532 files changed, 61956 insertions, 12671 deletions

diff --git a/vendor/github.com/hashicorp/errwrap/README.md b/vendor/github.com/hashicorp/errwrap/README.md
index 1c95f59..444df08 100644
--- a/vendor/github.com/hashicorp/errwrap/README.md
+++ b/vendor/github.com/hashicorp/errwrap/README.md
@@ -48,7 +48,7 @@ func main() {
         // We can use the Contains helpers to check if an error contains
         // another error. It is safe to do this with a nil error, or with
         // an error that doesn't even use the errwrap package.
-        if errwrap.Contains(err, ErrNotExist) {
+        if errwrap.Contains(err, "does not exist") {
                 // Do something
         }
         if errwrap.ContainsType(err, new(os.PathError)) {
diff --git a/vendor/github.com/hashicorp/errwrap/go.mod b/vendor/github.com/hashicorp/errwrap/go.mod
new file mode 100644
index 0000000..c9b8402
--- /dev/null
+++ b/vendor/github.com/hashicorp/errwrap/go.mod
@@ -0,0 +1 @@
+module github.com/hashicorp/errwrap
diff --git a/vendor/github.com/hashicorp/go-getter/.travis.yml b/vendor/github.com/hashicorp/go-getter/.travis.yml
index da804c2..4fe9176 100644
--- a/vendor/github.com/hashicorp/go-getter/.travis.yml
+++ b/vendor/github.com/hashicorp/go-getter/.travis.yml
@@ -9,15 +9,16 @@ addons:
 
 language: go
 
+os:
+  - linux
+  - osx
+
 go:
-  - 1.8.x
-  - 1.9.x
-  - master
+  - "1.11.x"
+
+before_script:
+  - go build ./cmd/go-getter
 
 branches:
   only:
     - master
-
-matrix:
-  allow_failures:
-    - go: master
diff --git a/vendor/github.com/hashicorp/go-getter/README.md b/vendor/github.com/hashicorp/go-getter/README.md
index 40ace74..ba4df6f 100644
--- a/vendor/github.com/hashicorp/go-getter/README.md
+++ b/vendor/github.com/hashicorp/go-getter/README.md
@@ -71,6 +71,7 @@ can be augmented at runtime by implementing the `Getter` interface.
   * Mercurial
   * HTTP
   * Amazon S3
+  * Google GCP
 
 In addition to the above protocols, go-getter has what are called "detectors."
 These take a URL and attempt to automatically choose the best protocol for
@@ -97,7 +98,7 @@ would download the given HTTP URL using the Git protocol.
 
 Forced protocols will also override any detectors.
 
-In the absense of a forced protocol, detectors may be run on the URL, transforming
+In the absence of a forced protocol, detectors may be run on the URL, transforming
 the protocol anyways. The above example would've used the Git protocol either
 way since the Git detector would've detected it was a GitHub URL.
 
@@ -155,20 +156,44 @@ For file downloads of any protocol, go-getter can automatically verify
 a checksum for you. Note that checksumming only works for downloading files,
 not directories, but checksumming will work for any protocol.
 
-To checksum a file, append a `checksum` query parameter to the URL.
-The paramter value should be in the format of `type:value`, where
-type is "md5", "sha1", "sha256", or "sha512". The "value" should be
-the actual checksum value. go-getter will parse out this query parameter
-automatically and use it to verify the checksum. An example URL
-is shown below:
+To checksum a file, append a `checksum` query parameter to the URL. go-getter
+will parse out this query parameter automatically and use it to verify the
+checksum. The parameter value can be in the format of `type:value` or just
+`value`, where type is "md5", "sha1", "sha256", "sha512" or "file" . The
+"value" should be the actual checksum value or download URL for "file". When
+`type` part is omitted, type will be guessed based on the length of the
+checksum string. Examples:
 
 ```
 ./foo.txt?checksum=md5:b7d96c89d09d9e204f5fedc4d5d55b21
 ```
 
+```
+./foo.txt?checksum=b7d96c89d09d9e204f5fedc4d5d55b21
+```
+
+```
+./foo.txt?checksum=file:./foo.txt.sha256sum
+```
+ 
+When checksumming from a file - ex: with `checksum=file:url` - go-getter will
+get the file linked in the URL after `file:` using the same configuration. For
+example, in `file:http://releases.ubuntu.com/cosmic/MD5SUMS` go-getter will
+download a checksum file under the aforementioned url using the http protocol.
+All protocols supported by go-getter can be used. The checksum file will be
+downloaded in a temporary file then parsed. The destination of the temporary
+file can be changed by setting system specific environment variables: `TMPDIR`
+for unix; `TMP`, `TEMP` or `USERPROFILE` on windows. Read godoc of
+[os.TempDir](https://golang.org/pkg/os/#TempDir) for more information on the
+temporary directory selection. Content of files are expected to be BSD or GNU
+style. Once go-getter is done with the checksum file; it is deleted.
+
 The checksum query parameter is never sent to the backend protocol
 implementation. It is used at a higher level by go-getter itself.
 
+If the destination file exists and the checksums match: download
+will be skipped.
+
 ### Unarchiving
 
 go-getter will automatically unarchive files into a file or directory
@@ -215,11 +240,12 @@ from the URL before going to the final protocol downloader.
 
 ## Protocol-Specific Options
 
-This section documents the protocol-specific options that can be specified
-for go-getter. These options should be appended to the input as normal query
-parameters. Depending on the usage of go-getter, applications may provide
-alternate ways of inputting options. For example, [Nomad](https://www.nomadproject.io)
-provides a nice options block for specifying options rather than in the URL.
+This section documents the protocol-specific options that can be specified for
+go-getter. These options should be appended to the input as normal query
+parameters ([HTTP headers](#headers) are an exception to this, however).
+Depending on the usage of go-getter, applications may provide alternate ways of
+inputting options. For example, [Nomad](https://www.nomadproject.io) provides a
+nice options block for specifying options rather than in the URL.
 
 ## General (All Protocols)
 
@@ -250,6 +276,19 @@ None
     from a private key file on disk, you would run `base64 -w0 <file>`.
 
     **Note**: Git 2.3+ is required to use this feature.
+  
+  * `depth` - The Git clone depth. The provided number specifies the last `n`
+    revisions to clone from the repository.
+
+
+The `git` getter accepts both URL-style SSH addresses like
+`git::ssh://git@example.com/foo/bar`, and "scp-style" addresses like
+`git::git@example.com/foo/bar`. In the latter case, omitting the `git::`
+force prefix is allowed if the username prefix is exactly `git@`.
+
+The "scp-style" addresses _cannot_ be used in conjunction with the `ssh://`
+scheme prefix, because in that case the colon is used to mark an optional
+port number to connect on, rather than to delimit the path from the host.
 
 ### Mercurial (`hg`)
 
@@ -263,6 +302,13 @@ To use HTTP basic authentication with go-getter, simply prepend `username:passwo
 hostname in the URL such as `https://Aladdin:OpenSesame@www.example.com/index.html`. All special
 characters, including the username and password, must be URL encoded.
 
+#### Headers
+
+Optional request headers can be added by supplying them in a custom
+[`HttpGetter`](https://godoc.org/github.com/hashicorp/go-getter#HttpGetter)
+(_not_ as query parameters like most other options). These headers will be sent
+out on every request the getter in question makes.
+
 ### S3 (`s3`)
 
 S3 takes various access configurations in the URL. Note that it will also
@@ -299,3 +345,14 @@ Some examples for these addressing schemes:
 - bucket.s3-eu-west-1.amazonaws.com/foo/bar
 - "s3::http://127.0.0.1:9000/test-bucket/hello.txt?aws_access_key_id=KEYID&aws_access_key_secret=SECRETKEY&region=us-east-2"
 
+### GCS (`gcs`)
+
+#### GCS Authentication
+
+In order to access to GCS, authentication credentials should be provided. More information can be found [here](https://cloud.google.com/docs/authentication/getting-started)
+
+#### GCS Bucket Examples
+
+- gcs::https://www.googleapis.com/storage/v1/bucket
+- gcs::https://www.googleapis.com/storage/v1/bucket/foo.zip
+- www.googleapis.com/storage/v1/bucket/foo
diff --git a/vendor/github.com/hashicorp/go-getter/appveyor.yml b/vendor/github.com/hashicorp/go-getter/appveyor.yml
index ec48d45..1e8718e 100644
--- a/vendor/github.com/hashicorp/go-getter/appveyor.yml
+++ b/vendor/github.com/hashicorp/go-getter/appveyor.yml
@@ -13,4 +13,4 @@ install:
 
     go get -d -v -t ./...
 build_script:
-- cmd: go test -v ./...
+- cmd: go test ./...
diff --git a/vendor/github.com/hashicorp/go-getter/checksum.go b/vendor/github.com/hashicorp/go-getter/checksum.go
new file mode 100644
index 0000000..bea7ed1
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/checksum.go
@@ -0,0 +1,314 @@
+package getter
+
+import (
+        "bufio"
+        "bytes"
+        "crypto/md5"
+        "crypto/sha1"
+        "crypto/sha256"
+        "crypto/sha512"
+        "encoding/hex"
+        "fmt"
+        "hash"
+        "io"
+        "net/url"
+        "os"
+        "path/filepath"
+        "strings"
+
+        urlhelper "github.com/hashicorp/go-getter/helper/url"
+)
+
+// fileChecksum helps verifying the checksum for a file.
+type fileChecksum struct {
+        Type     string
+        Hash     hash.Hash
+        Value    []byte
+        Filename string
+}
+
+// A ChecksumError is returned when a checksum differs
+type ChecksumError struct {
+        Hash     hash.Hash
+        Actual   []byte
+        Expected []byte
+        File     string
+}
+
+func (cerr *ChecksumError) Error() string {
+        if cerr == nil {
+                return "<nil>"
+        }
+        return fmt.Sprintf(
+                "Checksums did not match for %s.\nExpected: %s\nGot: %s\n%T",
+                cerr.File,
+                hex.EncodeToString(cerr.Expected),
+                hex.EncodeToString(cerr.Actual),
+                cerr.Hash, // ex: *sha256.digest
+        )
+}
+
+// checksum is a simple method to compute the checksum of a source file
+// and compare it to the given expected value.
+func (c *fileChecksum) checksum(source string) error {
+        f, err := os.Open(source)
+        if err != nil {
+                return fmt.Errorf("Failed to open file for checksum: %s", err)
+        }
+        defer f.Close()
+
+        c.Hash.Reset()
+        if _, err := io.Copy(c.Hash, f); err != nil {
+                return fmt.Errorf("Failed to hash: %s", err)
+        }
+
+        if actual := c.Hash.Sum(nil); !bytes.Equal(actual, c.Value) {
+                return &ChecksumError{
+                        Hash:     c.Hash,
+                        Actual:   actual,
+                        Expected: c.Value,
+                        File:     source,
+                }
+        }
+
+        return nil
+}
+
+// extractChecksum will return a fileChecksum based on the 'checksum'
+// parameter of u.
+// ex:
+//  http://hashicorp.com/terraform?checksum=<checksumValue>
+//  http://hashicorp.com/terraform?checksum=<checksumType>:<checksumValue>
+//  http://hashicorp.com/terraform?checksum=file:<checksum_url>
+// when checksumming from a file, extractChecksum will go get checksum_url
+// in a temporary directory, parse the content of the file then delete it.
+// Content of files are expected to be BSD style or GNU style.
+//
+// BSD-style checksum:
+//  MD5 (file1) = <checksum>
+//  MD5 (file2) = <checksum>
+//
+// GNU-style:
+//  <checksum>  file1
+//  <checksum> *file2
+//
+// see parseChecksumLine for more detail on checksum file parsing
+func (c *Client) extractChecksum(u *url.URL) (*fileChecksum, error) {
+        q := u.Query()
+        v := q.Get("checksum")
+
+        if v == "" {
+                return nil, nil
+        }
+
+        vs := strings.SplitN(v, ":", 2)
+        switch len(vs) {
+        case 2:
+                break // good
+        default:
+                // here, we try to guess the checksum from it's length
+                // if the type was not passed
+                return newChecksumFromValue(v, filepath.Base(u.EscapedPath()))
+        }
+
+        checksumType, checksumValue := vs[0], vs[1]
+
+        switch checksumType {
+        case "file":
+                return c.checksumFromFile(checksumValue, u)
+        default:
+                return newChecksumFromType(checksumType, checksumValue, filepath.Base(u.EscapedPath()))
+        }
+}
+
+func newChecksum(checksumValue, filename string) (*fileChecksum, error) {
+        c := &fileChecksum{
+                Filename: filename,
+        }
+        var err error
+        c.Value, err = hex.DecodeString(checksumValue)
+        if err != nil {
+                return nil, fmt.Errorf("invalid checksum: %s", err)
+        }
+        return c, nil
+}
+
+func newChecksumFromType(checksumType, checksumValue, filename string) (*fileChecksum, error) {
+        c, err := newChecksum(checksumValue, filename)
+        if err != nil {
+                return nil, err
+        }
+
+        c.Type = strings.ToLower(checksumType)
+        switch c.Type {
+        case "md5":
+                c.Hash = md5.New()
+        case "sha1":
+                c.Hash = sha1.New()
+        case "sha256":
+                c.Hash = sha256.New()
+        case "sha512":
+                c.Hash = sha512.New()
+        default:
+                return nil, fmt.Errorf(
+                        "unsupported checksum type: %s", checksumType)
+        }
+
+        return c, nil
+}
+
+func newChecksumFromValue(checksumValue, filename string) (*fileChecksum, error) {
+        c, err := newChecksum(checksumValue, filename)
+        if err != nil {
+                return nil, err
+        }
+
+        switch len(c.Value) {
+        case md5.Size:
+                c.Hash = md5.New()
+                c.Type = "md5"
+        case sha1.Size:
+                c.Hash = sha1.New()
+                c.Type = "sha1"
+        case sha256.Size:
+                c.Hash = sha256.New()
+                c.Type = "sha256"
+        case sha512.Size:
+                c.Hash = sha512.New()
+                c.Type = "sha512"
+        default:
+                return nil, fmt.Errorf("Unknown type for checksum %s", checksumValue)
+        }
+
+        return c, nil
+}
+
+// checksumsFromFile will return all the fileChecksums found in file
+//
+// checksumsFromFile will try to guess the hashing algorithm based on content
+// of checksum file
+//
+// checksumsFromFile will only return checksums for files that match file
+// behind src
+func (c *Client) checksumFromFile(checksumFile string, src *url.URL) (*fileChecksum, error) {
+        checksumFileURL, err := urlhelper.Parse(checksumFile)
+        if err != nil {
+                return nil, err
+        }
+
+        tempfile, err := tmpFile("", filepath.Base(checksumFileURL.Path))
+        if err != nil {
+                return nil, err
+        }
+        defer os.Remove(tempfile)
+
+        c2 := &Client{
+                Ctx:              c.Ctx,
+                Getters:          c.Getters,
+                Decompressors:    c.Decompressors,
+                Detectors:        c.Detectors,
+                Pwd:              c.Pwd,
+                Dir:              false,
+                Src:              checksumFile,
+                Dst:              tempfile,
+                ProgressListener: c.ProgressListener,
+        }
+        if err = c2.Get(); err != nil {
+                return nil, fmt.Errorf(
+                        "Error downloading checksum file: %s", err)
+        }
+
+        filename := filepath.Base(src.Path)
+        absPath, err := filepath.Abs(src.Path)
+        if err != nil {
+                return nil, err
+        }
+        checksumFileDir := filepath.Dir(checksumFileURL.Path)
+        relpath, err := filepath.Rel(checksumFileDir, absPath)
+        switch {
+        case err == nil ||
+                err.Error() == "Rel: can't make "+absPath+" relative to "+checksumFileDir:
+                // ex: on windows C:\gopath\...\content.txt cannot be relative to \
+                // which is okay, may be another expected path will work.
+                break
+        default:
+                return nil, err
+        }
+
+        // possible file identifiers:
+        options := []string{
+                filename,       // ubuntu-14.04.1-server-amd64.iso
+                "*" + filename, // *ubuntu-14.04.1-server-amd64.iso  Standard checksum
+                "?" + filename, // ?ubuntu-14.04.1-server-amd64.iso  shasum -p
+                relpath,        // dir/ubuntu-14.04.1-server-amd64.iso
+                "./" + relpath, // ./dir/ubuntu-14.04.1-server-amd64.iso
+                absPath,        // fullpath; set if local
+        }
+
+        f, err := os.Open(tempfile)
+        if err != nil {
+                return nil, fmt.Errorf(
+                        "Error opening downloaded file: %s", err)
+        }
+        defer f.Close()
+        rd := bufio.NewReader(f)
+        for {
+                line, err := rd.ReadString('\n')
+                if err != nil {
+                        if err != io.EOF {
+                                return nil, fmt.Errorf(
+                                        "Error reading checksum file: %s", err)
+                        }
+                        break
+                }
+                checksum, err := parseChecksumLine(line)
+                if err != nil || checksum == nil {
+                        continue
+                }
+                if checksum.Filename == "" {
+                        // filename not sure, let's try
+                        return checksum, nil
+                }
+                // make sure the checksum is for the right file
+                for _, option := range options {
+                        if option != "" && checksum.Filename == option {
+                                // any checksum will work so we return the first one
+                                return checksum, nil
+                        }
+                }
+        }
+        return nil, fmt.Errorf("no checksum found in: %s", checksumFile)
+}
+
+// parseChecksumLine takes a line from a checksum file and returns
+// checksumType, checksumValue and filename parseChecksumLine guesses the style
+// of the checksum BSD vs GNU by splitting the line and by counting the parts.
+// of a line.
+// for BSD type sums parseChecksumLine guesses the hashing algorithm
+// by checking the length of the checksum.
+func parseChecksumLine(line string) (*fileChecksum, error) {
+        parts := strings.Fields(line)
+
+        switch len(parts) {
+        case 4:
+                // BSD-style checksum:
+                //  MD5 (file1) = <checksum>
+                //  MD5 (file2) = <checksum>
+                if len(parts[1]) <= 2 ||
+                        parts[1][0] != '(' || parts[1][len(parts[1])-1] != ')' {
+                        return nil, fmt.Errorf(
+                                "Unexpected BSD-style-checksum filename format: %s", line)
+                }
+                filename := parts[1][1 : len(parts[1])-1]
+                return newChecksumFromType(parts[0], parts[3], filename)
+        case 2:
+                // GNU-style:
+                //  <checksum>  file1
+                //  <checksum> *file2
+                return newChecksumFromValue(parts[0], parts[1])
+        case 0:
+                return nil, nil // empty line
+        default:
+                return newChecksumFromValue(parts[0], "")
+        }
+}
diff --git a/vendor/github.com/hashicorp/go-getter/client.go b/vendor/github.com/hashicorp/go-getter/client.go
index 300301c..007a78b 100644
--- a/vendor/github.com/hashicorp/go-getter/client.go
+++ b/vendor/github.com/hashicorp/go-getter/client.go
@@ -1,15 +1,8 @@
 package getter
 
 import (
-        "bytes"
-        "crypto/md5"
-        "crypto/sha1"
-        "crypto/sha256"
-        "crypto/sha512"
-        "encoding/hex"
+        "context"
         "fmt"
-        "hash"
-        "io"
         "io/ioutil"
         "os"
         "path/filepath"
@@ -17,7 +10,7 @@ import (
         "strings"
 
         urlhelper "github.com/hashicorp/go-getter/helper/url"
-        "github.com/hashicorp/go-safetemp"
+        safetemp "github.com/hashicorp/go-safetemp"
 )
 
 // Client is a client for downloading things.
@@ -26,6 +19,9 @@ import (
 // Using a client directly allows more fine-grained control over how downloading
 // is done, as well as customizing the protocols supported.
 type Client struct {
+        // Ctx for cancellation
+        Ctx context.Context
+
         // Src is the source URL to get.
         //
         // Dst is the path to save the downloaded thing as. If Dir is set to
@@ -62,10 +58,20 @@ type Client struct {
         //
         // WARNING: deprecated. If Mode is set, that will take precedence.
         Dir bool
+
+        // ProgressListener allows to track file downloads.
+        // By default a no op progress listener is used.
+        ProgressListener ProgressTracker
+
+        Options []ClientOption
 }
 
 // Get downloads the configured source to the destination.
 func (c *Client) Get() error {
+        if err := c.Configure(c.Options...); err != nil {
+                return err
+        }
+
         // Store this locally since there are cases we swap this
         mode := c.Mode
         if mode == ClientModeInvalid {
@@ -76,18 +82,7 @@ func (c *Client) Get() error {
                 }
         }
 
-        // Default decompressor value
-        decompressors := c.Decompressors
-        if decompressors == nil {
-                decompressors = Decompressors
-        }
-
-        // Detect the URL. This is safe if it is already detected.
-        detectors := c.Detectors
-        if detectors == nil {
-                detectors = Detectors
-        }
-        src, err := Detect(c.Src, c.Pwd, detectors)
+        src, err := Detect(c.Src, c.Pwd, c.Detectors)
         if err != nil {
                 return err
         }
@@ -119,12 +114,7 @@ func (c *Client) Get() error {
                 force = u.Scheme
         }
 
-        getters := c.Getters
-        if getters == nil {
-                getters = Getters
-        }
-
-        g, ok := getters[force]
+        g, ok := c.Getters[force]
         if !ok {
                 return fmt.Errorf(
                         "download not supported for scheme '%s'", force)
@@ -150,7 +140,7 @@ func (c *Client) Get() error {
         if archiveV == "" {
                 // We don't appear to... but is it part of the filename?
                 matchingLen := 0
-                for k, _ := range decompressors {
+                for k := range c.Decompressors {
                         if strings.HasSuffix(u.Path, "."+k) && len(k) > matchingLen {
                                 archiveV = k
                                 matchingLen = len(k)
@@ -163,7 +153,7 @@ func (c *Client) Get() error {
         // real path.
         var decompressDst string
         var decompressDir bool
-        decompressor := decompressors[archiveV]
+        decompressor := c.Decompressors[archiveV]
         if decompressor != nil {
                 // Create a temporary directory to store our archive. We delete
                 // this at the end of everything.
@@ -182,44 +172,16 @@ func (c *Client) Get() error {
                 mode = ClientModeFile
         }
 
-        // Determine if we have a checksum
-        var checksumHash hash.Hash
-        var checksumValue []byte
-        if v := q.Get("checksum"); v != "" {
-                // Delete the query parameter if we have it.
-                q.Del("checksum")
-                u.RawQuery = q.Encode()
-
-                // Determine the checksum hash type
-                checksumType := ""
-                idx := strings.Index(v, ":")
-                if idx > -1 {
-                        checksumType = v[:idx]
-                }
-                switch checksumType {
-                case "md5":
-                        checksumHash = md5.New()
-                case "sha1":
-                        checksumHash = sha1.New()
-                case "sha256":
-                        checksumHash = sha256.New()
-                case "sha512":
-                        checksumHash = sha512.New()
-                default:
-                        return fmt.Errorf(
-                                "unsupported checksum type: %s", checksumType)
-                }
-
-                // Get the remainder of the value and parse it into bytes
-                b, err := hex.DecodeString(v[idx+1:])
-                if err != nil {
-                        return fmt.Errorf("invalid checksum: %s", err)
-                }
-
-                // Set our value
-                checksumValue = b
+        // Determine checksum if we have one
+        checksum, err := c.extractChecksum(u)
+        if err != nil {
+                return fmt.Errorf("invalid checksum: %s", err)
         }
 
+        // Delete the query parameter if we have it.
+        q.Del("checksum")
+        u.RawQuery = q.Encode()
+
         if mode == ClientModeAny {
                 // Ask the getter which client mode to use
                 mode, err = g.ClientMode(u)
@@ -248,15 +210,24 @@ func (c *Client) Get() error {
         // If we're not downloading a directory, then just download the file
         // and return.
         if mode == ClientModeFile {
-                err := g.GetFile(dst, u)
-                if err != nil {
-                        return err
+                getFile := true
+                if checksum != nil {
+                        if err := checksum.checksum(dst); err == nil {
+                                // don't get the file if the checksum of dst is correct
+                                getFile = false
+                        }
                 }
-
-                if checksumHash != nil {
-                        if err := checksum(dst, checksumHash, checksumValue); err != nil {
+                if getFile {
+                        err := g.GetFile(dst, u)
+                        if err != nil {
                                 return err
                         }
+
+                        if checksum != nil {
+                                if err := checksum.checksum(dst); err != nil {
+                                        return err
+                                }
+                        }
                 }
 
                 if decompressor != nil {
@@ -291,7 +262,7 @@ func (c *Client) Get() error {
         if decompressor == nil {
                 // If we're getting a directory, then this is an error. You cannot
                 // checksum a directory. TODO: test
-                if checksumHash != nil {
+                if checksum != nil {
                         return fmt.Errorf(
                                 "checksum cannot be specified for directory download")
                 }
@@ -320,30 +291,7 @@ func (c *Client) Get() error {
                         return err
                 }
 
