't exist yet. This is a bug in Terraform.", addr),
+                                        ))
+                                        continue
+                                }
+
+                                // Allocating a deposed key separately from using it can be racy
+                                // in general, but we assume here that nothing except the apply
+                                // node we instantiate below will actually make new deposed objects
+                                // in practice, and so the set of already-used keys will not change
+                                // between now and then.
+                                dk = ris.FindUnusedDeposedKey()
+                        } else {
+                                // If we have no state at all yet then we can use _any_
+                                // DeposedKey.
+                                dk = states.NewDeposedKey()
+                        }
+                }
 
-                        // If we're destroying, add the destroy node
-                        if inst.Destroy || inst.GetDestroyDeposed() {
-                                abstract := &NodeAbstractResource{Addr: addr}
-                                g.Add(&NodeDestroyResource{NodeAbstractResource: abstract})
+                if update {
+                        // All actions except destroying the node type chosen by t.Concrete
+                        abstract := NewNodeAbstractResourceInstance(addr)
+                        var node dag.Vertex = abstract
+                        if f := t.Concrete; f != nil {
+                                node = f(abstract)
                         }
 
-                        // If we have changes, then add the applyable version
-                        if len(inst.Attributes) > 0 {
-                                // Add the resource to the graph
-                                abstract := &NodeAbstractResource{Addr: addr}
-                                var node dag.Vertex = abstract
-                                if f := t.Concrete; f != nil {
-                                        node = f(abstract)
+                        if createBeforeDestroy {
+                                // We'll attach our pre-allocated DeposedKey to the node if
+                                // it supports that. NodeApplyableResourceInstance is the
+                                // specific concrete node type we are looking for here really,
+                                // since that's the only node type that might depose objects.
+                                if dn, ok := node.(GraphNodeDeposer); ok {
+                                        dn.SetPreallocatedDeposedKey(dk)
                                 }
+                                log.Printf("[TRACE] DiffTransformer: %s will be represented by %s, deposing prior object to %s", addr, dag.VertexName(node), dk)
+                        } else {
+                                log.Printf("[TRACE] DiffTransformer: %s will be represented by %s", addr, dag.VertexName(node))
+                        }
 
-                                nodes = append(nodes, node)
+                        g.Add(node)
+                        rsrcAddr := addr.ContainingResource().String()
+                        for _, rsrcNode := range resourceNodes[rsrcAddr] {
+                                g.Connect(dag.BasicEdge(node, rsrcNode))
+                        }
+                }
+
+                if delete {
+                        // Destroying always uses a destroy-specific node type, though
+                        // which one depends on whether we're destroying a current object
+                        // or a deposed object.
+                        var node GraphNodeResourceInstance
+                        abstract := NewNodeAbstractResourceInstance(addr)
+                        if dk == states.NotDeposed {
+                                node = &NodeDestroyResourceInstance{
+                                        NodeAbstractResourceInstance: abstract,
+                                        DeposedKey:                   dk,
+                                }
+                                node.(*NodeDestroyResourceInstance).ModifyCreateBeforeDestroy(createBeforeDestroy)
+                        } else {
+                                node = &NodeDestroyDeposedResourceInstanceObject{
+                                        NodeAbstractResourceInstance: abstract,
+                                        DeposedKey:                   dk,
+                                }
+                        }
+                        if dk == states.NotDeposed {
+                                log.Printf("[TRACE] DiffTransformer: %s will be represented for destruction by %s", addr, dag.VertexName(node))
+                        } else {
+                                log.Printf("[TRACE] DiffTransformer: %s deposed object %s will be represented for destruction by %s", addr, dk, dag.VertexName(node))
+                        }
+                        g.Add(node)
+                        rsrcAddr := addr.ContainingResource().String()
+                        for _, rsrcNode := range resourceNodes[rsrcAddr] {
+                                // We connect this edge "forwards" (even though destroy dependencies
+                                // are often inverted) because evaluating the resource node
+                                // after the destroy node could cause an unnecessary husk of
+                                // a resource state to be re-added.
+                                g.Connect(dag.BasicEdge(node, rsrcNode))
                         }
                 }
-        }
 
-        // Add all the nodes to the graph
-        for _, n := range nodes {
-                g.Add(n)
         }
 
-        return nil
+        log.Printf("[TRACE] DiffTransformer complete")
+
+        return diags.Err()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_import_provider.go b/vendor/github.com/hashicorp/terraform/terraform/transform_import_provider.go
index 3673771..c1945f0 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_import_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_import_provider.go
@@ -2,7 +2,10 @@ package terraform
 
 import (
         "fmt"
-        "strings"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ImportProviderValidateTransformer is a GraphTransformer that goes through
@@ -10,6 +13,8 @@ import (
 type ImportProviderValidateTransformer struct{}
 
 func (t *ImportProviderValidateTransformer) Transform(g *Graph) error {
+        var diags tfdiags.Diagnostics
+
         for _, v := range g.Vertices() {
                 // We only care about providers
                 pv, ok := v.(GraphNodeProvider)
@@ -24,15 +29,16 @@ func (t *ImportProviderValidateTransformer) Transform(g *Graph) error {
                 }
 
                 for _, ref := range rn.References() {
-                        if !strings.HasPrefix(ref, "var.") {
-                                return fmt.Errorf(
-                                        "Provider %q depends on non-var %q. Providers for import can currently\n"+
-                                                "only depend on variables or must be hardcoded. You can stop import\n"+
-                                                "from loading configurations by specifying `-config=\"\"`.",
-                                        pv.ProviderName(), ref)
+                        if _, ok := ref.Subject.(addrs.InputVariable); !ok {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid provider dependency for import",
+                                        Detail:   fmt.Sprintf("The configuration for %s depends on %s. Providers used with import must either have literal configuration or refer only to input variables.", pv.ProviderAddr(), ref.Subject.String()),
+                                        Subject:  ref.SourceRange.ToHCL().Ptr(),
+                                })
                         }
                 }
         }
 
-        return nil
+        return diags.Err()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_import_state.go b/vendor/github.com/hashicorp/terraform/terraform/transform_import_state.go
index fcbff65..ab0ecae 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_import_state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_import_state.go
@@ -2,6 +2,10 @@ package terraform
 
 import (
         "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ImportStateTransformer is a GraphTransformer that adds nodes to the
@@ -11,64 +15,68 @@ type ImportStateTransformer struct {
 }
 
 func (t *ImportStateTransformer) Transform(g *Graph) error {
-        nodes := make([]*graphNodeImportState, 0, len(t.Targets))
         for _, target := range t.Targets {
-                addr, err := ParseResourceAddress(target.Addr)
-                if err != nil {
-                        return fmt.Errorf(
-                                "failed to parse resource address '%s': %s",
-                                target.Addr, err)
+                // The ProviderAddr may not be supplied for non-aliased providers.
+                // This will be populated if the targets come from the cli, but tests
+                // may not specify implied provider addresses.
+                providerAddr := target.ProviderAddr
+                if providerAddr.ProviderConfig.Type == "" {
+                        providerAddr = target.Addr.Resource.Resource.DefaultProviderConfig().Absolute(target.Addr.Module)
                 }
 
-                nodes = append(nodes, &graphNodeImportState{
-                        Addr:         addr,
+                node := &graphNodeImportState{
+                        Addr:         target.Addr,
                         ID:           target.ID,
-                        ProviderName: target.Provider,
-                })
-        }
-
-        // Build the graph vertices
-        for _, n := range nodes {
-                g.Add(n)
+                        ProviderAddr: providerAddr,
+                }
+                g.Add(node)
         }
-
         return nil
 }
 
 type graphNodeImportState struct {
-        Addr             *ResourceAddress // Addr is the resource address to import to
-        ID               string           // ID is the ID to import as
-        ProviderName     string           // Provider string
-        ResolvedProvider string           // provider node address
+        Addr             addrs.AbsResourceInstance // Addr is the resource address to import into
+        ID               string                    // ID is the ID to import as
+        ProviderAddr     addrs.AbsProviderConfig   // Provider address given by the user, or implied by the resource type
+        ResolvedProvider addrs.AbsProviderConfig   // provider node address after resolution
 
-        states []*InstanceState
+        states []providers.ImportedResource
 }
 
+var (
+        _ GraphNodeSubPath           = (*graphNodeImportState)(nil)
+        _ GraphNodeEvalable          = (*graphNodeImportState)(nil)
+        _ GraphNodeProviderConsumer  = (*graphNodeImportState)(nil)
+        _ GraphNodeDynamicExpandable = (*graphNodeImportState)(nil)
+)
+
 func (n *graphNodeImportState) Name() string {
-        return fmt.Sprintf("%s (import id: %s)", n.Addr, n.ID)
+        return fmt.Sprintf("%s (import id %q)", n.Addr, n.ID)
 }
 
-func (n *graphNodeImportState) ProvidedBy() string {
-        return resourceProvider(n.Addr.Type, n.ProviderName)
+// GraphNodeProviderConsumer
+func (n *graphNodeImportState) ProvidedBy() (addrs.AbsProviderConfig, bool) {
+        // We assume that n.ProviderAddr has been properly populated here.
+        // It's the responsibility of the code creating a graphNodeImportState
+        // to populate this, possibly by calling DefaultProviderConfig() on the
+        // resource address to infer an implied provider from the resource type
+        // name.
+        return n.ProviderAddr, false
 }
 
-func (n *graphNodeImportState) SetProvider(p string) {
-        n.ResolvedProvider = p
+// GraphNodeProviderConsumer
+func (n *graphNodeImportState) SetProvider(addr addrs.AbsProviderConfig) {
+        n.ResolvedProvider = addr
 }
 
 // GraphNodeSubPath
-func (n *graphNodeImportState) Path() []string {
-        return normalizeModulePath(n.Addr.Path)
+func (n *graphNodeImportState) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // GraphNodeEvalable impl.
 func (n *graphNodeImportState) EvalTree() EvalNode {
-        var provider ResourceProvider
-        info := &InstanceInfo{
-                Id:         fmt.Sprintf("%s.%s", n.Addr.Type, n.Addr.Name),
-                ModulePath: n.Path(),
-                Type:       n.Addr.Type,
-        }
+        var provider providers.Interface
 
         // Reset our states
         n.states = nil
@@ -77,13 +85,13 @@ func (n *graphNodeImportState) EvalTree() EvalNode {
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
+                                Addr:   n.ResolvedProvider,
                                 Output: &provider,
                         },
                         &EvalImportState{
+                                Addr:     n.Addr.Resource,
                                 Provider: &provider,
-                                Info:     info,
-                                Id:       n.ID,
+                                ID:       n.ID,
                                 Output:   &n.states,
                         },
                 },
@@ -97,6 +105,8 @@ func (n *graphNodeImportState) EvalTree() EvalNode {
 // resources they don't depend on anything else and refreshes are isolated
 // so this is nearly a perfect use case for dynamic expand.
 func (n *graphNodeImportState) DynamicExpand(ctx EvalContext) (*Graph, error) {
+        var diags tfdiags.Diagnostics
+
         g := &Graph{Path: ctx.Path()}
 
         // nameCounter is used to de-dup names in the state.
@@ -105,11 +115,11 @@ func (n *graphNodeImportState) DynamicExpand(ctx EvalContext) (*Graph, error) {
         // Compile the list of addresses that we'll be inserting into the state.
         // We do this ahead of time so we can verify that we aren't importing
         // something that already exists.
-        addrs := make([]*ResourceAddress, len(n.states))
+        addrs := make([]addrs.AbsResourceInstance, len(n.states))
         for i, state := range n.states {
-                addr := *n.Addr
-                if t := state.Ephemeral.Type; t != "" {
-                        addr.Type = t
+                addr := n.Addr
+                if t := state.TypeName; t != "" {
+                        addr.Resource.Resource.Type = t
                 }
 
                 // Determine if we need to suffix the name to de-dup
@@ -117,36 +127,31 @@ func (n *graphNodeImportState) DynamicExpand(ctx EvalContext) (*Graph, error) {
                 count, ok := nameCounter[key]
                 if ok {
                         count++
-                        addr.Name += fmt.Sprintf("-%d", count)
+                        addr.Resource.Resource.Name += fmt.Sprintf("-%d", count)
                 }
                 nameCounter[key] = count
 
                 // Add it to our list
-                addrs[i] = &addr
+                addrs[i] = addr
         }
 
         // Verify that all the addresses are clear
-        state, lock := ctx.State()
-        lock.RLock()
-        defer lock.RUnlock()
-        filter := &StateFilter{State: state}
+        state := ctx.State()
         for _, addr := range addrs {
-                result, err := filter.Filter(addr.String())
-                if err != nil {
-                        return nil, fmt.Errorf("Error verifying address %s: %s", addr, err)
-                }
-
-                // Go through the filter results and it is an error if we find
-                // a matching InstanceState, meaning that we would have a collision.
-                for _, r := range result {
-                        if _, ok := r.Value.(*InstanceState); ok {
-                                return nil, fmt.Errorf(
-                                        "Can't import %s, would collide with an existing resource.\n\n"+
-                                                "Please remove or rename this resource before continuing.",
-                                        addr)
-                        }
+                existing := state.ResourceInstance(addr)
+                if existing != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Resource already managed by Terraform",
+                                fmt.Sprintf("Terraform is already managing a remote object for %s. To import to this address you must first remove the existing object from the state.", addr),
+                        ))
+                        continue
                 }
         }
+        if diags.HasErrors() {
+                // Bail out early, then.
+                return nil, diags.Err()
+        }
 
         // For each of the states, we add a node to handle the refresh/add to state.
         // "n.states" is populated by our own EvalTree with the result of
@@ -154,10 +159,8 @@ func (n *graphNodeImportState) DynamicExpand(ctx EvalContext) (*Graph, error) {
         // is safe.
         for i, state := range n.states {
                 g.Add(&graphNodeImportStateSub{
-                        Target:           addrs[i],
-                        Path_:            n.Path(),
+                        TargetAddr:       addrs[i],
                         State:            state,
-                        ProviderName:     n.ProviderName,
                         ResolvedProvider: n.ResolvedProvider,
                 })
         }
@@ -169,79 +172,67 @@ func (n *graphNodeImportState) DynamicExpand(ctx EvalContext) (*Graph, error) {
         }
 
         // Done!
-        return g, nil
+        return g, diags.Err()
 }
 
 // graphNodeImportStateSub is the sub-node of graphNodeImportState
 // and is part of the subgraph. This node is responsible for refreshing
 // and adding a resource to the state once it is imported.
 type graphNodeImportStateSub struct {
-        Target           *ResourceAddress
-        State            *InstanceState
-        Path_            []string
-        ProviderName     string
-        ResolvedProvider string
+        TargetAddr       addrs.AbsResourceInstance
+        State            providers.ImportedResource
+        ResolvedProvider addrs.AbsProviderConfig
 }
 
+var (
+        _ GraphNodeSubPath  = (*graphNodeImportStateSub)(nil)
+        _ GraphNodeEvalable = (*graphNodeImportStateSub)(nil)
+)
+
 func (n *graphNodeImportStateSub) Name() string {
-        return fmt.Sprintf("import %s result: %s", n.Target, n.State.ID)
+        return fmt.Sprintf("import %s result", n.TargetAddr)
 }
 
-func (n *graphNodeImportStateSub) Path() []string {
-        return n.Path_
+func (n *graphNodeImportStateSub) Path() addrs.ModuleInstance {
+        return n.TargetAddr.Module
 }
 
 // GraphNodeEvalable impl.
 func (n *graphNodeImportStateSub) EvalTree() EvalNode {
         // If the Ephemeral type isn't set, then it is an error
-        if n.State.Ephemeral.Type == "" {
-                err := fmt.Errorf(
-                        "import of %s didn't set type for %s",
-                        n.Target.String(), n.State.ID)
+        if n.State.TypeName == "" {
+                err := fmt.Errorf("import of %s didn't set type", n.TargetAddr.String())
                 return &EvalReturnError{Error: &err}
         }
 
-        // DeepCopy so we're only modifying our local copy
-        state := n.State.DeepCopy()
+        state := n.State.AsInstanceObject()
 
-        // Build the resource info
-        info := &InstanceInfo{
-                Id:         fmt.Sprintf("%s.%s", n.Target.Type, n.Target.Name),
-                ModulePath: n.Path_,
-                Type:       n.State.Ephemeral.Type,
-        }
-
-        // Key is the resource key
-        key := &ResourceStateKey{
-                Name:  n.Target.Name,
-                Type:  info.Type,
-                Index: n.Target.Index,
-        }
-
-        // The eval sequence
-        var provider ResourceProvider
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
+                                Addr:   n.ResolvedProvider,
                                 Output: &provider,
+                                Schema: &providerSchema,
                         },
                         &EvalRefresh{
-                                Provider: &provider,
-                                State:    &state,
-                                Info:     info,
-                                Output:   &state,
+                                Addr:           n.TargetAddr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                                Output:         &state,
                         },
                         &EvalImportStateVerify{
-                                Info:  info,
-                                Id:    n.State.ID,
+                                Addr:  n.TargetAddr.Resource,
                                 State: &state,
                         },
                         &EvalWriteState{
-                                Name:         key.String(),
-                                ResourceType: info.Type,
-                                Provider:     n.ResolvedProvider,
-                                State:        &state,
+                                Addr:           n.TargetAddr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
                         },
                 },
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_local.go b/vendor/github.com/hashicorp/terraform/terraform/transform_local.go
index 95ecfc0..84eb26b 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_local.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_local.go
@@ -1,37 +1,45 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
 )
 
 // LocalTransformer is a GraphTransformer that adds all the local values
 // from the configuration to the graph.
 type LocalTransformer struct {
-        Module *module.Tree
+        Config *configs.Config
 }
 
 func (t *LocalTransformer) Transform(g *Graph) error {
-        return t.transformModule(g, t.Module)
+        return t.transformModule(g, t.Config)
 }
 
-func (t *LocalTransformer) transformModule(g *Graph, m *module.Tree) error {
-        if m == nil {
+func (t *LocalTransformer) transformModule(g *Graph, c *configs.Config) error {
+        if c == nil {
                 // Can't have any locals if there's no config
                 return nil
         }
 
-        for _, local := range m.Config().Locals {
+        // Our addressing system distinguishes between modules and module instances,
+        // but we're not yet ready to make that distinction here (since we don't
+        // support "count"/"for_each" on modules) and so we just do a naive
+        // transform of the module path into a module instance path, assuming that
+        // no keys are in use. This should be removed when "count" and "for_each"
+        // are implemented for modules.
+        path := c.Path.UnkeyedInstanceShim()
+
+        for _, local := range c.Module.Locals {
+                addr := path.LocalValue(local.Name)
                 node := &NodeLocal{
-                        PathValue: normalizeModulePath(m.Path()),
-                        Config:    local,
+                        Addr:   addr,
+                        Config: local,
                 }
-
                 g.Add(node)
         }
 
         // Also populate locals for child modules
-        for _, c := range m.Children() {
-                if err := t.transformModule(g, c); err != nil {
+        for _, cc := range c.Children {
+                if err := t.transformModule(g, cc); err != nil {
                         return err
                 }
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_module_variable.go b/vendor/github.com/hashicorp/terraform/terraform/transform_module_variable.go
index 467950b..a994bd4 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_module_variable.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_module_variable.go
@@ -1,46 +1,54 @@
 package terraform
 
 import (
-        "log"
+        "fmt"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
-        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs"
 )
 
 // ModuleVariableTransformer is a GraphTransformer that adds all the variables
 // in the configuration to the graph.
 //
-// This only adds variables that are referenced by other things in the graph.
-// If a module variable is not referenced, it won't be added to the graph.
+// Any "variable" block present in any non-root module is included here, even
+// if a particular variable is not referenced from anywhere.
+//
+// The transform will produce errors if a call to a module does not conform
+// to the expected set of arguments, but this transformer is not in a good
+// position to return errors and so the validate walk should include specific
+// steps for validating module blocks, separate from this transform.
 type ModuleVariableTransformer struct {
-        Module *module.Tree
-
-        DisablePrune bool // True if pruning unreferenced should be disabled
+        Config *configs.Config
 }
 
 func (t *ModuleVariableTransformer) Transform(g *Graph) error {
-        return t.transform(g, nil, t.Module)
+        return t.transform(g, nil, t.Config)
 }
 