-                return copyDir(realDst, subDir, false)
-        }
-
-        return nil
-}
-
-// checksum is a simple method to compute the checksum of a source file
-// and compare it to the given expected value.
-func checksum(source string, h hash.Hash, v []byte) error {
-        f, err := os.Open(source)
-        if err != nil {
-                return fmt.Errorf("Failed to open file for checksum: %s", err)
-        }
-        defer f.Close()
-
-        if _, err := io.Copy(h, f); err != nil {
-                return fmt.Errorf("Failed to hash: %s", err)
-        }
-
-        if actual := h.Sum(nil); !bytes.Equal(actual, v) {
-                return fmt.Errorf(
-                        "Checksums did not match.\nExpected: %s\nGot: %s",
-                        hex.EncodeToString(v),
-                        hex.EncodeToString(actual))
+                return copyDir(c.Ctx, realDst, subDir, false)
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/go-getter/client_option.go b/vendor/github.com/hashicorp/go-getter/client_option.go
new file mode 100644
index 0000000..c1ee413
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/client_option.go
@@ -0,0 +1,46 @@
+package getter
+
+import "context"
+
+// A ClientOption allows to configure a client
+type ClientOption func(*Client) error
+
+// Configure configures a client with options.
+func (c *Client) Configure(opts ...ClientOption) error {
+        if c.Ctx == nil {
+                c.Ctx = context.Background()
+        }
+        c.Options = opts
+        for _, opt := range opts {
+                err := opt(c)
+                if err != nil {
+                        return err
+                }
+        }
+        // Default decompressor values
+        if c.Decompressors == nil {
+                c.Decompressors = Decompressors
+        }
+        // Default detector values
+        if c.Detectors == nil {
+                c.Detectors = Detectors
+        }
+        // Default getter values
+        if c.Getters == nil {
+                c.Getters = Getters
+        }
+
+        for _, getter := range c.Getters {
+                getter.SetClient(c)
+        }
+        return nil
+}
+
+// WithContext allows to pass a context to operation
+// in order to be able to cancel a download in progress.
+func WithContext(ctx context.Context) func(*Client) error {
+        return func(c *Client) error {
+                c.Ctx = ctx
+                return nil
+        }
+}
diff --git a/vendor/github.com/hashicorp/go-getter/client_option_progress.go b/vendor/github.com/hashicorp/go-getter/client_option_progress.go
new file mode 100644
index 0000000..9b185f7
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/client_option_progress.go
@@ -0,0 +1,38 @@
+package getter
+
+import (
+        "io"
+)
+
+// WithProgress allows for a user to track
+// the progress of a download.
+// For example by displaying a progress bar with
+// current download.
+// Not all getters have progress support yet.
+func WithProgress(pl ProgressTracker) func(*Client) error {
+        return func(c *Client) error {
+                c.ProgressListener = pl
+                return nil
+        }
+}
+
+// ProgressTracker allows to track the progress of downloads.
+type ProgressTracker interface {
+        // TrackProgress should be called when
+        // a new object is being downloaded.
+        // src is the location the file is
+        // downloaded from.
+        // currentSize is the current size of
+        // the file in case it is a partial
+        // download.
+        // totalSize is the total size in bytes,
+        // size can be zero if the file size
+        // is not known.
+        // stream is the file being downloaded, every
+        // written byte will add up to processed size.
+        //
+        // TrackProgress returns a ReadCloser that wraps the
+        // download in progress ( stream ).
+        // When the download is finished, body shall be closed.
+        TrackProgress(src string, currentSize, totalSize int64, stream io.ReadCloser) (body io.ReadCloser)
+}
diff --git a/vendor/github.com/hashicorp/go-getter/common.go b/vendor/github.com/hashicorp/go-getter/common.go
new file mode 100644
index 0000000..d2afd8a
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/common.go
@@ -0,0 +1,14 @@
+package getter
+
+import (
+        "io/ioutil"
+)
+
+func tmpFile(dir, pattern string) (string, error) {
+        f, err := ioutil.TempFile(dir, pattern)
+        if err != nil {
+                return "", err
+        }
+        f.Close()
+        return f.Name(), nil
+}
diff --git a/vendor/github.com/hashicorp/go-getter/copy_dir.go b/vendor/github.com/hashicorp/go-getter/copy_dir.go
index 2f58e8a..641fe6d 100644
--- a/vendor/github.com/hashicorp/go-getter/copy_dir.go
+++ b/vendor/github.com/hashicorp/go-getter/copy_dir.go
@@ -1,7 +1,7 @@
 package getter
 
 import (
-        "io"
+        "context"
         "os"
         "path/filepath"
         "strings"
@@ -11,7 +11,7 @@ import (
 // should already exist.
 //
 // If ignoreDot is set to true, then dot-prefixed files/folders are ignored.
-func copyDir(dst string, src string, ignoreDot bool) error {
+func copyDir(ctx context.Context, dst string, src string, ignoreDot bool) error {
         src, err := filepath.EvalSymlinks(src)
         if err != nil {
                 return err
@@ -66,7 +66,7 @@ func copyDir(dst string, src string, ignoreDot bool) error {
                 }
                 defer dstF.Close()
 
-                if _, err := io.Copy(dstF, srcF); err != nil {
+                if _, err := Copy(ctx, dstF, srcF); err != nil {
                         return err
                 }
 
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_tar.go b/vendor/github.com/hashicorp/go-getter/decompress_tar.go
index 39cb392..b6986a2 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_tar.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_tar.go
@@ -6,6 +6,7 @@ import (
         "io"
         "os"
         "path/filepath"
+        "time"
 )
 
 // untar is a shared helper for untarring an archive. The reader should provide
@@ -14,6 +15,7 @@ func untar(input io.Reader, dst, src string, dir bool) error {
         tarR := tar.NewReader(input)
         done := false
         dirHdrs := []*tar.Header{}
+        now := time.Now()
         for {
                 hdr, err := tarR.Next()
                 if err == io.EOF {
@@ -95,17 +97,37 @@ func untar(input io.Reader, dst, src string, dir bool) error {
                         return err
                 }
 
-                // Set the access and modification time
-                if err := os.Chtimes(path, hdr.AccessTime, hdr.ModTime); err != nil {
+                // Set the access and modification time if valid, otherwise default to current time
+                aTime := now
+                mTime := now
+                if hdr.AccessTime.Unix() > 0 {
+                        aTime = hdr.AccessTime
+                }
+                if hdr.ModTime.Unix() > 0 {
+                        mTime = hdr.ModTime
+                }
+                if err := os.Chtimes(path, aTime, mTime); err != nil {
                         return err
                 }
         }
 
-        // Adding a file or subdirectory changes the mtime of a directory
-        // We therefore wait until we've extracted everything and then set the mtime and atime attributes
+        // Perform a final pass over extracted directories to update metadata
         for _, dirHdr := range dirHdrs {
                 path := filepath.Join(dst, dirHdr.Name)
-                if err := os.Chtimes(path, dirHdr.AccessTime, dirHdr.ModTime); err != nil {
+                // Chmod the directory since they might be created before we know the mode flags
+                if err := os.Chmod(path, dirHdr.FileInfo().Mode()); err != nil {
+                        return err
+                }
+                // Set the mtime/atime attributes since they would have been changed during extraction
+                aTime := now
+                mTime := now
+                if dirHdr.AccessTime.Unix() > 0 {
+                        aTime = dirHdr.AccessTime
+                }
+                if dirHdr.ModTime.Unix() > 0 {
+                        mTime = dirHdr.ModTime
+                }
+                if err := os.Chtimes(path, aTime, mTime); err != nil {
                         return err
                 }
         }
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_testing.go b/vendor/github.com/hashicorp/go-getter/decompress_testing.go
index 91cf33d..b2f662a 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_testing.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_testing.go
@@ -18,16 +18,18 @@ import (
 
 // TestDecompressCase is a single test case for testing decompressors
 type TestDecompressCase struct {
-        Input   string   // Input is the complete path to the input file
-        Dir     bool     // Dir is whether or not we're testing directory mode
-        Err     bool     // Err is whether we expect an error or not
-        DirList []string // DirList is the list of files for Dir mode
-        FileMD5 string   // FileMD5 is the expected MD5 for a single file
-        Mtime *time.Time // Mtime is the optionally expected mtime for a single file (or all files if in Dir mode)
+        Input   string     // Input is the complete path to the input file
+        Dir     bool       // Dir is whether or not we're testing directory mode
+        Err     bool       // Err is whether we expect an error or not
+        DirList []string   // DirList is the list of files for Dir mode
+        FileMD5 string     // FileMD5 is the expected MD5 for a single file
+        Mtime   *time.Time // Mtime is the optionally expected mtime for a single file (or all files if in Dir mode)
 }
 
 // TestDecompressor is a helper function for testing generic decompressors.
 func TestDecompressor(t testing.T, d Decompressor, cases []TestDecompressCase) {
+        t.Helper()
+
         for _, tc := range cases {
                 t.Logf("Testing: %s", tc.Input)
 
@@ -72,9 +74,13 @@ func TestDecompressor(t testing.T, d Decompressor, cases []TestDecompressCase) {
 
                                 if tc.Mtime != nil {
                                         actual := fi.ModTime()
-                                        expected := *tc.Mtime
-                                        if actual != expected {
-                                                t.Fatalf("err %s: expected mtime '%s' for %s, got '%s'", tc.Input, expected.String(), dst, actual.String())
+                                        if tc.Mtime.Unix() > 0 {
+                                                expected := *tc.Mtime
+                                                if actual != expected {
+                                                        t.Fatalf("err %s: expected mtime '%s' for %s, got '%s'", tc.Input, expected.String(), dst, actual.String())
+                                                }
+                                        } else if actual.Unix() <= 0 {
+                                                t.Fatalf("err %s: expected mtime to be > 0, got '%s'", actual.String())
                                         }
                                 }
 
@@ -103,10 +109,15 @@ func TestDecompressor(t testing.T, d Decompressor, cases []TestDecompressCase) {
                                                 t.Fatalf("err: %s", err)
                                         }
                                         actual := fi.ModTime()
-                                        expected := *tc.Mtime
-                                        if actual != expected {
-                                                t.Fatalf("err %s: expected mtime '%s' for %s, got '%s'", tc.Input, expected.String(), path, actual.String())
+                                        if tc.Mtime.Unix() > 0 {
+                                                expected := *tc.Mtime
+                                                if actual != expected {
+                                                        t.Fatalf("err %s: expected mtime '%s' for %s, got '%s'", tc.Input, expected.String(), path, actual.String())
+                                                }
+                                        } else if actual.Unix() < 0 {
+                                                t.Fatalf("err %s: expected mtime to be > 0, got '%s'", actual.String())
                                         }
+
                                 }
                         }
                 }()
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_zip.go b/vendor/github.com/hashicorp/go-getter/decompress_zip.go
index b0e70ca..0830f79 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_zip.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_zip.go
@@ -9,7 +9,7 @@ import (
 )
 
 // ZipDecompressor is an implementation of Decompressor that can
-// decompress tar.gzip files.
+// decompress zip files.
 type ZipDecompressor struct{}
 
 func (d *ZipDecompressor) Decompress(dst, src string, dir bool) error {
diff --git a/vendor/github.com/hashicorp/go-getter/detect.go b/vendor/github.com/hashicorp/go-getter/detect.go
index c369551..5bb750c 100644
--- a/vendor/github.com/hashicorp/go-getter/detect.go
+++ b/vendor/github.com/hashicorp/go-getter/detect.go
@@ -23,8 +23,10 @@ var Detectors []Detector
 func init() {
         Detectors = []Detector{
                 new(GitHubDetector),
+                new(GitDetector),
                 new(BitBucketDetector),
                 new(S3Detector),
+                new(GCSDetector),
                 new(FileDetector),
         }
 }
diff --git a/vendor/github.com/hashicorp/go-getter/detect_gcs.go b/vendor/github.com/hashicorp/go-getter/detect_gcs.go
new file mode 100644
index 0000000..1136373
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/detect_gcs.go
@@ -0,0 +1,43 @@
+package getter
+
+import (
+        "fmt"
+        "net/url"
+        "strings"
+)
+
+// GCSDetector implements Detector to detect GCS URLs and turn
+// them into URLs that the GCSGetter can understand.
+type GCSDetector struct{}
+
+func (d *GCSDetector) Detect(src, _ string) (string, bool, error) {
+        if len(src) == 0 {
+                return "", false, nil
+        }
+
+        if strings.Contains(src, "googleapis.com/") {
+                return d.detectHTTP(src)
+        }
+
+        return "", false, nil
+}
+
+func (d *GCSDetector) detectHTTP(src string) (string, bool, error) {
+
+        parts := strings.Split(src, "/")
+        if len(parts) < 5 {
+                return "", false, fmt.Errorf(
+                        "URL is not a valid GCS URL")
+        }
+        version := parts[2]
+        bucket := parts[3]
+        object := strings.Join(parts[4:], "/")
+
+        url, err := url.Parse(fmt.Sprintf("https://www.googleapis.com/storage/%s/%s/%s",
+                version, bucket, object))
+        if err != nil {
+                return "", false, fmt.Errorf("error parsing GCS URL: %s", err)
+        }
+
+        return "gcs::" + url.String(), true, nil
+}
diff --git a/vendor/github.com/hashicorp/go-getter/detect_git.go b/vendor/github.com/hashicorp/go-getter/detect_git.go
new file mode 100644
index 0000000..eeb8a04
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/detect_git.go
@@ -0,0 +1,26 @@
+package getter
+
+// GitDetector implements Detector to detect Git SSH URLs such as
+// git@host.com:dir1/dir2 and converts them to proper URLs.
+type GitDetector struct{}
+
+func (d *GitDetector) Detect(src, _ string) (string, bool, error) {
+        if len(src) == 0 {
+                return "", false, nil
+        }
+
+        u, err := detectSSH(src)
+        if err != nil {
+                return "", true, err
+        }
+        if u == nil {
+                return "", false, nil
+        }
+
+        // We require the username to be "git" to assume that this is a Git URL
+        if u.User.Username() != "git" {
+                return "", false, nil
+        }
+
+        return "git::" + u.String(), true, nil
+}
diff --git a/vendor/github.com/hashicorp/go-getter/detect_github.go b/vendor/github.com/hashicorp/go-getter/detect_github.go
index c084ad9..4bf4daf 100644
--- a/vendor/github.com/hashicorp/go-getter/detect_github.go
+++ b/vendor/github.com/hashicorp/go-getter/detect_github.go
@@ -17,8 +17,6 @@ func (d *GitHubDetector) Detect(src, _ string) (string, bool, error) {
 
         if strings.HasPrefix(src, "github.com/") {
                 return d.detectHTTP(src)
-        } else if strings.HasPrefix(src, "git@github.com:") {
-                return d.detectSSH(src)
         }
 
         return "", false, nil
@@ -47,27 +45,3 @@ func (d *GitHubDetector) detectHTTP(src string) (string, bool, error) {
 
         return "git::" + url.String(), true, nil
 }
-
-func (d *GitHubDetector) detectSSH(src string) (string, bool, error) {
-        idx := strings.Index(src, ":")
-        qidx := strings.Index(src, "?")
-        if qidx == -1 {
-                qidx = len(src)
-        }
-
-        var u url.URL
-        u.Scheme = "ssh"
-        u.User = url.User("git")
-        u.Host = "github.com"
-        u.Path = src[idx+1 : qidx]
-        if qidx < len(src) {
-                q, err := url.ParseQuery(src[qidx+1:])
-                if err != nil {
-                        return "", true, fmt.Errorf("error parsing GitHub SSH URL: %s", err)
-                }
-
-                u.RawQuery = q.Encode()
-        }
-
-        return "git::" + u.String(), true, nil
-}
diff --git a/vendor/github.com/hashicorp/go-getter/detect_ssh.go b/vendor/github.com/hashicorp/go-getter/detect_ssh.go
new file mode 100644
index 0000000..c0dbe9d
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/detect_ssh.go
@@ -0,0 +1,49 @@
+package getter
+
+import (
+        "fmt"
+        "net/url"
+        "regexp"
+        "strings"
+)
+
+// Note that we do not have an SSH-getter currently so this file serves
+// only to hold the detectSSH helper that is used by other detectors.
+
+// sshPattern matches SCP-like SSH patterns (user@host:path)
+var sshPattern = regexp.MustCompile("^(?:([^@]+)@)?([^:]+):/?(.+)$")
+
+// detectSSH determines if the src string matches an SSH-like URL and
+// converts it into a net.URL compatible string. This returns nil if the
+// string doesn't match the SSH pattern.
+//
+// This function is tested indirectly via detect_git_test.go
+func detectSSH(src string) (*url.URL, error) {
+        matched := sshPattern.FindStringSubmatch(src)
+        if matched == nil {
+                return nil, nil
+        }
+
+        user := matched[1]
+        host := matched[2]
+        path := matched[3]
+        qidx := strings.Index(path, "?")
+        if qidx == -1 {
+                qidx = len(path)
+        }
+
+        var u url.URL
+        u.Scheme = "ssh"
+        u.User = url.User(user)
+        u.Host = host
+        u.Path = path[0:qidx]
+        if qidx < len(path) {
+                q, err := url.ParseQuery(path[qidx+1:])
+                if err != nil {
+                        return nil, fmt.Errorf("error parsing GitHub SSH URL: %s", err)
+                }
+                u.RawQuery = q.Encode()
+        }
+
+        return &u, nil
+}
diff --git a/vendor/github.com/hashicorp/go-getter/get.go b/vendor/github.com/hashicorp/go-getter/get.go
index e6053d9..c233763 100644
--- a/vendor/github.com/hashicorp/go-getter/get.go
+++ b/vendor/github.com/hashicorp/go-getter/get.go
@@ -41,6 +41,11 @@ type Getter interface {
         // ClientMode returns the mode based on the given URL. This is used to
         // allow clients to let the getters decide which mode to use.
         ClientMode(*url.URL) (ClientMode, error)
+
+        // SetClient allows a getter to know it's client
+        // in order to access client's Get functions or
+        // progress tracking.
+        SetClient(*Client)
 }
 
 // Getters is the mapping of scheme to the Getter implementation that will
@@ -62,6 +67,7 @@ func init() {
         Getters = map[string]Getter{
                 "file":  new(FileGetter),
                 "git":   new(GitGetter),
+                "gcs":   new(GCSGetter),
                 "hg":    new(HgGetter),
                 "s3":    new(S3Getter),
                 "http":  httpGetter,
@@ -74,12 +80,12 @@ func init() {
 //
 // src is a URL, whereas dst is always just a file path to a folder. This
 // folder doesn't need to exist. It will be created if it doesn't exist.
-func Get(dst, src string) error {
+func Get(dst, src string, opts ...ClientOption) error {
         return (&Client{
                 Src:     src,
                 Dst:     dst,
                 Dir:     true,
-                Getters: Getters,
+                Options: opts,
         }).Get()
 }
 
@@ -89,23 +95,23 @@ func Get(dst, src string) error {
 // dst must be a directory. If src is a file, it will be downloaded
 // into dst with the basename of the URL. If src is a directory or
 // archive, it will be unpacked directly into dst.
-func GetAny(dst, src string) error {
+func GetAny(dst, src string, opts ...ClientOption) error {
         return (&Client{
                 Src:     src,
                 Dst:     dst,
                 Mode:    ClientModeAny,
-                Getters: Getters,
+                Options: opts,
         }).Get()
 }
 
 // GetFile downloads the file specified by src into the path specified by
 // dst.
-func GetFile(dst, src string) error {
+func GetFile(dst, src string, opts ...ClientOption) error {
         return (&Client{
                 Src:     src,
                 Dst:     dst,
                 Dir:     false,
-                Getters: Getters,
+                Options: opts,
         }).Get()
 }
 
diff --git a/vendor/github.com/hashicorp/go-getter/get_base.go b/vendor/github.com/hashicorp/go-getter/get_base.go
new file mode 100644
index 0000000..09e9b63
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/get_base.go
@@ -0,0 +1,20 @@
+package getter
+
+import "context"
+
+// getter is our base getter; it regroups
+// fields all getters have in common.
+type getter struct {
+        client *Client
+}
+
+func (g *getter) SetClient(c *Client) { g.client = c }
+
+// Context tries to returns the Contex from the getter's
+// client. otherwise context.Background() is returned.
+func (g *getter) Context() context.Context {
+        if g == nil || g.client == nil {
+                return context.Background()
+        }
+        return g.client.Ctx
+}
diff --git a/vendor/github.com/hashicorp/go-getter/get_file.go b/vendor/github.com/hashicorp/go-getter/get_file.go
index e5d2d61..7866083 100644
--- a/vendor/github.com/hashicorp/go-getter/get_file.go
+++ b/vendor/github.com/hashicorp/go-getter/get_file.go
@@ -8,7 +8,11 @@ import (
 // FileGetter is a Getter implementation that will download a module from
 // a file scheme.
 type FileGetter struct {
-        // Copy, if set to true, will copy data instead of using a symlink
+        getter
+
+        // Copy, if set to true, will copy data instead of using a symlink. If
+        // false, attempts to symlink to speed up the operation and to lower the
+        // disk space usage. If the symlink fails, may attempt to copy on windows.
         Copy bool
 }
 
diff --git a/vendor/github.com/hashicorp/go-getter/get_file_copy.go b/vendor/github.com/hashicorp/go-getter/get_file_copy.go
new file mode 100644
index 0000000..d70fb49
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/get_file_copy.go
@@ -0,0 +1,29 @@
+package getter
+
+import (
+        "context"
+        "io"
+)
+
+// readerFunc is syntactic sugar for read interface.
+type readerFunc func(p []byte) (n int, err error)
+
+func (rf readerFunc) Read(p []byte) (n int, err error) { return rf(p) }
+
+// Copy is a io.Copy cancellable by context
+func Copy(ctx context.Context, dst io.Writer, src io.Reader) (int64, error) {
+        // Copy will call the Reader and Writer interface multiple time, in order
+        // to copy by chunk (avoiding loading the whole file in memory).
+        return io.Copy(dst, readerFunc(func(p []byte) (int, error) {
+
+                select {
+                case <-ctx.Done():
+                        // context has been canceled
+                        // stop process and propagate "context canceled" error
+                        return 0, ctx.Err()
+                default:
+                        // otherwise just run default io.Reader implementation
+                        return src.Read(p)
+                }
+        }))
+}
diff --git a/vendor/github.com/hashicorp/go-getter/get_file_unix.go b/vendor/github.com/hashicorp/go-getter/get_file_unix.go
index c89a2d5..c3b28ae 100644
--- a/vendor/github.com/hashicorp/go-getter/get_file_unix.go
+++ b/vendor/github.com/hashicorp/go-getter/get_file_unix.go
@@ -4,7 +4,6 @@ package getter
 
 import (
         "fmt"
-        "io"
         "net/url"
         "os"
         "path/filepath"
@@ -50,6 +49,7 @@ func (g *FileGetter) Get(dst string, u *url.URL) error {
 }
 
 func (g *FileGetter) GetFile(dst string, u *url.URL) error {
+        ctx := g.Context()
         path := u.Path
         if u.RawPath != "" {
                 path = u.RawPath
@@ -98,6 +98,6 @@ func (g *FileGetter) GetFile(dst string, u *url.URL) error {
         }
         defer dstF.Close()
 
-        _, err = io.Copy(dstF, srcF)
+        _, err = Copy(ctx, dstF, srcF)
         return err
 }
diff --git a/vendor/github.com/hashicorp/go-getter/get_file_windows.go b/vendor/github.com/hashicorp/go-getter/get_file_windows.go
index f87ed0a..24f1acb 100644
--- a/vendor/github.com/hashicorp/go-getter/get_file_windows.go
+++ b/vendor/github.com/hashicorp/go-getter/get_file_windows.go
@@ -4,15 +4,16 @@ package getter
 
 import (
         "fmt"
-        "io"
         "net/url"
         "os"
         "os/exec"
         "path/filepath"
         "strings"
+        "syscall"
 )
 
 func (g *FileGetter) Get(dst string, u *url.URL) error {
+        ctx := g.Context()
         path := u.Path
         if u.RawPath != "" {
                 path = u.RawPath
@@ -51,7 +52,7 @@ func (g *FileGetter) Get(dst string, u *url.URL) error {
         sourcePath := toBackslash(path)
 
         // Use mklink to create a junction point
-        output, err := exec.Command("cmd", "/c", "mklink", "/J", dst, sourcePath).CombinedOutput()
+        output, err := exec.CommandContext(ctx, "cmd", "/c", "mklink", "/J", dst, sourcePath).CombinedOutput()
         if err != nil {
                 return fmt.Errorf("failed to run mklink %v %v: %v %q", dst, sourcePath, err, output)
         }
@@ -60,6 +61,7 @@ func (g *FileGetter) Get(dst string, u *url.URL) error {
 }
 
 func (g *FileGetter) GetFile(dst string, u *url.URL) error {
+        ctx := g.Context()
         path := u.Path
         if u.RawPath != "" {
                 path = u.RawPath
@@ -92,7 +94,21 @@ func (g *FileGetter) GetFile(dst string, u *url.URL) error {
 
         // If we're not copying, just symlink and we're done
         if !g.Copy {
-                return os.Symlink(path, dst)
+                if err = os.Symlink(path, dst); err == nil {
+                        return err
+                }
+                lerr, ok := err.(*os.LinkError)
+                if !ok {
+                        return err
+                }
+                switch lerr.Err {
+                case syscall.ERROR_PRIVILEGE_NOT_HELD:
+                        // no symlink privilege, let's
+                        // fallback to a copy to avoid an error.
+                        break
+                default:
+                        return err
+                }
         }
 
         // Copy
@@ -108,7 +124,7 @@ func (g *FileGetter) GetFile(dst string, u *url.URL) error {
         }
         defer dstF.Close()
 
-        _, err = io.Copy(dstF, srcF)
+        _, err = Copy(ctx, dstF, srcF)
         return err
 }
 
diff --git a/vendor/github.com/hashicorp/go-getter/get_gcs.go b/vendor/github.com/hashicorp/go-getter/get_gcs.go
new file mode 100644
index 0000000..6faa70f
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/get_gcs.go
@@ -0,0 +1,172 @@
+package getter
+
+import (
+        "context"
+        "fmt"
+        "net/url"
+        "os"
+        "path/filepath"
+        "strings"
+
+        "cloud.google.com/go/storage"
+        "google.golang.org/api/iterator"
+)
+
+// GCSGetter is a Getter implementation that will download a module from
+// a GCS bucket.
+type GCSGetter struct {
+        getter
+}
+
+func (g *GCSGetter) ClientMode(u *url.URL) (ClientMode, error) {
+        ctx := g.Context()
+
+        // Parse URL
+        bucket, object, err := g.parseURL(u)
+        if err != nil {
+                return 0, err
+        }
+
+        client, err := storage.NewClient(ctx)
+        if err != nil {
+                return 0, err
+        }
+        iter := client.Bucket(bucket).Objects(ctx, &storage.Query{Prefix: object})
+        for {
+                obj, err := iter.Next()
+                if err != nil && err != iterator.Done {
+                        return 0, err
+                }
+
+                if err == iterator.Done {
+                        break
+                }
+                if strings.HasSuffix(obj.Name, "/") {
+                        // A directory matched the prefix search, so this must be a directory
+                        return ClientModeDir, nil
+                } else if obj.Name != object {
+                        // A file matched the prefix search and doesn't have the same name
+                        // as the query, so this must be a directory
+                        return ClientModeDir, nil
+                }
+        }
+        // There are no directories or subdirectories, and if a match was returned,
+        // it was exactly equal to the prefix search. So return File mode
+        return ClientModeFile, nil
+}
+
+func (g *GCSGetter) Get(dst string, u *url.URL) error {
+        ctx := g.Context()
+
+        // Parse URL
+        bucket, object, err := g.parseURL(u)
+        if err != nil {
+                return err
+        }
+
+        // Remove destination if it already exists
+        _, err = os.Stat(dst)
+        if err != nil && !os.IsNotExist(err) {
+                return err
+        }
+        if err == nil {
+                // Remove the destination
+                if err := os.RemoveAll(dst); err != nil {
+                        return err
+                }
+        }
+
+        // Create all the parent directories
+        if err := os.MkdirAll(filepath.Dir(dst), 0755); err != nil {
+                return err
+        }
+
+        client, err := storage.NewClient(ctx)
+        if err != nil {
+                return err
+        }
+
+        // Iterate through all matching objects.
+        iter := client.Bucket(bucket).Objects(ctx, &storage.Query{Prefix: object})
+        for {
+                obj, err := iter.Next()
+                if err != nil && err != iterator.Done {
+                        return err
+                }
+                if err == iterator.Done {
+                        break
+                }
+
+                if !strings.HasSuffix(obj.Name, "/") {
+                        // Get the object destination path
+                        objDst, err := filepath.Rel(object, obj.Name)
+                        if err != nil {
+                                return err
+                        }
+                        objDst = filepath.Join(dst, objDst)
+                        // Download the matching object.
+                        err = g.getObject(ctx, client, objDst, bucket, obj.Name)
+                        if err != nil {
+                                return err
+                        }
+                }
+        }
+        return nil
+}
+
+func (g *GCSGetter) GetFile(dst string, u *url.URL) error {
+        ctx := g.Context()
+
+        // Parse URL
+        bucket, object, err := g.parseURL(u)
+        if err != nil {
+                return err
+        }
+
+        client, err := storage.NewClient(ctx)
+        if err != nil {
+                return err
+        }
+        return g.getObject(ctx, client, dst, bucket, object)
+}
+
+func (g *GCSGetter) getObject(ctx context.Context, client *storage.Client, dst, bucket, object string) error {
+        rc, err := client.Bucket(bucket).Object(object).NewReader(ctx)
+        if err != nil {
+                return err
+        }
+        defer rc.Close()
+
+        // Create all the parent directories
+        if err := os.MkdirAll(filepath.Dir(dst), 0755); err != nil {
+                return err
+        }
+
+        f, err := os.Create(dst)
+        if err != nil {
+                return err
+        }
+        defer f.Close()
+
+        _, err = Copy(ctx, f, rc)
+        return err
+}
+
+func (g *GCSGetter) parseURL(u *url.URL) (bucket, path string, err error) {
+        if strings.Contains(u.Host, "googleapis.com") {
+                hostParts := strings.Split(u.Host, ".")
+                if len(hostParts) != 3 {
+                        err = fmt.Errorf("URL is not a valid GCS URL")
+                        return
+                }
+
+                pathParts := strings.SplitN(u.Path, "/", 5)
+                if len(pathParts) != 5 {
+                        err = fmt.Errorf("URL is not a valid GCS URL")
+                        return
+                }
+                bucket = pathParts[3]
+                path = pathParts[4]
+        }
+        return
+}
diff --git a/vendor/github.com/hashicorp/go-getter/get_git.go b/vendor/github.com/hashicorp/go-getter/get_git.go
index cb1d029..67e8b2f 100644
--- a/vendor/github.com/hashicorp/go-getter/get_git.go
+++ b/vendor/github.com/hashicorp/go-getter/get_git.go
@@ -1,6 +1,7 @@
 package getter
 
 import (
+        "context"
         "encoding/base64"
         "fmt"
         "io/ioutil"
@@ -8,28 +9,43 @@ import (
         "os"
         "os/exec"
         "path/filepath"
+        "runtime"
+        "strconv"
         "strings"
 
         urlhelper "github.com/hashicorp/go-getter/helper/url"
-        "github.com/hashicorp/go-safetemp"
-        "github.com/hashicorp/go-version"
+        safetemp "github.com/hashicorp/go-safetemp"
+        version "github.com/hashicorp/go-version"
 )
 
 // GitGetter is a Getter implementation that will download a module from
 // a git repository.
-type GitGetter struct{}
+type GitGetter struct {
+        getter
+}
 
 func (g *GitGetter) ClientMode(_ *url.URL) (ClientMode, error) {
         return ClientModeDir, nil
 }
 
 func (g *GitGetter) Get(dst string, u *url.URL) error {
+        ctx := g.Context()
         if _, err := exec.LookPath("git"); err != nil {
                 return fmt.Errorf("git must be available and on the PATH")
         }
 
+        // The port number must be parseable as an integer. If not, the user
+        // was probably trying to use a scp-style address, in which case the
+        // ssh:// prefix must be removed to indicate that.
+        if portStr := u.Port(); portStr != "" {
+                if _, err := strconv.ParseUint(portStr, 10, 16); err != nil {
+                        return fmt.Errorf("invalid port number %q; if using the \"scp-like\" git address scheme where a colon introduces the path instead, remove the ssh:// portion and use just the git:: prefix", portStr)
+                }
+        }
+
         // Extract some query parameters we use
         var ref, sshKey string
+        var depth int
         q := u.Query()
         if len(q) > 0 {
                 ref = q.Get("ref")
@@ -38,6 +54,11 @@ func (g *GitGetter) Get(dst string, u *url.URL) error {
                 sshKey = q.Get("sshkey")
                 q.Del("sshkey")
 
+                if n, err := strconv.Atoi(q.Get("depth")); err == nil {
+                        depth = n
+                }
+                q.Del("depth")
+
                 // Copy the URL
                 var newU url.URL = *u
                 u = &newU
@@ -84,9 +105,9 @@ func (g *GitGetter) Get(dst string, u *url.URL) error {
                 return err
         }
         if err == nil {
-                err = g.update(dst, sshKeyFile, ref)
+                err = g.update(ctx, dst, sshKeyFile, ref, depth)
         } else {
-                err = g.clone(dst, sshKeyFile, u)
+                err = g.clone(ctx, dst, sshKeyFile, u, depth)
         }
         if err != nil {
                 return err
@@ -100,7 +121,7 @@ func (g *GitGetter) Get(dst string, u *url.URL) error {
         }
 
         // Lastly, download any/all submodules.
-        return g.fetchSubmodules(dst, sshKeyFile)
+        return g.fetchSubmodules(ctx, dst, sshKeyFile, depth)
 }
 
 // GetFile for Git doesn't support updating at this time. It will download
@@ -138,16 +159,23 @@ func (g *GitGetter) checkout(dst string, ref string) error {
         return getRunCommand(cmd)
 }
 
-func (g *GitGetter) clone(dst, sshKeyFile string, u *url.URL) error {
-        cmd := exec.Command("git", "clone", u.String(), dst)
+func (g *GitGetter) clone(ctx context.Context, dst, sshKeyFile string, u *url.URL, depth int) error {
+        args := []string{"clone"}
+
+        if depth > 0 {
+                args = append(args, "--depth", strconv.Itoa(depth))
+        }
+
+        args = append(args, u.String(), dst)
+        cmd := exec.CommandContext(ctx, "git", args...)
         setupGitEnv(cmd, sshKeyFile)
         return getRunCommand(cmd)
 }
 
-func (g *GitGetter) update(dst, sshKeyFile, ref string) error {
+func (g *GitGetter) update(ctx context.Context, dst, sshKeyFile, ref string, depth int) error {
         // Determine if we're a branch. If we're NOT a branch, then we just
         // switch to master prior to checking out
-        cmd := exec.Command("git", "show-ref", "-q", "--verify", "refs/heads/"+ref)
+        cmd := exec.CommandContext(ctx, "git", "show-ref", "-q", "--verify", "refs/heads/"+ref)
         cmd.Dir = dst
 
         if getRunCommand(cmd) != nil {
@@ -162,15 +190,24 @@ func (g *GitGetter) update(dst, sshKeyFile, ref string) error {
                 return err
         }
 
-        cmd = exec.Command("git", "pull", "--ff-only")
+        if depth > 0 {
+                cmd = exec.Command("git", "pull", "--depth", strconv.Itoa(depth), "--ff-only")
+        } else {
+                cmd = exec.Command("git", "pull", "--ff-only")
+        }
+
         cmd.Dir = dst
         setupGitEnv(cmd, sshKeyFile)
         return getRunCommand(cmd)
 }
 
 // fetchSubmodules downloads any configured submodules recursively.
-func (g *GitGetter) fetchSubmodules(dst, sshKeyFile string) error {
-        cmd := exec.Command("git", "submodule", "update", "--init", "--recursive")
+func (g *GitGetter) fetchSubmodules(ctx context.Context, dst, sshKeyFile string, depth int) error {
+        args := []string{"submodule", "update", "--init", "--recursive"}
+        if depth > 0 {
+                args = append(args, "--depth", strconv.Itoa(depth))
+        }
+        cmd := exec.CommandContext(ctx, "git", args...)
         cmd.Dir = dst
         setupGitEnv(cmd, sshKeyFile)
         return getRunCommand(cmd)
@@ -187,7 +224,7 @@ func setupGitEnv(cmd *exec.Cmd, sshKeyFile string) {
         // with versions of Go < 1.9.
         env := os.Environ()
         for i, v := range env {
-                if strings.HasPrefix(v, gitSSHCommand) {
+                if strings.HasPrefix(v, gitSSHCommand) && len(v) > len(gitSSHCommand) {
                         sshCmd = []string{v}
 
                         env[i], env[len(env)-1] = env[len(env)-1], env[i]
@@ -202,6 +239,9 @@ func setupGitEnv(cmd *exec.Cmd, sshKeyFile string) {
 
         if sshKeyFile != "" {
                 // We have an SSH key temp file configured, tell ssh about this.
+                if runtime.GOOS == "windows" {
+                        sshKeyFile = strings.Replace(sshKeyFile, `\`, `/`, -1)
+                }
                 sshCmd = append(sshCmd, "-i", sshKeyFile)
         }
 
@@ -224,11 +264,20 @@ func checkGitVersion(min string) error {
         }
 
         fields := strings.Fields(string(out))
-        if len(fields) != 3 {
+        if len(fields) < 3 {
                 return fmt.Errorf("Unexpected 'git version' output: %q", string(out))
         }
+        v := fields[2]
+        if runtime.GOOS == "windows" && strings.Contains(v, ".windows.") {
+                // on windows, git version will return for example:
+                // git version 2.20.1.windows.1
+                // Which does not follow the semantic versionning specs
+                // https://semver.org. We remove that part in order for
+                // go-version to not error.
+                v = v[:strings.Index(v, ".windows.")]
+        }
 
-        have, err := version.NewVersion(fields[2])
+        have, err := version.NewVersion(v)
         if err != nil {
                 return err
         }
diff --git a/vendor/github.com/hashicorp/go-getter/get_hg.go b/vendor/github.com/hashicorp/go-getter/get_hg.go
index f386922..290649c 100644
--- a/vendor/github.com/hashicorp/go-getter/get_hg.go
+++ b/vendor/github.com/hashicorp/go-getter/get_hg.go
@@ -1,6 +1,7 @@
 package getter
 
 import (
+        "context"
         "fmt"
         "net/url"
         "os"
@@ -9,18 +10,21 @@ import (
         "runtime"
 
         urlhelper "github.com/hashicorp/go-getter/helper/url"
-        "github.com/hashicorp/go-safetemp"
+        safetemp "github.com/hashicorp/go-safetemp"
 )
 
 // HgGetter is a Getter implementation that will download a module from
 // a Mercurial repository.
-type HgGetter struct{}
+type HgGetter struct {
+        getter
+}
 
 func (g *HgGetter) ClientMode(_ *url.URL) (ClientMode, error) {
         return ClientModeDir, nil
 }
 
 func (g *HgGetter) Get(dst string, u *url.URL) error {
+        ctx := g.Context()
         if _, err := exec.LookPath("hg"); err != nil {
                 return fmt.Errorf("hg must be available and on the PATH")
         }
@@ -58,7 +62,7 @@ func (g *HgGetter) Get(dst string, u *url.URL) error {
                 return err
         }
 
-        return g.update(dst, newURL, rev)
+        return g.update(ctx, dst, newURL, rev)
 }
 
 // GetFile for Hg doesn't support updating at this time. It will download
@@ -93,7 +97,7 @@ func (g *HgGetter) GetFile(dst string, u *url.URL) error {
                 return err
         }
 
-        fg := &FileGetter{Copy: true}
+        fg := &FileGetter{Copy: true, getter: g.getter}
         return fg.GetFile(dst, u)
 }
 
@@ -108,13 +112,13 @@ func (g *HgGetter) pull(dst string, u *url.URL) error {
         return getRunCommand(cmd)
 }
 
-func (g *HgGetter) update(dst string, u *url.URL, rev string) error {
+func (g *HgGetter) update(ctx context.Context, dst string, u *url.URL, rev string) error {
         args := []string{"update"}
         if rev != "" {
                 args = append(args, rev)
         }
 
-        cmd := exec.Command("hg", args...)
+        cmd := exec.CommandContext(ctx, "hg", args...)
         cmd.Dir = dst
         return getRunCommand(cmd)
 }
diff --git a/vendor/github.com/hashicorp/go-getter/get_http.go b/vendor/github.com/hashicorp/go-getter/get_http.go
index d2e2879..7c4541c 100644
--- a/vendor/github.com/hashicorp/go-getter/get_http.go
+++ b/vendor/github.com/hashicorp/go-getter/get_http.go
@@ -1,6 +1,7 @@
 package getter
 
 import (
+        "context"
         "encoding/xml"
         "fmt"
         "io"
@@ -8,9 +9,10 @@ import (
         "net/url"
         "os"
         "path/filepath"
+        "strconv"
         "strings"
 
-        "github.com/hashicorp/go-safetemp"
+        safetemp "github.com/hashicorp/go-safetemp"
 )
 
 // HttpGetter is a Getter implementation that will download from an HTTP
@@ -18,7 +20,7 @@ import (
 //
 // For file downloads, HTTP is used directly.
 //
-// The protocol for downloading a directory from an HTTP endpoing is as follows:
+// The protocol for downloading a directory from an HTTP endpoint is as follows:
 //
 // An HTTP GET request is made to the URL with the additional GET parameter
 // "terraform-get=1". This lets you handle that scenario specially if you
@@ -34,6 +36,8 @@ import (
 // formed URL. The shorthand syntax of "github.com/foo/bar" or relative
 // paths are not allowed.
 type HttpGetter struct {
+        getter
+
         // Netrc, if true, will lookup and use auth information found
         // in the user's netrc file if available.
         Netrc bool
@@ -41,6 +45,12 @@ type HttpGetter struct {
         // Client is the http.Client to use for Get requests.
         // This defaults to a cleanhttp.DefaultClient if left unset.
         Client *http.Client
+
+        // Header contains optional request header fields that should be included
+        // with every HTTP request. Note that the zero value of this field is nil,
+        // and as such it needs to be initialized before use, via something like
+        // make(http.Header).
+        Header http.Header
 }
 
 func (g *HttpGetter) ClientMode(u *url.URL) (ClientMode, error) {
@@ -51,6 +61,7 @@ func (g *HttpGetter) ClientMode(u *url.URL) (ClientMode, error) {
 }
 
 func (g *HttpGetter) Get(dst string, u *url.URL) error {
+        ctx := g.Context()
         // Copy the URL so we can modify it
         var newU url.URL = *u
         u = &newU
@@ -72,10 +83,17 @@ func (g *HttpGetter) Get(dst string, u *url.URL) error {
         u.RawQuery = q.Encode()
 
         // Get the URL
-        resp, err := g.Client.Get(u.String())
+        req, err := http.NewRequest("GET", u.String(), nil)
         if err != nil {
                 return err
         }
+
+        req.Header = g.Header
+        resp, err := g.Client.Do(req)
+        if err != nil {
+                return err
+        }
+
         defer resp.Body.Close()
         if resp.StatusCode < 200 || resp.StatusCode >= 300 {
                 return fmt.Errorf("bad response code: %d", resp.StatusCode)
@@ -99,57 +117,107 @@ func (g *HttpGetter) Get(dst string, u *url.URL) error {
         // into a temporary directory, then copy over the proper subdir.
         source, subDir := SourceDirSubdir(source)
         if subDir == "" {
-                return Get(dst, source)
+                var opts []ClientOption
+                if g.client != nil {
+                        opts = g.client.Options
+                }
+                return Get(dst, source, opts...)
         }
 
         // We have a subdir, time to jump some hoops
-        return g.getSubdir(dst, source, subDir)
+        return g.getSubdir(ctx, dst, source, subDir)
 }
 
-func (g *HttpGetter) GetFile(dst string, u *url.URL) error {
+func (g *HttpGetter) GetFile(dst string, src *url.URL) error {
+        ctx := g.Context()
         if g.Netrc {
                 // Add auth from netrc if we can
-                if err := addAuthFromNetrc(u); err != nil {
+                if err := addAuthFromNetrc(src); err != nil {
                         return err
                 }
         }
 
-        if g.Client == nil {
-                g.Client = httpClient
+        // Create all the parent directories if needed
+        if err := os.MkdirAll(filepath.Dir(dst), 0755); err != nil {
+                return err
         }
 
-        resp, err := g.Client.Get(u.String())
+        f, err := os.OpenFile(dst, os.O_RDWR|os.O_CREATE, os.FileMode(0666))
         if err != nil {
                 return err
         }
-        defer resp.Body.Close()
-        if resp.StatusCode != 200 {
-                return fmt.Errorf("bad response code: %d", resp.StatusCode)
+        defer f.Close()
+
+        if g.Client == nil {
+                g.Client = httpClient
         }
 
-        // Create all the parent directories
-        if err := os.MkdirAll(filepath.Dir(dst), 0755); err != nil {
+        var currentFileSize int64
+
+        // We first make a HEAD request so we can check
+        // if the server supports range queries. If the server/URL doesn't
+        // support HEAD requests, we just fall back to GET.
+        req, err := http.NewRequest("HEAD", src.String(), nil)
+        if err != nil {
                 return err
         }
+        if g.Header != nil {
+                req.Header = g.Header
+        }
+        headResp, err := g.Client.Do(req)
+        if err == nil && headResp != nil {
+                headResp.Body.Close()
+                if headResp.StatusCode == 200 {
+                        // If the HEAD request succeeded, then attempt to set the range
+                        // query if we can.
+                        if headResp.Header.Get("Accept-Ranges") == "bytes" {
+                                if fi, err := f.Stat(); err == nil {
+                                        if _, err = f.Seek(0, os.SEEK_END); err == nil {
+                                                req.Header.Set("Range", fmt.Sprintf("bytes=%d-", fi.Size()))
+                                                currentFileSize = fi.Size()
+                                                totalFileSize, _ := strconv.ParseInt(headResp.Header.Get("Content-Length"), 10, 64)
+                                                if currentFileSize >= totalFileSize {
+                                                        // file already present
+                                                        return nil
+                                                }
+                                        }
+                                }
+                        }
+                }
+        }
+        req.Method = "GET"
 
-        f, err := os.Create(dst)
+        resp, err := g.Client.Do(req)
         if err != nil {
                 return err
         }
+        switch resp.StatusCode {
+        case http.StatusOK, http.StatusPartialContent:
+                // all good
+        default:
+                resp.Body.Close()
+                return fmt.Errorf("bad response code: %d", resp.StatusCode)
+        }
+
+        body := resp.Body
 
-        n, err := io.Copy(f, resp.Body)
+        if g.client != nil && g.client.ProgressListener != nil {
+                // track download
+                fn := filepath.Base(src.EscapedPath())
+                body = g.client.ProgressListener.TrackProgress(fn, currentFileSize, currentFileSize+resp.ContentLength, resp.Body)
+        }
+        defer body.Close()
+
+        n, err := Copy(ctx, f, body)
         if err == nil && n < resp.ContentLength {
                 err = io.ErrShortWrite
         }
-        if err1 := f.Close(); err == nil {
-                err = err1
-        }
         return err
 }
 
 // getSubdir downloads the source into the destination, but with
 // the proper subdir.
-func (g *HttpGetter) getSubdir(dst, source, subDir string) error {
+func (g *HttpGetter) getSubdir(ctx context.Context, dst, source, subDir string) error {
         // Create a temporary directory to store the full source. This has to be
         // a non-existent directory.
         td, tdcloser, err := safetemp.Dir("", "getter")
@@ -158,8 +226,12 @@ func (g *HttpGetter) getSubdir(dst, source, subDir string) error {
         }
         defer tdcloser.Close()
 
+        var opts []ClientOption
+        if g.client != nil {
+                opts = g.client.Options
+        }
         // Download that into the given directory
-        if err := Get(td, source); err != nil {
+        if err := Get(td, source, opts...); err != nil {
                 return err
         }
 
@@ -185,7 +257,7 @@ func (g *HttpGetter) getSubdir(dst, source, subDir string) error {
                 return err
         }
 
-        return copyDir(dst, sourcePath, false)
+        return copyDir(ctx, dst, sourcePath, false)
 }
 
 // parseMeta looks for the first meta tag in the given reader that
diff --git a/vendor/github.com/hashicorp/go-getter/get_mock.go b/vendor/github.com/hashicorp/go-getter/get_mock.go
index 882e694..e2a98ea 100644
--- a/vendor/github.com/hashicorp/go-getter/get_mock.go
+++ b/vendor/github.com/hashicorp/go-getter/get_mock.go
@@ -6,6 +6,8 @@ import (
 
 // MockGetter is an implementation of Getter that can be used for tests.
 type MockGetter struct {
+        getter
+
         // Proxy, if set, will be called after recording the calls below.
         // If it isn't set, then the *Err values will be returned.
         Proxy Getter
diff --git a/vendor/github.com/hashicorp/go-getter/get_s3.go b/vendor/github.com/hashicorp/go-getter/get_s3.go
index ebb3217..93eeb0b 100644
--- a/vendor/github.com/hashicorp/go-getter/get_s3.go
+++ b/vendor/github.com/hashicorp/go-getter/get_s3.go
@@ -1,8 +1,8 @@
 package getter
 
 import (
+        "context"
         "fmt"
-        "io"
         "net/url"
         "os"
         "path/filepath"
@@ -18,7 +18,9 @@ import (
 
 // S3Getter is a Getter implementation that will download a module from
 // a S3 bucket.
-type S3Getter struct{}
+type S3Getter struct {
+        getter
+}
 
 func (g *S3Getter) ClientMode(u *url.URL) (ClientMode, error) {
         // Parse URL
@@ -60,6 +62,8 @@ func (g *S3Getter) ClientMode(u *url.URL) (ClientMode, error) {
 }
 
 func (g *S3Getter) Get(dst string, u *url.URL) error {
+        ctx := g.Context()
+
         // Parse URL
         region, bucket, path, _, creds, err := g.parseUrl(u)
         if err != nil {
@@ -124,7 +128,7 @@ func (g *S3Getter) Get(dst string, u *url.URL) error {
                         }
                         objDst = filepath.Join(dst, objDst)
 
-                        if err := g.getObject(client, objDst, bucket, objPath, ""); err != nil {
+                        if err := g.getObject(ctx, client, objDst, bucket, objPath, ""); err != nil {
                                 return err
                         }
                 }
@@ -134,6 +138,7 @@ func (g *S3Getter) Get(dst string, u *url.URL) error {
 }
 
 func (g *S3Getter) GetFile(dst string, u *url.URL) error {
+        ctx := g.Context()
         region, bucket, path, version, creds, err := g.parseUrl(u)
         if err != nil {
                 return err
@@ -142,10 +147,10 @@ func (g *S3Getter) GetFile(dst string, u *url.URL) error {
         config := g.getAWSConfig(region, u, creds)
         sess := session.New(config)
         client := s3.New(sess)
-        return g.getObject(client, dst, bucket, path, version)
+        return g.getObject(ctx, client, dst, bucket, path, version)
 }
 
-func (g *S3Getter) getObject(client *s3.S3, dst, bucket, key, version string) error {
+func (g *S3Getter) getObject(ctx context.Context, client *s3.S3, dst, bucket, key, version string) error {
         req := &s3.GetObjectInput{
                 Bucket: aws.String(bucket),
                 Key:    aws.String(key),
@@ -170,7 +175,7 @@ func (g *S3Getter) getObject(client *s3.S3, dst, bucket, key, version string) er
         }
         defer f.Close()
 