-func (t *ModuleVariableTransformer) transform(g *Graph, parent, m *module.Tree) error {
-        // If no config, no variables
-        if m == nil {
+func (t *ModuleVariableTransformer) transform(g *Graph, parent, c *configs.Config) error {
+        // We can have no variables if we have no configuration.
+        if c == nil {
                 return nil
         }
 
-        // Transform all the children. This must be done BEFORE the transform
-        // above since child module variables can reference parent module variables.
-        for _, c := range m.Children() {
-                if err := t.transform(g, m, c); err != nil {
+        // Transform all the children first.
+        for _, cc := range c.Children {
+                if err := t.transform(g, c, cc); err != nil {
                         return err
                 }
         }
 
+        // If we're processing anything other than the root module then we'll
+        // add graph nodes for variables defined inside. (Variables for the root
+        // module are dealt with in RootVariableTransformer).
         // If we have a parent, we can determine if a module variable is being
         // used, so we transform this.
         if parent != nil {
-                if err := t.transformSingle(g, parent, m); err != nil {
+                if err := t.transformSingle(g, parent, c); err != nil {
                         return err
                 }
         }
@@ -48,71 +56,69 @@ func (t *ModuleVariableTransformer) transform(g *Graph, parent, m *module.Tree)
         return nil
 }
 
-func (t *ModuleVariableTransformer) transformSingle(g *Graph, parent, m *module.Tree) error {
-        // If we have no vars, we're done!
-        vars := m.Config().Variables
-        if len(vars) == 0 {
-                log.Printf("[TRACE] Module %#v has no variables, skipping.", m.Path())
-                return nil
+func (t *ModuleVariableTransformer) transformSingle(g *Graph, parent, c *configs.Config) error {
+
+        // Our addressing system distinguishes between modules and module instances,
+        // but we're not yet ready to make that distinction here (since we don't
+        // support "count"/"for_each" on modules) and so we just do a naive
+        // transform of the module path into a module instance path, assuming that
+        // no keys are in use. This should be removed when "count" and "for_each"
+        // are implemented for modules.
+        path := c.Path.UnkeyedInstanceShim()
+        _, call := path.Call()
+
+        // Find the call in the parent module configuration, so we can get the
+        // expressions given for each input variable at the call site.
+        callConfig, exists := parent.Module.ModuleCalls[call.Name]
+        if !exists {
+                // This should never happen, since it indicates an improperly-constructed
+                // configuration tree.
+                panic(fmt.Errorf("no module call block found for %s", path))
         }
 
-        // Look for usage of this module
-        var mod *config.Module
-        for _, modUse := range parent.Config().Modules {
-                if modUse.Name == m.Name() {
-                        mod = modUse
-                        break
-                }
+        // We need to construct a schema for the expected call arguments based on
+        // the configured variables in our config, which we can then use to
+        // decode the content of the call block.
+        schema := &hcl.BodySchema{}
+        for _, v := range c.Module.Variables {
+                schema.Attributes = append(schema.Attributes, hcl.AttributeSchema{
+                        Name:     v.Name,
+                        Required: v.Default == cty.NilVal,
+                })
         }
-        if mod == nil {
-                log.Printf("[INFO] Module %#v not used, not adding variables", m.Path())
-                return nil
+
+        content, contentDiags := callConfig.Config.Content(schema)
+        if contentDiags.HasErrors() {
+                // Validation code elsewhere should deal with any errors before we
+                // get in here, but we'll report them out here just in case, to
+                // avoid crashes.
+                var diags tfdiags.Diagnostics
+                diags = diags.Append(contentDiags)
+                return diags.Err()
         }
 
-        // Build the reference map so we can determine if we're referencing things.
-        refMap := NewReferenceMap(g.Vertices())
-
-        // Add all variables here
-        for _, v := range vars {
-                // Determine the value of the variable. If it isn't in the
-                // configuration then it was never set and that's not a problem.
-                var value *config.RawConfig
-                if raw, ok := mod.RawConfig.Raw[v.Name]; ok {
-                        var err error
-                        value, err = config.NewRawConfig(map[string]interface{}{
-                                v.Name: raw,
-                        })
-                        if err != nil {
-                                // This shouldn't happen because it is already in
-                                // a RawConfig above meaning it worked once before.
-                                panic(err)
+        for _, v := range c.Module.Variables {
+                var expr hcl.Expression
+                if attr := content.Attributes[v.Name]; attr != nil {
+                        expr = attr.Expr
+                } else {
+                        // No expression provided for this variable, so we'll make a
+                        // synthetic one using the variable's default value.
+                        expr = &hclsyntax.LiteralValueExpr{
+                                Val:      v.Default,
+                                SrcRange: v.DeclRange, // This is not exact, but close enough
                         }
                 }
 
-                // Build the node.
-                //
-                // NOTE: For now this is just an "applyable" variable. As we build
-                // new graph builders for the other operations I suspect we'll
-                // find a way to parameterize this, require new transforms, etc.
+                // For now we treat all module variables as "applyable", even though
+                // such nodes are valid to use on other walks too. We may specialize
+                // this in future if we find reasons to employ different behaviors
+                // in different scenarios.
                 node := &NodeApplyableModuleVariable{
-                        PathValue: normalizeModulePath(m.Path()),
-                        Config:    v,
-                        Value:     value,
-                        Module:    t.Module,
+                        Addr:   path.InputVariable(v.Name),
+                        Config: v,
+                        Expr:   expr,
                 }
-
-                if !t.DisablePrune {
-                        // If the node is not referenced by anything, then we don't need
-                        // to include it since it won't be used.
-                        if matches := refMap.ReferencedBy(node); len(matches) == 0 {
-                                log.Printf(
-                                        "[INFO] Not including %q in graph, nothing depends on it",
-                                        dag.VertexName(node))
-                                continue
-                        }
-                }
-
-                // Add it!
                 g.Add(node)
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_count.go b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_count.go
index b256a25..eec762e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_count.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_count.go
@@ -3,7 +3,9 @@ package terraform
 import (
         "log"
 
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
 )
 
 // OrphanResourceCountTransformer is a GraphTransformer that adds orphans
@@ -14,95 +16,106 @@ import (
 // This transform assumes that if an element in the state is within the count
 // bounds given, that it is not an orphan.
 type OrphanResourceCountTransformer struct {
-        Concrete ConcreteResourceNodeFunc
+        Concrete ConcreteResourceInstanceNodeFunc
 
-        Count int              // Actual count of the resource
-        Addr  *ResourceAddress // Addr of the resource to look for orphans
-        State *State           // Full global state
+        Count int               // Actual count of the resource, or -1 if count is not set at all
+        Addr  addrs.AbsResource // Addr of the resource to look for orphans
+        State *states.State     // Full global state
 }
 
 func (t *OrphanResourceCountTransformer) Transform(g *Graph) error {
-        log.Printf("[TRACE] OrphanResourceCount: Starting...")
+        rs := t.State.Resource(t.Addr)
+        if rs == nil {
+                return nil // Resource doesn't exist in state, so nothing to do!
+        }
 
-        // Grab the module in the state just for this resource address
-        ms := t.State.ModuleByPath(normalizeModulePath(t.Addr.Path))
-        if ms == nil {
-                // If no state, there can't be orphans
-                return nil
+        haveKeys := make(map[addrs.InstanceKey]struct{})
+        for key := range rs.Instances {
+                haveKeys[key] = struct{}{}
         }
 
-        orphanIndex := -1
-        if t.Count == 1 {
-                orphanIndex = 0
+        if t.Count < 0 {
+                return t.transformNoCount(haveKeys, g)
+        }
+        if t.Count == 0 {
+                return t.transformZeroCount(haveKeys, g)
         }
+        return t.transformCount(haveKeys, g)
+}
+
+func (t *OrphanResourceCountTransformer) transformCount(haveKeys map[addrs.InstanceKey]struct{}, g *Graph) error {
+        // Due to the logic in Transform, we only get in here if our count is
+        // at least one.
 
-        // Go through the orphans and add them all to the state
-        for key, _ := range ms.Resources {
-                // Build the address
-                addr, err := parseResourceAddressInternal(key)
-                if err != nil {
-                        return err
+        _, have0Key := haveKeys[addrs.IntKey(0)]
+
+        for key := range haveKeys {
+                if key == addrs.NoKey && !have0Key {
+                        // If we have no 0-key then we will accept a no-key instance
+                        // as an alias for it.
+                        continue
                 }
-                addr.Path = ms.Path[1:]
 
-                // Copy the address for comparison. If we aren't looking at
-                // the same resource, then just ignore it.
-                addrCopy := addr.Copy()
-                addrCopy.Index = -1
-                if !addrCopy.Equals(t.Addr) {
+                i, isInt := key.(addrs.IntKey)
+                if isInt && int(i) < t.Count {
                         continue
                 }
 
-                log.Printf("[TRACE] OrphanResourceCount: Checking: %s", addr)
+                abstract := NewNodeAbstractResourceInstance(t.Addr.Instance(key))
+                var node dag.Vertex = abstract
+                if f := t.Concrete; f != nil {
+                        node = f(abstract)
+                }
+                log.Printf("[TRACE] OrphanResourceCount(non-zero): adding %s as %T", t.Addr, node)
+                g.Add(node)
+        }
+
+        return nil
+}
 
-                idx := addr.Index
+func (t *OrphanResourceCountTransformer) transformZeroCount(haveKeys map[addrs.InstanceKey]struct{}, g *Graph) error {
+        // This case is easy: we need to orphan any keys we have at all.
 
-                // If we have zero and the index here is 0 or 1, then we
-                // change the index to a high number so that we treat it as
-                // an orphan.
-                if t.Count <= 0 && idx <= 0 {
-                        idx = t.Count + 1
+        for key := range haveKeys {
+                abstract := NewNodeAbstractResourceInstance(t.Addr.Instance(key))
+                var node dag.Vertex = abstract
+                if f := t.Concrete; f != nil {
+                        node = f(abstract)
                 }
+                log.Printf("[TRACE] OrphanResourceCount(zero): adding %s as %T", t.Addr, node)
+                g.Add(node)
+        }
 
-                // If we have a count greater than 0 and we're at the zero index,
-                // we do a special case check to see if our state also has a
-                // -1 index value. If so, this is an orphan because our rules are
-                // that if both a -1 and 0 are in the state, the 0 is destroyed.
-                if t.Count > 0 && idx == orphanIndex {
-                        // This is a piece of cleverness (beware), but its simple:
-                        // if orphanIndex is 0, then check -1, else check 0.
-                        checkIndex := (orphanIndex + 1) * -1
-
-                        key := &ResourceStateKey{
-                                Name:  addr.Name,
-                                Type:  addr.Type,
-                                Mode:  addr.Mode,
-                                Index: checkIndex,
-                        }
-
-                        if _, ok := ms.Resources[key.String()]; ok {
-                                // We have a -1 index, too. Make an arbitrarily high
-                                // index so that we always mark this as an orphan.
-                                log.Printf(
-                                        "[WARN] OrphanResourceCount: %q both -1 and 0 index found, orphaning %d",
-                                        addr, orphanIndex)
-                                idx = t.Count + 1
-                        }
-                }
+        return nil
+}
 
-                // If the index is within the count bounds, it is not an orphan
-                if idx < t.Count {
+func (t *OrphanResourceCountTransformer) transformNoCount(haveKeys map[addrs.InstanceKey]struct{}, g *Graph) error {
+        // Negative count indicates that count is not set at all, in which
+        // case we expect to have a single instance with no key set at all.
+        // However, we'll also accept an instance with key 0 set as an alias
+        // for it, in case the user has just deleted the "count" argument and
+        // so wants to keep the first instance in the set.
+
+        _, haveNoKey := haveKeys[addrs.NoKey]
+        _, have0Key := haveKeys[addrs.IntKey(0)]
+        keepKey := addrs.NoKey
+        if have0Key && !haveNoKey {
+                // If we don't have a no-key instance then we can use the 0-key instance
+                // instead.
+                keepKey = addrs.IntKey(0)
+        }
+
+        for key := range haveKeys {
+                if key == keepKey {
                         continue
                 }
 
-                // Build the abstract node and the concrete one
-                abstract := &NodeAbstractResource{Addr: addr}
+                abstract := NewNodeAbstractResourceInstance(t.Addr.Instance(key))
                 var node dag.Vertex = abstract
                 if f := t.Concrete; f != nil {
                         node = f(abstract)
                 }
-
-                // Add it to the graph
+                log.Printf("[TRACE] OrphanResourceCount(no-count): adding %s as %T", t.Addr, node)
                 g.Add(node)
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_output.go b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_output.go
index aea2bd0..c675409 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_output.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_output.go
@@ -3,16 +3,17 @@ package terraform
 import (
         "log"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/states"
 )
 
 // OrphanOutputTransformer finds the outputs that aren't present
 // in the given config that are in the state and adds them to the graph
 // for deletion.
 type OrphanOutputTransformer struct {
-        Module *module.Tree // Root module
-        State  *State       // State is the root state
+        Config *configs.Config // Root of config tree
+        State  *states.State   // State is the root state
 }
 
 func (t *OrphanOutputTransformer) Transform(g *Graph) error {
@@ -29,24 +30,30 @@ func (t *OrphanOutputTransformer) Transform(g *Graph) error {
         return nil
 }
 
-func (t *OrphanOutputTransformer) transform(g *Graph, ms *ModuleState) error {
+func (t *OrphanOutputTransformer) transform(g *Graph, ms *states.Module) error {
         if ms == nil {
                 return nil
         }
 
-        path := normalizeModulePath(ms.Path)
+        moduleAddr := ms.Addr
 
         // Get the config for this path, which is nil if the entire module has been
         // removed.
-        var c *config.Config
-        if m := t.Module.Child(path[1:]); m != nil {
-                c = m.Config()
+        var outputs map[string]*configs.Output
+        if c := t.Config.DescendentForInstance(moduleAddr); c != nil {
+                outputs = c.Module.Outputs
         }
 
-        // add all the orphaned outputs to the graph
-        for _, n := range ms.RemovedOutputs(c) {
-                g.Add(&NodeOutputOrphan{OutputName: n, PathValue: path})
+        // An output is "orphaned" if it's present in the state but not declared
+        // in the configuration.
+        for name := range ms.OutputValues {
+                if _, exists := outputs[name]; exists {
+                        continue
+                }
 
+                g.Add(&NodeOutputOrphan{
+                        Addr: addrs.OutputValue{Name: name}.Absolute(moduleAddr),
+                })
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_resource.go b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_resource.go
index e42d3c8..50df178 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_resource.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_resource.go
@@ -1,34 +1,43 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "log"
+
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
 )
 
-// OrphanResourceTransformer is a GraphTransformer that adds resource
-// orphans to the graph. A resource orphan is a resource that is
-// represented in the state but not in the configuration.
-//
-// This only adds orphans that have no representation at all in the
+// OrphanResourceInstanceTransformer is a GraphTransformer that adds orphaned
+// resource instances to the graph. An "orphan" is an instance that is present
+// in the state but belongs to a resource that is no longer present in the
 // configuration.
-type OrphanResourceTransformer struct {
-        Concrete ConcreteResourceNodeFunc
+//
+// This is not the transformer that deals with "count orphans" (instances that
+// are no longer covered by a resource's "count" or "for_each" setting); that's
+// handled instead by OrphanResourceCountTransformer.
+type OrphanResourceInstanceTransformer struct {
+        Concrete ConcreteResourceInstanceNodeFunc
 
         // State is the global state. We require the global state to
         // properly find module orphans at our path.
-        State *State
+        State *states.State
 
-        // Module is the root module. We'll look up the proper configuration
-        // using the graph path.
-        Module *module.Tree
+        // Config is the root node in the configuration tree. We'll look up
+        // the appropriate note in this tree using the path in each node.
+        Config *configs.Config
 }
 
-func (t *OrphanResourceTransformer) Transform(g *Graph) error {
+func (t *OrphanResourceInstanceTransformer) Transform(g *Graph) error {
         if t.State == nil {
                 // If the entire state is nil, there can't be any orphans
                 return nil
         }
+        if t.Config == nil {
+                // Should never happen: we can't be doing any Terraform operations
+                // without at least an empty configuration.
+                panic("OrphanResourceInstanceTransformer used without setting Config")
+        }
 
         // Go through the modules and for each module transform in order
         // to add the orphan.
@@ -41,38 +50,130 @@ func (t *OrphanResourceTransformer) Transform(g *Graph) error {
         return nil
 }
 
-func (t *OrphanResourceTransformer) transform(g *Graph, ms *ModuleState) error {
+func (t *OrphanResourceInstanceTransformer) transform(g *Graph, ms *states.Module) error {
         if ms == nil {
                 return nil
         }
 
-        // Get the configuration for this path. The configuration might be
+        moduleAddr := ms.Addr
+
+        // Get the configuration for this module. The configuration might be
         // nil if the module was removed from the configuration. This is okay,
         // this just means that every resource is an orphan.
-        var c *config.Config
-        if m := t.Module.Child(ms.Path[1:]); m != nil {
-                c = m.Config()
+        var m *configs.Module
+        if c := t.Config.DescendentForInstance(moduleAddr); c != nil {
+                m = c.Module
         }
 
-        // Go through the orphans and add them all to the state
-        for _, key := range ms.Orphans(c) {
-                // Build the abstract resource
-                addr, err := parseResourceAddressInternal(key)
-                if err != nil {
-                        return err
+        // An "orphan" is a resource that is in the state but not the configuration,
+        // so we'll walk the state resources and try to correlate each of them
+        // with a configuration block. Each orphan gets a node in the graph whose
+        // type is decided by t.Concrete.
+        //
+        // We don't handle orphans related to changes in the "count" and "for_each"
+        // pseudo-arguments here. They are handled by OrphanResourceCountTransformer.
+        for _, rs := range ms.Resources {
+                if m != nil {
+                        if r := m.ResourceByAddr(rs.Addr); r != nil {
+                                continue
+                        }
                 }
-                addr.Path = ms.Path[1:]
 
-                // Build the abstract node and the concrete one
-                abstract := &NodeAbstractResource{Addr: addr}
-                var node dag.Vertex = abstract
-                if f := t.Concrete; f != nil {
-                        node = f(abstract)
+                for key := range rs.Instances {
+                        addr := rs.Addr.Instance(key).Absolute(moduleAddr)
+                        abstract := NewNodeAbstractResourceInstance(addr)
+                        var node dag.Vertex = abstract
+                        if f := t.Concrete; f != nil {
+                                node = f(abstract)
+                        }
+                        log.Printf("[TRACE] OrphanResourceInstanceTransformer: adding single-instance orphan node for %s", addr)
+                        g.Add(node)
                 }
+        }
+
+        return nil
+}
+
+// OrphanResourceTransformer is a GraphTransformer that adds orphaned
+// resources to the graph. An "orphan" is a resource that is present in
+// the state but no longer present in the config.
+//
+// This is separate to OrphanResourceInstanceTransformer in that it deals with
+// whole resources, rather than individual instances of resources. Orphan
+// resource nodes are only used during apply to clean up leftover empty
+// resource state skeletons, after all of the instances inside have been
+// removed.
+//
+// This transformer will also create edges in the graph to any pre-existing
+// node that creates or destroys the entire orphaned resource or any of its
+// instances, to ensure that the "orphan-ness" of a resource is always dealt
+// with after all other aspects of it.
+type OrphanResourceTransformer struct {
+        Concrete ConcreteResourceNodeFunc
+
+        // State is the global state.
+        State *states.State
 