-        _, err = io.Copy(f, resp.Body)
+        _, err = Copy(ctx, f, resp.Body)
         return err
 }
 
diff --git a/vendor/github.com/hashicorp/go-getter/go.mod b/vendor/github.com/hashicorp/go-getter/go.mod
new file mode 100644
index 0000000..807c0a2
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/go.mod
@@ -0,0 +1,22 @@
+module github.com/hashicorp/go-getter
+
+require (
+        cloud.google.com/go v0.36.0
+        github.com/aws/aws-sdk-go v1.15.78
+        github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d
+        github.com/cheggaaa/pb v1.0.27
+        github.com/fatih/color v1.7.0 // indirect
+        github.com/hashicorp/go-cleanhttp v0.5.0
+        github.com/hashicorp/go-safetemp v1.0.0
+        github.com/hashicorp/go-version v1.1.0
+        github.com/mattn/go-colorable v0.0.9 // indirect
+        github.com/mattn/go-isatty v0.0.4 // indirect
+        github.com/mattn/go-runewidth v0.0.4 // indirect
+        github.com/mitchellh/go-homedir v1.0.0
+        github.com/mitchellh/go-testing-interface v1.0.0
+        github.com/ulikunitz/xz v0.5.5
+        golang.org/x/net v0.0.0-20181114220301-adae6a3d119a // indirect
+        golang.org/x/sys v0.0.0-20181213200352-4d1cda033e06 // indirect
+        google.golang.org/api v0.1.0
+        gopkg.in/cheggaaa/pb.v1 v1.0.27 // indirect
+)
diff --git a/vendor/github.com/hashicorp/go-getter/go.sum b/vendor/github.com/hashicorp/go-getter/go.sum
new file mode 100644
index 0000000..0fc5088
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/go.sum
@@ -0,0 +1,182 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.31.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.36.0 h1:+aCSj7tOo2LODWVEuZDZeGCckdt6MlSF+X/rB3wUiS8=
+cloud.google.com/go v0.36.0/go.mod h1:RUoy9p/M4ge0HzT8L+SDZ8jg+Q6fth0CiBuhFJpSV40=
+dmitri.shuralyov.com/app/changes v0.0.0-20180602232624-0a106ad413e3/go.mod h1:Yl+fi1br7+Rr3LqpNJf1/uxUdtRUV+Tnj0o93V2B9MU=
+dmitri.shuralyov.com/html/belt v0.0.0-20180602232347-f7d459c86be0/go.mod h1:JLBrvjyP0v+ecvNYvCpyZgu5/xkfAUhi6wJj28eUfSU=
+dmitri.shuralyov.com/service/change v0.0.0-20181023043359-a85b471d5412/go.mod h1:a1inKt/atXimZ4Mv927x+r7UpyzRUf4emIoiiSC2TN4=
+dmitri.shuralyov.com/state v0.0.0-20180228185332-28bcc343414c/go.mod h1:0PRwlb0D6DFvNNtx+9ybjezNCa8XF0xaYcETyp6rHWU=
+git.apache.org/thrift.git v0.0.0-20180902110319-2566ecd5d999/go.mod h1:fPE2ZNJGynbRyZ4dJvy6G277gSllfV2HJqblrnkyeyg=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
+github.com/aws/aws-sdk-go v1.15.78 h1:LaXy6lWR0YK7LKyuU0QWy2ws/LWTPfYV/UgfiBu4tvY=
+github.com/aws/aws-sdk-go v1.15.78/go.mod h1:E3/ieXAlvM0XWO57iftYVDLLvQ824smPP3ATZkfNZeM=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d h1:xDfNPAt8lFiC1UJrqV3uuy861HCTo708pDMbjHHdCas=
+github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d/go.mod h1:6QX/PXZ00z/TKoufEY6K/a0k6AhaJrQKdFe6OfVXsa4=
+github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g=
+github.com/cheggaaa/pb v1.0.27 h1:wIkZHkNfC7R6GI5w7l/PdAdzXzlrbcI3p8OAlnkTsnc=
+github.com/cheggaaa/pb v1.0.27/go.mod h1:pQciLPpbU0oxA0h+VJYYLxO+XeDQb5pZijXscXHm81s=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/coreos/go-systemd v0.0.0-20181012123002-c6f51f82210d/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
+github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
+github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/gliderlabs/ssh v0.1.1/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/lint v0.0.0-20180702182130-06c8688daad7/go.mod h1:tluoj9z5200jBnyusfRPU2LqT6J+DAorxEvtC7LHB+E=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-github v17.0.0+incompatible/go.mod h1:zLgOLi98H3fifZn+44m+umXrS52loVEgC2AApnigrVQ=
+github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
+github.com/google/martian v2.1.0+incompatible h1:/CP5g8u/VJHijgedC/Legn3BAbAaWPgecwXBIDzw5no=
+github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
+github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/googleapis/gax-go v2.0.0+incompatible h1:j0GKcs05QVmm7yesiZq2+9cxHkNK9YM6zKx4D2qucQU=
+github.com/googleapis/gax-go v2.0.0+incompatible/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY=
+github.com/googleapis/gax-go/v2 v2.0.3 h1:siORttZ36U2R/WjiJuDz8znElWBiAlO9rVt+mqJt0Cc=
+github.com/googleapis/gax-go/v2 v2.0.3/go.mod h1:LLvjysVCY1JZeum8Z6l8qUty8fiNwE08qbEPm1M08qg=
+github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
+github.com/grpc-ecosystem/grpc-gateway v1.5.0/go.mod h1:RSKVYQBd5MCa4OVpNdGskqpgL2+G+NZTnrVHpWWfpdw=
+github.com/hashicorp/go-cleanhttp v0.5.0 h1:wvCrVc9TjDls6+YGAF2hAifE1E5U1+b4tH6KdvN3Gig=
+github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
+github.com/hashicorp/go-safetemp v1.0.0 h1:2HR189eFNrjHQyENnQMMpCiBAsRxzbTMIgBhEyExpmo=
+github.com/hashicorp/go-safetemp v1.0.0/go.mod h1:oaerMy3BhqiTbVye6QuFhFtIceqFoDHxNAB65b+Rj1I=
+github.com/hashicorp/go-version v1.1.0 h1:bPIoEKD27tNdebFGGxxYwcL4nepeY4j1QP23PFRGzg0=
+github.com/hashicorp/go-version v1.1.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/jellevandenhooff/dkim v0.0.0-20150330215556-f50fe3d243e1/go.mod h1:E0B/fFc00Y+Rasa88328GlI/XbtyysCtTHZS8h7IrBU=
+github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8 h1:12VvqtR6Aowv3l/EQUlocDHW2Cp4G9WJVH7uyH8QFJE=
+github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/pty v1.1.3/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/mattn/go-colorable v0.0.9 h1:UVL0vNpWh04HeJXV0KLcaT7r06gOH2l4OW6ddYRUIY4=
+github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-isatty v0.0.4 h1:bnP0vzxcAdeI1zdubAl5PjU6zsERjGZb7raWodagDYs=
+github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-runewidth v0.0.4 h1:2BvfKmzob6Bmd4YsL0zygOqfdFnK7GR4QL06Do4/p7Y=
+github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/microcosm-cc/bluemonday v1.0.1/go.mod h1:hsXNsILzKxV+sX77C5b8FSuKF00vh2OMYv+xgHpAMF4=
+github.com/mitchellh/go-homedir v1.0.0 h1:vKb8ShqSby24Yrqr/yDYkuFz8d0WUjys40rvnGC8aR0=
+github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/go-testing-interface v1.0.0 h1:fzU/JVNcaqHQEcVFAKeR41fkiLdIPrefOvVG1VZ96U0=
+github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
+github.com/neelance/astrewrite v0.0.0-20160511093645-99348263ae86/go.mod h1:kHJEU3ofeGjhHklVoIGuVj85JJwZ6kWPaJwCIxgnFmo=
+github.com/neelance/sourcemap v0.0.0-20151028013722-8c68805598ab/go.mod h1:Qr6/a/Q4r9LP1IltGz7tA7iOK1WonHEYhu1HRBA7ZiM=
+github.com/openzipkin/zipkin-go v0.1.1/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTmOf0Erfk+hxe8=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v0.8.0/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/common v0.0.0-20180801064454-c7de2306084e/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
+github.com/prometheus/procfs v0.0.0-20180725123919-05ee40e3a273/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
+github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
+github.com/shurcooL/component v0.0.0-20170202220835-f88ec8f54cc4/go.mod h1:XhFIlyj5a1fBNx5aJTbKoIq0mNaPvOagO+HjB3EtxrY=
+github.com/shurcooL/events v0.0.0-20181021180414-410e4ca65f48/go.mod h1:5u70Mqkb5O5cxEA8nxTsgrgLehJeAw6Oc4Ab1c/P1HM=
+github.com/shurcooL/github_flavored_markdown v0.0.0-20181002035957-2122de532470/go.mod h1:2dOwnU2uBioM+SGy2aZoq1f/Sd1l9OkAeAUvjSyvgU0=
+github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
+github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041/go.mod h1:N5mDOmsrJOB+vfqUK+7DmDyjhSLIIBnXo9lvZJj3MWQ=
+github.com/shurcooL/gofontwoff v0.0.0-20180329035133-29b52fc0a18d/go.mod h1:05UtEgK5zq39gLST6uB0cf3NEHjETfB4Fgr3Gx5R9Vw=
+github.com/shurcooL/gopherjslib v0.0.0-20160914041154-feb6d3990c2c/go.mod h1:8d3azKNyqcHP1GaQE/c6dDgjkgSx2BZ4IoEi4F1reUI=
+github.com/shurcooL/highlight_diff v0.0.0-20170515013008-09bb4053de1b/go.mod h1:ZpfEhSmds4ytuByIcDnOLkTHGUI6KNqRNPDLHDk+mUU=
+github.com/shurcooL/highlight_go v0.0.0-20181028180052-98c3abbbae20/go.mod h1:UDKB5a1T23gOMUJrI+uSuH0VRDStOiUVSjBTRDVBVag=
+github.com/shurcooL/home v0.0.0-20181020052607-80b7ffcb30f9/go.mod h1:+rgNQw2P9ARFAs37qieuu7ohDNQ3gds9msbT2yn85sg=
+github.com/shurcooL/htmlg v0.0.0-20170918183704-d01228ac9e50/go.mod h1:zPn1wHpTIePGnXSHpsVPWEktKXHr6+SS6x/IKRb7cpw=
+github.com/shurcooL/httperror v0.0.0-20170206035902-86b7830d14cc/go.mod h1:aYMfkZ6DWSJPJ6c4Wwz3QtW22G7mf/PEgaB9k/ik5+Y=
+github.com/shurcooL/httpfs v0.0.0-20171119174359-809beceb2371/go.mod h1:ZY1cvUeJuFPAdZ/B6v7RHavJWZn2YPVFQ1OSXhCGOkg=
+github.com/shurcooL/httpgzip v0.0.0-20180522190206-b1c53ac65af9/go.mod h1:919LwcH0M7/W4fcZ0/jy0qGght1GIhqyS/EgWGH2j5Q=
+github.com/shurcooL/issues v0.0.0-20181008053335-6292fdc1e191/go.mod h1:e2qWDig5bLteJ4fwvDAc2NHzqFEthkqn7aOZAOpj+PQ=
+github.com/shurcooL/issuesapp v0.0.0-20180602232740-048589ce2241/go.mod h1:NPpHK2TI7iSaM0buivtFUc9offApnI0Alt/K8hcHy0I=
+github.com/shurcooL/notifications v0.0.0-20181007000457-627ab5aea122/go.mod h1:b5uSkrEVM1jQUspwbixRBhaIjIzL2xazXp6kntxYle0=
+github.com/shurcooL/octicon v0.0.0-20181028054416-fa4f57f9efb2/go.mod h1:eWdoE5JD4R5UVWDucdOPg1g2fqQRq78IQa9zlOV1vpQ=
+github.com/shurcooL/reactions v0.0.0-20181006231557-f2e0b4ca5b82/go.mod h1:TCR1lToEk4d2s07G3XGfz2QrgHXg4RJBvjrOozvoWfk=
+github.com/shurcooL/sanitized_anchor_name v0.0.0-20170918181015-86672fcb3f95/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/shurcooL/users v0.0.0-20180125191416-49c67e49c537/go.mod h1:QJTqeLYEDaXHZDBsXlPCDqdhQuJkuw4NOtaxYe3xii4=
+github.com/shurcooL/webdavfs v0.0.0-20170829043945-18c3829fa133/go.mod h1:hKmq5kWdCj2z2KEozexVbfEZIWiTjhE0+UjmZgPqehw=
+github.com/sourcegraph/annotate v0.0.0-20160123013949-f4cad6c6324d/go.mod h1:UdhH50NIW0fCiwBSr0co2m7BnFLdv4fQTgdqdJTHFeE=
+github.com/sourcegraph/syntaxhighlight v0.0.0-20170531221838-bd320f5d308e/go.mod h1:HuIsMU8RRBOtsCgI77wP899iHVBQpCmg4ErYMZB+2IA=
+github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1w=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/tarm/serial v0.0.0-20180830185346-98f6abe2eb07/go.mod h1:kDXzergiv9cbyO7IOYJZWg1U88JhDg3PB6klq9Hg2pA=
+github.com/ulikunitz/xz v0.5.5 h1:pFrO0lVpTBXLpYw+pnLj6TbvHuyjXMfjGeCwSqCVwok=
+github.com/ulikunitz/xz v0.5.5/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8=
+go.opencensus.io v0.18.0 h1:Mk5rgZcggtbvtAun5aJzAtjKKN/t0R3jJPlWILlv938=
+go.opencensus.io v0.18.0/go.mod h1:vKdFvxhtzZ9onBp9VKHK8z/sRpBMnKAsufL7wlDrCOA=
+go4.org v0.0.0-20180809161055-417644f6feb5/go.mod h1:MkTOUMDaeVYJUOUsaDXIhWPZYa1yOyC1qaOBpL57BhE=
+golang.org/x/build v0.0.0-20190111050920-041ab4dc3f9d/go.mod h1:OWs+y06UdEOHN4y+MfF/py+xQ/tYqIWW03b70/CG9Rw=
+golang.org/x/crypto v0.0.0-20181030102418-4d3f4d9ffa16/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/lint v0.0.0-20180702182130-06c8688daad7/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181029044818-c44066c5c816/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181106065722-10aee1819953/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181114220301-adae6a3d119a h1:gOpx8G595UYyvj8UK4+OFyY4rx037g3fmfhe5SasG3U=
+golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20181017192945-9dcd33a902f4/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890 h1:uESlIz09WIHT2I+pasSXcpLYqYK8wHcdCetU3VuMBJE=
+golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/perf v0.0.0-20180704124530-6e6d33e29852/go.mod h1:JLpeXjPJfIyPr5TlbXLkXWLhP8nz10XfvxElABhCtcw=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f h1:Bl/8QSvNqXvPGPGXa2z5xUTmV7VDcZyvRZ+QQXkXTZQ=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181029174526-d69651ed3497/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181213200352-4d1cda033e06 h1:0oC8rFnE+74kEmuHZ46F6KHsMr5Gx2gUQPuNz28iQZM=
+golang.org/x/sys v0.0.0-20181213200352-4d1cda033e06/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2 h1:z99zHgr7hKfrUcX/KsoJk5FJfjTceCKIp96+biqP4To=
+golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20181030000716-a0a13e073c7b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+google.golang.org/api v0.0.0-20180910000450-7ca32eb868bf/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
+google.golang.org/api v0.0.0-20181030000543-1d582fd0359e/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
+google.golang.org/api v0.1.0 h1:K6z2u68e86TPdSdefXdzvXgR1zEMa+459vBSfWYAZkI=
+google.golang.org/api v0.1.0/go.mod h1:UGEZY7KEX120AnNLIHFMKIo4obdJhkp2tPbaPlQx13Y=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.2.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.3.0 h1:FBSsiFRMz3LBeXIomRnVzrQwSDj4ibvcRexLG0LZGQk=
+google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20180831171423-11092d34479b/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20181029155118-b69ba1387ce2/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20181202183823-bd91e49a0898/go.mod h1:7Ep/1NZk928CDR8SjdVbjWNpdIf6nzjE3BTgJDr2Atg=
+google.golang.org/genproto v0.0.0-20190201180003-4b09977fb922 h1:mBVYJnbrXLA/ZCBTCe7PtEgAUP+1bg92qTaFoPHdz+8=
+google.golang.org/genproto v0.0.0-20190201180003-4b09977fb922/go.mod h1:L3J43x8/uS+qIUoksaLKe6OS3nUKxOKuIFz1sl2/jx4=
+google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
+google.golang.org/grpc v1.16.0/go.mod h1:0JHn/cJsOMiMfNA9+DeHDlAU7KAAB5GDlYFpa9MZMio=
+google.golang.org/grpc v1.17.0 h1:TRJYBgMclJvGYn2rIMjj+h9KtMt5r1Ij7ODVRIZkwhk=
+google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/cheggaaa/pb.v1 v1.0.27 h1:kJdccidYzt3CaHD1crCFTS1hxyhSi059NhOFUf03YFo=
+gopkg.in/cheggaaa/pb.v1 v1.0.27/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+grpc.go4.org v0.0.0-20170609214715-11d0a25b4919/go.mod h1:77eQGdRu53HpSqPFJFmuJdjuHRquDANNeA4x7B8WQ9o=
+honnef.co/go/tools v0.0.0-20180728063816-88497007e858/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+sourcegraph.com/sourcegraph/go-diff v0.5.0/go.mod h1:kuch7UrkMzY0X+p9CRK03kfuPQ2zzQcaEFbx8wA8rck=
+sourcegraph.com/sqs/pbtypes v0.0.0-20180604144634-d3ebe8f20ae4/go.mod h1:ketZ/q3QxT9HOBeFhu6RdvsftgpsbFHBF5Cas6cDKZ0=
diff --git a/vendor/github.com/hashicorp/go-getter/helper/url/url_windows.go b/vendor/github.com/hashicorp/go-getter/helper/url/url_windows.go
index 4655226..4280ec5 100644
--- a/vendor/github.com/hashicorp/go-getter/helper/url/url_windows.go
+++ b/vendor/github.com/hashicorp/go-getter/helper/url/url_windows.go
@@ -11,19 +11,18 @@ func parse(rawURL string) (*url.URL, error) {
         // Make sure we're using "/" since URLs are "/"-based.
         rawURL = filepath.ToSlash(rawURL)
 
+        if len(rawURL) > 1 && rawURL[1] == ':' {
+                // Assume we're dealing with a drive letter. In which case we
+                // force the 'file' scheme to avoid "net/url" URL.String() prepending
+                // our url with "./".
+                rawURL = "file://" + rawURL
+        }
+
         u, err := url.Parse(rawURL)
         if err != nil {
                 return nil, err
         }
 
-        if len(rawURL) > 1 && rawURL[1] == ':' {
-                // Assume we're dealing with a drive letter file path where the drive
-                // letter has been parsed into the URL Scheme, and the rest of the path
-                // has been parsed into the URL Path without the leading ':' character.
-                u.Path = fmt.Sprintf("%s:%s", string(rawURL[0]), u.Path)
-                u.Scheme = ""
-        }
-
         if len(u.Host) > 1 && u.Host[1] == ':' && strings.HasPrefix(rawURL, "file://") {
                 // Assume we're dealing with a drive letter file path where the drive
                 // letter has been parsed into the URL Host.
diff --git a/vendor/github.com/hashicorp/go-getter/source.go b/vendor/github.com/hashicorp/go-getter/source.go
index c63f2bb..dab6d40 100644
--- a/vendor/github.com/hashicorp/go-getter/source.go
+++ b/vendor/github.com/hashicorp/go-getter/source.go
@@ -6,18 +6,31 @@ import (
         "strings"
 )
 
-// SourceDirSubdir takes a source and returns a tuple of the URL without
-// the subdir and the URL with the subdir.
+// SourceDirSubdir takes a source URL and returns a tuple of the URL without
+// the subdir and the subdir.
+//
+// ex:
+//   dom.com/path/?q=p               => dom.com/path/?q=p, ""
+//   proto://dom.com/path//*?q=p     => proto://dom.com/path?q=p, "*"
+//   proto://dom.com/path//path2?q=p => proto://dom.com/path?q=p, "path2"
+//
 func SourceDirSubdir(src string) (string, string) {
-        // Calcaulate an offset to avoid accidentally marking the scheme
+
+        // URL might contains another url in query parameters
+        stop := len(src)
+        if idx := strings.Index(src, "?"); idx > -1 {
+                stop = idx
+        }
+
+        // Calculate an offset to avoid accidentally marking the scheme
         // as the dir.
         var offset int
-        if idx := strings.Index(src, "://"); idx > -1 {
+        if idx := strings.Index(src[:stop], "://"); idx > -1 {
                 offset = idx + 3
         }
 
         // First see if we even have an explicit subdir
-        idx := strings.Index(src[offset:], "//")
+        idx := strings.Index(src[offset:stop], "//")
         if idx == -1 {
                 return src, ""
         }
diff --git a/vendor/github.com/hashicorp/go-hclog/.gitignore b/vendor/github.com/hashicorp/go-hclog/.gitignore
new file mode 100644
index 0000000..42cc410
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-hclog/.gitignore
@@ -0,0 +1 @@
+.idea*
\ No newline at end of file
diff --git a/vendor/github.com/hashicorp/go-hclog/README.md b/vendor/github.com/hashicorp/go-hclog/README.md
index 614342b..1153e28 100644
--- a/vendor/github.com/hashicorp/go-hclog/README.md
+++ b/vendor/github.com/hashicorp/go-hclog/README.md
@@ -10,8 +10,7 @@ interface for use in development and production environments.
 It provides logging levels that provide decreased output based upon the
 desired amount of output, unlike the standard library `log` package.
 
-It does not provide `Printf` style logging, only key/value logging that is
-exposed as arguments to the logging functions for simplicity.
+It provides `Printf` style logging of values via `hclog.Fmt()`.
 
 It provides a human readable output mode for use in development as well as
 JSON output mode for production.
@@ -100,6 +99,17 @@ requestLogger.Info("we are transporting a request")
 This allows sub Loggers to be context specific without having to thread that
 into all the callers.
 