-                // Add it to the graph
-                g.Add(node)
+        // Config is the root node in the configuration tree.
+        Config *configs.Config
+}
+
+func (t *OrphanResourceTransformer) Transform(g *Graph) error {
+        if t.State == nil {
+                // If the entire state is nil, there can't be any orphans
+                return nil
+        }
+        if t.Config == nil {
+                // Should never happen: we can't be doing any Terraform operations
+                // without at least an empty configuration.
+                panic("OrphanResourceTransformer used without setting Config")
+        }
+
+        // We'll first collect up the existing nodes for each resource so we can
+        // create dependency edges for any new nodes we create.
+        deps := map[string][]dag.Vertex{}
+        for _, v := range g.Vertices() {
+                switch tv := v.(type) {
+                case GraphNodeResourceInstance:
+                        k := tv.ResourceInstanceAddr().ContainingResource().String()
+                        deps[k] = append(deps[k], v)
+                case GraphNodeResource:
+                        k := tv.ResourceAddr().String()
+                        deps[k] = append(deps[k], v)
+                case GraphNodeDestroyer:
+                        k := tv.DestroyAddr().ContainingResource().String()
+                        deps[k] = append(deps[k], v)
+                }
+        }
+
+        for _, ms := range t.State.Modules {
+                moduleAddr := ms.Addr
+
+                mc := t.Config.DescendentForInstance(moduleAddr) // might be nil if whole module has been removed
+
+                for _, rs := range ms.Resources {
+                        if mc != nil {
+                                if r := mc.Module.ResourceByAddr(rs.Addr); r != nil {
+                                        // It's in the config, so nothing to do for this one.
+                                        continue
+                                }
+                        }
+
+                        addr := rs.Addr.Absolute(moduleAddr)
+                        abstract := NewNodeAbstractResource(addr)
+                        var node dag.Vertex = abstract
+                        if f := t.Concrete; f != nil {
+                                node = f(abstract)
+                        }
+                        log.Printf("[TRACE] OrphanResourceTransformer: adding whole-resource orphan node for %s", addr)
+                        g.Add(node)
+                        for _, dn := range deps[addr.String()] {
+                                log.Printf("[TRACE] OrphanResourceTransformer: node %q depends on %q", dag.VertexName(node), dag.VertexName(dn))
+                                g.Connect(dag.BasicEdge(node, dn))
+                        }
+                }
         }
 
         return nil
+
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_output.go b/vendor/github.com/hashicorp/terraform/terraform/transform_output.go
index faa25e4..ed93cdb 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_output.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_output.go
@@ -3,7 +3,7 @@ package terraform
 import (
         "log"
 
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -14,42 +14,42 @@ import (
 // aren't changing since there is no downside: the state will be available
 // even if the dependent items aren't changing.
 type OutputTransformer struct {
-        Module *module.Tree
+        Config *configs.Config
 }
 
 func (t *OutputTransformer) Transform(g *Graph) error {
-        return t.transform(g, t.Module)
+        return t.transform(g, t.Config)
 }
 
-func (t *OutputTransformer) transform(g *Graph, m *module.Tree) error {
-        // If no config, no outputs
-        if m == nil {
+func (t *OutputTransformer) transform(g *Graph, c *configs.Config) error {
+        // If we have no config then there can be no outputs.
+        if c == nil {
                 return nil
         }
 
         // Transform all the children. We must do this first because
         // we can reference module outputs and they must show up in the
         // reference map.
-        for _, c := range m.Children() {
-                if err := t.transform(g, c); err != nil {
+        for _, cc := range c.Children {
+                if err := t.transform(g, cc); err != nil {
                         return err
                 }
         }
 
-        // If we have no outputs, we're done!
-        os := m.Config().Outputs
-        if len(os) == 0 {
-                return nil
-        }
+        // Our addressing system distinguishes between modules and module instances,
+        // but we're not yet ready to make that distinction here (since we don't
+        // support "count"/"for_each" on modules) and so we just do a naive
+        // transform of the module path into a module instance path, assuming that
+        // no keys are in use. This should be removed when "count" and "for_each"
+        // are implemented for modules.
+        path := c.Path.UnkeyedInstanceShim()
 
-        // Add all outputs here
-        for _, o := range os {
+        for _, o := range c.Module.Outputs {
+                addr := path.OutputValue(o.Name)
                 node := &NodeApplyableOutput{
-                        PathValue: normalizeModulePath(m.Path()),
-                        Config:    o,
+                        Addr:   addr,
+                        Config: o,
                 }
-
-                // Add it!
                 g.Add(node)
         }
 
@@ -71,8 +71,8 @@ func (t *DestroyOutputTransformer) Transform(g *Graph) error {
 
                 // create the destroy node for this output
                 node := &NodeDestroyableOutput{
-                        PathValue: output.PathValue,
-                        Config:    output.Config,
+                        Addr:   output.Addr,
+                        Config: output.Config,
                 }
 
                 log.Printf("[TRACE] creating %s", node.Name())
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_provider.go b/vendor/github.com/hashicorp/terraform/terraform/transform_provider.go
index c4772b4..6a4fb47 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_provider.go
@@ -1,22 +1,21 @@
 package terraform
 
 import (
-        "errors"
         "fmt"
         "log"
-        "strings"
 
-        "github.com/hashicorp/go-multierror"
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
-func TransformProviders(providers []string, concrete ConcreteProviderNodeFunc, mod *module.Tree) GraphTransformer {
+func TransformProviders(providers []string, concrete ConcreteProviderNodeFunc, config *configs.Config) GraphTransformer {
         return GraphTransformMulti(
                 // Add providers from the config
                 &ProviderConfigTransformer{
-                        Module:    mod,
+                        Config:    config,
                         Providers: providers,
                         Concrete:  concrete,
                 },
@@ -26,7 +25,9 @@ func TransformProviders(providers []string, concrete ConcreteProviderNodeFunc, m
                         Concrete:  concrete,
                 },
                 // Connect the providers
-                &ProviderTransformer{},
+                &ProviderTransformer{
+                        Config: config,
+                },
                 // Remove unused providers and proxies
                 &PruneProviderTransformer{},
                 // Connect provider to their parent provider nodes
@@ -36,10 +37,14 @@ func TransformProviders(providers []string, concrete ConcreteProviderNodeFunc, m
 
 // GraphNodeProvider is an interface that nodes that can be a provider
 // must implement.
-// ProviderName returns the name of the provider this satisfies.
+//
+// ProviderAddr returns the address of the provider configuration this
+// satisfies, which is relative to the path returned by method Path().
+//
 // Name returns the full name of the provider in the config.
 type GraphNodeProvider interface {
-        ProviderName() string
+        GraphNodeSubPath
+        ProviderAddr() addrs.AbsProviderConfig
         Name() string
 }
 
@@ -47,62 +52,132 @@ type GraphNodeProvider interface {
 // provider must implement. The CloseProviderName returned is the name of
 // the provider they satisfy.
 type GraphNodeCloseProvider interface {
-        CloseProviderName() string
+        GraphNodeSubPath
+        CloseProviderAddr() addrs.AbsProviderConfig
 }
 
 // GraphNodeProviderConsumer is an interface that nodes that require
-// a provider must implement. ProvidedBy must return the name of the provider
-// to use. This may be a provider by type, type.alias or a fully resolved
-// provider name
+// a provider must implement. ProvidedBy must return the address of the provider
+// to use, which will be resolved to a configuration either in the same module
+// or in an ancestor module, with the resulting absolute address passed to
+// SetProvider.
 type GraphNodeProviderConsumer interface {
-        ProvidedBy() string
+        // ProvidedBy returns the address of the provider configuration the node
+        // refers to. If the returned "exact" value is true, this address will
+        // be taken exactly. If "exact" is false, a provider configuration from
+        // an ancestor module may be selected instead.
+        ProvidedBy() (addr addrs.AbsProviderConfig, exact bool)
         // Set the resolved provider address for this resource.
-        SetProvider(string)
+        SetProvider(addrs.AbsProviderConfig)
 }
 
 // ProviderTransformer is a GraphTransformer that maps resources to
 // providers within the graph. This will error if there are any resources
 // that don't map to proper resources.
-type ProviderTransformer struct{}
+type ProviderTransformer struct {
+        Config *configs.Config
+}
 
 func (t *ProviderTransformer) Transform(g *Graph) error {
-        // Go through the other nodes and match them to providers they need
-        var err error
-        m := providerVertexMap(g)
+        // We need to find a provider configuration address for each resource
+        // either directly represented by a node or referenced by a node in
+        // the graph, and then create graph edges from provider to provider user
+        // so that the providers will get initialized first.
+
+        var diags tfdiags.Diagnostics
+
+        // To start, we'll collect the _requested_ provider addresses for each
+        // node, which we'll then resolve (handling provider inheritence, etc) in
+        // the next step.
+        // Our "requested" map is from graph vertices to string representations of
+        // provider config addresses (for deduping) to requests.
+        type ProviderRequest struct {
+                Addr  addrs.AbsProviderConfig
+                Exact bool // If true, inheritence from parent modules is not attempted
+        }
+        requested := map[dag.Vertex]map[string]ProviderRequest{}
+        needConfigured := map[string]addrs.AbsProviderConfig{}
         for _, v := range g.Vertices() {
+
+                // Does the vertex _directly_ use a provider?
                 if pv, ok := v.(GraphNodeProviderConsumer); ok {
-                        p := pv.ProvidedBy()
+                        requested[v] = make(map[string]ProviderRequest)
 
-                        key := providerMapKey(p, pv)
+                        p, exact := pv.ProvidedBy()
+                        if exact {
+                                log.Printf("[TRACE] ProviderTransformer: %s is provided by %s exactly", dag.VertexName(v), p)
+                        } else {
+                                log.Printf("[TRACE] ProviderTransformer: %s is provided by %s or inherited equivalent", dag.VertexName(v), p)
+                        }
+
+                        requested[v][p.String()] = ProviderRequest{
+                                Addr:  p,
+                                Exact: exact,
+                        }
+
+                        // Direct references need the provider configured as well as initialized
+                        needConfigured[p.String()] = p
+                }
+        }
+
+        // Now we'll go through all the requested addresses we just collected and
+        // figure out which _actual_ config address each belongs to, after resolving
+        // for provider inheritance and passing.
+        m := providerVertexMap(g)
+        for v, reqs := range requested {
+                for key, req := range reqs {
+                        p := req.Addr
                         target := m[key]
 
-                        sp, ok := pv.(GraphNodeSubPath)
+                        _, ok := v.(GraphNodeSubPath)
                         if !ok && target == nil {
-                                // no target, and no path to walk up
-                                err = multierror.Append(err, fmt.Errorf(
-                                        "%s: provider %s couldn't be found",
-                                        dag.VertexName(v), p))
-                                break
+                                // No target and no path to traverse up from
+                                diags = diags.Append(fmt.Errorf("%s: provider %s couldn't be found", dag.VertexName(v), p))
+                                continue
+                        }
+
+                        if target != nil {
+                                log.Printf("[TRACE] ProviderTransformer: exact match for %s serving %s", p, dag.VertexName(v))
                         }
 
-                        // if we don't have a provider at this level, walk up the path looking for one
-                        for i := 1; target == nil; i++ {
-                                path := normalizeModulePath(sp.Path())
-                                if len(path) < i {
-                                        break
+                        // if we don't have a provider at this level, walk up the path looking for one,
+                        // unless we were told to be exact.
+                        if target == nil && !req.Exact {
+                                for pp, ok := p.Inherited(); ok; pp, ok = pp.Inherited() {
+                                        key := pp.String()
+                                        target = m[key]
+                                        if target != nil {
+                                                log.Printf("[TRACE] ProviderTransformer: %s uses inherited configuration %s", dag.VertexName(v), pp)
+                                                break
+                                        }
+                                        log.Printf("[TRACE] ProviderTransformer: looking for %s to serve %s", pp, dag.VertexName(v))
                                 }
+                        }
 
-                                key = ResolveProviderName(p, path[:len(path)-i])
-                                target = m[key]
-                                if target != nil {
-                                        break
+                        // If this provider doesn't need to be configured then we can just
+                        // stub it out with an init-only provider node, which will just
+                        // start up the provider and fetch its schema.
+                        if _, exists := needConfigured[key]; target == nil && !exists {
+                                stubAddr := p.ProviderConfig.Absolute(addrs.RootModuleInstance)
+                                stub := &NodeEvalableProvider{
+                                        &NodeAbstractProvider{
+                                                Addr: stubAddr,
+                                        },
                                 }
+                                m[stubAddr.String()] = stub
+                                log.Printf("[TRACE] ProviderTransformer: creating init-only node for %s", stubAddr)
+                                target = stub
+                                g.Add(target)
                         }
 
                         if target == nil {
-                                err = multierror.Append(err, fmt.Errorf(
-                                        "%s: configuration for %s is not present; a provider configuration block is required for all operations",
-                                        dag.VertexName(v), p,
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Provider configuration not present",
+                                        fmt.Sprintf(
+                                                "To work with %s its original provider configuration at %s is required, but it has been removed. This occurs when a provider configuration is removed while objects created by that provider still exist in the state. Re-add the provider configuration to destroy %s, after which you can remove the provider configuration again.",
+                                                dag.VertexName(v), p, dag.VertexName(v),
+                                        ),
                                 ))
                                 break
                         }
@@ -111,16 +186,18 @@ func (t *ProviderTransformer) Transform(g *Graph) error {
                         if p, ok := target.(*graphNodeProxyProvider); ok {
                                 g.Remove(p)
                                 target = p.Target()
-                                key = target.(GraphNodeProvider).Name()
+                                key = target.(GraphNodeProvider).ProviderAddr().String()
                         }
 
-                        log.Printf("[DEBUG] resource %s using provider %s", dag.VertexName(pv), key)
-                        pv.SetProvider(key)
+                        log.Printf("[DEBUG] ProviderTransformer: %q (%T) needs %s", dag.VertexName(v), v, dag.VertexName(target))
+                        if pv, ok := v.(GraphNodeProviderConsumer); ok {
+                                pv.SetProvider(target.ProviderAddr())
+                        }
                         g.Connect(dag.BasicEdge(v, target))
                 }
         }
 
-        return err
+        return diags.Err()
 }
 
 // CloseProviderTransformer is a GraphTransformer that adds nodes to the
@@ -136,15 +213,16 @@ func (t *CloseProviderTransformer) Transform(g *Graph) error {
 
         for _, v := range pm {
                 p := v.(GraphNodeProvider)
+                key := p.ProviderAddr().String()
 
                 // get the close provider of this type if we alread created it
-                closer := cpm[p.Name()]
+                closer := cpm[key]
 
                 if closer == nil {
                         // create a closer for this provider type
-                        closer = &graphNodeCloseProvider{ProviderNameValue: p.Name()}
+                        closer = &graphNodeCloseProvider{Addr: p.ProviderAddr()}
                         g.Add(closer)
-                        cpm[p.Name()] = closer
+                        cpm[key] = closer
                 }
 
                 // Close node depends on the provider itself
@@ -164,10 +242,20 @@ func (t *CloseProviderTransformer) Transform(g *Graph) error {
         return err
 }
 
-// MissingProviderTransformer is a GraphTransformer that adds nodes for all
-// required providers into the graph. Specifically, it creates provider
-// configuration nodes for all the providers that we support. These are pruned
-// later during an optimization pass.
+// MissingProviderTransformer is a GraphTransformer that adds to the graph
+// a node for each default provider configuration that is referenced by another
+// node but not already present in the graph.
+//
+// These "default" nodes are always added to the root module, regardless of
+// where they are requested. This is important because our inheritance
+// resolution behavior in ProviderTransformer will then treat these as a
+// last-ditch fallback after walking up the tree, rather than preferring them
+// as it would if they were placed in the same module as the requester.
+//
+// This transformer may create extra nodes that are not needed in practice,
+// due to overriding provider configurations in child modules.
+// PruneProviderTransformer can then remove these once ProviderTransformer
+// has resolved all of the inheritence, etc.
 type MissingProviderTransformer struct {
         // Providers is the list of providers we support.
         Providers []string
@@ -192,34 +280,40 @@ func (t *MissingProviderTransformer) Transform(g *Graph) error {
                         continue
                 }
 
-                p := pv.ProvidedBy()
-                // this may be the resolved provider from the state, so we need to get
-                // the base provider name.
-                parts := strings.SplitAfter(p, "provider.")
-                p = parts[len(parts)-1]
+                // For our work here we actually care only about the provider type and
+                // we plan to place all default providers in the root module, and so
+                // it's safe for us to rely on ProvidedBy here rather than waiting for
+                // the later proper resolution of provider inheritance done by
+                // ProviderTransformer.
+                p, _ := pv.ProvidedBy()
+                if p.ProviderConfig.Alias != "" {
+                        // We do not create default aliased configurations.
+                        log.Println("[TRACE] MissingProviderTransformer: skipping implication of aliased config", p)
+                        continue
+                }
 
-                key := ResolveProviderName(p, nil)
+                // We're going to create an implicit _default_ configuration for the
+                // referenced provider type in the _root_ module, ignoring all other
+                // aspects of the resource's declared provider address.
+                defaultAddr := addrs.RootModuleInstance.ProviderConfigDefault(p.ProviderConfig.Type)
+                key := defaultAddr.String()
                 provider := m[key]
 
-                // we already have it
                 if provider != nil {
+                        // There's already an explicit default configuration for this
+                        // provider type in the root module, so we have nothing to do.
                         continue
                 }
 
-                // we don't implicitly create aliased providers
-                if strings.Contains(p, ".") {
-                        log.Println("[DEBUG] not adding missing provider alias:", p)
-                        continue
-                }
-
-                log.Println("[DEBUG] adding missing provider:", p)
+                log.Printf("[DEBUG] adding implicit provider configuration %s, implied first by %s", defaultAddr, dag.VertexName(v))
 
-                // create the misisng top-level provider
+                // create the missing top-level provider
                 provider = t.Concrete(&NodeAbstractProvider{
-                        NameValue: p,
-                }).(dag.Vertex)
+                        Addr: defaultAddr,
+                }).(GraphNodeProvider)
 
-                m[key] = g.Add(provider)
+                g.Add(provider)
+                m[key] = provider
         }
 
         return err
@@ -237,26 +331,26 @@ func (t *ParentProviderTransformer) Transform(g *Graph) error {
         for _, v := range g.Vertices() {
                 // Only care about providers
                 pn, ok := v.(GraphNodeProvider)
-                if !ok || pn.ProviderName() == "" {
+                if !ok {
                         continue
                 }
 
-                // Also require a subpath, if there is no subpath then we
-                // can't have a parent.
-                if pn, ok := v.(GraphNodeSubPath); ok {
-                        if len(normalizeModulePath(pn.Path())) <= 1 {
-                                continue
-                        }
+                // Also require non-empty path, since otherwise we're in the root
+                // module and so cannot have a parent.
+                if len(pn.Path()) <= 1 {
+                        continue
                 }
 
                 // this provider may be disabled, but we can only get it's name from
                 // the ProviderName string
-                name := ResolveProviderName(strings.SplitN(pn.ProviderName(), " ", 2)[0], nil)
-                parent := pm[name]
-                if parent != nil {
-                        g.Connect(dag.BasicEdge(v, parent))
+                addr := pn.ProviderAddr()
+                parentAddr, ok := addr.Inherited()
+                if ok {
+                        parent := pm[parentAddr.String()]
+                        if parent != nil {
+                                g.Connect(dag.BasicEdge(v, parent))
+                        }
                 }
-
         }
         return nil
 }
@@ -270,20 +364,20 @@ type PruneProviderTransformer struct{}
 func (t *PruneProviderTransformer) Transform(g *Graph) error {
         for _, v := range g.Vertices() {
                 // We only care about providers
-                pn, ok := v.(GraphNodeProvider)
-                if !ok || pn.ProviderName() == "" {
+                _, ok := v.(GraphNodeProvider)
+                if !ok {
                         continue
                 }
 