+### Using `hclog.Fmt()`
+
+```go
+var int totalBandwidth = 200
+appLogger.Info("total bandwidth exceeded", "bandwidth", hclog.Fmt("%d GB/s", totalBandwidth))
+```
+
+```text
+... [INFO ] my-app: total bandwidth exceeded: bandwidth="200 GB/s"
+```
+
 ### Use this with code that uses the standard library logger
 
 If you want to use the standard library's `log.Logger` interface you can wrap
diff --git a/vendor/github.com/hashicorp/go-hclog/go.mod b/vendor/github.com/hashicorp/go-hclog/go.mod
new file mode 100644
index 0000000..0d079a6
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-hclog/go.mod
@@ -0,0 +1,7 @@
+module github.com/hashicorp/go-hclog
+
+require (
+        github.com/davecgh/go-spew v1.1.1 // indirect
+        github.com/pmezard/go-difflib v1.0.0 // indirect
+        github.com/stretchr/testify v1.2.2
+)
diff --git a/vendor/github.com/hashicorp/go-hclog/go.sum b/vendor/github.com/hashicorp/go-hclog/go.sum
new file mode 100644
index 0000000..e03ee77
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-hclog/go.sum
@@ -0,0 +1,6 @@
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1w=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
diff --git a/vendor/github.com/hashicorp/go-hclog/int.go b/vendor/github.com/hashicorp/go-hclog/int.go
index 9f90c28..2aaa1f8 100644
--- a/vendor/github.com/hashicorp/go-hclog/int.go
+++ b/vendor/github.com/hashicorp/go-hclog/int.go
@@ -2,14 +2,19 @@ package hclog
 
 import (
         "bufio"
+        "bytes"
+        "encoding"
         "encoding/json"
         "fmt"
         "log"
         "os"
+        "reflect"
         "runtime"
+        "sort"
         "strconv"
         "strings"
         "sync"
+        "sync/atomic"
         "time"
 )
 
@@ -17,8 +22,8 @@ var (
         _levelToBracket = map[Level]string{
                 Debug: "[DEBUG]",
                 Trace: "[TRACE]",
-                Info:  "[INFO ]",
-                Warn:  "[WARN ]",
+                Info:  "[INFO] ",
+                Warn:  "[WARN] ",
                 Error: "[ERROR]",
         }
 )
@@ -39,28 +44,40 @@ func New(opts *LoggerOptions) Logger {
                 level = DefaultLevel
         }
 
-        return &intLogger{
-                m:      new(sync.Mutex),
-                json:   opts.JSONFormat,
-                caller: opts.IncludeLocation,
-                name:   opts.Name,
-                w:      bufio.NewWriter(output),
-                level:  level,
+        mtx := opts.Mutex
+        if mtx == nil {
+                mtx = new(sync.Mutex)
         }
+
+        ret := &intLogger{
+                m:          mtx,
+                json:       opts.JSONFormat,
+                caller:     opts.IncludeLocation,
+                name:       opts.Name,
+                timeFormat: TimeFormat,
+                w:          bufio.NewWriter(output),
+                level:      new(int32),
+        }
+        if opts.TimeFormat != "" {
+                ret.timeFormat = opts.TimeFormat
+        }
+        atomic.StoreInt32(ret.level, int32(level))
+        return ret
 }
 
 // The internal logger implementation. Internal in that it is defined entirely
 // by this package.
 type intLogger struct {
-        json   bool
-        caller bool
-        name   string
+        json       bool
+        caller     bool
+        name       string
+        timeFormat string
 
         // this is a pointer so that it's shared by any derived loggers, since
         // those derived loggers share the bufio.Writer as well.
         m     *sync.Mutex
         w     *bufio.Writer
-        level Level
+        level *int32
 
         implied []interface{}
 }
@@ -75,7 +92,7 @@ const TimeFormat = "2006-01-02T15:04:05.000Z0700"
 // Log a message and a set of key/value pairs if the given level is at
 // or more severe that the threshold configured in the Logger.
 func (z *intLogger) Log(level Level, msg string, args ...interface{}) {
-        if level < z.level {
+        if level < Level(atomic.LoadInt32(z.level)) {
                 return
         }
 
@@ -126,14 +143,14 @@ func trimCallerPath(path string) string {
 
 // Non-JSON logging format function
 func (z *intLogger) log(t time.Time, level Level, msg string, args ...interface{}) {
-        z.w.WriteString(t.Format(TimeFormat))
+        z.w.WriteString(t.Format(z.timeFormat))
         z.w.WriteByte(' ')
 
         s, ok := _levelToBracket[level]
         if ok {
                 z.w.WriteString(s)
         } else {
-                z.w.WriteString("[UNKN ]")
+                z.w.WriteString("[?????]")
         }
 
         if z.caller {
@@ -174,7 +191,10 @@ func (z *intLogger) log(t time.Time, level Level, msg string, args ...interface{
 
         FOR:
                 for i := 0; i < len(args); i = i + 2 {
-                        var val string
+                        var (
+                                val string
+                                raw bool
+                        )
 
                         switch st := args[i+1].(type) {
                         case string:
@@ -202,15 +222,23 @@ func (z *intLogger) log(t time.Time, level Level, msg string, args ...interface{
                         case CapturedStacktrace:
                                 stacktrace = st
                                 continue FOR
+                        case Format:
+                                val = fmt.Sprintf(st[0].(string), st[1:]...)
                         default:
-                                val = fmt.Sprintf("%v", st)
+                                v := reflect.ValueOf(st)
+                                if v.Kind() == reflect.Slice {
+                                        val = z.renderSlice(v)
+                                        raw = true
+                                } else {
+                                        val = fmt.Sprintf("%v", st)
+                                }
                         }
 
                         z.w.WriteByte(' ')
                         z.w.WriteString(args[i].(string))
                         z.w.WriteByte('=')
 
-                        if strings.ContainsAny(val, " \t\n\r") {
+                        if !raw && strings.ContainsAny(val, " \t\n\r") {
                                 z.w.WriteByte('"')
                                 z.w.WriteString(val)
                                 z.w.WriteByte('"')
@@ -227,6 +255,45 @@ func (z *intLogger) log(t time.Time, level Level, msg string, args ...interface{
         }
 }
 
+func (z *intLogger) renderSlice(v reflect.Value) string {
+        var buf bytes.Buffer
+
+        buf.WriteRune('[')
+
+        for i := 0; i < v.Len(); i++ {
+                if i > 0 {
+                        buf.WriteString(", ")
+                }
+
+                sv := v.Index(i)
+
+                var val string
+
+                switch sv.Kind() {
+                case reflect.String:
+                        val = sv.String()
+                case reflect.Int, reflect.Int16, reflect.Int32, reflect.Int64:
+                        val = strconv.FormatInt(sv.Int(), 10)
+                case reflect.Uint, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+                        val = strconv.FormatUint(sv.Uint(), 10)
+                default:
+                        val = fmt.Sprintf("%v", sv.Interface())
+                }
+
+                if strings.ContainsAny(val, " \t\n\r") {
+                        buf.WriteByte('"')
+                        buf.WriteString(val)
+                        buf.WriteByte('"')
+                } else {
+                        buf.WriteString(val)
+                }
+        }
+
+        buf.WriteRune(']')
+
+        return buf.String()
+}
+
 // JSON logging function
 func (z *intLogger) logJson(t time.Time, level Level, msg string, args ...interface{}) {
         vals := map[string]interface{}{
@@ -262,6 +329,8 @@ func (z *intLogger) logJson(t time.Time, level Level, msg string, args ...interf
                 }
         }
 
+        args = append(z.implied, args...)
+
         if args != nil && len(args) > 0 {
                 if len(args)%2 != 0 {
                         cs, ok := args[len(args)-1].(CapturedStacktrace)
@@ -279,7 +348,22 @@ func (z *intLogger) logJson(t time.Time, level Level, msg string, args ...interf
                                 // without injecting into logs...
                                 continue
                         }
-                        vals[args[i].(string)] = args[i+1]
+                        val := args[i+1]
+                        switch sv := val.(type) {
+                        case error:
+                                // Check if val is of type error. If error type doesn't
+                                // implement json.Marshaler or encoding.TextMarshaler
+                                // then set val to err.Error() so that it gets marshaled
+                                switch sv.(type) {
+                                case json.Marshaler, encoding.TextMarshaler:
+                                default:
+                                        val = sv.Error()
+                                }
+                        case Format:
+                                val = fmt.Sprintf(sv[0].(string), sv[1:]...)
+                        }
+
+                        vals[args[i].(string)] = val
                 }
         }
 
@@ -316,36 +400,66 @@ func (z *intLogger) Error(msg string, args ...interface{}) {
 
 // Indicate that the logger would emit TRACE level logs
 func (z *intLogger) IsTrace() bool {
-        return z.level == Trace
+        return Level(atomic.LoadInt32(z.level)) == Trace
 }
 
 // Indicate that the logger would emit DEBUG level logs
 func (z *intLogger) IsDebug() bool {
-        return z.level <= Debug
+        return Level(atomic.LoadInt32(z.level)) <= Debug
 }
 
 // Indicate that the logger would emit INFO level logs
 func (z *intLogger) IsInfo() bool {
-        return z.level <= Info
+        return Level(atomic.LoadInt32(z.level)) <= Info
 }
 
 // Indicate that the logger would emit WARN level logs
 func (z *intLogger) IsWarn() bool {
-        return z.level <= Warn
+        return Level(atomic.LoadInt32(z.level)) <= Warn
 }
 
 // Indicate that the logger would emit ERROR level logs
 func (z *intLogger) IsError() bool {
-        return z.level <= Error
+        return Level(atomic.LoadInt32(z.level)) <= Error
 }
 
 // Return a sub-Logger for which every emitted log message will contain
 // the given key/value pairs. This is used to create a context specific
 // Logger.
 func (z *intLogger) With(args ...interface{}) Logger {
+        if len(args)%2 != 0 {
+                panic("With() call requires paired arguments")
+        }
+
         var nz intLogger = *z
 
-        nz.implied = append(nz.implied, args...)
+        result := make(map[string]interface{}, len(z.implied)+len(args))
+        keys := make([]string, 0, len(z.implied)+len(args))
+
+        // Read existing args, store map and key for consistent sorting
+        for i := 0; i < len(z.implied); i += 2 {
+                key := z.implied[i].(string)
+                keys = append(keys, key)
+                result[key] = z.implied[i+1]
+        }
+        // Read new args, store map and key for consistent sorting
+        for i := 0; i < len(args); i += 2 {
+                key := args[i].(string)
+                _, exists := result[key]
+                if !exists {
+                        keys = append(keys, key)
+                }
+                result[key] = args[i+1]
+        }
+
+        // Sort keys to be consistent
+        sort.Strings(keys)
+
+        nz.implied = make([]interface{}, 0, len(z.implied)+len(args))
+        for _, k := range keys {
+                nz.implied = append(nz.implied, k)
+                nz.implied = append(nz.implied, result[k])
+        }
 
         return &nz
 }
@@ -357,6 +471,8 @@ func (z *intLogger) Named(name string) Logger {
 
         if nz.name != "" {
                 nz.name = nz.name + "." + name
+        } else {
+                nz.name = name
         }
 
         return &nz
@@ -373,6 +489,12 @@ func (z *intLogger) ResetNamed(name string) Logger {
         return &nz
 }
 
+// Update the logging level on-the-fly. This will affect all subloggers as
+// well.
+func (z *intLogger) SetLevel(level Level) {
+        atomic.StoreInt32(z.level, int32(level))
+}
+
 // Create a *log.Logger that will send it's data through this Logger. This
 // allows packages that expect to be using the standard library log to actually
 // use this logger.
diff --git a/vendor/github.com/hashicorp/go-hclog/log.go b/vendor/github.com/hashicorp/go-hclog/log.go
index 6bb16ba..d98714e 100644
--- a/vendor/github.com/hashicorp/go-hclog/log.go
+++ b/vendor/github.com/hashicorp/go-hclog/log.go
@@ -5,6 +5,7 @@ import (
         "log"
         "os"
         "strings"
+        "sync"
 )
 
 var (
@@ -12,7 +13,7 @@ var (
         DefaultLevel  = Info
 )
 
-type Level int
+type Level int32
 
 const (
         // This is a special level used to indicate that no level has been
@@ -36,6 +37,18 @@ const (
         Error Level = 5
 )
 
+// When processing a value of this type, the logger automatically treats the first
+// argument as a Printf formatting string and passes the rest as the values to be
+// formatted. For example: L.Info(Fmt{"%d beans/day", beans}). This is a simple
+// convience type for when formatting is required.
+type Format []interface{}
+
+// Fmt returns a Format type. This is a convience function for creating a Format
+// type.
+func Fmt(str string, args ...interface{}) Format {
+        return append(Format{str}, args...)
+}
+
 // LevelFromString returns a Level type for the named log level, or "NoLevel" if
 // the level string is invalid. This facilitates setting the log level via
 // config or environment variable by name in a predictable way.
@@ -108,6 +121,10 @@ type Logger interface {
         // the current name as well.
         ResetNamed(name string) Logger
 
+        // Updates the level. This should affect all sub-loggers as well. If an
+        // implementation cannot update the level on the fly, it should no-op.
+        SetLevel(level Level)
+
         // Return a value that conforms to the stdlib log.Logger interface
         StandardLogger(opts *StandardLoggerOptions) *log.Logger
 }
@@ -127,12 +144,18 @@ type LoggerOptions struct {
         // The threshold for the logger. Anything less severe is supressed
         Level Level
 
-        // Where to write the logs to. Defaults to os.Stdout if nil
+        // Where to write the logs to. Defaults to os.Stderr if nil
         Output io.Writer
 
+        // An optional mutex pointer in case Output is shared
+        Mutex *sync.Mutex
+
         // Control if the output should be in JSON.
         JSONFormat bool
 
-        // Intclude file and line information in each log line
+        // Include file and line information in each log line
         IncludeLocation bool
+
+        // The time format to use instead of the default
+        TimeFormat string
 }
diff --git a/vendor/github.com/hashicorp/go-hclog/nulllogger.go b/vendor/github.com/hashicorp/go-hclog/nulllogger.go
new file mode 100644
index 0000000..0942361
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-hclog/nulllogger.go
@@ -0,0 +1,47 @@
+package hclog
+
+import (
+        "io/ioutil"
+        "log"
+)
+
+// NewNullLogger instantiates a Logger for which all calls
+// will succeed without doing anything.
+// Useful for testing purposes.
+func NewNullLogger() Logger {
+        return &nullLogger{}
+}
+
+type nullLogger struct{}
+
+func (l *nullLogger) Trace(msg string, args ...interface{}) {}
+
+func (l *nullLogger) Debug(msg string, args ...interface{}) {}
+
+func (l *nullLogger) Info(msg string, args ...interface{}) {}
+
+func (l *nullLogger) Warn(msg string, args ...interface{}) {}
+
+func (l *nullLogger) Error(msg string, args ...interface{}) {}
+
+func (l *nullLogger) IsTrace() bool { return false }
+
+func (l *nullLogger) IsDebug() bool { return false }
+
+func (l *nullLogger) IsInfo() bool { return false }
+
+func (l *nullLogger) IsWarn() bool { return false }
+
+func (l *nullLogger) IsError() bool { return false }
+
+func (l *nullLogger) With(args ...interface{}) Logger { return l }
+
+func (l *nullLogger) Named(name string) Logger { return l }
+
+func (l *nullLogger) ResetNamed(name string) Logger { return l }
+
+func (l *nullLogger) SetLevel(level Level) {}
+
+func (l *nullLogger) StandardLogger(opts *StandardLoggerOptions) *log.Logger {
+        return log.New(ioutil.Discard, "", log.LstdFlags)
+}
diff --git a/vendor/github.com/hashicorp/go-multierror/.travis.yml b/vendor/github.com/hashicorp/go-multierror/.travis.yml
new file mode 100644
index 0000000..304a835
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-multierror/.travis.yml
@@ -0,0 +1,12 @@
+sudo: false
+
+language: go
+
+go:
+  - 1.x
+
+branches:
+  only:
+    - master
+
+script: make test testrace
diff --git a/vendor/github.com/hashicorp/go-multierror/Makefile b/vendor/github.com/hashicorp/go-multierror/Makefile
new file mode 100644
index 0000000..b97cd6e
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-multierror/Makefile
@@ -0,0 +1,31 @@
+TEST?=./...
+
+default: test
+
+# test runs the test suite and vets the code.
+test: generate
+        @echo "==> Running tests..."
+        @go list $(TEST) \
+                | grep -v "/vendor/" \
+                | xargs -n1 go test -timeout=60s -parallel=10 ${TESTARGS}
+
+# testrace runs the race checker
+testrace: generate
+        @echo "==> Running tests (race)..."
+        @go list $(TEST) \
+                | grep -v "/vendor/" \
+                | xargs -n1 go test -timeout=60s -race ${TESTARGS}
+
+# updatedeps installs all the dependencies needed to run and build.
+updatedeps:
+        @sh -c "'${CURDIR}/scripts/deps.sh' '${NAME}'"
+
+# generate runs `go generate` to build the dynamically generated source files.
+generate:
+        @echo "==> Generating..."
+        @find . -type f -name '.DS_Store' -delete
+        @go list ./... \
+                | grep -v "/vendor/" \
+                | xargs -n1 go generate
+
+.PHONY: default test testrace updatedeps generate
diff --git a/vendor/github.com/hashicorp/go-multierror/README.md b/vendor/github.com/hashicorp/go-multierror/README.md
index e81be50..ead5830 100644
--- a/vendor/github.com/hashicorp/go-multierror/README.md
+++ b/vendor/github.com/hashicorp/go-multierror/README.md
@@ -1,5 +1,11 @@
 # go-multierror
 
+[![Build Status](http://img.shields.io/travis/hashicorp/go-multierror.svg?style=flat-square)][travis]
+[![Go Documentation](http://img.shields.io/badge/go-documentation-blue.svg?style=flat-square)][godocs]
+
+[travis]: https://travis-ci.org/hashicorp/go-multierror
+[godocs]: https://godoc.org/github.com/hashicorp/go-multierror
+
 `go-multierror` is a package for Go that provides a mechanism for
 representing a list of `error` values as a single `error`.
 
diff --git a/vendor/github.com/hashicorp/go-multierror/append.go b/vendor/github.com/hashicorp/go-multierror/append.go
index 00afa9b..775b6e7 100644
--- a/vendor/github.com/hashicorp/go-multierror/append.go
+++ b/vendor/github.com/hashicorp/go-multierror/append.go
@@ -18,9 +18,13 @@ func Append(err error, errs ...error) *Error {
                 for _, e := range errs {
                         switch e := e.(type) {
                         case *Error:
-                                err.Errors = append(err.Errors, e.Errors...)
+                                if e != nil {
+                                        err.Errors = append(err.Errors, e.Errors...)
+                                }
                         default:
-                                err.Errors = append(err.Errors, e)
+                                if e != nil {
+                                        err.Errors = append(err.Errors, e)
+                                }
                         }
                 }
 
diff --git a/vendor/github.com/hashicorp/go-multierror/format.go b/vendor/github.com/hashicorp/go-multierror/format.go
index bb65a12..47f13c4 100644
--- a/vendor/github.com/hashicorp/go-multierror/format.go
+++ b/vendor/github.com/hashicorp/go-multierror/format.go
@@ -12,12 +12,16 @@ type ErrorFormatFunc func([]error) string
 // ListFormatFunc is a basic formatter that outputs the number of errors
 // that occurred along with a bullet point list of the errors.
 func ListFormatFunc(es []error) string {
+        if len(es) == 1 {
+                return fmt.Sprintf("1 error occurred:\n\t* %s\n\n", es[0])
+        }
+
         points := make([]string, len(es))
         for i, err := range es {
                 points[i] = fmt.Sprintf("* %s", err)
         }
 
         return fmt.Sprintf(
-                "%d error(s) occurred:\n\n%s",
-                len(es), strings.Join(points, "\n"))
+                "%d errors occurred:\n\t%s\n\n",
+                len(es), strings.Join(points, "\n\t"))
 }
diff --git a/vendor/github.com/hashicorp/go-multierror/go.mod b/vendor/github.com/hashicorp/go-multierror/go.mod
new file mode 100644
index 0000000..2534331
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-multierror/go.mod
@@ -0,0 +1,3 @@
+module github.com/hashicorp/go-multierror
+
+require github.com/hashicorp/errwrap v1.0.0
diff --git a/vendor/github.com/hashicorp/go-multierror/go.sum b/vendor/github.com/hashicorp/go-multierror/go.sum
new file mode 100644
index 0000000..85b1f8f
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-multierror/go.sum
@@ -0,0 +1,4 @@
+github.com/hashicorp/errwrap v0.0.0-20141028054710-7554cd9344ce h1:prjrVgOk2Yg6w+PflHoszQNLTUh4kaByUcEWM/9uin4=
+github.com/hashicorp/errwrap v0.0.0-20141028054710-7554cd9344ce/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
diff --git a/vendor/github.com/hashicorp/go-multierror/multierror.go b/vendor/github.com/hashicorp/go-multierror/multierror.go
index 2ea0827..89b1422 100644
--- a/vendor/github.com/hashicorp/go-multierror/multierror.go
+++ b/vendor/github.com/hashicorp/go-multierror/multierror.go
@@ -40,11 +40,11 @@ func (e *Error) GoString() string {
 }
 
 // WrappedErrors returns the list of errors that this Error is wrapping.
-// It is an implementatin of the errwrap.Wrapper interface so that
+// It is an implementation of the errwrap.Wrapper interface so that
 // multierror.Error can be used with that library.
 //
 // This method is not safe to be called concurrently and is no different
-// than accessing the Errors field directly. It is implementd only to
+// than accessing the Errors field directly. It is implemented only to
 // satisfy the errwrap.Wrapper interface.
 func (e *Error) WrappedErrors() []error {
         return e.Errors
diff --git a/vendor/github.com/hashicorp/go-multierror/sort.go b/vendor/github.com/hashicorp/go-multierror/sort.go
new file mode 100644
index 0000000..fecb14e
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-multierror/sort.go
@@ -0,0 +1,16 @@
+package multierror
+
+// Len implements sort.Interface function for length
+func (err Error) Len() int {
+        return len(err.Errors)
+}
+
+// Swap implements sort.Interface function for swapping elements
+func (err Error) Swap(i, j int) {
+        err.Errors[i], err.Errors[j] = err.Errors[j], err.Errors[i]
+}
+
+// Less implements sort.Interface function for determining order
+func (err Error) Less(i, j int) bool {
+        return err.Errors[i].Error() < err.Errors[j].Error()
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/README.md b/vendor/github.com/hashicorp/go-plugin/README.md
index e4558db..fe305ad 100644
--- a/vendor/github.com/hashicorp/go-plugin/README.md
+++ b/vendor/github.com/hashicorp/go-plugin/README.md
@@ -109,7 +109,7 @@ high-level steps that must be done. Examples are available in the
   1. Choose the interface(s) you want to expose for plugins.
 
   2. For each interface, implement an implementation of that interface
-     that communicates over a `net/rpc` connection or other a
+     that communicates over a `net/rpc` connection or over a
      [gRPC](http://www.grpc.io) connection or both. You'll have to implement
      both a client and server implementation.
 
@@ -150,19 +150,19 @@ user experience.
 
 When we started using plugins (late 2012, early 2013), plugins over RPC
 were the only option since Go didn't support dynamic library loading. Today,
-Go still doesn't support dynamic library loading, but they do intend to.
-Since 2012, our plugin system has stabilized from millions of users using it,
-and has many benefits we've come to value greatly.
-
-For example, we intend to use this plugin system in
-[Vault](https://www.vaultproject.io), and dynamic library loading will
-simply never be acceptable in Vault for security reasons. That is an extreme
+Go supports the [plugin](https://golang.org/pkg/plugin/) standard library with
+a number of  limitations. Since 2012, our plugin system has stabilized 
+from tens of millions of users using it, and has many benefits we've come to 
+value greatly.
+
+For example, we use this plugin system in
+[Vault](https://www.vaultproject.io) where dynamic library loading is
+not acceptable for security reasons. That is an extreme
 example, but we believe our library system has more upsides than downsides
 over dynamic library loading and since we've had it built and tested for years,
-we'll likely continue to use it.
+we'll continue to use it.
 
 Shared libraries have one major advantage over our system which is much
 higher performance. In real world scenarios across our various tools,
 we've never required any more performance out of our plugin system and it
 has seen very high throughput, so this isn't a concern for us at the moment.
-
diff --git a/vendor/github.com/hashicorp/go-plugin/client.go b/vendor/github.com/hashicorp/go-plugin/client.go
index b3e3b78..679e10a 100644
--- a/vendor/github.com/hashicorp/go-plugin/client.go
+++ b/vendor/github.com/hashicorp/go-plugin/client.go
@@ -5,12 +5,13 @@ import (
         "context"
         "crypto/subtle"
         "crypto/tls"
+        "crypto/x509"
+        "encoding/base64"
         "errors"
         "fmt"
         "hash"
         "io"
         "io/ioutil"
-        "log"
         "net"
         "os"
         "os/exec"
@@ -20,7 +21,6 @@ import (
         "sync"
         "sync/atomic"
         "time"
-        "unicode"
 
         hclog "github.com/hashicorp/go-hclog"
 )
@@ -71,16 +71,31 @@ var (
 //
 // See NewClient and ClientConfig for using a Client.
 type Client struct {
-        config      *ClientConfig
-        exited      bool
-        doneLogging chan struct{}
-        l           sync.Mutex
-        address     net.Addr
-        process     *os.Process
-        client      ClientProtocol
-        protocol    Protocol
-        logger      hclog.Logger
-        doneCtx     context.Context
+        config            *ClientConfig
+        exited            bool
+        l                 sync.Mutex
+        address           net.Addr
+        process           *os.Process
+        client            ClientProtocol
+        protocol          Protocol
+        logger            hclog.Logger
+        doneCtx           context.Context
+        ctxCancel         context.CancelFunc
+        negotiatedVersion int
+
+        // clientWaitGroup is used to manage the lifecycle of the plugin management
+        // goroutines.
+        clientWaitGroup sync.WaitGroup
+
+        // processKilled is used for testing only, to flag when the process was
+        // forcefully killed.
+        processKilled bool
+}
+
+// NegotiatedVersion returns the protocol version negotiated with the server.
+// This is only valid after Start() is called.
+func (c *Client) NegotiatedVersion() int {
+        return c.negotiatedVersion
 }
 
 // ClientConfig is the configuration used to initialize a new
@@ -91,7 +106,13 @@ type ClientConfig struct {
         HandshakeConfig
 
         // Plugins are the plugins that can be consumed.
-        Plugins map[string]Plugin
+        // The implied version of this PluginSet is the Handshake.ProtocolVersion.
+        Plugins PluginSet
+
+        // VersionedPlugins is a map of PluginSets for specific protocol versions.
+        // These can be used to negotiate a compatible version between client and
+        // server. If this is set, Handshake.ProtocolVersion is not required.
+        VersionedPlugins map[int]PluginSet
 
         // One of the following must be set, but not both.
         //
@@ -158,6 +179,29 @@ type ClientConfig struct {
         // Logger is the logger that the client will used. If none is provided,
         // it will default to hclog's default logger.
         Logger hclog.Logger
+
+        // AutoMTLS has the client and server automatically negotiate mTLS for
+        // transport authentication. This ensures that only the original client will
+        // be allowed to connect to the server, and all other connections will be
+        // rejected. The client will also refuse to connect to any server that isn't
+        // the original instance started by the client.
+        //
+        // In this mode of operation, the client generates a one-time use tls
+        // certificate, sends the public x.509 certificate to the new server, and
+        // the server generates a one-time use tls certificate, and sends the public
+        // x.509 certificate back to the client. These are used to authenticate all
+        // rpc connections between the client and server.
+        //
+        // Setting AutoMTLS to true implies that the server must support the
+        // protocol, and correctly negotiate the tls certificates, or a connection
+        // failure will result.
+        //
+        // The client should not set TLSConfig, nor should the server set a
+        // TLSProvider, because AutoMTLS implies that a new certificate and tls
+        // configuration will be generated at startup.
+        //
+        // You cannot Reattach to a server with this option enabled.
+        AutoMTLS bool
 }
 
 // ReattachConfig is used to configure a client to reattach to an
@@ -234,7 +278,6 @@ func CleanupClients() {
         }
         managedClientsLock.Unlock()
 
-        log.Println("[DEBUG] plugin: waiting for all plugin processes to complete...")
         wg.Wait()
 }
 
@@ -333,6 +376,14 @@ func (c *Client) Exited() bool {
         return c.exited
 }
 
+// killed is used in tests to check if a process failed to exit gracefully, and
+// needed to be killed.
+func (c *Client) killed() bool {
+        c.l.Lock()
+        defer c.l.Unlock()
+        return c.processKilled
+}
+
 // End the executing subprocess (if it is running) and perform any cleanup
 // tasks necessary such as capturing any remaining logs and so on.
 //
@@ -344,14 +395,24 @@ func (c *Client) Kill() {
         c.l.Lock()
         process := c.process
         addr := c.address
-        doneCh := c.doneLogging
         c.l.Unlock()
 
-        // If there is no process, we never started anything. Nothing to kill.
+        // If there is no process, there is nothing to kill.
         if process == nil {
                 return
         }
 
+        defer func() {
+                // Wait for the all client goroutines to finish.
+                c.clientWaitGroup.Wait()
+
+                // Make sure there is no reference to the old process after it has been
+                // killed.
+                c.l.Lock()
+                c.process = nil
+                c.l.Unlock()
+        }()
+
         // We need to check for address here. It is possible that the plugin
         // started (process != nil) but has no address (addr == nil) if the
         // plugin failed at startup. If we do have an address, we need to close
@@ -372,6 +433,8 @@ func (c *Client) Kill() {
                                 // kill in a moment anyways.
                                 c.logger.Warn("error closing client during Kill", "err", err)
                         }
+                } else {
+                        c.logger.Error("client", "error", err)
                 }
         }
 
@@ -380,17 +443,20 @@ func (c *Client) Kill() {
         // doneCh which would be closed if the process exits.
         if graceful {
                 select {
-                case <-doneCh:
+                case <-c.doneCtx.Done():
+                        c.logger.Debug("plugin exited")
                         return
-                case <-time.After(250 * time.Millisecond):
+                case <-time.After(2 * time.Second):
                 }
         }
 
         // If graceful exiting failed, just kill it
+        c.logger.Warn("plugin failed to exit gracefully")
         process.Kill()
 
-        // Wait for the client to finish logging so we have a complete log
-        <-doneCh
+        c.l.Lock()
+        c.processKilled = true
+        c.l.Unlock()
 }
 
 // Starts the underlying subprocess, communicating with it to negotiate
@@ -409,7 +475,7 @@ func (c *Client) Start() (addr net.Addr, err error) {
 
         // If one of cmd or reattach isn't set, then it is an error. We wrap
         // this in a {} for scoping reasons, and hopeful that the escape
-        // analysis will pop the stock here.
+        // analysis will pop the stack here.
         {
                 cmdSet := c.config.Cmd != nil
                 attachSet := c.config.Reattach != nil
@@ -423,77 +489,49 @@ func (c *Client) Start() (addr net.Addr, err error) {
                 }
         }
 
-        // Create the logging channel for when we kill
-        c.doneLogging = make(chan struct{})
-        // Create a context for when we kill
-        var ctxCancel context.CancelFunc
-        c.doneCtx, ctxCancel = context.WithCancel(context.Background())
-
         if c.config.Reattach != nil {
-                // Verify the process still exists. If not, then it is an error
-                p, err := os.FindProcess(c.config.Reattach.Pid)
-                if err != nil {
-                        return nil, err
-                }
+                return c.reattach()
+        }
 
-                // Attempt to connect to the addr since on Unix systems FindProcess
-                // doesn't actually return an error if it can't find the process.
-                conn, err := net.Dial(
-                        c.config.Reattach.Addr.Network(),
-                        c.config.Reattach.Addr.String())
-                if err != nil {
-                        p.Kill()
-                        return nil, ErrProcessNotFound
-                }
-                conn.Close()
-
-                // Goroutine to mark exit status
-                go func(pid int) {
-                        // Wait for the process to die
-                        pidWait(pid)
-
-                        // Log so we can see it
-                        c.logger.Debug("reattached plugin process exited")
-
-                        // Mark it
-                        c.l.Lock()
-                        defer c.l.Unlock()
-                        c.exited = true
-
-                        // Close the logging channel since that doesn't work on reattach
-                        close(c.doneLogging)
-
-                        // Cancel the context
-                        ctxCancel()
-                }(p.Pid)
-
-                // Set the address and process
-                c.address = c.config.Reattach.Addr
-                c.process = p
-                c.protocol = c.config.Reattach.Protocol
-                if c.protocol == "" {
-                        // Default the protocol to net/rpc for backwards compatibility
-                        c.protocol = ProtocolNetRPC
-                }
+        if c.config.VersionedPlugins == nil {
+                c.config.VersionedPlugins = make(map[int]PluginSet)
+        }
 
-                return c.address, nil
+        // handle all plugins as versioned, using the handshake config as the default.
+        version := int(c.config.ProtocolVersion)
+
+        // Make sure we're not overwriting a real version 0. If ProtocolVersion was
+        // non-zero, then we have to just assume the user made sure that
+        // VersionedPlugins doesn't conflict.
+        if _, ok := c.config.VersionedPlugins[version]; !ok && c.config.Plugins != nil {
+                c.config.VersionedPlugins[version] = c.config.Plugins
+        }
+
+        var versionStrings []string
+        for v := range c.config.VersionedPlugins {
+                versionStrings = append(versionStrings, strconv.Itoa(v))
         }
 
         env := []string{
                 fmt.Sprintf("%s=%s", c.config.MagicCookieKey, c.config.MagicCookieValue),
                 fmt.Sprintf("PLUGIN_MIN_PORT=%d", c.config.MinPort),
                 fmt.Sprintf("PLUGIN_MAX_PORT=%d", c.config.MaxPort),
+                fmt.Sprintf("PLUGIN_PROTOCOL_VERSIONS=%s", strings.Join(versionStrings, ",")),
         }
 
-        stdout_r, stdout_w := io.Pipe()
-        stderr_r, stderr_w := io.Pipe()
-
         cmd := c.config.Cmd
         cmd.Env = append(cmd.Env, os.Environ()...)
         cmd.Env = append(cmd.Env, env...)
         cmd.Stdin = os.Stdin
-        cmd.Stderr = stderr_w
-        cmd.Stdout = stdout_w
+
+        cmdStdout, err := cmd.StdoutPipe()
+        if err != nil {
+                return nil, err
+        }
+        cmdStderr, err := cmd.StderrPipe()
+        if err != nil {
+                return nil, err
+        }
 
         if c.config.SecureConfig != nil {
                 if ok, err := c.config.SecureConfig.Check(cmd.Path); err != nil {
@@ -503,6 +541,29 @@ func (c *Client) Start() (addr net.Addr, err error) {
                 }
         }
 
+        // Setup a temporary certificate for client/server mtls, and send the public
+        // certificate to the plugin.
+        if c.config.AutoMTLS {
+                c.logger.Info("configuring client automatic mTLS")
+                certPEM, keyPEM, err := generateCert()
+                if err != nil {
+                        c.logger.Error("failed to generate client certificate", "error", err)
+                        return nil, err
+                }
+                cert, err := tls.X509KeyPair(certPEM, keyPEM)
+                if err != nil {
+                        c.logger.Error("failed to parse client certificate", "error", err)
+                        return nil, err
+                }
+
+                cmd.Env = append(cmd.Env, fmt.Sprintf("PLUGIN_CLIENT_CERT=%s", certPEM))
+
+                c.config.TLSConfig = &tls.Config{
+                        Certificates: []tls.Certificate{cert},
+                        ServerName:   "localhost",
+                }
+        }
+
         c.logger.Debug("starting plugin", "path", cmd.Path, "args", cmd.Args)
         err = cmd.Start()
         if err != nil {
@@ -511,6 +572,7 @@ func (c *Client) Start() (addr net.Addr, err error) {
 
         // Set the process
         c.process = cmd.Process
+        c.logger.Debug("plugin started", "path", cmd.Path, "pid", c.process.Pid)
 
         // Make sure the command is properly cleaned up if there is an error
         defer func() {
@@ -525,27 +587,37 @@ func (c *Client) Start() (addr net.Addr, err error) {
                 }
         }()
 
-        // Start goroutine to wait for process to exit
-        exitCh := make(chan struct{})
+        // Create a context for when we kill
+        c.doneCtx, c.ctxCancel = context.WithCancel(context.Background())
+
+        c.clientWaitGroup.Add(1)
         go func() {
-                // Make sure we close the write end of our stderr/stdout so
-                // that the readers send EOF properly.
-                defer stderr_w.Close()
-                defer stdout_w.Close()
+                // ensure the context is cancelled when we're done
+                defer c.ctxCancel()
+
+                defer c.clientWaitGroup.Done()
+
+                // get the cmd info early, since the process information will be removed
+                // in Kill.
+                pid := c.process.Pid
+                path := cmd.Path
 
                 // Wait for the command to end.
-                cmd.Wait()
+                err := cmd.Wait()
+
+                debugMsgArgs := []interface{}{
+                        "path", path,
+                        "pid", pid,
+                }
+                if err != nil {
+                        debugMsgArgs = append(debugMsgArgs,
+                                []interface{}{"error", err.Error()}...)
+                }
 
                 // Log and make sure to flush the logs write away
-                c.logger.Debug("plugin process exited", "path", cmd.Path)
+                c.logger.Debug("plugin process exited", debugMsgArgs...)
                 os.Stderr.Sync()
 
-                // Mark that we exited
-                close(exitCh)
-
-                // Cancel the context, marking that we exited
-                ctxCancel()
-
                 // Set that we exited, which takes a lock
                 c.l.Lock()
                 defer c.l.Unlock()
@@ -553,32 +625,33 @@ func (c *Client) Start() (addr net.Addr, err error) {
         }()
 
         // Start goroutine that logs the stderr
-        go c.logStderr(stderr_r)
+        c.clientWaitGroup.Add(1)
+        // logStderr calls Done()
+        go c.logStderr(cmdStderr)
 
         // Start a goroutine that is going to be reading the lines
         // out of stdout
-        linesCh := make(chan []byte)
+        linesCh := make(chan string)
+        c.clientWaitGroup.Add(1)
         go func() {
+                defer c.clientWaitGroup.Done()
                 defer close(linesCh)
 
-                buf := bufio.NewReader(stdout_r)
-                for {
-                        line, err := buf.ReadBytes('\n')
-                        if line != nil {
-                                linesCh <- line
-                        }
-
-                        if err == io.EOF {
-                                return
-                        }
+                scanner := bufio.NewScanner(cmdStdout)
+                for scanner.Scan() {
+                        linesCh <- scanner.Text()
                 }
         }()
 
         // Make sure after we exit we read the lines from stdout forever
-        // so they don't block since it is an io.Pipe
+        // so they don't block since it is a pipe.
+        // The scanner goroutine above will close this, but track it with a wait
+        // group for completeness.
+        c.clientWaitGroup.Add(1)
         defer func() {
                 go func() {
-                        for _ = range linesCh {
+                        defer c.clientWaitGroup.Done()
+                        for range linesCh {
                         }
                 }()
         }()
@@ -591,12 +664,12 @@ func (c *Client) Start() (addr net.Addr, err error) {
         select {
         case <-timeout:
                 err = errors.New("timeout while waiting for plugin to start")
-        case <-exitCh:
+        case <-c.doneCtx.Done():
                 err = errors.New("plugin exited before we could connect")
-        case lineBytes := <-linesCh:
+        case line := <-linesCh:
                 // Trim the line and split by "|" in order to get the parts of
                 // the output.
-                line := strings.TrimSpace(string(lineBytes))
+                line = strings.TrimSpace(line)
                 parts := strings.SplitN(line, "|", 6)
                 if len(parts) < 4 {
                         err = fmt.Errorf(
@@ -624,20 +697,18 @@ func (c *Client) Start() (addr net.Addr, err error) {
                         }
                 }
 
-                // Parse the protocol version
-                var protocol int64
-                protocol, err = strconv.ParseInt(parts[1], 10, 0)
+                // Test the API version
+                version, pluginSet, err := c.checkProtoVersion(parts[1])
                 if err != nil {
-                        err = fmt.Errorf("Error parsing protocol version: %s", err)
-                        return
+                        return addr, err
                 }
 
-                // Test the API version
-                if uint(protocol) != c.config.ProtocolVersion {
-                        err = fmt.Errorf("Incompatible API version with plugin. "+
-                                "Plugin version: %s, Core version: %d", parts[1], c.config.ProtocolVersion)
-                        return
-                }
+                // set the Plugins value to the compatible set, so the version
+                // doesn't need to be passed through to the ClientProtocol
+                // implementation.
+                c.config.Plugins = pluginSet
+                c.negotiatedVersion = version
+                c.logger.Debug("using plugin", "version", version)
 
                 switch parts[2] {
                 case "tcp":
@@ -665,15 +736,125 @@ func (c *Client) Start() (addr net.Addr, err error) {
                 if !found {
                         err = fmt.Errorf("Unsupported plugin protocol %q. Supported: %v",
                                 c.protocol, c.config.AllowedProtocols)
-                        return
+                        return addr, err
                 }
 
+                // See if we have a TLS certificate from the server.
+                // Checking if the length is > 50 rules out catching the unused "extra"
+                // data returned from some older implementations.
+                if len(parts) >= 6 && len(parts[5]) > 50 {
+                        err := c.loadServerCert(parts[5])
+                        if err != nil {
+                                return nil, fmt.Errorf("error parsing server cert: %s", err)
+                        }
+                }
         }
 
         c.address = addr
         return
 }
 
+// loadServerCert is used by AutoMTLS to read an x.509 cert returned by the
+// server, and load it as the RootCA for the client TLSConfig.
+func (c *Client) loadServerCert(cert string) error {
+        certPool := x509.NewCertPool()
+
+        asn1, err := base64.RawStdEncoding.DecodeString(cert)
+        if err != nil {
+                return err
+        }
+
+        x509Cert, err := x509.ParseCertificate([]byte(asn1))
+        if err != nil {
+                return err
+        }
+
+        certPool.AddCert(x509Cert)
+
+        c.config.TLSConfig.RootCAs = certPool
+        return nil
+}
+
+func (c *Client) reattach() (net.Addr, error) {
+        // Verify the process still exists. If not, then it is an error
+        p, err := os.FindProcess(c.config.Reattach.Pid)
+        if err != nil {
+                return nil, err
+        }
+
+        // Attempt to connect to the addr since on Unix systems FindProcess
+        // doesn't actually return an error if it can't find the process.
+        conn, err := net.Dial(
+                c.config.Reattach.Addr.Network(),
+                c.config.Reattach.Addr.String())
+        if err != nil {
+                p.Kill()
+                return nil, ErrProcessNotFound
+        }
+        conn.Close()
+
+        // Create a context for when we kill
+        c.doneCtx, c.ctxCancel = context.WithCancel(context.Background())
+
+        c.clientWaitGroup.Add(1)
+        // Goroutine to mark exit status
+        go func(pid int) {
+                defer c.clientWaitGroup.Done()
+
+                // ensure the context is cancelled when we're done
+                defer c.ctxCancel()
+
+                // Wait for the process to die
+                pidWait(pid)
+
+                // Log so we can see it
+                c.logger.Debug("reattached plugin process exited")
+
+                // Mark it
+                c.l.Lock()
+                defer c.l.Unlock()
+                c.exited = true
+        }(p.Pid)
+
+        // Set the address and process
+        c.address = c.config.Reattach.Addr
+        c.process = p
+        c.protocol = c.config.Reattach.Protocol
+        if c.protocol == "" {
+                // Default the protocol to net/rpc for backwards compatibility
+                c.protocol = ProtocolNetRPC
+        }
+
+        return c.address, nil
+}
+
+// checkProtoVersion returns the negotiated version and PluginSet.
+// This returns an error if the server returned an incompatible protocol
+// version, or an invalid handshake response.
+func (c *Client) checkProtoVersion(protoVersion string) (int, PluginSet, error) {
+        serverVersion, err := strconv.Atoi(protoVersion)
+        if err != nil {
+                return 0, nil, fmt.Errorf("Error parsing protocol version %q: %s", protoVersion, err)
+        }
+
+        // record these for the error message
+        var clientVersions []int
+
+        // all versions, including the legacy ProtocolVersion have been added to
+        // the versions set
+        for version, plugins := range c.config.VersionedPlugins {
+                clientVersions = append(clientVersions, version)
+
+                if serverVersion != version {
+                        continue
+                }
+                return version, plugins, nil
+        }
+
+        return 0, nil, fmt.Errorf("Incompatible API version with plugin. "+
+                "Plugin version: %d, Client versions: %d", serverVersion, clientVersions)
+}
+
 // ReattachConfig returns the information that must be provided to NewClient
 // to reattach to the plugin process that this client started. This is
 // useful for plugins that detach from their parent process.
@@ -751,44 +932,84 @@ func (c *Client) dialer(_ string, timeout time.Duration) (net.Conn, error) {
         return conn, nil
 }
 
+var stdErrBufferSize = 64 * 1024
+
 func (c *Client) logStderr(r io.Reader) {
-        bufR := bufio.NewReader(r)
+        defer c.clientWaitGroup.Done()
+        l := c.logger.Named(filepath.Base(c.config.Cmd.Path))
+
+        reader := bufio.NewReaderSize(r, stdErrBufferSize)
+        // continuation indicates the previous line was a prefix
+        continuation := false
+
         for {
-                line, err := bufR.ReadString('\n')
-                if line != "" {
-                        c.config.Stderr.Write([]byte(line))
-                        line = strings.TrimRightFunc(line, unicode.IsSpace)
+                line, isPrefix, err := reader.ReadLine()
+                switch {
+                case err == io.EOF:
+                        return
+                case err != nil:
+                        l.Error("reading plugin stderr", "error", err)
+                        return
+                }
 
-                        l := c.logger.Named(filepath.Base(c.config.Cmd.Path))
+                c.config.Stderr.Write(line)
 
-                        entry, err := parseJSON(line)
-                        // If output is not JSON format, print directly to Debug
-                        if err != nil {
-                                l.Debug(line)
-                        } else {
-                                out := flattenKVPairs(entry.KVPairs)
-
-                                l = l.With("timestamp", entry.Timestamp.Format(hclog.TimeFormat))
-                                switch hclog.LevelFromString(entry.Level) {
-                                case hclog.Trace:
-                                        l.Trace(entry.Message, out...)
-                                case hclog.Debug:
-                                        l.Debug(entry.Message, out...)
-                                case hclog.Info:
-                                        l.Info(entry.Message, out...)
-                                case hclog.Warn:
-                                        l.Warn(entry.Message, out...)
-                                case hclog.Error:
-                                        l.Error(entry.Message, out...)
-                                }
+                // The line was longer than our max token size, so it's likely
+                // incomplete and won't unmarshal.
+                if isPrefix || continuation {
+                        l.Debug(string(line))
+
+                        // if we're finishing a continued line, add the newline back in
+                        if !isPrefix {
+                                c.config.Stderr.Write([]byte{'\n'})
                         }
+
+                        continuation = isPrefix
+                        continue
                 }
 
-                if err == io.EOF {
-                        break
+                c.config.Stderr.Write([]byte{'\n'})
+
+                entry, err := parseJSON(line)
+                // If output is not JSON format, print directly to Debug
+                if err != nil {
+                        // Attempt to infer the desired log level from the commonly used
+                        // string prefixes
+                        switch line := string(line); {
+                        case strings.HasPrefix(line, "[TRACE]"):
+                                l.Trace(line)
+                        case strings.HasPrefix(line, "[DEBUG]"):
+                                l.Debug(line)
+                        case strings.HasPrefix(line, "[INFO]"):
+                                l.Info(line)
+                        case strings.HasPrefix(line, "[WARN]"):
+                                l.Warn(line)
+                        case strings.HasPrefix(line, "[ERROR]"):
+                                l.Error(line)
+                        default:
+                                l.Debug(line)
+                        }
+                } else {
+                        out := flattenKVPairs(entry.KVPairs)
+
+                        out = append(out, "timestamp", entry.Timestamp.Format(hclog.TimeFormat))
+                        switch hclog.LevelFromString(entry.Level) {
+                        case hclog.Trace:
+                                l.Trace(entry.Message, out...)
+                        case hclog.Debug:
+                                l.Debug(entry.Message, out...)
+                        case hclog.Info:
+                                l.Info(entry.Message, out...)
+                        case hclog.Warn:
+                                l.Warn(entry.Message, out...)
+                        case hclog.Error:
+                                l.Error(entry.Message, out...)
+                        default:
+                                // if there was no log level, it's likely this is unexpected
+                                // json from something other than hclog, and we should output
+                                // it verbatim.
+                                l.Debug(string(line))
+                        }
                 }
         }
-
-        // Flag that we've completed logging for others
-        close(c.doneLogging)
 }
diff --git a/vendor/github.com/hashicorp/go-plugin/go.mod b/vendor/github.com/hashicorp/go-plugin/go.mod
new file mode 100644
index 0000000..f3ddf44
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/go.mod
@@ -0,0 +1,17 @@
+module github.com/hashicorp/go-plugin
+
+require (
+        github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b // indirect
+        github.com/golang/protobuf v1.2.0
+        github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd
+        github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb
+        github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77
+        github.com/oklog/run v1.0.0
+        github.com/stretchr/testify v1.3.0 // indirect
+        golang.org/x/net v0.0.0-20180826012351-8a410e7b638d
+        golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4 // indirect
+        golang.org/x/sys v0.0.0-20190129075346-302c3dd5f1cc // indirect
+        golang.org/x/text v0.3.0 // indirect
+        google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8 // indirect
+        google.golang.org/grpc v1.14.0
+)
diff --git a/vendor/github.com/hashicorp/go-plugin/go.sum b/vendor/github.com/hashicorp/go-plugin/go.sum
new file mode 100644
index 0000000..21b14e9
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/go.sum
@@ -0,0 +1,31 @@
+github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd h1:rNuUHR+CvK1IS89MMtcF0EpcVMZtjKfPRp4MEmt/aTs=
+github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd/go.mod h1:9bjs9uLqI8l75knNv3lV1kA55veR+WUPSiKIWcQHudI=
+github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb h1:b5rjCoWHc7eqmAS4/qyk21ZsHyb6Mxv/jykxvNTkU4M=
+github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
+github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77 h1:7GoSOOW2jpsfkntVKaS2rAr1TJqfcxotyaUcuxoZSzg=
+github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
+github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw=
+github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d h1:g9qWBGx4puODJTMVyoPrpoxPFgVGd+z1DZwjfRu4d0I=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4 h1:YUO/7uOKsKeq9UokNS62b8FYywz3ker1l1vDZRCRefw=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20190129075346-302c3dd5f1cc h1:WiYx1rIFmx8c0mXAFtv5D/mHyKe1+jmuP7PViuwqwuQ=
+golang.org/x/sys v0.0.0-20190129075346-302c3dd5f1cc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8 h1:Nw54tB0rB7hY/N0NQvRW8DG4Yk3Q6T9cu9RcFQDu1tc=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/grpc v1.14.0 h1:ArxJuB1NWfPY6r9Gp9gqwplT0Ge7nqv9msgu03lHLmo=
+google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
diff --git a/vendor/github.com/hashicorp/go-plugin/grpc_broker.go b/vendor/github.com/hashicorp/go-plugin/grpc_broker.go
index 49fd21c..daf142d 100644
--- a/vendor/github.com/hashicorp/go-plugin/grpc_broker.go
+++ b/vendor/github.com/hashicorp/go-plugin/grpc_broker.go
@@ -11,6 +11,8 @@ import (
         "sync/atomic"
         "time"
 
+        "github.com/hashicorp/go-plugin/internal/plugin"
+
         "github.com/oklog/run"
         "google.golang.org/grpc"
         "google.golang.org/grpc/credentials"
@@ -19,14 +21,14 @@ import (
 // streamer interface is used in the broker to send/receive connection
 // information.
 type streamer interface {
-        Send(*ConnInfo) error
-        Recv() (*ConnInfo, error)
+        Send(*plugin.ConnInfo) error
+        Recv() (*plugin.ConnInfo, error)
         Close()
 }
 
 // sendErr is used to pass errors back during a send.
 type sendErr struct {
-        i  *ConnInfo
+        i  *plugin.ConnInfo
         ch chan error
 }
 
@@ -38,7 +40,7 @@ type gRPCBrokerServer struct {
         send chan *sendErr
 
         // recv is used to receive connection info from the gRPC stream.
-        recv chan *ConnInfo
+        recv chan *plugin.ConnInfo
 
         // quit closes down the stream.
         quit chan struct{}
@@ -50,7 +52,7 @@ type gRPCBrokerServer struct {
 func newGRPCBrokerServer() *gRPCBrokerServer {
         return &gRPCBrokerServer{
                 send: make(chan *sendErr),
-                recv: make(chan *ConnInfo),
+                recv: make(chan *plugin.ConnInfo),
                 quit: make(chan struct{}),
         }
 }
@@ -58,7 +60,7 @@ func newGRPCBrokerServer() *gRPCBrokerServer {
 // StartStream implements the GRPCBrokerServer interface and will block until
 // the quit channel is closed or the context reports Done. The stream will pass
 // connection information to/from the client.
-func (s *gRPCBrokerServer) StartStream(stream GRPCBroker_StartStreamServer) error {
+func (s *gRPCBrokerServer) StartStream(stream plugin.GRPCBroker_StartStreamServer) error {
         doneCh := stream.Context().Done()
         defer s.Close()
 
@@ -97,7 +99,7 @@ func (s *gRPCBrokerServer) StartStream(stream GRPCBroker_StartStreamServer) erro
 
 // Send is used by the GRPCBroker to pass connection information into the stream
 // to the client.
-func (s *gRPCBrokerServer) Send(i *ConnInfo) error {
+func (s *gRPCBrokerServer) Send(i *plugin.ConnInfo) error {
         ch := make(chan error)
         defer close(ch)
 