                 // ProxyProviders will have up edges, but we're now done with them in the graph
                 if _, ok := v.(*graphNodeProxyProvider); ok {
-                        log.Printf("[DEBUG] pruning proxy provider %s", dag.VertexName(v))
+                        log.Printf("[DEBUG] pruning proxy %s", dag.VertexName(v))
                         g.Remove(v)
                 }
 
                 // Remove providers with no dependencies.
                 if g.UpEdges(v).Len() == 0 {
-                        log.Printf("[DEBUG] pruning unused provider %s", dag.VertexName(v))
+                        log.Printf("[DEBUG] pruning unused %s", dag.VertexName(v))
                         g.Remove(v)
                 }
         }
@@ -291,40 +385,24 @@ func (t *PruneProviderTransformer) Transform(g *Graph) error {
         return nil
 }
 
-// providerMapKey is a helper that gives us the key to use for the
-// maps returned by things such as providerVertexMap.
-func providerMapKey(k string, v dag.Vertex) string {
-        if strings.Contains(k, "provider.") {
-                // this is already resolved
-                return k
-        }
-
-        // we create a dummy provider to
-        var path []string
-        if sp, ok := v.(GraphNodeSubPath); ok {
-                path = normalizeModulePath(sp.Path())
-        }
-        return ResolveProviderName(k, path)
-}
-
-func providerVertexMap(g *Graph) map[string]dag.Vertex {
-        m := make(map[string]dag.Vertex)
+func providerVertexMap(g *Graph) map[string]GraphNodeProvider {
+        m := make(map[string]GraphNodeProvider)
         for _, v := range g.Vertices() {
                 if pv, ok := v.(GraphNodeProvider); ok {
-                        // TODO:  The Name may have meta info, like " (disabled)"
-                        name := strings.SplitN(pv.Name(), " ", 2)[0]
-                        m[name] = v
+                        addr := pv.ProviderAddr()
+                        m[addr.String()] = pv
                 }
         }
 
         return m
 }
 
-func closeProviderVertexMap(g *Graph) map[string]dag.Vertex {
-        m := make(map[string]dag.Vertex)
+func closeProviderVertexMap(g *Graph) map[string]GraphNodeCloseProvider {
+        m := make(map[string]GraphNodeCloseProvider)
         for _, v := range g.Vertices() {
                 if pv, ok := v.(GraphNodeCloseProvider); ok {
-                        m[pv.CloseProviderName()] = v
+                        addr := pv.CloseProviderAddr()
+                        m[addr.String()] = pv
                 }
         }
 
@@ -332,16 +410,25 @@ func closeProviderVertexMap(g *Graph) map[string]dag.Vertex {
 }
 
 type graphNodeCloseProvider struct {
-        ProviderNameValue string
+        Addr addrs.AbsProviderConfig
 }
 
+var (
+        _ GraphNodeCloseProvider = (*graphNodeCloseProvider)(nil)
+)
+
 func (n *graphNodeCloseProvider) Name() string {
-        return n.ProviderNameValue + " (close)"
+        return n.Addr.String() + " (close)"
+}
+
+// GraphNodeSubPath impl.
+func (n *graphNodeCloseProvider) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // GraphNodeEvalable impl.
 func (n *graphNodeCloseProvider) EvalTree() EvalNode {
-        return CloseProviderEvalTree(n.ProviderNameValue)
+        return CloseProviderEvalTree(n.Addr)
 }
 
 // GraphNodeDependable impl.
@@ -349,8 +436,8 @@ func (n *graphNodeCloseProvider) DependableName() []string {
         return []string{n.Name()}
 }
 
-func (n *graphNodeCloseProvider) CloseProviderName() string {
-        return n.ProviderNameValue
+func (n *graphNodeCloseProvider) CloseProviderAddr() addrs.AbsProviderConfig {
+        return n.Addr
 }
 
 // GraphNodeDotter impl.
@@ -380,17 +467,24 @@ func (n *graphNodeCloseProvider) RemoveIfNotTargeted() bool {
 // configurations, and are removed after all the resources have been connected
 // to their providers.
 type graphNodeProxyProvider struct {
-        nameValue string
-        path      []string
-        target    GraphNodeProvider
+        addr   addrs.AbsProviderConfig
+        target GraphNodeProvider
+}
+
+var (
+        _ GraphNodeProvider = (*graphNodeProxyProvider)(nil)
+)
+
+func (n *graphNodeProxyProvider) ProviderAddr() addrs.AbsProviderConfig {
+        return n.addr
 }
 
-func (n *graphNodeProxyProvider) ProviderName() string {
-        return n.Target().ProviderName()
+func (n *graphNodeProxyProvider) Path() addrs.ModuleInstance {
+        return n.addr.Module
 }
 
 func (n *graphNodeProxyProvider) Name() string {
-        return ResolveProviderName(n.nameValue, n.path)
+        return n.addr.String() + " (proxy)"
 }
 
 // find the concrete provider instance
@@ -415,26 +509,21 @@ type ProviderConfigTransformer struct {
         // record providers that can be overriden with a proxy
         proxiable map[string]bool
 
-        // Module is the module to add resources from.
-        Module *module.Tree
+        // Config is the root node of the configuration tree to add providers from.
+        Config *configs.Config
 }
 
 func (t *ProviderConfigTransformer) Transform(g *Graph) error {
-        // If no module is given, we don't do anything
-        if t.Module == nil {
+        // If no configuration is given, we don't do anything
+        if t.Config == nil {
                 return nil
         }
 
-        // If the module isn't loaded, that is simply an error
-        if !t.Module.Loaded() {
-                return errors.New("module must be loaded for ProviderConfigTransformer")
-        }
-
         t.providers = make(map[string]GraphNodeProvider)
         t.proxiable = make(map[string]bool)
 
         // Start the transformation process
-        if err := t.transform(g, t.Module); err != nil {
+        if err := t.transform(g, t.Config); err != nil {
                 return err
         }
 
@@ -442,95 +531,126 @@ func (t *ProviderConfigTransformer) Transform(g *Graph) error {
         return t.attachProviderConfigs(g)
 }
 
-func (t *ProviderConfigTransformer) transform(g *Graph, m *module.Tree) error {
+func (t *ProviderConfigTransformer) transform(g *Graph, c *configs.Config) error {
         // If no config, do nothing
-        if m == nil {
+        if c == nil {
                 return nil
         }
 
         // Add our resources
-        if err := t.transformSingle(g, m); err != nil {
+        if err := t.transformSingle(g, c); err != nil {
                 return err
         }
 
         // Transform all the children.
-        for _, c := range m.Children() {
-                if err := t.transform(g, c); err != nil {
+        for _, cc := range c.Children {
+                if err := t.transform(g, cc); err != nil {
                         return err
                 }
         }
         return nil
 }
 
-func (t *ProviderConfigTransformer) transformSingle(g *Graph, m *module.Tree) error {
-        log.Printf("[TRACE] ProviderConfigTransformer: Starting for path: %v", m.Path())
-
-        // Get the configuration for this module
-        conf := m.Config()
-
-        // Build the path we're at
-        path := m.Path()
-        if len(path) > 0 {
-                path = append([]string{RootModuleName}, path...)
+func (t *ProviderConfigTransformer) transformSingle(g *Graph, c *configs.Config) error {
+        // Get the module associated with this configuration tree node
+        mod := c.Module
+        staticPath := c.Path
+
+        // We actually need a dynamic module path here, but we've not yet updated
+        // our graph builders enough to support expansion of module calls with
+        // "count" and "for_each" set, so for now we'll shim this by converting to
+        // a dynamic path with no keys. At the time of writing this is the only
+        // possible kind of dynamic path anyway.
+        path := make(addrs.ModuleInstance, len(staticPath))
+        for i, name := range staticPath {
+                path[i] = addrs.ModuleInstanceStep{
+                        Name: name,
+                }
         }
 
         // add all providers from the configuration
-        for _, p := range conf.ProviderConfigs {
-                name := p.Name
-                if p.Alias != "" {
-                        name += "." + p.Alias
-                }
+        for _, p := range mod.ProviderConfigs {
+                relAddr := p.Addr()
+                addr := relAddr.Absolute(path)
 
-                v := t.Concrete(&NodeAbstractProvider{
-                        NameValue: name,
-                        PathValue: path,
-                })
+                abstract := &NodeAbstractProvider{
+                        Addr: addr,
+                }
+                var v dag.Vertex
+                if t.Concrete != nil {
+                        v = t.Concrete(abstract)
+                } else {
+                        v = abstract
+                }
 
                 // Add it to the graph
                 g.Add(v)
-                fullName := ResolveProviderName(name, path)
-                t.providers[fullName] = v.(GraphNodeProvider)
-                t.proxiable[fullName] = len(p.RawConfig.RawMap()) == 0
+                key := addr.String()
+                t.providers[key] = v.(GraphNodeProvider)
+
+                // A provider configuration is "proxyable" if its configuration is
+                // entirely empty. This means it's standing in for a provider
+                // configuration that must be passed in from the parent module.
+                // We decide this by evaluating the config with an empty schema;
+                // if this succeeds, then we know there's nothing in the body.
+                _, diags := p.Config.Content(&hcl.BodySchema{})
+                t.proxiable[key] = !diags.HasErrors()
         }
 
         // Now replace the provider nodes with proxy nodes if a provider was being
         // passed in, and create implicit proxies if there was no config. Any extra
         // proxies will be removed in the prune step.
-        return t.addProxyProviders(g, m)
+        return t.addProxyProviders(g, c)
 }
 
-func (t *ProviderConfigTransformer) addProxyProviders(g *Graph, m *module.Tree) error {
-        path := m.Path()
+func (t *ProviderConfigTransformer) addProxyProviders(g *Graph, c *configs.Config) error {
+        path := c.Path
 
         // can't add proxies at the root
         if len(path) == 0 {
                 return nil
         }
 
-        parentPath := path[:len(path)-1]
-        parent := t.Module.Child(parentPath)
+        parentPath, callAddr := path.Call()
+        parent := c.Parent
         if parent == nil {
                 return nil
         }
 
-        var parentCfg *config.Module
-        for _, mod := range parent.Config().Modules {
-                if mod.Name == m.Name() {
+        callName := callAddr.Name
+        var parentCfg *configs.ModuleCall
+        for name, mod := range parent.Module.ModuleCalls {
+                if name == callName {
                         parentCfg = mod
                         break
                 }
         }
 
+        // We currently don't support count/for_each for modules and so we must
+        // shim our path and parentPath into module instances here so that the
+        // rest of Terraform can behave as if we do. This shimming should be
+        // removed later as part of implementing count/for_each for modules.
+        instPath := make(addrs.ModuleInstance, len(path))
+        for i, name := range path {
+                instPath[i] = addrs.ModuleInstanceStep{Name: name}
+        }
+        parentInstPath := make(addrs.ModuleInstance, len(parentPath))
+        for i, name := range parentPath {
+                parentInstPath[i] = addrs.ModuleInstanceStep{Name: name}
+        }
+
         if parentCfg == nil {
                 // this can't really happen during normal execution.
-                return fmt.Errorf("parent module config not found for %s", m.Name())
+                return fmt.Errorf("parent module config not found for %s", c.Path.String())
         }
 
         // Go through all the providers the parent is passing in, and add proxies to
         // the parent provider nodes.
-        for name, parentName := range parentCfg.Providers {
-                fullName := ResolveProviderName(name, path)
-                fullParentName := ResolveProviderName(parentName, parentPath)
+        for _, pair := range parentCfg.Providers {
+                fullAddr := pair.InChild.Addr().Absolute(instPath)
+                fullParentAddr := pair.InParent.Addr().Absolute(parentInstPath)
+                fullName := fullAddr.String()
+                fullParentName := fullParentAddr.String()
 
                 parentProvider := t.providers[fullParentName]
 
@@ -539,9 +659,8 @@ func (t *ProviderConfigTransformer) addProxyProviders(g *Graph, m *module.Tree)
                 }
 
                 proxy := &graphNodeProxyProvider{
-                        nameValue: name,
-                        path:      path,
-                        target:    parentProvider,
+                        addr:   fullAddr,
+                        target: parentProvider,
                 }
 
                 concreteProvider := t.providers[fullName]
@@ -553,8 +672,8 @@ func (t *ProviderConfigTransformer) addProxyProviders(g *Graph, m *module.Tree)
                         continue
                 }
 
-                // aliased providers can't be implicitly passed in
-                if strings.Contains(name, ".") {
+                // aliased configurations can't be implicitly passed in
+                if fullAddr.ProviderConfig.Alias != "" {
                         continue
                 }
 
@@ -575,27 +694,19 @@ func (t *ProviderConfigTransformer) attachProviderConfigs(g *Graph) error {
                 }
 
                 // Determine what we're looking for
-                path := normalizeModulePath(apn.Path())[1:]
-                name := apn.ProviderName()
-                log.Printf("[TRACE] Attach provider request: %#v %s", path, name)
+                addr := apn.ProviderAddr()
 
                 // Get the configuration.
-                tree := t.Module.Child(path)
-                if tree == nil {
+                mc := t.Config.DescendentForInstance(addr.Module)
+                if mc == nil {
+                        log.Printf("[TRACE] ProviderConfigTransformer: no configuration available for %s", addr.String())
                         continue
                 }
 
                 // Go through the provider configs to find the matching config
-                for _, p := range tree.Config().ProviderConfigs {
-                        // Build the name, which is "name.alias" if an alias exists
-                        current := p.Name
-                        if p.Alias != "" {
-                                current += "." + p.Alias
-                        }
-
-                        // If the configs match then attach!
-                        if current == name {
-                                log.Printf("[TRACE] Attaching provider config: %#v", p)
+                for _, p := range mc.Module.ProviderConfigs {
+                        if p.Name == addr.ProviderConfig.Type && p.Alias == addr.ProviderConfig.Alias {
+                                log.Printf("[TRACE] ProviderConfigTransformer: attaching to %q provider configuration from %s", dag.VertexName(v), p.DeclRange)
                                 apn.AttachProvider(p)
                                 break
                         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_provisioner.go b/vendor/github.com/hashicorp/terraform/terraform/transform_provisioner.go
index f49d824..fe4cf0e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_provisioner.go
@@ -2,6 +2,9 @@ package terraform
 
 import (
         "fmt"
+        "log"
+
+        "github.com/hashicorp/terraform/addrs"
 
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/terraform/dag"
@@ -22,8 +25,8 @@ type GraphNodeCloseProvisioner interface {
 }
 
 // GraphNodeProvisionerConsumer is an interface that nodes that require
-// a provisioner must implement. ProvisionedBy must return the name of the
-// provisioner to use.
+// a provisioner must implement. ProvisionedBy must return the names of the
+// provisioners to use.
 type GraphNodeProvisionerConsumer interface {
         ProvisionedBy() []string
 }
@@ -48,6 +51,7 @@ func (t *ProvisionerTransformer) Transform(g *Graph) error {
                                         continue
                                 }
 
+                                log.Printf("[TRACE] ProvisionerTransformer: %s is provisioned by %s (%q)", dag.VertexName(v), key, dag.VertexName(m[key]))
                                 g.Connect(dag.BasicEdge(v, m[key]))
                         }
                 }
@@ -83,12 +87,9 @@ func (t *MissingProvisionerTransformer) Transform(g *Graph) error {
 
                 // If this node has a subpath, then we use that as a prefix
                 // into our map to check for an existing provider.
-                var path []string
+                path := addrs.RootModuleInstance
                 if sp, ok := pv.(GraphNodeSubPath); ok {
-                        raw := normalizeModulePath(sp.Path())
-                        if len(raw) > len(rootModulePath) {
-                                path = raw
-                        }
+                        path = sp.Path()
                 }
 
                 for _, p := range pv.ProvisionedBy() {
@@ -101,7 +102,7 @@ func (t *MissingProvisionerTransformer) Transform(g *Graph) error {
                         }
 
                         if _, ok := supported[p]; !ok {
-                                // If we don't support the provisioner type, skip it.
+                                // If we don't support the provisioner type, we skip it.
                                 // Validation later will catch this as an error.
                                 continue
                         }
@@ -114,6 +115,7 @@ func (t *MissingProvisionerTransformer) Transform(g *Graph) error {
 
                         // Add the missing provisioner node to the graph
                         m[key] = g.Add(newV)
+                        log.Printf("[TRACE] MissingProviderTransformer: added implicit provisioner %s, first implied by %s", key, dag.VertexName(v))
                 }
         }
 
@@ -156,10 +158,7 @@ func (t *CloseProvisionerTransformer) Transform(g *Graph) error {
 func provisionerMapKey(k string, v dag.Vertex) string {
         pathPrefix := ""
         if sp, ok := v.(GraphNodeSubPath); ok {
-                raw := normalizeModulePath(sp.Path())
-                if len(raw) > len(rootModulePath) {
-                        pathPrefix = modulePrefixStr(raw) + "."
-                }
+                pathPrefix = sp.Path().String() + "."
         }
 
         return pathPrefix + k
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_reference.go b/vendor/github.com/hashicorp/terraform/terraform/transform_reference.go
index be8c7f9..23bc8cd 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_reference.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_reference.go
@@ -3,8 +3,12 @@ package terraform
 import (
         "fmt"
         "log"
-        "strings"
 
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang"
+
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/dag"
 )
@@ -17,35 +21,46 @@ import (
 // be referenced and other methods of referencing may still be possible (such
 // as by path!)
 type GraphNodeReferenceable interface {
-        // ReferenceableName is the name by which this can be referenced.
-        // This can be either just the type, or include the field. Example:
-        // "aws_instance.bar" or "aws_instance.bar.id".
-        ReferenceableName() []string
+        GraphNodeSubPath
+
+        // ReferenceableAddrs returns a list of addresses through which this can be
+        // referenced.
+        ReferenceableAddrs() []addrs.Referenceable
 }
 
 // GraphNodeReferencer must be implemented by nodes that reference other
 // Terraform items and therefore depend on them.
 type GraphNodeReferencer interface {
-        // References are the list of things that this node references. This
-        // can include fields or just the type, just like GraphNodeReferenceable
-        // above.
-        References() []string
+        GraphNodeSubPath
+
+        // References returns a list of references made by this node, which
+        // include both a referenced address and source location information for
+        // the reference.
+        References() []*addrs.Reference
 }
 
-// GraphNodeReferenceGlobal is an interface that can optionally be
-// implemented. If ReferenceGlobal returns true, then the References()
-// and ReferenceableName() must be _fully qualified_ with "module.foo.bar"
-// etc.
+// GraphNodeReferenceOutside is an interface that can optionally be implemented.
+// A node that implements it can specify that its own referenceable addresses
+// and/or the addresses it references are in a different module than the
+// node itself.
+//
+// Any referenceable addresses returned by ReferenceableAddrs are interpreted
+// relative to the returned selfPath.
 //
-// This allows a node to reference and be referenced by a specific name
-// that may cross module boundaries. This can be very dangerous so use
-// this wisely.
+// Any references returned by References are interpreted relative to the
+// returned referencePath.
 //
-// The primary use case for this is module boundaries (variables coming in).
-type GraphNodeReferenceGlobal interface {
-        // Set to true to signal that references and name are fully
-        // qualified. See the above docs for more information.
-        ReferenceGlobal() bool
+// It is valid but not required for either of these paths to match what is
+// returned by method Path, though if both match the main Path then there
+// is no reason to implement this method.
+//
+// The primary use-case for this is the nodes representing module input
+// variables, since their expressions are resolved in terms of their calling
+// module, but they are still referenced from their own module.
+type GraphNodeReferenceOutside interface {
+        // ReferenceOutside returns a path in which any references from this node
+        // are resolved.
+        ReferenceOutside() (selfPath, referencePath addrs.ModuleInstance)
 }
 