@@ -115,7 +117,7 @@ func (s *gRPCBrokerServer) Send(i *ConnInfo) error {
 
 // Recv is used by the GRPCBroker to pass connection information that has been
 // sent from the client from the stream to the broker.
-func (s *gRPCBrokerServer) Recv() (*ConnInfo, error) {
+func (s *gRPCBrokerServer) Recv() (*plugin.ConnInfo, error) {
         select {
         case <-s.quit:
                 return nil, errors.New("broker closed")
@@ -136,13 +138,13 @@ func (s *gRPCBrokerServer) Close() {
 // streamer interfaces.
 type gRPCBrokerClientImpl struct {
         // client is the underlying GRPC client used to make calls to the server.
-        client GRPCBrokerClient
+        client plugin.GRPCBrokerClient
 
         // send is used to send connection info to the gRPC stream.
         send chan *sendErr
 
         // recv is used to receive connection info from the gRPC stream.
-        recv chan *ConnInfo
+        recv chan *plugin.ConnInfo
 
         // quit closes down the stream.
         quit chan struct{}
@@ -153,9 +155,9 @@ type gRPCBrokerClientImpl struct {
 
 func newGRPCBrokerClient(conn *grpc.ClientConn) *gRPCBrokerClientImpl {
         return &gRPCBrokerClientImpl{
-                client: NewGRPCBrokerClient(conn),
+                client: plugin.NewGRPCBrokerClient(conn),
                 send:   make(chan *sendErr),
-                recv:   make(chan *ConnInfo),
+                recv:   make(chan *plugin.ConnInfo),
                 quit:   make(chan struct{}),
         }
 }
@@ -207,7 +209,7 @@ func (s *gRPCBrokerClientImpl) StartStream() error {
 
 // Send is used by the GRPCBroker to pass connection information into the stream
 // to the plugin.
-func (s *gRPCBrokerClientImpl) Send(i *ConnInfo) error {
+func (s *gRPCBrokerClientImpl) Send(i *plugin.ConnInfo) error {
         ch := make(chan error)
         defer close(ch)
 
@@ -225,7 +227,7 @@ func (s *gRPCBrokerClientImpl) Send(i *ConnInfo) error {
 
 // Recv is used by the GRPCBroker to pass connection information that has been
 // sent from the plugin to the broker.
-func (s *gRPCBrokerClientImpl) Recv() (*ConnInfo, error) {
+func (s *gRPCBrokerClientImpl) Recv() (*plugin.ConnInfo, error) {
         select {
         case <-s.quit:
                 return nil, errors.New("broker closed")
@@ -266,7 +268,7 @@ type GRPCBroker struct {
 }
 
 type gRPCBrokerPending struct {
-        ch     chan *ConnInfo
+        ch     chan *plugin.ConnInfo
         doneCh chan struct{}
 }
 
@@ -288,7 +290,7 @@ func (b *GRPCBroker) Accept(id uint32) (net.Listener, error) {
                 return nil, err
         }
 
-        err = b.streamer.Send(&ConnInfo{
+        err = b.streamer.Send(&plugin.ConnInfo{
                 ServiceId: id,
                 Network:   listener.Addr().Network(),
                 Address:   listener.Addr().String(),
@@ -363,7 +365,7 @@ func (b *GRPCBroker) Close() error {
 
 // Dial opens a connection by ID.
 func (b *GRPCBroker) Dial(id uint32) (conn *grpc.ClientConn, err error) {
-        var c *ConnInfo
+        var c *plugin.ConnInfo
 
         // Open the stream
         p := b.getStream(id)
@@ -433,7 +435,7 @@ func (m *GRPCBroker) getStream(id uint32) *gRPCBrokerPending {
         }
 
         m.streams[id] = &gRPCBrokerPending{
-                ch:     make(chan *ConnInfo, 1),
+                ch:     make(chan *plugin.ConnInfo, 1),
                 doneCh: make(chan struct{}),
         }
         return m.streams[id]
diff --git a/vendor/github.com/hashicorp/go-plugin/grpc_client.go b/vendor/github.com/hashicorp/go-plugin/grpc_client.go
index 44294d0..294518e 100644
--- a/vendor/github.com/hashicorp/go-plugin/grpc_client.go
+++ b/vendor/github.com/hashicorp/go-plugin/grpc_client.go
@@ -6,6 +6,7 @@ import (
         "net"
         "time"
 
+        "github.com/hashicorp/go-plugin/internal/plugin"
         "golang.org/x/net/context"
         "google.golang.org/grpc"
         "google.golang.org/grpc/credentials"
@@ -16,12 +17,9 @@ func dialGRPCConn(tls *tls.Config, dialer func(string, time.Duration) (net.Conn,
         // Build dialing options.
         opts := make([]grpc.DialOption, 0, 5)
 
-        // We use a custom dialer so that we can connect over unix domain sockets
+        // We use a custom dialer so that we can connect over unix domain sockets.
         opts = append(opts, grpc.WithDialer(dialer))
 
-        // go-plugin expects to block the connection
-        opts = append(opts, grpc.WithBlock())
-
         // Fail right away
         opts = append(opts, grpc.FailOnNonTempDialError(true))
 
@@ -58,12 +56,15 @@ func newGRPCClient(doneCtx context.Context, c *Client) (*GRPCClient, error) {
         go broker.Run()
         go brokerGRPCClient.StartStream()
 
-        return &GRPCClient{
-                Conn:    conn,
-                Plugins: c.config.Plugins,
-                doneCtx: doneCtx,
-                broker:  broker,
-        }, nil
+        cl := &GRPCClient{
+                Conn:       conn,
+                Plugins:    c.config.Plugins,
+                doneCtx:    doneCtx,
+                broker:     broker,
+                controller: plugin.NewGRPCControllerClient(conn),
+        }
+
+        return cl, nil
 }
 
 // GRPCClient connects to a GRPCServer over gRPC to dispense plugin types.
@@ -73,11 +74,14 @@ type GRPCClient struct {
 
         doneCtx context.Context
         broker  *GRPCBroker
+
+        controller plugin.GRPCControllerClient
 }
 
 // ClientProtocol impl.
 func (c *GRPCClient) Close() error {
         c.broker.Close()
+        c.controller.Shutdown(c.doneCtx, &plugin.Empty{})
         return c.Conn.Close()
 }
 
diff --git a/vendor/github.com/hashicorp/go-plugin/grpc_controller.go b/vendor/github.com/hashicorp/go-plugin/grpc_controller.go
new file mode 100644
index 0000000..1a8a8e7
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/grpc_controller.go
@@ -0,0 +1,23 @@
+package plugin
+
+import (
+        "context"
+
+        "github.com/hashicorp/go-plugin/internal/plugin"
+)
+
+// GRPCControllerServer handles shutdown calls to terminate the server when the
+// plugin client is closed.
+type grpcControllerServer struct {
+        server *GRPCServer
+}
+
+// Shutdown stops the grpc server. It first will attempt a graceful stop, then a
+// full stop on the server.
+func (s *grpcControllerServer) Shutdown(ctx context.Context, _ *plugin.Empty) (*plugin.Empty, error) {
+        resp := &plugin.Empty{}
+
+        // TODO: figure out why GracefullStop doesn't work.
+        s.server.Stop()
+        return resp, nil
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/grpc_server.go b/vendor/github.com/hashicorp/go-plugin/grpc_server.go
index 3a72739..d3dbf1c 100644
--- a/vendor/github.com/hashicorp/go-plugin/grpc_server.go
+++ b/vendor/github.com/hashicorp/go-plugin/grpc_server.go
@@ -8,6 +8,8 @@ import (
         "io"
         "net"
 
+        hclog "github.com/hashicorp/go-hclog"
+        "github.com/hashicorp/go-plugin/internal/plugin"
         "google.golang.org/grpc"
         "google.golang.org/grpc/credentials"
         "google.golang.org/grpc/health"
@@ -52,6 +54,8 @@ type GRPCServer struct {
         config GRPCServerConfig
         server *grpc.Server
         broker *GRPCBroker
+
+        logger hclog.Logger
 }
 
 // ServerProtocol impl.
@@ -71,10 +75,16 @@ func (s *GRPCServer) Init() error {
 
         // Register the broker service
         brokerServer := newGRPCBrokerServer()
-        RegisterGRPCBrokerServer(s.server, brokerServer)
+        plugin.RegisterGRPCBrokerServer(s.server, brokerServer)
         s.broker = newGRPCBroker(brokerServer, s.TLS)
         go s.broker.Run()
 
+        // Register the controller
+        controllerServer := &grpcControllerServer{
+                server: s,
+        }
+        plugin.RegisterGRPCControllerServer(s.server, controllerServer)
+
         // Register all our plugins onto the gRPC server.
         for k, raw := range s.Plugins {
                 p, ok := raw.(GRPCPlugin)
@@ -83,7 +93,7 @@ func (s *GRPCServer) Init() error {
                 }
 
                 if err := p.GRPCServer(s.broker, s.server); err != nil {
-                        return fmt.Errorf("error registring %q: %s", k, err)
+                        return fmt.Errorf("error registering %q: %s", k, err)
                 }
         }
 
@@ -117,11 +127,11 @@ func (s *GRPCServer) Config() string {
 }
 
 func (s *GRPCServer) Serve(lis net.Listener) {
-        // Start serving in a goroutine
-        go s.server.Serve(lis)
-
-        // Wait until graceful completion
-        <-s.DoneCh
+        defer close(s.DoneCh)
+        err := s.server.Serve(lis)
+        if err != nil {
+                s.logger.Error("grpc server", "error", err)
+        }
 }
 
 // GRPCServerConfig is the extra configuration passed along for consumers
diff --git a/vendor/github.com/hashicorp/go-plugin/internal/plugin/gen.go b/vendor/github.com/hashicorp/go-plugin/internal/plugin/gen.go
new file mode 100644
index 0000000..aa2fdc8
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/internal/plugin/gen.go
@@ -0,0 +1,3 @@
+//go:generate protoc -I ./ ./grpc_broker.proto ./grpc_controller.proto --go_out=plugins=grpc:.
+
+package plugin
diff --git a/vendor/github.com/hashicorp/go-plugin/grpc_broker.pb.go b/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.pb.go
index d490daf..b6850aa 100644
--- a/vendor/github.com/hashicorp/go-plugin/grpc_broker.pb.go
+++ b/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.pb.go
@@ -1,24 +1,14 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // source: grpc_broker.proto
 
-/*
-Package plugin is a generated protocol buffer package.
-
-It is generated from these files:
-        grpc_broker.proto
-
-It has these top-level messages:
-        ConnInfo
-*/
 package plugin
 
-import proto "github.com/golang/protobuf/proto"
-import fmt "fmt"
-import math "math"
-
 import (
+        fmt "fmt"
+        proto "github.com/golang/protobuf/proto"
         context "golang.org/x/net/context"
         grpc "google.golang.org/grpc"
+        math "math"
 )
 
 // Reference imports to suppress errors if they are not otherwise used.
@@ -33,15 +23,38 @@ var _ = math.Inf
 const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
 
 type ConnInfo struct {
-        ServiceId uint32 `protobuf:"varint,1,opt,name=service_id,json=serviceId" json:"service_id,omitempty"`
-        Network   string `protobuf:"bytes,2,opt,name=network" json:"network,omitempty"`
-        Address   string `protobuf:"bytes,3,opt,name=address" json:"address,omitempty"`
+        ServiceId            uint32   `protobuf:"varint,1,opt,name=service_id,json=serviceId,proto3" json:"service_id,omitempty"`
+        Network              string   `protobuf:"bytes,2,opt,name=network,proto3" json:"network,omitempty"`
+        Address              string   `protobuf:"bytes,3,opt,name=address,proto3" json:"address,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ConnInfo) Reset()         { *m = ConnInfo{} }
+func (m *ConnInfo) String() string { return proto.CompactTextString(m) }
+func (*ConnInfo) ProtoMessage()    {}
+func (*ConnInfo) Descriptor() ([]byte, []int) {
+        return fileDescriptor_802e9beed3ec3b28, []int{0}
 }
 
-func (m *ConnInfo) Reset()                    { *m = ConnInfo{} }
-func (m *ConnInfo) String() string            { return proto.CompactTextString(m) }
-func (*ConnInfo) ProtoMessage()               {}
-func (*ConnInfo) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
+func (m *ConnInfo) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ConnInfo.Unmarshal(m, b)
+}
+func (m *ConnInfo) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ConnInfo.Marshal(b, m, deterministic)
+}
+func (m *ConnInfo) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ConnInfo.Merge(m, src)
+}
+func (m *ConnInfo) XXX_Size() int {
+        return xxx_messageInfo_ConnInfo.Size(m)
+}
+func (m *ConnInfo) XXX_DiscardUnknown() {
+        xxx_messageInfo_ConnInfo.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ConnInfo proto.InternalMessageInfo
 
 func (m *ConnInfo) GetServiceId() uint32 {
         if m != nil {
@@ -68,6 +81,23 @@ func init() {
         proto.RegisterType((*ConnInfo)(nil), "plugin.ConnInfo")
 }
 
+func init() { proto.RegisterFile("grpc_broker.proto", fileDescriptor_802e9beed3ec3b28) }
+
+var fileDescriptor_802e9beed3ec3b28 = []byte{
+        // 175 bytes of a gzipped FileDescriptorProto
+        0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x12, 0x4c, 0x2f, 0x2a, 0x48,
+        0x8e, 0x4f, 0x2a, 0xca, 0xcf, 0x4e, 0x2d, 0xd2, 0x2b, 0x28, 0xca, 0x2f, 0xc9, 0x17, 0x62, 0x2b,
+        0xc8, 0x29, 0x4d, 0xcf, 0xcc, 0x53, 0x8a, 0xe5, 0xe2, 0x70, 0xce, 0xcf, 0xcb, 0xf3, 0xcc, 0x4b,
+        0xcb, 0x17, 0x92, 0xe5, 0xe2, 0x2a, 0x4e, 0x2d, 0x2a, 0xcb, 0x4c, 0x4e, 0x8d, 0xcf, 0x4c, 0x91,
+        0x60, 0x54, 0x60, 0xd4, 0xe0, 0x0d, 0xe2, 0x84, 0x8a, 0x78, 0xa6, 0x08, 0x49, 0x70, 0xb1, 0xe7,
+        0xa5, 0x96, 0x94, 0xe7, 0x17, 0x65, 0x4b, 0x30, 0x29, 0x30, 0x6a, 0x70, 0x06, 0xc1, 0xb8, 0x20,
+        0x99, 0xc4, 0x94, 0x94, 0xa2, 0xd4, 0xe2, 0x62, 0x09, 0x66, 0x88, 0x0c, 0x94, 0x6b, 0xe4, 0xcc,
+        0xc5, 0xe5, 0x1e, 0x14, 0xe0, 0xec, 0x04, 0xb6, 0x5a, 0xc8, 0x94, 0x8b, 0x3b, 0xb8, 0x24, 0xb1,
+        0xa8, 0x24, 0xb8, 0xa4, 0x28, 0x35, 0x31, 0x57, 0x48, 0x40, 0x0f, 0xe2, 0x08, 0x3d, 0x98, 0x0b,
+        0xa4, 0x30, 0x44, 0x34, 0x18, 0x0d, 0x18, 0x9d, 0x38, 0xa2, 0xa0, 0xae, 0x4d, 0x62, 0x03, 0x3b,
+        0xde, 0x18, 0x10, 0x00, 0x00, 0xff, 0xff, 0x10, 0x15, 0x39, 0x47, 0xd1, 0x00, 0x00, 0x00,
+}
+
 // Reference imports to suppress errors if they are not otherwise used.
 var _ context.Context
 var _ grpc.ClientConn
@@ -76,8 +106,9 @@ var _ grpc.ClientConn
 // is compatible with the grpc package it is being compiled against.
 const _ = grpc.SupportPackageIsVersion4
 
-// Client API for GRPCBroker service
-
+// GRPCBrokerClient is the client API for GRPCBroker service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
 type GRPCBrokerClient interface {
         StartStream(ctx context.Context, opts ...grpc.CallOption) (GRPCBroker_StartStreamClient, error)
 }
@@ -91,7 +122,7 @@ func NewGRPCBrokerClient(cc *grpc.ClientConn) GRPCBrokerClient {
 }
 
 func (c *gRPCBrokerClient) StartStream(ctx context.Context, opts ...grpc.CallOption) (GRPCBroker_StartStreamClient, error) {
-        stream, err := grpc.NewClientStream(ctx, &_GRPCBroker_serviceDesc.Streams[0], c.cc, "/plugin.GRPCBroker/StartStream", opts...)
+        stream, err := c.cc.NewStream(ctx, &_GRPCBroker_serviceDesc.Streams[0], "/plugin.GRPCBroker/StartStream", opts...)
         if err != nil {
                 return nil, err
         }
@@ -121,8 +152,7 @@ func (x *gRPCBrokerStartStreamClient) Recv() (*ConnInfo, error) {
         return m, nil
 }
 
-// Server API for GRPCBroker service
-
+// GRPCBrokerServer is the server API for GRPCBroker service.
 type GRPCBrokerServer interface {
         StartStream(GRPCBroker_StartStreamServer) error
 }
@@ -171,20 +201,3 @@ var _GRPCBroker_serviceDesc = grpc.ServiceDesc{
         },
         Metadata: "grpc_broker.proto",
 }
-
-func init() { proto.RegisterFile("grpc_broker.proto", fileDescriptor0) }
-
-var fileDescriptor0 = []byte{
-        // 170 bytes of a gzipped FileDescriptorProto
-        0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x12, 0x4c, 0x2f, 0x2a, 0x48,
-        0x8e, 0x4f, 0x2a, 0xca, 0xcf, 0x4e, 0x2d, 0xd2, 0x2b, 0x28, 0xca, 0x2f, 0xc9, 0x17, 0x62, 0x2b,
-        0xc8, 0x29, 0x4d, 0xcf, 0xcc, 0x53, 0x8a, 0xe5, 0xe2, 0x70, 0xce, 0xcf, 0xcb, 0xf3, 0xcc, 0x4b,
-        0xcb, 0x17, 0x92, 0xe5, 0xe2, 0x2a, 0x4e, 0x2d, 0x2a, 0xcb, 0x4c, 0x4e, 0x8d, 0xcf, 0x4c, 0x91,
-        0x60, 0x54, 0x60, 0xd4, 0xe0, 0x0d, 0xe2, 0x84, 0x8a, 0x78, 0xa6, 0x08, 0x49, 0x70, 0xb1, 0xe7,
-        0xa5, 0x96, 0x94, 0xe7, 0x17, 0x65, 0x4b, 0x30, 0x29, 0x30, 0x6a, 0x70, 0x06, 0xc1, 0xb8, 0x20,
-        0x99, 0xc4, 0x94, 0x94, 0xa2, 0xd4, 0xe2, 0x62, 0x09, 0x66, 0x88, 0x0c, 0x94, 0x6b, 0xe4, 0xcc,
-        0xc5, 0xe5, 0x1e, 0x14, 0xe0, 0xec, 0x04, 0xb6, 0x5a, 0xc8, 0x94, 0x8b, 0x3b, 0xb8, 0x24, 0xb1,
-        0xa8, 0x24, 0xb8, 0xa4, 0x28, 0x35, 0x31, 0x57, 0x48, 0x40, 0x0f, 0xe2, 0x08, 0x3d, 0x98, 0x0b,
-        0xa4, 0x30, 0x44, 0x34, 0x18, 0x0d, 0x18, 0x93, 0xd8, 0xc0, 0x4e, 0x36, 0x06, 0x04, 0x00, 0x00,
-        0xff, 0xff, 0x7b, 0x5d, 0xfb, 0xe1, 0xc7, 0x00, 0x00, 0x00,
-}
diff --git a/vendor/github.com/hashicorp/go-plugin/grpc_broker.proto b/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.proto
index f578348..3fa79e8 100644
--- a/vendor/github.com/hashicorp/go-plugin/grpc_broker.proto
+++ b/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.proto
@@ -1,5 +1,6 @@
 syntax = "proto3";
 package plugin;
+option go_package = "plugin";
 
 message ConnInfo {
     uint32 service_id = 1;
diff --git a/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.pb.go b/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.pb.go
new file mode 100644
index 0000000..38b4204
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.pb.go
@@ -0,0 +1,143 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// source: grpc_controller.proto
+
+package plugin
+
+import (
+        fmt "fmt"
+        proto "github.com/golang/protobuf/proto"
+        context "golang.org/x/net/context"
+        grpc "google.golang.org/grpc"
+        math "math"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
+
+type Empty struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Empty) Reset()         { *m = Empty{} }
+func (m *Empty) String() string { return proto.CompactTextString(m) }
+func (*Empty) ProtoMessage()    {}
+func (*Empty) Descriptor() ([]byte, []int) {
+        return fileDescriptor_23c2c7e42feab570, []int{0}
+}
+
+func (m *Empty) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Empty.Unmarshal(m, b)
+}
+func (m *Empty) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Empty.Marshal(b, m, deterministic)
+}
+func (m *Empty) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Empty.Merge(m, src)
+}
+func (m *Empty) XXX_Size() int {
+        return xxx_messageInfo_Empty.Size(m)
+}
+func (m *Empty) XXX_DiscardUnknown() {
+        xxx_messageInfo_Empty.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Empty proto.InternalMessageInfo
+
+func init() {
+        proto.RegisterType((*Empty)(nil), "plugin.Empty")
+}
+
+func init() { proto.RegisterFile("grpc_controller.proto", fileDescriptor_23c2c7e42feab570) }
+
+var fileDescriptor_23c2c7e42feab570 = []byte{
+        // 108 bytes of a gzipped FileDescriptorProto
+        0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x12, 0x4d, 0x2f, 0x2a, 0x48,
+        0x8e, 0x4f, 0xce, 0xcf, 0x2b, 0x29, 0xca, 0xcf, 0xc9, 0x49, 0x2d, 0xd2, 0x2b, 0x28, 0xca, 0x2f,
+        0xc9, 0x17, 0x62, 0x2b, 0xc8, 0x29, 0x4d, 0xcf, 0xcc, 0x53, 0x62, 0xe7, 0x62, 0x75, 0xcd, 0x2d,
+        0x28, 0xa9, 0x34, 0xb2, 0xe2, 0xe2, 0x73, 0x0f, 0x0a, 0x70, 0x76, 0x86, 0x2b, 0x14, 0xd2, 0xe0,
+        0xe2, 0x08, 0xce, 0x28, 0x2d, 0x49, 0xc9, 0x2f, 0xcf, 0x13, 0xe2, 0xd5, 0x83, 0xa8, 0xd7, 0x03,
+        0x2b, 0x96, 0x42, 0xe5, 0x3a, 0x71, 0x44, 0x41, 0x8d, 0x4b, 0x62, 0x03, 0x9b, 0x6e, 0x0c, 0x08,
+        0x00, 0x00, 0xff, 0xff, 0xab, 0x7c, 0x27, 0xe5, 0x76, 0x00, 0x00, 0x00,
+}
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ context.Context
+var _ grpc.ClientConn
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+const _ = grpc.SupportPackageIsVersion4
+
+// GRPCControllerClient is the client API for GRPCController service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
+type GRPCControllerClient interface {
+        Shutdown(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*Empty, error)
+}
+
+type gRPCControllerClient struct {
+        cc *grpc.ClientConn
+}
+
+func NewGRPCControllerClient(cc *grpc.ClientConn) GRPCControllerClient {
+        return &gRPCControllerClient{cc}
+}
+
+func (c *gRPCControllerClient) Shutdown(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*Empty, error) {
+        out := new(Empty)
+        err := c.cc.Invoke(ctx, "/plugin.GRPCController/Shutdown", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+// GRPCControllerServer is the server API for GRPCController service.
+type GRPCControllerServer interface {
+        Shutdown(context.Context, *Empty) (*Empty, error)
+}
+
+func RegisterGRPCControllerServer(s *grpc.Server, srv GRPCControllerServer) {
+        s.RegisterService(&_GRPCController_serviceDesc, srv)
+}
+
+func _GRPCController_Shutdown_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(Empty)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(GRPCControllerServer).Shutdown(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/plugin.GRPCController/Shutdown",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(GRPCControllerServer).Shutdown(ctx, req.(*Empty))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+var _GRPCController_serviceDesc = grpc.ServiceDesc{
+        ServiceName: "plugin.GRPCController",
+        HandlerType: (*GRPCControllerServer)(nil),
+        Methods: []grpc.MethodDesc{
+                {
+                        MethodName: "Shutdown",
+                        Handler:    _GRPCController_Shutdown_Handler,
+                },
+        },
+        Streams:  []grpc.StreamDesc{},
+        Metadata: "grpc_controller.proto",
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.proto b/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.proto
new file mode 100644
index 0000000..345d0a1
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.proto
@@ -0,0 +1,11 @@
+syntax = "proto3";
+package plugin;
+option go_package = "plugin";
+
+message Empty {
+}
+
+// The GRPCController is responsible for telling the plugin server to shutdown.
+service GRPCController {
+    rpc Shutdown(Empty) returns (Empty);
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/log_entry.go b/vendor/github.com/hashicorp/go-plugin/log_entry.go
index 2996c14..fb2ef93 100644
--- a/vendor/github.com/hashicorp/go-plugin/log_entry.go
+++ b/vendor/github.com/hashicorp/go-plugin/log_entry.go
@@ -32,11 +32,11 @@ func flattenKVPairs(kvs []*logEntryKV) []interface{} {
 }
 
 // parseJSON handles parsing JSON output
-func parseJSON(input string) (*logEntry, error) {
+func parseJSON(input []byte) (*logEntry, error) {
         var raw map[string]interface{}
         entry := &logEntry{}
 