 // ReferenceTransformer is a GraphTransformer that connects all the
@@ -158,75 +173,91 @@ func (t *PruneUnusedValuesTransformer) Transform(g *Graph) error {
 // ReferenceMap is a structure that can be used to efficiently check
 // for references on a graph.
 type ReferenceMap struct {
-        // m is the mapping of referenceable name to list of verticies that
-        // implement that name. This is built on initialization.
-        references   map[string][]dag.Vertex
-        referencedBy map[string][]dag.Vertex
+        // vertices is a map from internal reference keys (as produced by the
+        // mapKey method) to one or more vertices that are identified by each key.
+        //
+        // A particular reference key might actually identify multiple vertices,
+        // e.g. in situations where one object is contained inside another.
+        vertices map[string][]dag.Vertex
+
+        // edges is a map whose keys are a subset of the internal reference keys
+        // from "vertices", and whose values are the nodes that refer to each
+        // key. The values in this map are the referrers, while values in
+        // "verticies" are the referents. The keys in both cases are referents.
+        edges map[string][]dag.Vertex
 }
 
-// References returns the list of vertices that this vertex
-// references along with any missing references.
-func (m *ReferenceMap) References(v dag.Vertex) ([]dag.Vertex, []string) {
+// References returns the set of vertices that the given vertex refers to,
+// and any referenced addresses that do not have corresponding vertices.
+func (m *ReferenceMap) References(v dag.Vertex) ([]dag.Vertex, []addrs.Referenceable) {
         rn, ok := v.(GraphNodeReferencer)
         if !ok {
                 return nil, nil
         }
+        if _, ok := v.(GraphNodeSubPath); !ok {
+                return nil, nil
+        }
 
         var matches []dag.Vertex
-        var missing []string
-        prefix := m.prefix(v)
-
-        for _, ns := range rn.References() {
-                found := false
-                for _, n := range strings.Split(ns, "/") {
-                        n = prefix + n
-                        parents, ok := m.references[n]
-                        if !ok {
-                                continue
+        var missing []addrs.Referenceable
+
+        for _, ref := range rn.References() {
+                subject := ref.Subject
+
+                key := m.referenceMapKey(v, subject)
+                if _, exists := m.vertices[key]; !exists {
+                        // If what we were looking for was a ResourceInstance then we
+                        // might be in a resource-oriented graph rather than an
+                        // instance-oriented graph, and so we'll see if we have the
+                        // resource itself instead.
+                        switch ri := subject.(type) {
+                        case addrs.ResourceInstance:
+                                subject = ri.ContainingResource()
+                        case addrs.ResourceInstancePhase:
+                                subject = ri.ContainingResource()
                         }
+                        key = m.referenceMapKey(v, subject)
+                }
 
-                        // Mark that we found a match
-                        found = true
-
-                        for _, p := range parents {
-                                // don't include self-references
-                                if p == v {
-                                        continue
-                                }
-                                matches = append(matches, p)
+                vertices := m.vertices[key]
+                for _, rv := range vertices {
+                        // don't include self-references
+                        if rv == v {
+                                continue
                         }
-
-                        break
+                        matches = append(matches, rv)
                 }
-
-                if !found {
-                        missing = append(missing, ns)
+                if len(vertices) == 0 {
+                        missing = append(missing, ref.Subject)
                 }
         }
 
         return matches, missing
 }
 
-// ReferencedBy returns the list of vertices that reference the
-// vertex passed in.
-func (m *ReferenceMap) ReferencedBy(v dag.Vertex) []dag.Vertex {
+// Referrers returns the set of vertices that refer to the given vertex.
+func (m *ReferenceMap) Referrers(v dag.Vertex) []dag.Vertex {
         rn, ok := v.(GraphNodeReferenceable)
         if !ok {
                 return nil
         }
+        sp, ok := v.(GraphNodeSubPath)
+        if !ok {
+                return nil
+        }
 
         var matches []dag.Vertex
-        prefix := m.prefix(v)
-        for _, n := range rn.ReferenceableName() {
-                n = prefix + n
-                children, ok := m.referencedBy[n]
+        for _, addr := range rn.ReferenceableAddrs() {
+                key := m.mapKey(sp.Path(), addr)
+                referrers, ok := m.edges[key]
                 if !ok {
                         continue
                 }
 
-                // Make sure this isn't a self reference, which isn't included
+                // If the referrer set includes our own given vertex then we skip,
+                // since we don't want to return self-references.
                 selfRef := false
-                for _, p := range children {
+                for _, p := range referrers {
                         if p == v {
                                 selfRef = true
                                 break
@@ -236,28 +267,77 @@ func (m *ReferenceMap) ReferencedBy(v dag.Vertex) []dag.Vertex {
                         continue
                 }
 
-                matches = append(matches, children...)
+                matches = append(matches, referrers...)
         }
 
         return matches
 }
 
-func (m *ReferenceMap) prefix(v dag.Vertex) string {
-        // If the node is stating it is already fully qualified then
-        // we don't have to create the prefix!
-        if gn, ok := v.(GraphNodeReferenceGlobal); ok && gn.ReferenceGlobal() {
-                return ""
+func (m *ReferenceMap) mapKey(path addrs.ModuleInstance, addr addrs.Referenceable) string {
+        return fmt.Sprintf("%s|%s", path.String(), addr.String())
+}
+
+// vertexReferenceablePath returns the path in which the given vertex can be
+// referenced. This is the path that its results from ReferenceableAddrs
+// are considered to be relative to.
+//
+// Only GraphNodeSubPath implementations can be referenced, so this method will
+// panic if the given vertex does not implement that interface.
+func (m *ReferenceMap) vertexReferenceablePath(v dag.Vertex) addrs.ModuleInstance {
+        sp, ok := v.(GraphNodeSubPath)
+        if !ok {
+                // Only nodes with paths can participate in a reference map.
+                panic(fmt.Errorf("vertexMapKey on vertex type %T which doesn't implement GraphNodeSubPath", sp))
         }
 
-        // Create the prefix based on the path
-        var prefix string
-        if pn, ok := v.(GraphNodeSubPath); ok {
-                if path := normalizeModulePath(pn.Path()); len(path) > 1 {
-                        prefix = modulePrefixStr(path) + "."
-                }
+        if outside, ok := v.(GraphNodeReferenceOutside); ok {
+                // Vertex is referenced from a different module than where it was
+                // declared.
+                path, _ := outside.ReferenceOutside()
+                return path
+        }
+
+        // Vertex is referenced from the same module as where it was declared.
+        return sp.Path()
+}
+
+// vertexReferencePath returns the path in which references _from_ the given
+// vertex must be interpreted.
+//
+// Only GraphNodeSubPath implementations can have references, so this method
+// will panic if the given vertex does not implement that interface.
+func vertexReferencePath(referrer dag.Vertex) addrs.ModuleInstance {
+        sp, ok := referrer.(GraphNodeSubPath)
+        if !ok {
+                // Only nodes with paths can participate in a reference map.
+                panic(fmt.Errorf("vertexReferencePath on vertex type %T which doesn't implement GraphNodeSubPath", sp))
+        }
+
+        var path addrs.ModuleInstance
+        if outside, ok := referrer.(GraphNodeReferenceOutside); ok {
+                // Vertex makes references to objects in a different module than where
+                // it was declared.
+                _, path = outside.ReferenceOutside()
+                return path
         }
 
-        return prefix
+        // Vertex makes references to objects in the same module as where it
+        // was declared.
+        return sp.Path()
+}
+
+// referenceMapKey produces keys for the "edges" map. "referrer" is the vertex
+// that the reference is from, and "addr" is the address of the object being
+// referenced.
+//
+// The result is an opaque string that includes both the address of the given
+// object and the address of the module instance that object belongs to.
+//
+// Only GraphNodeSubPath implementations can be referrers, so this method will
+// panic if the given vertex does not implement that interface.
+func (m *ReferenceMap) referenceMapKey(referrer dag.Vertex, addr addrs.Referenceable) string {
+        path := vertexReferencePath(referrer)
+        return m.mapKey(path, addr)
 }
 
 // NewReferenceMap is used to create a new reference map for the
@@ -266,83 +346,82 @@ func NewReferenceMap(vs []dag.Vertex) *ReferenceMap {
         var m ReferenceMap
 
         // Build the lookup table
-        refMap := make(map[string][]dag.Vertex)
+        vertices := make(map[string][]dag.Vertex)
         for _, v := range vs {
+                _, ok := v.(GraphNodeSubPath)
+                if !ok {
+                        // Only nodes with paths can participate in a reference map.
+                        continue
+                }
+
                 // We're only looking for referenceable nodes
                 rn, ok := v.(GraphNodeReferenceable)
                 if !ok {
                         continue
                 }
 
+                path := m.vertexReferenceablePath(v)
+
                 // Go through and cache them
-                prefix := m.prefix(v)
-                for _, n := range rn.ReferenceableName() {
-                        n = prefix + n
-                        refMap[n] = append(refMap[n], v)
+                for _, addr := range rn.ReferenceableAddrs() {
+                        key := m.mapKey(path, addr)
+                        vertices[key] = append(vertices[key], v)
                 }
 
-                // If there is a path, it is always referenceable by that. For
-                // example, if this is a referenceable thing at path []string{"foo"},
-                // then it can be referenced at "module.foo"
-                if pn, ok := v.(GraphNodeSubPath); ok {
-                        for _, p := range ReferenceModulePath(pn.Path()) {
-                                refMap[p] = append(refMap[p], v)
-                        }
+                // Any node can be referenced by the address of the module it belongs
+                // to or any of that module's ancestors.
+                for _, addr := range path.Ancestors()[1:] {
+                        // Can be referenced either as the specific call instance (with
+                        // an instance key) or as the bare module call itself (the "module"
+                        // block in the parent module that created the instance).
+                        callPath, call := addr.Call()
+                        callInstPath, callInst := addr.CallInstance()
+                        callKey := m.mapKey(callPath, call)
+                        callInstKey := m.mapKey(callInstPath, callInst)
+                        vertices[callKey] = append(vertices[callKey], v)
+                        vertices[callInstKey] = append(vertices[callInstKey], v)
                 }
         }
 
         // Build the lookup table for referenced by
-        refByMap := make(map[string][]dag.Vertex)
+        edges := make(map[string][]dag.Vertex)
         for _, v := range vs {
-                // We're only looking for referenceable nodes
+                _, ok := v.(GraphNodeSubPath)
+                if !ok {
+                        // Only nodes with paths can participate in a reference map.
+                        continue
+                }
+
                 rn, ok := v.(GraphNodeReferencer)
                 if !ok {
+                        // We're only looking for referenceable nodes
                         continue
                 }
 
                 // Go through and cache them
-                prefix := m.prefix(v)
-                for _, n := range rn.References() {
-                        n = prefix + n
-                        refByMap[n] = append(refByMap[n], v)
+                for _, ref := range rn.References() {
+                        if ref.Subject == nil {
+                                // Should never happen
+                                panic(fmt.Sprintf("%T.References returned reference with nil subject", rn))
+                        }
+                        key := m.referenceMapKey(v, ref.Subject)
+                        edges[key] = append(edges[key], v)
                 }
         }
 
-        m.references = refMap
-        m.referencedBy = refByMap
+        m.vertices = vertices
+        m.edges = edges
         return &m
 }
 
-// Returns the reference name for a module path. The path "foo" would return
-// "module.foo". If this is a deeply nested module, it will be every parent
-// as well. For example: ["foo", "bar"] would return both "module.foo" and
-// "module.foo.module.bar"
-func ReferenceModulePath(p []string) []string {
-        p = normalizeModulePath(p)
-        if len(p) == 1 {
-                // Root, no name
-                return nil
-        }
-
-        result := make([]string, 0, len(p)-1)
-        for i := len(p); i > 1; i-- {
-                result = append(result, modulePrefixStr(p[:i]))
-        }
-
-        return result
-}
-
 // ReferencesFromConfig returns the references that a configuration has
 // based on the interpolated variables in a configuration.
-func ReferencesFromConfig(c *config.RawConfig) []string {
-        var result []string
-        for _, v := range c.Variables {
-                if r := ReferenceFromInterpolatedVar(v); len(r) > 0 {
-                        result = append(result, r...)
-                }
+func ReferencesFromConfig(body hcl.Body, schema *configschema.Block) []*addrs.Reference {
+        if body == nil {
+                return nil
         }
-
-        return result
+        refs, _ := lang.ReferencesInBlock(body, schema)
+        return refs
 }
 
 // ReferenceFromInterpolatedVar returns the reference from this variable,
@@ -378,18 +457,31 @@ func ReferenceFromInterpolatedVar(v config.InterpolatedVariable) []string {
         }
 }
 
-func modulePrefixStr(p []string) string {
-        // strip "root"
-        if len(p) > 0 && p[0] == rootModulePath[0] {
-                p = p[1:]
-        }
-
-        parts := make([]string, 0, len(p)*2)
-        for _, p := range p {
-                parts = append(parts, "module", p)
+// appendResourceDestroyReferences identifies resource and resource instance
+// references in the given slice and appends to it the "destroy-phase"
+// equivalents of those references, returning the result.
+//
+// This can be used in the References implementation for a node which must also
+// depend on the destruction of anything it references.
+func appendResourceDestroyReferences(refs []*addrs.Reference) []*addrs.Reference {
+        given := refs
+        for _, ref := range given {
+                switch tr := ref.Subject.(type) {
+                case addrs.Resource:
+                        newRef := *ref // shallow copy
+                        newRef.Subject = tr.Phase(addrs.ResourceInstancePhaseDestroy)
+                        refs = append(refs, &newRef)
+                case addrs.ResourceInstance:
+                        newRef := *ref // shallow copy
+                        newRef.Subject = tr.Phase(addrs.ResourceInstancePhaseDestroy)
+                        refs = append(refs, &newRef)
+                }
         }
+        return refs
+}
 
-        return strings.Join(parts, ".")
+func modulePrefixStr(p addrs.ModuleInstance) string {
+        return p.String()
 }
 
 func modulePrefixList(result []string, prefix string) []string {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_removed_modules.go b/vendor/github.com/hashicorp/terraform/terraform/transform_removed_modules.go
index 2e05edb..ee71387 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_removed_modules.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_removed_modules.go
@@ -3,14 +3,15 @@ package terraform
 import (
         "log"
 
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/states"
 )
 
-// RemoveModuleTransformer implements GraphTransformer to add nodes indicating
+// RemovedModuleTransformer implements GraphTransformer to add nodes indicating
 // when a module was removed from the configuration.
 type RemovedModuleTransformer struct {
-        Module *module.Tree // root module
-        State  *State
+        Config *configs.Config // root node in the config tree
+        State  *states.State
 }
 
 func (t *RemovedModuleTransformer) Transform(g *Graph) error {
@@ -20,13 +21,13 @@ func (t *RemovedModuleTransformer) Transform(g *Graph) error {
         }
 
         for _, m := range t.State.Modules {
-                c := t.Module.Child(m.Path[1:])
-                if c != nil {
+                cc := t.Config.DescendentForInstance(m.Addr)
+                if cc != nil {
                         continue
                 }
 
-                log.Printf("[DEBUG] module %s no longer in config\n", modulePrefixStr(m.Path))
-                g.Add(&NodeModuleRemoved{PathValue: m.Path})
+                log.Printf("[DEBUG] %s is no longer in configuration\n", m.Addr)
+                g.Add(&NodeModuleRemoved{Addr: m.Addr})
         }
         return nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go b/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go
index e528b37..1123790 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go
@@ -1,8 +1,8 @@
 package terraform
 
 import (
-        "fmt"
-
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -11,41 +11,44 @@ import (
 //
 // This assumes that the count is already interpolated.
 type ResourceCountTransformer struct {
-        Concrete ConcreteResourceNodeFunc
+        Concrete ConcreteResourceInstanceNodeFunc
+        Schema   *configschema.Block
 
+        // Count is either the number of indexed instances to create, or -1 to
+        // indicate that count is not set at all and thus a no-key instance should
+        // be created.
         Count int
-        Addr  *ResourceAddress
+        Addr  addrs.AbsResource
 }
 
 func (t *ResourceCountTransformer) Transform(g *Graph) error {
-        // Don't allow the count to be negative
         if t.Count < 0 {
-                return fmt.Errorf("negative count: %d", t.Count)
+                // Negative count indicates that count is not set at all.
+                addr := t.Addr.Instance(addrs.NoKey)
+
+                abstract := NewNodeAbstractResourceInstance(addr)
+                abstract.Schema = t.Schema
+                var node dag.Vertex = abstract
+                if f := t.Concrete; f != nil {
+                        node = f(abstract)
+                }
+
+                g.Add(node)
+                return nil
         }
 
         // For each count, build and add the node
         for i := 0; i < t.Count; i++ {
-                // Set the index. If our count is 1 we special case it so that
-                // we handle the "resource.0" and "resource" boundary properly.
-                index := i
-                if t.Count == 1 {
-                        index = -1
-                }
+                key := addrs.IntKey(i)
+                addr := t.Addr.Instance(key)
 
-                // Build the resource address
-                addr := t.Addr.Copy()
-                addr.Index = index
-
-                // Build the abstract node and the concrete one
-                abstract := &NodeAbstractResource{
-                        Addr: addr,
-                }
+                abstract := NewNodeAbstractResourceInstance(addr)
+                abstract.Schema = t.Schema
                 var node dag.Vertex = abstract
                 if f := t.Concrete; f != nil {
                         node = f(abstract)
                 }
 
-                // Add it to the graph
                 g.Add(node)
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_state.go b/vendor/github.com/hashicorp/terraform/terraform/transform_state.go
index 471cd74..0b52347 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_state.go
@@ -1,10 +1,9 @@
 package terraform
 
 import (
-        "fmt"
         "log"
 
-        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
 )
 
 // StateTransformer is a GraphTransformer that adds the elements of
@@ -13,53 +12,63 @@ import (
 // This transform is used for example by the DestroyPlanGraphBuilder to ensure
 // that only resources that are in the state are represented in the graph.
 type StateTransformer struct {
-        Concrete ConcreteResourceNodeFunc
+        // ConcreteCurrent and ConcreteDeposed are used to specialize the abstract
+        // resource instance nodes that this transformer will create.
+        //
+        // If either of these is nil, the objects of that type will be skipped and
+        // not added to the graph at all. It doesn't make sense to use this
+        // transformer without setting at least one of these, since that would
+        // skip everything and thus be a no-op.
+        ConcreteCurrent ConcreteResourceInstanceNodeFunc
+        ConcreteDeposed ConcreteResourceInstanceDeposedNodeFunc
 
-        State *State
+        State *states.State
 }
 
 func (t *StateTransformer) Transform(g *Graph) error {
-        // If the state is nil or empty (nil is empty) then do nothing
-        if t.State.Empty() {
+        if !t.State.HasResources() {
+                log.Printf("[TRACE] StateTransformer: state is empty, so nothing to do")
                 return nil
         }
 
-        // Go through all the modules in the diff.
-        log.Printf("[TRACE] StateTransformer: starting")
-        var nodes []dag.Vertex
+        switch {
+        case t.ConcreteCurrent != nil && t.ConcreteDeposed != nil:
+                log.Printf("[TRACE] StateTransformer: creating nodes for both current and deposed instance objects")
+        case t.ConcreteCurrent != nil:
+                log.Printf("[TRACE] StateTransformer: creating nodes for current instance objects only")
+        case t.ConcreteDeposed != nil:
+                log.Printf("[TRACE] StateTransformer: creating nodes for deposed instance objects only")
+        default:
+                log.Printf("[TRACE] StateTransformer: pointless no-op call, creating no nodes at all")
+        }
+
         for _, ms := range t.State.Modules {
-                log.Printf("[TRACE] StateTransformer: Module: %v", ms.Path)
+                moduleAddr := ms.Addr
 
-                // Go through all the resources in this module.
-                for name, rs := range ms.Resources {
-                        log.Printf("[TRACE] StateTransformer: Resource %q: %#v", name, rs)
+                for _, rs := range ms.Resources {
+                        resourceAddr := rs.Addr.Absolute(moduleAddr)
 
-                        // Add the resource to the graph
-                        addr, err := parseResourceAddressInternal(name)
-                        if err != nil {
-                                panic(fmt.Sprintf(
-                                        "Error parsing internal name, this is a bug: %q", name))
-                        }
+                        for key, is := range rs.Instances {
+                                addr := resourceAddr.Instance(key)
 
-                        // Very important: add the module path for this resource to
-                        // the address. Remove "root" from it.
-                        addr.Path = ms.Path[1:]
+                                if obj := is.Current; obj != nil && t.ConcreteCurrent != nil {
+                                        abstract := NewNodeAbstractResourceInstance(addr)
+                                        node := t.ConcreteCurrent(abstract)
+                                        g.Add(node)
+                                        log.Printf("[TRACE] StateTransformer: added %T for %s current object", node, addr)
+                                }
 
-                        // Add the resource to the graph
-                        abstract := &NodeAbstractResource{Addr: addr}
-                        var node dag.Vertex = abstract
-                        if f := t.Concrete; f != nil {
-                                node = f(abstract)
+                                if t.ConcreteDeposed != nil {
+                                        for dk := range is.Deposed {
+                                                abstract := NewNodeAbstractResourceInstance(addr)
+                                                node := t.ConcreteDeposed(abstract, dk)
+                                                g.Add(node)
+                                                log.Printf("[TRACE] StateTransformer: added %T for %s deposed object %s", node, addr, dk)
+                                        }
+                                }
                         }
-
-                        nodes = append(nodes, node)
                 }
         }
 
-        // Add all the nodes to the graph
-        for _, n := range nodes {
-                g.Add(n)
-        }
-
         return nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go b/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go
index af6defe..d25274e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go
@@ -3,6 +3,7 @@ package terraform
 import (
         "log"
 
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -12,7 +13,7 @@ import (
 // provided will contain every target provided, and each implementing graph
 // node must filter this list to targets considered relevant.
 type GraphNodeTargetable interface {
-        SetTargets([]ResourceAddress)
+        SetTargets([]addrs.Targetable)
 }
 
 // GraphNodeTargetDownstream is an interface for graph nodes that need to
@@ -35,11 +36,7 @@ type GraphNodeTargetDownstream interface {
 // their dependencies.
 type TargetsTransformer struct {
         // List of targeted resource names specified by the user
-        Targets []string
-
-        // List of parsed targets, provided by callers like ResourceCountTransform
-        // that already have the targets parsed
-        ParsedTargets []ResourceAddress
+        Targets []addrs.Targetable
 
         // If set, the index portions of resource addresses will be ignored
         // for comparison. This is used when transforming a graph where
@@ -53,17 +50,8 @@ type TargetsTransformer struct {
 }
 
 func (t *TargetsTransformer) Transform(g *Graph) error {
-        if len(t.Targets) > 0 && len(t.ParsedTargets) == 0 {
-                addrs, err := t.parseTargetAddresses()
-                if err != nil {
-                        return err
-                }
-
-                t.ParsedTargets = addrs
-        }
-
-        if len(t.ParsedTargets) > 0 {
-                targetedNodes, err := t.selectTargetedNodes(g, t.ParsedTargets)
+        if len(t.Targets) > 0 {
+                targetedNodes, err := t.selectTargetedNodes(g, t.Targets)
                 if err != nil {
                         return err
                 }
@@ -88,24 +76,10 @@ func (t *TargetsTransformer) Transform(g *Graph) error {
         return nil
 }
 
-func (t *TargetsTransformer) parseTargetAddresses() ([]ResourceAddress, error) {
-        addrs := make([]ResourceAddress, len(t.Targets))
-        for i, target := range t.Targets {
-                ta, err := ParseResourceAddress(target)
-                if err != nil {
-                        return nil, err
-                }
-                addrs[i] = *ta
-        }
-
-        return addrs, nil
-}
-
-// Returns the list of targeted nodes. A targeted node is either addressed
-// directly, or is an Ancestor of a targeted node. Destroy mode keeps
-// Descendents instead of Ancestors.
-func (t *TargetsTransformer) selectTargetedNodes(
-        g *Graph, addrs []ResourceAddress) (*dag.Set, error) {
+// Returns a set of targeted nodes. A targeted node is either addressed
+// directly, address indirectly via its container, or it's a dependency of a
+// targeted node. Destroy mode keeps dependents instead of dependencies.
+func (t *TargetsTransformer) selectTargetedNodes(g *Graph, addrs []addrs.Targetable) (*dag.Set, error) {
         targetedNodes := new(dag.Set)
 
         vertices := g.Vertices()
@@ -154,6 +128,12 @@ func (t *TargetsTransformer) addDependencies(targetedNodes *dag.Set, g *Graph) (
                 vertices := queue
                 queue = nil // ready to append for next iteration if neccessary
                 for _, v := range vertices {
+                        // providers don't cause transitive dependencies, so don't target
+                        // downstream from them.
+                        if _, ok := v.(GraphNodeProvider); ok {
+                                continue
+                        }
+
                         dependers := g.UpEdges(v)
                         if dependers == nil {
                                 // indicates that there are no up edges for this node, so
@@ -240,21 +220,34 @@ func filterPartialOutputs(v interface{}, targetedNodes *dag.Set, g *Graph) bool
         return true
 }
 
-func (t *TargetsTransformer) nodeIsTarget(
-        v dag.Vertex, addrs []ResourceAddress) bool {
-        r, ok := v.(GraphNodeResource)
+func (t *TargetsTransformer) nodeIsTarget(v dag.Vertex, targets []addrs.Targetable) bool {
+        var vertexAddr addrs.Targetable
+        switch r := v.(type) {
+        case GraphNodeResourceInstance:
+                vertexAddr = r.ResourceInstanceAddr()
+        case GraphNodeResource:
+                vertexAddr = r.ResourceAddr()
+        default:
+                // Only resource and resource instance nodes can be targeted.
+                return false
+        }
+        _, ok := v.(GraphNodeResource)
         if !ok {
                 return false
         }
 
-        addr := r.ResourceAddr()
-        for _, targetAddr := range addrs {
+        for _, targetAddr := range targets {
                 if t.IgnoreIndices {
-                        // targetAddr is not a pointer, so we can safely mutate it without
-                        // interfering with references elsewhere.
-                        targetAddr.Index = -1
+                        // If we're ignoring indices then we'll convert any resource instance
+                        // addresses into resource addresses. We don't need to convert
+                        // vertexAddr because instance addresses are contained within
+                        // their associated resources, and so .TargetContains will take
+                        // care of this for us.
+                        if instance, isInstance := targetAddr.(addrs.AbsResourceInstance); isInstance {
+                                targetAddr = instance.ContainingResource()
+                        }
                 }
-                if targetAddr.Contains(addr) {
+                if targetAddr.TargetContains(vertexAddr) {
                         return true
                 }
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_variable.go b/vendor/github.com/hashicorp/terraform/terraform/transform_variable.go
index b31e2c7..05daa51 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_variable.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_variable.go
@@ -1,7 +1,8 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
 )
 
 // RootVariableTransformer is a GraphTransformer that adds all the root
@@ -11,28 +12,27 @@ import (
 // graph since downstream things that depend on them must be able to
 // reach them.
 type RootVariableTransformer struct {
-        Module *module.Tree
+        Config *configs.Config
 }
 
 func (t *RootVariableTransformer) Transform(g *Graph) error {
-        // If no config, no variables
-        if t.Module == nil {
+        // We can have no variables if we have no config.
+        if t.Config == nil {
                 return nil
         }
 
-        // If we have no vars, we're done!
-        vars := t.Module.Config().Variables
-        if len(vars) == 0 {
-                return nil
-        }
+        // We're only considering root module variables here, since child
+        // module variables are handled by ModuleVariableTransformer.
+        vars := t.Config.Module.Variables
 
         // Add all variables here
         for _, v := range vars {
                 node := &NodeRootVariable{
+                        Addr: addrs.InputVariable{
+                                Name: v.Name,
+                        },
                         Config: v,
                 }
-
-                // Add it!
                 g.Add(node)
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/ui_input.go b/vendor/github.com/hashicorp/terraform/terraform/ui_input.go
index 7c87459..f6790d9 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/ui_input.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/ui_input.go
@@ -1,10 +1,12 @@
 package terraform
 
+import "context"
+
 // UIInput is the interface that must be implemented to ask for input
 // from this user. This should forward the request to wherever the user
 // inputs things to ask for values.
 type UIInput interface {
-        Input(*InputOpts) (string, error)
+        Input(context.Context, *InputOpts) (string, error)
 }
 
 // InputOpts are options for asking for input.
diff --git a/vendor/github.com/hashicorp/terraform/terraform/ui_input_mock.go b/vendor/github.com/hashicorp/terraform/terraform/ui_input_mock.go
index e3a07ef..e2d9c38 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/ui_input_mock.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/ui_input_mock.go
@@ -1,5 +1,7 @@
 package terraform
 
+import "context"
+
 // MockUIInput is an implementation of UIInput that can be used for tests.
 type MockUIInput struct {
         InputCalled       bool
@@ -10,7 +12,7 @@ type MockUIInput struct {
         InputFn           func(*InputOpts) (string, error)
 }
 
-func (i *MockUIInput) Input(opts *InputOpts) (string, error) {
+func (i *MockUIInput) Input(ctx context.Context, opts *InputOpts) (string, error) {
         i.InputCalled = true
         i.InputOpts = opts
         if i.InputFn != nil {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/ui_input_prefix.go b/vendor/github.com/hashicorp/terraform/terraform/ui_input_prefix.go
index 2207d1d..b5d32b1 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/ui_input_prefix.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/ui_input_prefix.go
@@ -1,6 +1,7 @@
 package terraform
 
 import (
+        "context"
         "fmt"
 )
 
@@ -12,8 +13,8 @@ type PrefixUIInput struct {
         UIInput     UIInput
 }
 
-func (i *PrefixUIInput) Input(opts *InputOpts) (string, error) {
+func (i *PrefixUIInput) Input(ctx context.Context, opts *InputOpts) (string, error) {
         opts.Id = fmt.Sprintf("%s.%s", i.IdPrefix, opts.Id)
         opts.Query = fmt.Sprintf("%s%s", i.QueryPrefix, opts.Query)
-        return i.UIInput.Input(opts)
+        return i.UIInput.Input(ctx, opts)
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/ui_output_provisioner.go b/vendor/github.com/hashicorp/terraform/terraform/ui_output_provisioner.go
index 878a031..fff964f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/ui_output_provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/ui_output_provisioner.go
@@ -1,15 +1,19 @@
 package terraform
 
+import (
+        "github.com/hashicorp/terraform/addrs"
+)
+
 // ProvisionerUIOutput is an implementation of UIOutput that calls a hook
 // for the output so that the hooks can handle it.
 type ProvisionerUIOutput struct {
-        Info  *InstanceInfo
-        Type  string
-        Hooks []Hook
+        InstanceAddr    addrs.AbsResourceInstance
+        ProvisionerType string
+        Hooks           []Hook
 }
 
 func (o *ProvisionerUIOutput) Output(msg string) {
         for _, h := range o.Hooks {
-                h.ProvisionOutput(o.Info, o.Type, msg)
+                h.ProvisionOutput(o.InstanceAddr, o.ProvisionerType, msg)
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/valuesourcetype_string.go b/vendor/github.com/hashicorp/terraform/terraform/valuesourcetype_string.go
new file mode 100644
index 0000000..627593d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/valuesourcetype_string.go
@@ -0,0 +1,59 @@
+// Code generated by "stringer -type ValueSourceType"; DO NOT EDIT.
+
+package terraform
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[ValueFromUnknown-0]
+        _ = x[ValueFromConfig-67]
+        _ = x[ValueFromAutoFile-70]
+        _ = x[ValueFromNamedFile-78]
+        _ = x[ValueFromCLIArg-65]
+        _ = x[ValueFromEnvVar-69]
+        _ = x[ValueFromInput-73]
+        _ = x[ValueFromPlan-80]
+        _ = x[ValueFromCaller-83]
+}
+
+const (
+        _ValueSourceType_name_0 = "ValueFromUnknown"
+        _ValueSourceType_name_1 = "ValueFromCLIArg"
+        _ValueSourceType_name_2 = "ValueFromConfig"
+        _ValueSourceType_name_3 = "ValueFromEnvVarValueFromAutoFile"
+        _ValueSourceType_name_4 = "ValueFromInput"
+        _ValueSourceType_name_5 = "ValueFromNamedFile"
+        _ValueSourceType_name_6 = "ValueFromPlan"
+        _ValueSourceType_name_7 = "ValueFromCaller"
+)
+
+var (
+        _ValueSourceType_index_3 = [...]uint8{0, 15, 32}
+)
+
+func (i ValueSourceType) String() string {
+        switch {
+        case i == 0:
+                return _ValueSourceType_name_0
+        case i == 65:
+                return _ValueSourceType_name_1
+        case i == 67:
+                return _ValueSourceType_name_2
+        case 69 <= i && i <= 70:
+                i -= 69
+                return _ValueSourceType_name_3[_ValueSourceType_index_3[i]:_ValueSourceType_index_3[i+1]]
+        case i == 73:
+                return _ValueSourceType_name_4
+        case i == 78:
+                return _ValueSourceType_name_5
+        case i == 80:
+                return _ValueSourceType_name_6
+        case i == 83:
+                return _ValueSourceType_name_7
+        default:
+                return "ValueSourceType(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/variables.go b/vendor/github.com/hashicorp/terraform/terraform/variables.go
index 300f2ad..75531b2 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/variables.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/variables.go
@@ -2,165 +2,312 @@ package terraform
 
 import (
         "fmt"
-        "os"
-        "strings"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
-        "github.com/hashicorp/terraform/helper/hilmapstructure"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// InputValue represents a value for a variable in the root module, provided
+// as part of the definition of an operation.
+type InputValue struct {
+        Value      cty.Value
+        SourceType ValueSourceType
+
+        // SourceRange provides source location information for values whose
+        // SourceType is either ValueFromConfig or ValueFromFile. It is not
+        // populated for other source types, and so should not be used.
+        SourceRange tfdiags.SourceRange
+}
+
+// ValueSourceType describes what broad category of source location provided
+// a particular value.
+type ValueSourceType rune
+
+const (
+        // ValueFromUnknown is the zero value of ValueSourceType and is not valid.
+        ValueFromUnknown ValueSourceType = 0
+
+        // ValueFromConfig indicates that a value came from a .tf or .tf.json file,
+        // e.g. the default value defined for a variable.
+        ValueFromConfig ValueSourceType = 'C'
+
+        // ValueFromAutoFile indicates that a value came from a "values file", like
+        // a .tfvars file, that was implicitly loaded by naming convention.
+        ValueFromAutoFile ValueSourceType = 'F'
+
+        // ValueFromNamedFile indicates that a value came from a named "values file",
+        // like a .tfvars file, that was passed explicitly on the command line (e.g.
+        // -var-file=foo.tfvars).
+        ValueFromNamedFile ValueSourceType = 'N'
+
+        // ValueFromCLIArg indicates that the value was provided directly in
+        // a CLI argument. The name of this argument is not recorded and so it must
+        // be inferred from context.
+        ValueFromCLIArg ValueSourceType = 'A'
+
+        // ValueFromEnvVar indicates that the value was provided via an environment
+        // variable. The name of the variable is not recorded and so it must be
+        // inferred from context.
+        ValueFromEnvVar ValueSourceType = 'E'
+
+        // ValueFromInput indicates that the value was provided at an interactive
+        // input prompt.
+        ValueFromInput ValueSourceType = 'I'
+
+        // ValueFromPlan indicates that the value was retrieved from a stored plan.
+        ValueFromPlan ValueSourceType = 'P'
+
+        // ValueFromCaller indicates that the value was explicitly overridden by
+        // a caller to Context.SetVariable after the context was constructed.
+        ValueFromCaller ValueSourceType = 'S'
 )
 
-// Variables returns the fully loaded set of variables to use with
-// ContextOpts and NewContext, loading any additional variables from
-// the environment or any other sources.
+func (v *InputValue) GoString() string {
+        if (v.SourceRange != tfdiags.SourceRange{}) {
+                return fmt.Sprintf("&terraform.InputValue{Value: %#v, SourceType: %#v, SourceRange: %#v}", v.Value, v.SourceType, v.SourceRange)
+        } else {
+                return fmt.Sprintf("&terraform.InputValue{Value: %#v, SourceType: %#v}", v.Value, v.SourceType)
+        }
+}
+
+func (v ValueSourceType) GoString() string {
+        return fmt.Sprintf("terraform.%s", v)
+}
+
+//go:generate stringer -type ValueSourceType
+
+// InputValues is a map of InputValue instances.
+type InputValues map[string]*InputValue
+
+// InputValuesFromCaller turns the given map of naked values into an
+// InputValues that attributes each value to "a caller", using the source
+// type ValueFromCaller. This is primarily useful for testing purposes.
 //
-// The given module tree doesn't need to be loaded.
-func Variables(
-        m *module.Tree,
-        override map[string]interface{}) (map[string]interface{}, error) {
-        result := make(map[string]interface{})
-
-        // Variables are loaded in the following sequence. Each additional step
-        // will override conflicting variable keys from prior steps:
-        //
-        //   * Take default values from config
-        //   * Take values from TF_VAR_x env vars
-        //   * Take values specified in the "override" param which is usually
-        //     from -var, -var-file, etc.
-        //
-
-        // First load from the config
-        for _, v := range m.Config().Variables {
-                // If the var has no default, ignore
-                if v.Default == nil {
-                        continue
+// This should not be used as a general way to convert map[string]cty.Value
+// into InputValues, since in most real cases we want to set a suitable
+// other SourceType and possibly SourceRange value.
+func InputValuesFromCaller(vals map[string]cty.Value) InputValues {
+        ret := make(InputValues, len(vals))
+        for k, v := range vals {
+                ret[k] = &InputValue{
+                        Value:      v,
+                        SourceType: ValueFromCaller,
                 }
+        }
+        return ret
+}
 
-                // If the type isn't a string, we use it as-is since it is a rich type
-                if v.Type() != config.VariableTypeString {
-                        result[v.Name] = v.Default
-                        continue
+// Override merges the given value maps with the receiver, overriding any
+// conflicting keys so that the latest definition wins.
+func (vv InputValues) Override(others ...InputValues) InputValues {
+        // FIXME: This should check to see if any of the values are maps and
+        // merge them if so, in order to preserve the behavior from prior to
+        // Terraform 0.12.
+        ret := make(InputValues)
+        for k, v := range vv {
+                ret[k] = v
+        }
+        for _, other := range others {
+                for k, v := range other {
+                        ret[k] = v
                 }
+        }
+        return ret
+}
 
-                // v.Default has already been parsed as HCL but it may be an int type
-                switch typedDefault := v.Default.(type) {
-                case string:
-                        if typedDefault == "" {
-                                continue
-                        }
-                        result[v.Name] = typedDefault
-                case int, int64:
-                        result[v.Name] = fmt.Sprintf("%d", typedDefault)
-                case float32, float64:
-                        result[v.Name] = fmt.Sprintf("%f", typedDefault)
-                case bool:
-                        result[v.Name] = fmt.Sprintf("%t", typedDefault)
-                default:
-                        panic(fmt.Sprintf(
-                                "Unknown default var type: %T\n\n"+
-                                        "THIS IS A BUG. Please report it.",
-                                v.Default))
-                }
+// JustValues returns a map that just includes the values, discarding the
+// source information.
+func (vv InputValues) JustValues() map[string]cty.Value {
+        ret := make(map[string]cty.Value, len(vv))
+        for k, v := range vv {
+                ret[k] = v.Value
         }
+        return ret
+}
 
-        // Load from env vars
-        for _, v := range os.Environ() {
-                if !strings.HasPrefix(v, VarEnvPrefix) {
+// DefaultVariableValues returns an InputValues map representing the default
+// values specified for variables in the given configuration map.
+func DefaultVariableValues(configs map[string]*configs.Variable) InputValues {
+        ret := make(InputValues)
+        for k, c := range configs {
+                if c.Default == cty.NilVal {
                         continue
                 }
+                ret[k] = &InputValue{
+                        Value:       c.Default,
+                        SourceType:  ValueFromConfig,
+                        SourceRange: tfdiags.SourceRangeFromHCL(c.DeclRange),
+                }
+        }
+        return ret
+}
 
-                // Strip off the prefix and get the value after the first "="
-                idx := strings.Index(v, "=")
-                k := v[len(VarEnvPrefix):idx]
-                v = v[idx+1:]
-
-                // Override the configuration-default values. Note that *not* finding the variable
-                // in configuration is OK, as we don't want to preclude people from having multiple
-                // sets of TF_VAR_whatever in their environment even if it is a little weird.
-                for _, schema := range m.Config().Variables {
-                        if schema.Name != k {
-                                continue
-                        }
-
-                        varType := schema.Type()
-                        varVal, err := parseVariableAsHCL(k, v, varType)
-                        if err != nil {
-                                return nil, err
-                        }
+// SameValues returns true if the given InputValues has the same values as
+// the receiever, disregarding the source types and source ranges.
+//
+// Values are compared using the cty "RawEquals" method, which means that
+// unknown values can be considered equal to one another if they are of the
+// same type.
+func (vv InputValues) SameValues(other InputValues) bool {
+        if len(vv) != len(other) {
+                return false
+        }
 
-                        switch varType {
-                        case config.VariableTypeMap:
-                                if err := varSetMap(result, k, varVal); err != nil {
-                                        return nil, err
-                                }
-                        default:
-                                result[k] = varVal
-                        }
+        for k, v := range vv {
+                ov, exists := other[k]
+                if !exists {
+                        return false
+                }
+                if !v.Value.RawEquals(ov.Value) {
+                        return false
                 }
         }
 
-        // Load from overrides
-        for k, v := range override {
-                for _, schema := range m.Config().Variables {
-                        if schema.Name != k {
-                                continue
-                        }
+        return true
+}
 
-                        switch schema.Type() {
-                        case config.VariableTypeList:
-                                result[k] = v
-                        case config.VariableTypeMap:
-                                if err := varSetMap(result, k, v); err != nil {
-                                        return nil, err
-                                }
-                        case config.VariableTypeString:
-                                // Convert to a string and set. We don't catch any errors
-                                // here because the validation step later should catch
-                                // any type errors.
-                                var strVal string
-                                if err := hilmapstructure.WeakDecode(v, &strVal); err == nil {
-                                        result[k] = strVal
-                                } else {
-                                        result[k] = v
-                                }
-                        default:
-                                panic(fmt.Sprintf(
-                                        "Unhandled var type: %T\n\n"+
-                                                "THIS IS A BUG. Please report it.",
-                                        schema.Type()))
-                        }
+// HasValues returns true if the reciever has the same values as in the given
+// map, disregarding the source types and source ranges.
+//
+// Values are compared using the cty "RawEquals" method, which means that
+// unknown values can be considered equal to one another if they are of the
+// same type.
+func (vv InputValues) HasValues(vals map[string]cty.Value) bool {
+        if len(vv) != len(vals) {
+                return false
+        }
+
+        for k, v := range vv {
+                oVal, exists := vals[k]
+                if !exists {
+                        return false
+                }
+                if !v.Value.RawEquals(oVal) {
+                        return false
                 }
         }
 
-        return result, nil
+        return true
 }
 
-// varSetMap sets or merges the map in "v" with the key "k" in the
-// "current" set of variables. This is just a private function to remove
-// duplicate logic in Variables
-func varSetMap(current map[string]interface{}, k string, v interface{}) error {
-        existing, ok := current[k]
-        if !ok {
-                current[k] = v
-                return nil
+// Identical returns true if the given InputValues has the same values,
+// source types, and source ranges as the receiver.
+//
+// Values are compared using the cty "RawEquals" method, which means that
+// unknown values can be considered equal to one another if they are of the
+// same type.
+//
+// This method is primarily for testing. For most practical purposes, it's
+// better to use SameValues or HasValues.
+func (vv InputValues) Identical(other InputValues) bool {
+        if len(vv) != len(other) {
+                return false
         }
 
-        existingMap, ok := existing.(map[string]interface{})
-        if !ok {
-                panic(fmt.Sprintf("%q is not a map, this is a bug in Terraform.", k))
+        for k, v := range vv {
+                ov, exists := other[k]
+                if !exists {
+                        return false
+                }
+                if !v.Value.RawEquals(ov.Value) {
+                        return false
+                }
+                if v.SourceType != ov.SourceType {
+                        return false
+                }
+                if v.SourceRange != ov.SourceRange {
+                        return false
+                }
         }
 
-        switch typedV := v.(type) {
-        case []map[string]interface{}:
-                for newKey, newVal := range typedV[0] {
-                        existingMap[newKey] = newVal
+        return true
+}
+
+// checkInputVariables ensures that variable values supplied at the UI conform
+// to their corresponding declarations in configuration.
+//
+// The set of values is considered valid only if the returned diagnostics
+// does not contain errors. A valid set of values may still produce warnings,
+// which should be returned to the user.
+func checkInputVariables(vcs map[string]*configs.Variable, vs InputValues) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        for name, vc := range vcs {
+                val, isSet := vs[name]
+                if !isSet {
+                        // Always an error, since the caller should already have included
+                        // default values from the configuration in the values map.
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Unassigned variable",
+                                fmt.Sprintf("The input variable %q has not been assigned a value. This is a bug in Terraform; please report it in a GitHub issue.", name),
+                        ))
+                        continue
                 }
-        case map[string]interface{}:
-                for newKey, newVal := range typedV {
-                        existingMap[newKey] = newVal
+
+                wantType := vc.Type
+
+                // A given value is valid if it can convert to the desired type.
+                _, err := convert.Convert(val.Value, wantType)
+                if err != nil {
+                        switch val.SourceType {
+                        case ValueFromConfig, ValueFromAutoFile, ValueFromNamedFile:
+                                // We have source location information for these.
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid value for input variable",
+                                        Detail:   fmt.Sprintf("The given value is not valid for variable %q: %s.", name, err),
+                                        Subject:  val.SourceRange.ToHCL().Ptr(),
+                                })
+                        case ValueFromEnvVar:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid value for input variable",
+                                        fmt.Sprintf("The environment variable TF_VAR_%s does not contain a valid value for variable %q: %s.", name, name, err),
+                                ))
+                        case ValueFromCLIArg:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid value for input variable",
+                                        fmt.Sprintf("The argument -var=\"%s=...\" does not contain a valid value for variable %q: %s.", name, name, err),
+                                ))
+                        case ValueFromInput:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid value for input variable",
+                                        fmt.Sprintf("The value entered for variable %q is not valid: %s.", name, err),
+                                ))
+                        default:
+                                // The above gets us good coverage for the situations users
+                                // are likely to encounter with their own inputs. The other
+                                // cases are generally implementation bugs, so we'll just
+                                // use a generic error for these.
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid value for input variable",
+                                        fmt.Sprintf("The value provided for variable %q is not valid: %s.", name, err),
+                                ))
+                        }
                 }
-        default:
-                return fmt.Errorf("variable %q should be type map, got %s", k, hclTypeName(v))
         }
-        return nil
+
+        // Check for any variables that are assigned without being configured.
+        // This is always an implementation error in the caller, because we
+        // expect undefined variables to be caught during context construction
+        // where there is better context to report it well.
+        for name := range vs {
+                if _, defined := vcs[name]; !defined {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Value assigned to undeclared variable",
+                                fmt.Sprintf("A value was assigned to an undeclared input variable %q.", name),
+                        ))
+                }
+        }
+
+        return diags
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/version_required.go b/vendor/github.com/hashicorp/terraform/terraform/version_required.go
index 1f43045..61423c2 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/version_required.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/version_required.go
@@ -3,69 +3,60 @@ package terraform
 import (
         "fmt"
 
-        "github.com/hashicorp/go-version"
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/tfdiags"
+
+        "github.com/hashicorp/terraform/configs"
 
         tfversion "github.com/hashicorp/terraform/version"
 )
 
-// CheckRequiredVersion verifies that any version requirements specified by
-// the configuration are met.
-//
-// This checks the root module as well as any additional version requirements
-// from child modules.
+// CheckCoreVersionRequirements visits each of the modules in the given
+// configuration tree and verifies that any given Core version constraints
+// match with the version of Terraform Core that is being used.
 //
-// This is tested in context_test.go.
-func CheckRequiredVersion(m *module.Tree) error {
-        // Check any children
-        for _, c := range m.Children() {
-                if err := CheckRequiredVersion(c); err != nil {
-                        return err
-                }
-        }
-
-        var tf *config.Terraform
-        if c := m.Config(); c != nil {
-                tf = c.Terraform
-        }
-
-        // If there is no Terraform config or the required version isn't set,
-        // we move on.
-        if tf == nil || tf.RequiredVersion == "" {
+// The returned diagnostics will contain errors if any constraints do not match.
+// The returned diagnostics might also return warnings, which should be
+// displayed to the user.
+func CheckCoreVersionRequirements(config *configs.Config) tfdiags.Diagnostics {
+        if config == nil {
                 return nil
         }
 
-        // Path for errors
-        module := "root"
-        if path := normalizeModulePath(m.Path()); len(path) > 1 {
-                module = modulePrefixStr(path)
-        }
-
-        // Check this version requirement of this module
-        cs, err := version.NewConstraint(tf.RequiredVersion)
-        if err != nil {
-                return fmt.Errorf(
-                        "%s: terraform.required_version %q syntax error: %s",
-                        module,
-                        tf.RequiredVersion, err)
+        var diags tfdiags.Diagnostics
+        module := config.Module
+
+        for _, constraint := range module.CoreVersionConstraints {
+                if !constraint.Required.Check(tfversion.SemVer) {
+                        switch {
+                        case len(config.Path) == 0:
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Unsupported Terraform Core version",
+                                        Detail: fmt.Sprintf(
+                                                "This configuration does not support Terraform version %s. To proceed, either choose another supported Terraform version or update this version constraint. Version constraints are normally set for good reason, so updating the constraint may lead to other errors or unexpected behavior.",
+                                                tfversion.String(),
+                                        ),
+                                        Subject: &constraint.DeclRange,
+                                })
+                        default:
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Unsupported Terraform Core version",
+                                        Detail: fmt.Sprintf(
+                                                "Module %s (from %s) does not support Terraform version %s. To proceed, either choose another supported Terraform version or update this version constraint. Version constraints are normally set for good reason, so updating the constraint may lead to other errors or unexpected behavior.",
+                                                config.Path, config.SourceAddr, tfversion.String(),
+                                        ),
+                                        Subject: &constraint.DeclRange,
+                                })
+                        }
+                }
         }
 
-        if !cs.Check(tfversion.SemVer) {
-                return fmt.Errorf(
-                        "The currently running version of Terraform doesn't meet the\n"+
-                                "version requirements explicitly specified by the configuration.\n"+
-                                "Please use the required version or update the configuration.\n"+
-                                "Note that version requirements are usually set for a reason, so\n"+
-                                "we recommend verifying with whoever set the version requirements\n"+
-                                "prior to making any manual changes.\n\n"+
-                                "  Module: %s\n"+
-                                "  Required version: %s\n"+
-                                "  Current version: %s",
-                        module,
-                        tf.RequiredVersion,
-                        tfversion.SemVer)
+        for _, c := range config.Children {
+                childDiags := CheckCoreVersionRequirements(c)
+                diags = diags.Append(childDiags)
         }
 
-        return nil
+        return diags
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/walkoperation_string.go b/vendor/github.com/hashicorp/terraform/terraform/walkoperation_string.go
index 4cfc528..0666aa5 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/walkoperation_string.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/walkoperation_string.go
@@ -4,9 +4,24 @@ package terraform
 
 import "strconv"
 
-const _walkOperation_name = "walkInvalidwalkInputwalkApplywalkPlanwalkPlanDestroywalkRefreshwalkValidatewalkDestroywalkImport"
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[walkInvalid-0]
+        _ = x[walkApply-1]
+        _ = x[walkPlan-2]
+        _ = x[walkPlanDestroy-3]
+        _ = x[walkRefresh-4]
+        _ = x[walkValidate-5]
+        _ = x[walkDestroy-6]
+        _ = x[walkImport-7]
+        _ = x[walkEval-8]
+}
+
+const _walkOperation_name = "walkInvalidwalkApplywalkPlanwalkPlanDestroywalkRefreshwalkValidatewalkDestroywalkImportwalkEval"
 
-var _walkOperation_index = [...]uint8{0, 11, 20, 29, 37, 52, 63, 75, 86, 96}
+var _walkOperation_index = [...]uint8{0, 11, 20, 28, 43, 54, 66, 77, 87, 95}
 
 func (i walkOperation) String() string {
         if i >= walkOperation(len(_walkOperation_index)-1) {
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/config_traversals.go b/vendor/github.com/hashicorp/terraform/tfdiags/config_traversals.go
new file mode 100644
index 0000000..8e41f46
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/config_traversals.go
@@ -0,0 +1,68 @@
+package tfdiags
+
+import (
+        "bytes"
+        "fmt"
+        "strconv"
+
+        "github.com/zclconf/go-cty/cty"
+)
+
+// FormatCtyPath is a helper function to produce a user-friendly string
+// representation of a cty.Path. The result uses a syntax similar to the
+// HCL expression language in the hope of it being familiar to users.
+func FormatCtyPath(path cty.Path) string {
+        var buf bytes.Buffer
+        for _, step := range path {
+                switch ts := step.(type) {
+                case cty.GetAttrStep:
+                        fmt.Fprintf(&buf, ".%s", ts.Name)
+                case cty.IndexStep:
+                        buf.WriteByte('[')
+                        key := ts.Key
+                        keyTy := key.Type()
+                        switch {
+                        case key.IsNull():
+                                buf.WriteString("null")
+                        case !key.IsKnown():
+                                buf.WriteString("(not yet known)")
+                        case keyTy == cty.Number:
+                                bf := key.AsBigFloat()
+                                buf.WriteString(bf.Text('g', -1))
+                        case keyTy == cty.String:
+                                buf.WriteString(strconv.Quote(key.AsString()))
+                        default:
+                                buf.WriteString("...")
+                        }
+                        buf.WriteByte(']')
+                }
+        }
+        return buf.String()
+}
+
+// FormatError is a helper function to produce a user-friendly string
+// representation of certain special error types that we might want to
+// include in diagnostic messages.
+//
+// This currently has special behavior only for cty.PathError, where a
+// non-empty path is rendered in a HCL-like syntax as context.
+func FormatError(err error) string {
+        perr, ok := err.(cty.PathError)
+        if !ok || len(perr.Path) == 0 {
+                return err.Error()
+        }
+
+        return fmt.Sprintf("%s: %s", FormatCtyPath(perr.Path), perr.Error())
+}
+
+// FormatErrorPrefixed is like FormatError except that it presents any path
+// information after the given prefix string, which is assumed to contain
+// an HCL syntax representation of the value that errors are relative to.
+func FormatErrorPrefixed(err error, prefix string) string {
+        perr, ok := err.(cty.PathError)
+        if !ok || len(perr.Path) == 0 {
+                return fmt.Sprintf("%s: %s", prefix, err.Error())
+        }
+
+        return fmt.Sprintf("%s%s: %s", prefix, FormatCtyPath(perr.Path), perr.Error())
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/contextual.go b/vendor/github.com/hashicorp/terraform/tfdiags/contextual.go
new file mode 100644
index 0000000..25b2140
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/contextual.go
@@ -0,0 +1,372 @@
+package tfdiags
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+// The "contextual" family of diagnostics are designed to allow separating
+// the detection of a problem from placing that problem in context. For
+// example, some code that is validating an object extracted from configuration
+// may not have access to the configuration that generated it, but can still
+// report problems within that object which the caller can then place in
+// context by calling IsConfigBody on the returned diagnostics.
+//
+// When contextual diagnostics are used, the documentation for a method must
+// be very explicit about what context is implied for any diagnostics returned,
+// to help ensure the expected result.
+
+// contextualFromConfig is an interface type implemented by diagnostic types
+// that can elaborate themselves when given information about the configuration
+// body they are embedded in.
+//
+// Usually this entails extracting source location information in order to
+// populate the "Subject" range.
+type contextualFromConfigBody interface {
+        ElaborateFromConfigBody(hcl.Body) Diagnostic
+}
+
+// InConfigBody returns a copy of the receiver with any config-contextual
+// diagnostics elaborated in the context of the given body.
+func (d Diagnostics) InConfigBody(body hcl.Body) Diagnostics {
+        if len(d) == 0 {
+                return nil
+        }
+
+        ret := make(Diagnostics, len(d))
+        for i, srcDiag := range d {
+                if cd, isCD := srcDiag.(contextualFromConfigBody); isCD {
+                        ret[i] = cd.ElaborateFromConfigBody(body)
+                } else {
+                        ret[i] = srcDiag
+                }
+        }
+
+        return ret
+}
+
+// AttributeValue returns a diagnostic about an attribute value in an implied current
+// configuration context. This should be returned only from functions whose
+// interface specifies a clear configuration context that this will be
+// resolved in.
+//
+// The given path is relative to the implied configuration context. To describe
+// a top-level attribute, it should be a single-element cty.Path with a
+// cty.GetAttrStep. It's assumed that the path is returning into a structure
+// that would be produced by our conventions in the configschema package; it
+// may return unexpected results for structures that can't be represented by
+// configschema.
+//
+// Since mapping attribute paths back onto configuration is an imprecise
+// operation (e.g. dynamic block generation may cause the same block to be
+// evaluated multiple times) the diagnostic detail should include the attribute
+// name and other context required to help the user understand what is being
+// referenced in case the identified source range is not unique.
+//
+// The returned attribute will not have source location information until
+// context is applied to the containing diagnostics using diags.InConfigBody.
+// After context is applied, the source location is the value assigned to the
+// named attribute, or the containing body's "missing item range" if no
+// value is present.
+func AttributeValue(severity Severity, summary, detail string, attrPath cty.Path) Diagnostic {
+        return &attributeDiagnostic{
+                diagnosticBase: diagnosticBase{
+                        severity: severity,
+                        summary:  summary,
+                        detail:   detail,
+                },
+                attrPath: attrPath,
+        }
+}
+
+// GetAttribute extracts an attribute cty.Path from a diagnostic if it contains
+// one. Normally this is not accessed directly, and instead the config body is
+// added to the Diagnostic to create a more complete message for the user. In
+// some cases however, we may want to know just the name of the attribute that
+// generated the Diagnostic message.
+// This returns a nil cty.Path if it does not exist in the Diagnostic.
+func GetAttribute(d Diagnostic) cty.Path {
+        if d, ok := d.(*attributeDiagnostic); ok {
+                return d.attrPath
+        }
+        return nil
+}
+
+type attributeDiagnostic struct {
+        diagnosticBase
+        attrPath cty.Path
+        subject  *SourceRange // populated only after ElaborateFromConfigBody
+}
+
+// ElaborateFromConfigBody finds the most accurate possible source location
+// for a diagnostic's attribute path within the given body.
+//
+// Backing out from a path back to a source location is not always entirely
+// possible because we lose some information in the decoding process, so
+// if an exact position cannot be found then the returned diagnostic will
+// refer to a position somewhere within the containing body, which is assumed
+// to be better than no location at all.
+//
+// If possible it is generally better to report an error at a layer where
+// source location information is still available, for more accuracy. This
+// is not always possible due to system architecture, so this serves as a
+// "best effort" fallback behavior for such situations.
+func (d *attributeDiagnostic) ElaborateFromConfigBody(body hcl.Body) Diagnostic {
+        if len(d.attrPath) < 1 {
+                // Should never happen, but we'll allow it rather than crashing.
+                return d
+        }
+
+        if d.subject != nil {
+                // Don't modify an already-elaborated diagnostic.
+                return d
+        }
+
+        ret := *d
+
+        // This function will often end up re-decoding values that were already
+        // decoded by an earlier step. This is non-ideal but is architecturally
+        // more convenient than arranging for source location information to be
+        // propagated to every place in Terraform, and this happens only in the
+        // presence of errors where performance isn't a concern.
+
+        traverse := d.attrPath[:]
+        final := d.attrPath[len(d.attrPath)-1]
+
+        // Index should never be the first step
+        // as indexing of top blocks (such as resources & data sources)
+        // is handled elsewhere
+        if _, isIdxStep := traverse[0].(cty.IndexStep); isIdxStep {
+                subject := SourceRangeFromHCL(body.MissingItemRange())
+                ret.subject = &subject
+                return &ret
+        }
+
+        // Process index separately
+        idxStep, hasIdx := final.(cty.IndexStep)
+        if hasIdx {
+                final = d.attrPath[len(d.attrPath)-2]
+                traverse = d.attrPath[:len(d.attrPath)-1]
+        }
+
+        // If we have more than one step after removing index
+        // then we'll first try to traverse to a child body
+        // corresponding to the requested path.
+        if len(traverse) > 1 {
+                body = traversePathSteps(traverse, body)
+        }
+
+        // Default is to indicate a missing item in the deepest body we reached
+        // while traversing.
+        subject := SourceRangeFromHCL(body.MissingItemRange())
+        ret.subject = &subject
+
+        // Once we get here, "final" should be a GetAttr step that maps to an
+        // attribute in our current body.
+        finalStep, isAttr := final.(cty.GetAttrStep)
+        if !isAttr {
+                return &ret
+        }
+
+        content, _, contentDiags := body.PartialContent(&hcl.BodySchema{
+                Attributes: []hcl.AttributeSchema{
+                        {
+                                Name:     finalStep.Name,
+                                Required: true,
+                        },
+                },
+        })
+        if contentDiags.HasErrors() {
+                return &ret
+        }
+
+        if attr, ok := content.Attributes[finalStep.Name]; ok {
+                hclRange := attr.Expr.Range()
+                if hasIdx {
+                        // Try to be more precise by finding index range
+                        hclRange = hclRangeFromIndexStepAndAttribute(idxStep, attr)
+                }
+                subject = SourceRangeFromHCL(hclRange)
+                ret.subject = &subject
+        }
+
+        return &ret
+}
+
+func traversePathSteps(traverse []cty.PathStep, body hcl.Body) hcl.Body {
+        for i := 0; i < len(traverse); i++ {
+                step := traverse[i]
+
+                switch tStep := step.(type) {
+                case cty.GetAttrStep:
+
+                        var next cty.PathStep
+                        if i < (len(traverse) - 1) {
+                                next = traverse[i+1]
+                        }
+
+                        // Will be indexing into our result here?
+                        var indexType cty.Type
+                        var indexVal cty.Value
+                        if nextIndex, ok := next.(cty.IndexStep); ok {
+                                indexVal = nextIndex.Key
+                                indexType = indexVal.Type()
+                                i++ // skip over the index on subsequent iterations
+                        }
+
+                        var blockLabelNames []string
+                        if indexType == cty.String {
+                                // Map traversal means we expect one label for the key.
+                                blockLabelNames = []string{"key"}
+                        }
+
+                        // For intermediate steps we expect to be referring to a child
+                        // block, so we'll attempt decoding under that assumption.
+                        content, _, contentDiags := body.PartialContent(&hcl.BodySchema{
+                                Blocks: []hcl.BlockHeaderSchema{
+                                        {
+                                                Type:       tStep.Name,
+                                                LabelNames: blockLabelNames,
+                                        },
+                                },
+                        })
+                        if contentDiags.HasErrors() {
+                                return body
+                        }
+                        filtered := make([]*hcl.Block, 0, len(content.Blocks))
+                        for _, block := range content.Blocks {
+                                if block.Type == tStep.Name {
+                                        filtered = append(filtered, block)
+                                }
+                        }
+                        if len(filtered) == 0 {
+                                // Step doesn't refer to a block
+                                continue
+                        }
+
+                        switch indexType {
+                        case cty.NilType: // no index at all
+                                if len(filtered) != 1 {
+                                        return body
+                                }
+                                body = filtered[0].Body
+                        case cty.Number:
+                                var idx int
+                                err := gocty.FromCtyValue(indexVal, &idx)
+                                if err != nil || idx >= len(filtered) {
+                                        return body
+                                }
+                                body = filtered[idx].Body
+                        case cty.String:
+                                key := indexVal.AsString()
+                                var block *hcl.Block
+                                for _, candidate := range filtered {
+                                        if candidate.Labels[0] == key {
+                                                block = candidate
+                                                break
+                                        }
+                                }
+                                if block == nil {
+                                        // No block with this key, so we'll just indicate a
+                                        // missing item in the containing block.
+                                        return body
+                                }
+                                body = block.Body
+                        default:
+                                // Should never happen, because only string and numeric indices
+                                // are supported by cty collections.
+                                return body
+                        }
+
+                default:
+                        // For any other kind of step, we'll just return our current body
+                        // as the subject and accept that this is a little inaccurate.
+                        return body
+                }
+        }
+        return body
+}
+
+func hclRangeFromIndexStepAndAttribute(idxStep cty.IndexStep, attr *hcl.Attribute) hcl.Range {
+        switch idxStep.Key.Type() {
+        case cty.Number:
+                var idx int
+                err := gocty.FromCtyValue(idxStep.Key, &idx)
+                items, diags := hcl.ExprList(attr.Expr)
+                if diags.HasErrors() {
+                        return attr.Expr.Range()
+                }
+                if err != nil || idx >= len(items) {
+                        return attr.NameRange
+                }
+                return items[idx].Range()
+        case cty.String:
+                pairs, diags := hcl.ExprMap(attr.Expr)
+                if diags.HasErrors() {
+                        return attr.Expr.Range()
+                }
+                stepKey := idxStep.Key.AsString()
+                for _, kvPair := range pairs {
+                        key, err := kvPair.Key.Value(nil)
+                        if err != nil {
+                                return attr.Expr.Range()
+                        }
+                        if key.AsString() == stepKey {
+                                startRng := kvPair.Value.StartRange()
+                                return startRng
+                        }
+                }
+                return attr.NameRange
+        }
+        return attr.Expr.Range()
+}
+
+func (d *attributeDiagnostic) Source() Source {
+        return Source{
+                Subject: d.subject,
+        }
+}
+
+// WholeContainingBody returns a diagnostic about the body that is an implied
+// current configuration context. This should be returned only from
+// functions whose interface specifies a clear configuration context that this
+// will be resolved in.
+//
+// The returned attribute will not have source location information until
+// context is applied to the containing diagnostics using diags.InConfigBody.
+// After context is applied, the source location is currently the missing item
+// range of the body. In future, this may change to some other suitable
+// part of the containing body.
+func WholeContainingBody(severity Severity, summary, detail string) Diagnostic {
+        return &wholeBodyDiagnostic{
+                diagnosticBase: diagnosticBase{
+                        severity: severity,
+                        summary:  summary,
+                        detail:   detail,
+                },
+        }
+}
+
+type wholeBodyDiagnostic struct {
+        diagnosticBase
+        subject *SourceRange // populated only after ElaborateFromConfigBody
+}
+
+func (d *wholeBodyDiagnostic) ElaborateFromConfigBody(body hcl.Body) Diagnostic {
+        if d.subject != nil {
+                // Don't modify an already-elaborated diagnostic.
+                return d
+        }
+
+        ret := *d
+        rng := SourceRangeFromHCL(body.MissingItemRange())
+        ret.subject = &rng
+        return &ret
+}
+
+func (d *wholeBodyDiagnostic) Source() Source {
+        return Source{
+                Subject: d.subject,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic.go b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic.go
index 2c23f76..c91ba9a 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic.go
@@ -1,9 +1,18 @@
 package tfdiags
 
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
 type Diagnostic interface {
         Severity() Severity
         Description() Description
         Source() Source
+
+        // FromExpr returns the expression-related context for the diagnostic, if
+        // available. Returns nil if the diagnostic is not related to an
+        // expression evaluation.
+        FromExpr() *FromExpr
 }
 
 type Severity rune
@@ -24,3 +33,8 @@ type Source struct {
         Subject *SourceRange
         Context *SourceRange
 }
+
+type FromExpr struct {
+        Expression  hcl.Expression
+        EvalContext *hcl.EvalContext
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic_base.go b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic_base.go
new file mode 100644
index 0000000..50bf9d8
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic_base.go
@@ -0,0 +1,31 @@
+package tfdiags
+
+// diagnosticBase can be embedded in other diagnostic structs to get
+// default implementations of Severity and Description. This type also
+// has default implementations of Source and FromExpr that return no source
+// location or expression-related information, so embedders should generally
+// override those method to return more useful results where possible.
+type diagnosticBase struct {
+        severity Severity
+        summary  string
+        detail   string
+}
+
+func (d diagnosticBase) Severity() Severity {
+        return d.severity
+}
+
+func (d diagnosticBase) Description() Description {
+        return Description{
+                Summary: d.summary,
+                Detail:  d.detail,
+        }
+}
+
+func (d diagnosticBase) Source() Source {
+        return Source{}
+}
+
+func (d diagnosticBase) FromExpr() *FromExpr {
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/diagnostics.go b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostics.go
index 667ba80..465b230 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/diagnostics.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostics.go
@@ -3,6 +3,9 @@ package tfdiags
 import (
         "bytes"
         "fmt"
+        "path/filepath"
+        "sort"
+        "strings"
 
         "github.com/hashicorp/errwrap"
         multierror "github.com/hashicorp/go-multierror"
@@ -54,6 +57,8 @@ func (diags Diagnostics) Append(new ...interface{}) Diagnostics {
                         diags = append(diags, ti...) // flatten
                 case diagnosticsAsError:
                         diags = diags.Append(ti.Diagnostics) // unwrap
+                case NonFatalError:
+                        diags = diags.Append(ti.Diagnostics) // unwrap
                 case hcl.Diagnostics:
                         for _, hclDiag := range ti {
                                 diags = append(diags, hclDiagnostic{hclDiag})
@@ -136,6 +141,54 @@ func (diags Diagnostics) Err() error {
         return diagnosticsAsError{diags}
 }
 
+// ErrWithWarnings is similar to Err except that it will also return a non-nil
+// error if the receiver contains only warnings.
+//
+// In the warnings-only situation, the result is guaranteed to be of dynamic
+// type NonFatalError, allowing diagnostics-aware callers to type-assert
+// and unwrap it, treating it as non-fatal.
+//
+// This should be used only in contexts where the caller is able to recognize
+// and handle NonFatalError. For normal callers that expect a lack of errors
+// to be signaled by nil, use just Diagnostics.Err.
+func (diags Diagnostics) ErrWithWarnings() error {
+        if len(diags) == 0 {
+                return nil
+        }
+        if diags.HasErrors() {
+                return diags.Err()
+        }
+        return NonFatalError{diags}
+}
+
+// NonFatalErr is similar to Err except that it always returns either nil
+// (if there are no diagnostics at all) or NonFatalError.
+//
+// This allows diagnostics to be returned over an error return channel while
+// being explicit that the diagnostics should not halt processing.
+//
+// This should be used only in contexts where the caller is able to recognize
+// and handle NonFatalError. For normal callers that expect a lack of errors
+// to be signaled by nil, use just Diagnostics.Err.
+func (diags Diagnostics) NonFatalErr() error {
+        if len(diags) == 0 {
+                return nil
+        }
+        return NonFatalError{diags}
+}
+
+// Sort applies an ordering to the diagnostics in the receiver in-place.
+//
+// The ordering is: warnings before errors, sourceless before sourced,
+// short source paths before long source paths, and then ordering by
+// position within each file.
+//
+// Diagnostics that do not differ by any of these sortable characteristics
+// will remain in the same relative order after this method returns.
+func (diags Diagnostics) Sort() {
+        sort.Stable(sortDiagnostics(diags))
+}
+
 type diagnosticsAsError struct {
         Diagnostics
 }
@@ -179,3 +232,99 @@ func (dae diagnosticsAsError) WrappedErrors() []error {
         }
         return errs
 }
+
+// NonFatalError is a special error type, returned by
+// Diagnostics.ErrWithWarnings and Diagnostics.NonFatalErr,
+// that indicates that the wrapped diagnostics should be treated as non-fatal.
+// Callers can conditionally type-assert an error to this type in order to
+// detect the non-fatal scenario and handle it in a different way.
+type NonFatalError struct {
+        Diagnostics
+}
+
+func (woe NonFatalError) Error() string {
+        diags := woe.Diagnostics
+        switch {
+        case len(diags) == 0:
+                // should never happen, since we don't create this wrapper if
+                // there are no diagnostics in the list.
+                return "no errors or warnings"
+        case len(diags) == 1:
+                desc := diags[0].Description()
+                if desc.Detail == "" {
+                        return desc.Summary
+                }
+                return fmt.Sprintf("%s: %s", desc.Summary, desc.Detail)
+        default:
+                var ret bytes.Buffer
+                if diags.HasErrors() {
+                        fmt.Fprintf(&ret, "%d problems:\n", len(diags))
+                } else {
+                        fmt.Fprintf(&ret, "%d warnings:\n", len(diags))
+                }
+                for _, diag := range woe.Diagnostics {
+                        desc := diag.Description()
+                        if desc.Detail == "" {
+                                fmt.Fprintf(&ret, "\n- %s", desc.Summary)
+                        } else {
+                                fmt.Fprintf(&ret, "\n- %s: %s", desc.Summary, desc.Detail)
+                        }
+                }
+                return ret.String()
+        }
+}
+
+// sortDiagnostics is an implementation of sort.Interface
+type sortDiagnostics []Diagnostic
+
+var _ sort.Interface = sortDiagnostics(nil)
+
+func (sd sortDiagnostics) Len() int {
+        return len(sd)
+}
+
+func (sd sortDiagnostics) Less(i, j int) bool {
+        iD, jD := sd[i], sd[j]
+        iSev, jSev := iD.Severity(), jD.Severity()
+        iSrc, jSrc := iD.Source(), jD.Source()
+
+        switch {
+
+        case iSev != jSev:
+                return iSev == Warning
+
+        case (iSrc.Subject == nil) != (jSrc.Subject == nil):
+                return iSrc.Subject == nil
+
+        case iSrc.Subject != nil && *iSrc.Subject != *jSrc.Subject:
+                iSubj := iSrc.Subject
+                jSubj := jSrc.Subject
+                switch {
+                case iSubj.Filename != jSubj.Filename:
+                        // Path with fewer segments goes first if they are different lengths
+                        sep := string(filepath.Separator)
+                        iCount := strings.Count(iSubj.Filename, sep)
+                        jCount := strings.Count(jSubj.Filename, sep)
+                        if iCount != jCount {
+                                return iCount < jCount
+                        }
+                        return iSubj.Filename < jSubj.Filename
+                case iSubj.Start.Byte != jSubj.Start.Byte:
+                        return iSubj.Start.Byte < jSubj.Start.Byte
+                case iSubj.End.Byte != jSubj.End.Byte:
+                        return iSubj.End.Byte < jSubj.End.Byte
+                }
+                fallthrough
+
+        default:
+                // The remaining properties do not have a defined ordering, so
+                // we'll leave it unspecified. Since we use sort.Stable in
+                // the caller of this, the ordering of remaining items will
+                // be preserved.
+                return false
+        }
+}
+
+func (sd sortDiagnostics) Swap(i, j int) {
+        sd[i], sd[j] = sd[j], sd[i]
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/error.go b/vendor/github.com/hashicorp/terraform/tfdiags/error.go
index 35edc30..13f7a71 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/error.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/error.go
@@ -13,7 +13,7 @@ func (e nativeError) Severity() Severity {
 
 func (e nativeError) Description() Description {
         return Description{
-                Summary: e.err.Error(),
+                Summary: FormatError(e.err),
         }
 }
 
@@ -21,3 +21,8 @@ func (e nativeError) Source() Source {
         // No source information available for a native error
         return Source{}
 }
+
+func (e nativeError) FromExpr() *FromExpr {
+        // Native errors are not expression-related
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/hcl.go b/vendor/github.com/hashicorp/terraform/tfdiags/hcl.go
index 24851f4..f9aec41 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/hcl.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/hcl.go
@@ -40,6 +40,16 @@ func (d hclDiagnostic) Source() Source {
         return ret
 }
 
+func (d hclDiagnostic) FromExpr() *FromExpr {
+        if d.diag.Expression == nil || d.diag.EvalContext == nil {
+                return nil
+        }
+        return &FromExpr{
+                Expression:  d.diag.Expression,
+                EvalContext: d.diag.EvalContext,
+        }
+}
+
 // SourceRangeFromHCL constructs a SourceRange from the corresponding range
 // type within the HCL package.
 func SourceRangeFromHCL(hclRange hcl.Range) SourceRange {
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/rpc_friendly.go b/vendor/github.com/hashicorp/terraform/tfdiags/rpc_friendly.go
index 6cc95cc..485063b 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/rpc_friendly.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/rpc_friendly.go
@@ -48,6 +48,12 @@ func (d *rpcFriendlyDiag) Source() Source {
         }
 }
 
+func (d rpcFriendlyDiag) FromExpr() *FromExpr {
+        // RPC-friendly diagnostics cannot preserve expression information because
+        // expressions themselves are not RPC-friendly.
+        return nil
+}
+
 func init() {
         gob.Register((*rpcFriendlyDiag)(nil))
 }
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/severity_string.go b/vendor/github.com/hashicorp/terraform/tfdiags/severity_string.go
index 0b1249b..78a7210 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/severity_string.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/severity_string.go
@@ -4,6 +4,14 @@ package tfdiags
 
 import "strconv"
 
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[Error-69]
+        _ = x[Warning-87]
+}
+
 const (
         _Severity_name_0 = "Error"
         _Severity_name_1 = "Warning"
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/simple_warning.go b/vendor/github.com/hashicorp/terraform/tfdiags/simple_warning.go
index fb3ac98..b0f1ecd 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/simple_warning.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/simple_warning.go
@@ -20,6 +20,11 @@ func (e simpleWarning) Description() Description {
 }
 
 func (e simpleWarning) Source() Source {
-        // No source information available for a native error
+        // No source information available for a simple warning
         return Source{}
 }
+
+func (e simpleWarning) FromExpr() *FromExpr {
+        // Simple warnings are not expression-related
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/sourceless.go b/vendor/github.com/hashicorp/terraform/tfdiags/sourceless.go
new file mode 100644
index 0000000..eaa2737
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/sourceless.go
@@ -0,0 +1,13 @@
+package tfdiags
+
+// Sourceless creates and returns a diagnostic with no source location
+// information. This is generally used for operational-type errors that are
+// caused by or relate to the environment where Terraform is running rather
+// than to the provided configuration.
+func Sourceless(severity Severity, summary, detail string) Diagnostic {
+        return diagnosticBase{
+                severity: severity,
+                summary:  summary,
+                detail:   detail,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/version/version.go b/vendor/github.com/hashicorp/terraform/version/version.go
index b21b297..30d7284 100644
--- a/vendor/github.com/hashicorp/terraform/version/version.go
+++ b/vendor/github.com/hashicorp/terraform/version/version.go
@@ -11,17 +11,21 @@ import (
 )
 
 // The main version number that is being run at the moment.
-var Version = "0.11.12"
+var Version = "0.12.0"
 
 // A pre-release marker for the version. If this is "" (empty string)
 // then it means that it is a final release. Otherwise, this is a pre-release
 // such as "dev" (in development), "beta", "rc1", etc.
-var Prerelease = "dev"
+var Prerelease = ""
 
 // SemVer is an instance of version.Version. This has the secondary
 // benefit of verifying during tests and init time that our version is a
 // proper semantic version, which should always be the case.
-var SemVer = version.Must(version.NewVersion(Version))
+var SemVer *version.Version
+
+func init() {
+        SemVer = version.Must(version.NewVersion(Version))
+}
 
 // Header is the header name used to send the current terraform version
 // in http requests.