-        err := json.Unmarshal([]byte(input), &raw)
+        err := json.Unmarshal(input, &raw)
         if err != nil {
                 return nil, err
         }
diff --git a/vendor/github.com/hashicorp/go-plugin/mtls.go b/vendor/github.com/hashicorp/go-plugin/mtls.go
new file mode 100644
index 0000000..8895524
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/mtls.go
@@ -0,0 +1,73 @@
+package plugin
+
+import (
+        "bytes"
+        "crypto/ecdsa"
+        "crypto/elliptic"
+        "crypto/rand"
+        "crypto/x509"
+        "crypto/x509/pkix"
+        "encoding/pem"
+        "math/big"
+        "time"
+)
+
+// generateCert generates a temporary certificate for plugin authentication. The
+// certificate and private key are returns in PEM format.
+func generateCert() (cert []byte, privateKey []byte, err error) {
+        key, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+        if err != nil {
+                return nil, nil, err
+        }
+
+        serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
+        sn, err := rand.Int(rand.Reader, serialNumberLimit)
+        if err != nil {
+                return nil, nil, err
+        }
+
+        host := "localhost"
+
+        template := &x509.Certificate{
+                Subject: pkix.Name{
+                        CommonName:   host,
+                        Organization: []string{"HashiCorp"},
+                },
+                DNSNames: []string{host},
+                ExtKeyUsage: []x509.ExtKeyUsage{
+                        x509.ExtKeyUsageClientAuth,
+                        x509.ExtKeyUsageServerAuth,
+                },
+                KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment | x509.KeyUsageKeyAgreement | x509.KeyUsageCertSign,
+                BasicConstraintsValid: true,
+                SerialNumber:          sn,
+                NotBefore:             time.Now().Add(-30 * time.Second),
+                NotAfter:              time.Now().Add(262980 * time.Hour),
+                IsCA:                  true,
+        }
+
+        der, err := x509.CreateCertificate(rand.Reader, template, template, key.Public(), key)
+        if err != nil {
+                return nil, nil, err
+        }
+
+        var certOut bytes.Buffer
+        if err := pem.Encode(&certOut, &pem.Block{Type: "CERTIFICATE", Bytes: der}); err != nil {
+                return nil, nil, err
+        }
+
+        keyBytes, err := x509.MarshalECPrivateKey(key)
+        if err != nil {
+                return nil, nil, err
+        }
+
+        var keyOut bytes.Buffer
+        if err := pem.Encode(&keyOut, &pem.Block{Type: "EC PRIVATE KEY", Bytes: keyBytes}); err != nil {
+                return nil, nil, err
+        }
+
+        cert = certOut.Bytes()
+        privateKey = keyOut.Bytes()
+
+        return cert, privateKey, nil
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/server.go b/vendor/github.com/hashicorp/go-plugin/server.go
index 1e808b9..fc9f05a 100644
--- a/vendor/github.com/hashicorp/go-plugin/server.go
+++ b/vendor/github.com/hashicorp/go-plugin/server.go
@@ -2,6 +2,7 @@ package plugin
 
 import (
         "crypto/tls"
+        "crypto/x509"
         "encoding/base64"
         "errors"
         "fmt"
@@ -11,7 +12,9 @@ import (
         "os"
         "os/signal"
         "runtime"
+        "sort"
         "strconv"
+        "strings"
         "sync/atomic"
 
         "github.com/hashicorp/go-hclog"
@@ -36,6 +39,8 @@ type HandshakeConfig struct {
         // ProtocolVersion is the version that clients must match on to
         // agree they can communicate. This should match the ProtocolVersion
         // set on ClientConfig when using a plugin.
+        // This field is not required if VersionedPlugins are being used in the
+        // Client or Server configurations.
         ProtocolVersion uint
 
         // MagicCookieKey and value are used as a very basic verification
@@ -46,6 +51,10 @@ type HandshakeConfig struct {
         MagicCookieValue string
 }
 
+// PluginSet is a set of plugins provided to be registered in the plugin
+// server.
+type PluginSet map[string]Plugin
+
 // ServeConfig configures what sorts of plugins are served.
 type ServeConfig struct {
         // HandshakeConfig is the configuration that must match clients.
@@ -55,7 +64,13 @@ type ServeConfig struct {
         TLSProvider func() (*tls.Config, error)
 
         // Plugins are the plugins that are served.
-        Plugins map[string]Plugin
+        // The implied version of this PluginSet is the Handshake.ProtocolVersion.
+        Plugins PluginSet
+
+        // VersionedPlugins is a map of PluginSets for specific protocol versions.
+        // These can be used to negotiate a compatible version between client and
+        // server. If this is set, Handshake.ProtocolVersion is not required.
+        VersionedPlugins map[int]PluginSet
 
         // GRPCServer should be non-nil to enable serving the plugins over
         // gRPC. This is a function to create the server when needed with the
@@ -72,14 +87,83 @@ type ServeConfig struct {
         Logger hclog.Logger
 }
 
-// Protocol returns the protocol that this server should speak.
-func (c *ServeConfig) Protocol() Protocol {
-        result := ProtocolNetRPC
-        if c.GRPCServer != nil {
-                result = ProtocolGRPC
+// protocolVersion determines the protocol version and plugin set to be used by
+// the server. In the event that there is no suitable version, the last version
+// in the config is returned leaving the client to report the incompatibility.
+func protocolVersion(opts *ServeConfig) (int, Protocol, PluginSet) {
+        protoVersion := int(opts.ProtocolVersion)
+        pluginSet := opts.Plugins
+        protoType := ProtocolNetRPC
+        // Check if the client sent a list of acceptable versions
+        var clientVersions []int
+        if vs := os.Getenv("PLUGIN_PROTOCOL_VERSIONS"); vs != "" {
+                for _, s := range strings.Split(vs, ",") {
+                        v, err := strconv.Atoi(s)
+                        if err != nil {
+                                fmt.Fprintf(os.Stderr, "server sent invalid plugin version %q", s)
+                                continue
+                        }
+                        clientVersions = append(clientVersions, v)
+                }
+        }
+
+        // We want to iterate in reverse order, to ensure we match the newest
+        // compatible plugin version.
+        sort.Sort(sort.Reverse(sort.IntSlice(clientVersions)))
+
+        // set the old un-versioned fields as if they were versioned plugins
+        if opts.VersionedPlugins == nil {
+                opts.VersionedPlugins = make(map[int]PluginSet)
+        }
+
+        if pluginSet != nil {
+                opts.VersionedPlugins[protoVersion] = pluginSet
         }
 
-        return result
+        // Sort the version to make sure we match the latest first
+        var versions []int
+        for v := range opts.VersionedPlugins {
+                versions = append(versions, v)
+        }
+
+        sort.Sort(sort.Reverse(sort.IntSlice(versions)))
+
+        // See if we have multiple versions of Plugins to choose from
+        for _, version := range versions {
+                // Record each version, since we guarantee that this returns valid
+                // values even if they are not a protocol match.
+                protoVersion = version
+                pluginSet = opts.VersionedPlugins[version]
+
+                // If we have a configured gRPC server we should select a protocol
+                if opts.GRPCServer != nil {
+                        // All plugins in a set must use the same transport, so check the first
+                        // for the protocol type
+                        for _, p := range pluginSet {
+                                switch p.(type) {
+                                case GRPCPlugin:
+                                        protoType = ProtocolGRPC
+                                default:
+                                        protoType = ProtocolNetRPC
+                                }
+                                break
+                        }
+                }
+
+                for _, clientVersion := range clientVersions {
+                        if clientVersion == protoVersion {
+                                return protoVersion, protoType, pluginSet
+                        }
+                }
+        }
+
+        // Return the lowest version as the fallback.
+        // Since we iterated over all the versions in reverse order above, these
+        // values are from the lowest version number plugins (which may be from
+        // a combination of the Handshake.ProtocolVersion and ServeConfig.Plugins
+        // fields). This allows serving the oldest version of our plugins to a
+        // legacy client that did not send a PLUGIN_PROTOCOL_VERSIONS list.
+        return protoVersion, protoType, pluginSet
 }
 
 // Serve serves the plugins given by ServeConfig.
@@ -107,6 +191,10 @@ func Serve(opts *ServeConfig) {
                 os.Exit(1)
         }
 
+        // negotiate the version and plugins
+        // start with default version in the handshake config
+        protoVersion, protoType, pluginSet := protocolVersion(opts)
+
         // Logging goes to the original stderr
         log.SetOutput(os.Stderr)
 
@@ -155,12 +243,47 @@ func Serve(opts *ServeConfig) {
                 }
         }
 
+        var serverCert string
+        clientCert := os.Getenv("PLUGIN_CLIENT_CERT")
+        // If the client is configured using AutoMTLS, the certificate will be here,
+        // and we need to generate our own in response.
+        if tlsConfig == nil && clientCert != "" {
+                logger.Info("configuring server automatic mTLS")
+                clientCertPool := x509.NewCertPool()
+                if !clientCertPool.AppendCertsFromPEM([]byte(clientCert)) {
+                        logger.Error("client cert provided but failed to parse", "cert", clientCert)
+                }
+
+                certPEM, keyPEM, err := generateCert()
+                if err != nil {
+                        logger.Error("failed to generate client certificate", "error", err)
+                        panic(err)
+                }
+
+                cert, err := tls.X509KeyPair(certPEM, keyPEM)
+                if err != nil {
+                        logger.Error("failed to parse client certificate", "error", err)
+                        panic(err)
+                }
+
+                tlsConfig = &tls.Config{
+                        Certificates: []tls.Certificate{cert},
+                        ClientAuth:   tls.RequireAndVerifyClientCert,
+                        ClientCAs:    clientCertPool,
+                        MinVersion:   tls.VersionTLS12,
+                }
+
+                // We send back the raw leaf cert data for the client rather than the
+                // PEM, since the protocol can't handle newlines.
+                serverCert = base64.RawStdEncoding.EncodeToString(cert.Certificate[0])
+        }
+
         // Create the channel to tell us when we're done
         doneCh := make(chan struct{})
 
         // Build the server type
         var server ServerProtocol
-        switch opts.Protocol() {
+        switch protoType {
         case ProtocolNetRPC:
                 // If we have a TLS configuration then we wrap the listener
                 // ourselves and do it at that level.
@@ -170,7 +293,7 @@ func Serve(opts *ServeConfig) {
 
                 // Create the RPC server to dispense
                 server = &RPCServer{
-                        Plugins: opts.Plugins,
+                        Plugins: pluginSet,
                         Stdout:  stdout_r,
                         Stderr:  stderr_r,
                         DoneCh:  doneCh,
@@ -179,16 +302,17 @@ func Serve(opts *ServeConfig) {
         case ProtocolGRPC:
                 // Create the gRPC server
                 server = &GRPCServer{
-                        Plugins: opts.Plugins,
+                        Plugins: pluginSet,
                         Server:  opts.GRPCServer,
                         TLS:     tlsConfig,
                         Stdout:  stdout_r,
                         Stderr:  stderr_r,
                         DoneCh:  doneCh,
+                        logger:  logger,
                 }
 
         default:
-                panic("unknown server protocol: " + opts.Protocol())
+                panic("unknown server protocol: " + protoType)
         }
 
         // Initialize the servers
@@ -197,25 +321,16 @@ func Serve(opts *ServeConfig) {
                 return
         }
 
-        // Build the extra configuration
-        extra := ""
-        if v := server.Config(); v != "" {
-                extra = base64.StdEncoding.EncodeToString([]byte(v))
-        }
-        if extra != "" {
-                extra = "|" + extra
-        }
-
         logger.Debug("plugin address", "network", listener.Addr().Network(), "address", listener.Addr().String())
 
-        // Output the address and service name to stdout so that core can bring it up.
-        fmt.Printf("%d|%d|%s|%s|%s%s\n",
+        // Output the address and service name to stdout so that the client can bring it up.
+        fmt.Printf("%d|%d|%s|%s|%s|%s\n",
                 CoreProtocolVersion,
-                opts.ProtocolVersion,
+                protoVersion,
                 listener.Addr().Network(),
                 listener.Addr().String(),
-                opts.Protocol(),
-                extra)
+                protoType,
+                serverCert)
         os.Stdout.Sync()
 
         // Eat the interrupts
diff --git a/vendor/github.com/hashicorp/go-plugin/testing.go b/vendor/github.com/hashicorp/go-plugin/testing.go
index df29593..2cf2c26 100644
--- a/vendor/github.com/hashicorp/go-plugin/testing.go
+++ b/vendor/github.com/hashicorp/go-plugin/testing.go
@@ -3,13 +3,28 @@ package plugin
 import (
         "bytes"
         "context"
+        "io"
         "net"
         "net/rpc"
 
         "github.com/mitchellh/go-testing-interface"
+        hclog "github.com/hashicorp/go-hclog"
+        "github.com/hashicorp/go-plugin/internal/plugin"
         "google.golang.org/grpc"
 )
 
+// TestOptions allows specifying options that can affect the behavior of the
+// test functions
+type TestOptions struct {
+        //ServerStdout causes the given value to be used in place of a blank buffer
+        //for RPCServer's Stdout
+        ServerStdout io.ReadCloser
+
+        //ServerStderr causes the given value to be used in place of a blank buffer
+        //for RPCServer's Stderr
+        ServerStderr io.ReadCloser
+}
+
 // The testing file contains test helpers that you can use outside of
 // this package for making it easier to test plugins themselves.
 
@@ -61,12 +76,20 @@ func TestRPCConn(t testing.T) (*rpc.Client, *rpc.Server) {
 
 // TestPluginRPCConn returns a plugin RPC client and server that are connected
 // together and configured.
-func TestPluginRPCConn(t testing.T, ps map[string]Plugin) (*RPCClient, *RPCServer) {
+func TestPluginRPCConn(t testing.T, ps map[string]Plugin, opts *TestOptions) (*RPCClient, *RPCServer) {
         // Create two net.Conns we can use to shuttle our control connection
         clientConn, serverConn := TestConn(t)
 
         // Start up the server
         server := &RPCServer{Plugins: ps, Stdout: new(bytes.Buffer), Stderr: new(bytes.Buffer)}
+        if opts != nil {
+                if opts.ServerStdout != nil {
+                        server.Stdout = opts.ServerStdout
+                }
+                if opts.ServerStderr != nil {
+                        server.Stderr = opts.ServerStderr
+                }
+        }
         go server.ServeConn(serverConn)
 
         // Connect the client to the server
@@ -119,9 +142,11 @@ func TestPluginGRPCConn(t testing.T, ps map[string]Plugin) (*GRPCClient, *GRPCSe
         // Start up the server
         server := &GRPCServer{
                 Plugins: ps,
+                DoneCh:  make(chan struct{}),
                 Server:  DefaultGRPCServer,
                 Stdout:  new(bytes.Buffer),
                 Stderr:  new(bytes.Buffer),
+                logger:  hclog.Default(),
         }
         if err := server.Init(); err != nil {
                 t.Fatalf("err: %s", err)
@@ -144,10 +169,11 @@ func TestPluginGRPCConn(t testing.T, ps map[string]Plugin) (*GRPCClient, *GRPCSe
 
         // Create the client
         client := &GRPCClient{
-                Conn:    conn,
-                Plugins: ps,
-                broker:  broker,
-                doneCtx: context.Background(),
+                Conn:       conn,
+                Plugins:    ps,
+                broker:     broker,
+                doneCtx:    context.Background(),
+                controller: plugin.NewGRPCControllerClient(conn),
         }
 
         return client, server
diff --git a/vendor/github.com/hashicorp/go-safetemp/go.mod b/vendor/github.com/hashicorp/go-safetemp/go.mod
new file mode 100644
index 0000000..02bc5f5
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-safetemp/go.mod
@@ -0,0 +1 @@
+module github.com/hashicorp/go-safetemp
diff --git a/vendor/github.com/hashicorp/go-uuid/uuid.go b/vendor/github.com/hashicorp/go-uuid/uuid.go
index ff9364c..911227f 100644
--- a/vendor/github.com/hashicorp/go-uuid/uuid.go
+++ b/vendor/github.com/hashicorp/go-uuid/uuid.go
@@ -15,9 +15,11 @@ func GenerateRandomBytes(size int) ([]byte, error) {
         return buf, nil
 }
 
+const uuidLen = 16
+
 // GenerateUUID is used to generate a random UUID
 func GenerateUUID() (string, error) {
-        buf, err := GenerateRandomBytes(16)
+        buf, err := GenerateRandomBytes(uuidLen)
         if err != nil {
                 return "", err
         }
@@ -25,11 +27,11 @@ func GenerateUUID() (string, error) {
 }
 
 func FormatUUID(buf []byte) (string, error) {
-        if len(buf) != 16 {
-                return "", fmt.Errorf("wrong length byte slice (%d)", len(buf))
+        if buflen := len(buf); buflen != uuidLen {
+                return "", fmt.Errorf("wrong length byte slice (%d)", buflen)
         }
 
-        return fmt.Sprintf("%08x-%04x-%04x-%04x-%12x",
+        return fmt.Sprintf("%x-%x-%x-%x-%x",
                 buf[0:4],
                 buf[4:6],
                 buf[6:8],
@@ -38,16 +40,14 @@ func FormatUUID(buf []byte) (string, error) {
 }
 
 func ParseUUID(uuid string) ([]byte, error) {
-        if len(uuid) != 36 {
+        if len(uuid) != 2 * uuidLen + 4 {
                 return nil, fmt.Errorf("uuid string is wrong length")
         }
 
-        hyph := []byte("-")
-
-        if uuid[8] != hyph[0] ||
-                uuid[13] != hyph[0] ||
-                uuid[18] != hyph[0] ||
-                uuid[23] != hyph[0] {
+        if uuid[8] != '-' ||
+                uuid[13] != '-' ||
+                uuid[18] != '-' ||
+                uuid[23] != '-' {
                 return nil, fmt.Errorf("uuid is improperly formatted")
         }
 
@@ -57,7 +57,7 @@ func ParseUUID(uuid string) ([]byte, error) {
         if err != nil {
                 return nil, err
         }
-        if len(ret) != 16 {
+        if len(ret) != uuidLen {
                 return nil, fmt.Errorf("decoded hex is the wrong length")
         }
 
diff --git a/vendor/github.com/hashicorp/go-version/version.go b/vendor/github.com/hashicorp/go-version/version.go
index 4d1e6e2..186fd7c 100644
--- a/vendor/github.com/hashicorp/go-version/version.go
+++ b/vendor/github.com/hashicorp/go-version/version.go
@@ -10,14 +10,25 @@ import (
 )
 
 // The compiled regular expression used to test the validity of a version.
-var versionRegexp *regexp.Regexp
+var (
+        versionRegexp *regexp.Regexp
+        semverRegexp  *regexp.Regexp
+)
 
 // The raw regular expression string used for testing the validity
 // of a version.
-const VersionRegexpRaw string = `v?([0-9]+(\.[0-9]+)*?)` +
-        `(-([0-9]+[0-9A-Za-z\-~]*(\.[0-9A-Za-z\-~]+)*)|(-?([A-Za-z\-~]+[0-9A-Za-z\-~]*(\.[0-9A-Za-z\-~]+)*)))?` +
-        `(\+([0-9A-Za-z\-~]+(\.[0-9A-Za-z\-~]+)*))?` +
-        `?`
+const (
+        VersionRegexpRaw string = `v?([0-9]+(\.[0-9]+)*?)` +
+                `(-([0-9]+[0-9A-Za-z\-~]*(\.[0-9A-Za-z\-~]+)*)|(-?([A-Za-z\-~]+[0-9A-Za-z\-~]*(\.[0-9A-Za-z\-~]+)*)))?` +
+                `(\+([0-9A-Za-z\-~]+(\.[0-9A-Za-z\-~]+)*))?` +
+                `?`
+
+        // SemverRegexpRaw requires a separator between version and prerelease
+        SemverRegexpRaw string = `v?([0-9]+(\.[0-9]+)*?)` +
+                `(-([0-9]+[0-9A-Za-z\-~]*(\.[0-9A-Za-z\-~]+)*)|(-([A-Za-z\-~]+[0-9A-Za-z\-~]*(\.[0-9A-Za-z\-~]+)*)))?` +
+                `(\+([0-9A-Za-z\-~]+(\.[0-9A-Za-z\-~]+)*))?` +
+                `?`
+)
 
 // Version represents a single version.
 type Version struct {
@@ -30,12 +41,24 @@ type Version struct {
 
 func init() {
         versionRegexp = regexp.MustCompile("^" + VersionRegexpRaw + "$")
+        semverRegexp = regexp.MustCompile("^" + SemverRegexpRaw + "$")
 }
 
 // NewVersion parses the given version and returns a new
 // Version.
 func NewVersion(v string) (*Version, error) {
-        matches := versionRegexp.FindStringSubmatch(v)
+        return newVersion(v, versionRegexp)
+}
+
+// NewSemver parses the given version and returns a new
+// Version that adheres strictly to SemVer specs
+// https://semver.org/
+func NewSemver(v string) (*Version, error) {
+        return newVersion(v, semverRegexp)
+}
+
+func newVersion(v string, pattern *regexp.Regexp) (*Version, error) {
+        matches := pattern.FindStringSubmatch(v)
         if matches == nil {
                 return nil, fmt.Errorf("Malformed version: %s", v)
         }
diff --git a/vendor/github.com/hashicorp/hcl2/ext/dynblock/README.md b/vendor/github.com/hashicorp/hcl2/ext/dynblock/README.md
new file mode 100644
index 0000000..2b24fdb
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/dynblock/README.md
@@ -0,0 +1,184 @@
+# HCL Dynamic Blocks Extension
+
+This HCL extension implements a special block type named "dynamic" that can
+be used to dynamically generate blocks of other types by iterating over
+collection values.
+
+Normally the block structure in an HCL configuration file is rigid, even
+though dynamic expressions can be used within attribute values. This is
+convenient for most applications since it allows the overall structure of
+the document to be decoded easily, but in some applications it is desirable
+to allow dynamic block generation within certain portions of the configuration.
+
+Dynamic block generation is performed using the `dynamic` block type:
+
+```hcl
+toplevel {
+  nested {
+    foo = "static block 1"
+  }
+
+  dynamic "nested" {
+    for_each = ["a", "b", "c"]
+    iterator = nested
+    content {
+      foo = "dynamic block ${nested.value}"
+    }
+  }
+
+  nested {
+    foo = "static block 2"
+  }
+}
+```
+
+The above is interpreted as if it were written as follows:
+
+```hcl
+toplevel {
+  nested {
+    foo = "static block 1"
+  }
+
+  nested {
+    foo = "dynamic block a"
+  }
+
+  nested {
+    foo = "dynamic block b"
+  }
+
+  nested {
+    foo = "dynamic block c"
+  }
+
+  nested {
+    foo = "static block 2"
+  }
+}
+```
+
+Since HCL block syntax is not normally exposed to the possibility of unknown
+values, this extension must make some compromises when asked to iterate over
+an unknown collection. If the length of the collection cannot be statically
+recognized (because it is an unknown value of list, map, or set type) then
+the `dynamic` construct will generate a _single_ dynamic block whose iterator
+key and value are both unknown values of the dynamic pseudo-type, thus causing
+any attribute values derived from iteration to appear as unknown values. There
+is no explicit representation of the fact that the length of the collection may
+eventually be different than one.
+
+## Usage
+
+Pass a body to function `Expand` to obtain a new body that will, on access
+to its content, evaluate and expand any nested `dynamic` blocks.
+Dynamic block processing is also automatically propagated into any nested
+blocks that are returned, allowing users to nest dynamic blocks inside
+one another and to nest dynamic blocks inside other static blocks.
+
+HCL structural decoding does not normally have access to an `EvalContext`, so
+any variables and functions that should be available to the `for_each`
+and `labels` expressions must be passed in when calling `Expand`. Expressions
+within the `content` block are evaluated separately and so can be passed a
+separate `EvalContext` if desired, during normal attribute expression
+evaluation.
+
+## Detecting Variables
+
+Some applications dynamically generate an `EvalContext` by analyzing which
+variables are referenced by an expression before evaluating it.
+
+This unfortunately requires some extra effort when this analysis is required
+for the context passed to `Expand`: the HCL API requires a schema to be
+provided in order to do any analysis of the blocks in a body, but the low-level
+schema model provides a description of only one level of nested blocks at
+a time, and thus a new schema must be provided for each additional level of
+nesting.
+
+To make this arduous process as convenient as possbile, this package provides
+a helper function `WalkForEachVariables`, which returns a `WalkVariablesNode`
+instance that can be used to find variables directly in a given body and also
+determine which nested blocks require recursive calls. Using this mechanism
+requires that the caller be able to look up a schema given a nested block type.
+For _simple_ formats where a specific block type name always has the same schema
+regardless of context, a walk can be implemented as follows:
+
+```go
+func walkVariables(node dynblock.WalkVariablesNode, schema *hcl.BodySchema) []hcl.Traversal {
+        vars, children := node.Visit(schema)
+
+        for _, child := range children {
+                var childSchema *hcl.BodySchema
+                switch child.BlockTypeName {
+                case "a":
+                        childSchema = &hcl.BodySchema{
+                                Blocks: []hcl.BlockHeaderSchema{
+                                        {
+                                                Type:       "b",
+                                                LabelNames: []string{"key"},
+                                        },
+                                },
+                        }
+                case "b":
+                        childSchema = &hcl.BodySchema{
+                                Attributes: []hcl.AttributeSchema{
+                                        {
+                                                Name:     "val",
+                                                Required: true,
+                                        },
+                                },
+                        }
+                default:
+                        // Should never happen, because the above cases should be exhaustive
+                        // for the application's configuration format.
+                        panic(fmt.Errorf("can't find schema for unknown block type %q", child.BlockTypeName))
+                }
+
+                vars = append(vars, testWalkAndAccumVars(child.Node, childSchema)...)
+        }
+}
+```
+
+### Detecting Variables with `hcldec` Specifications
+
+For applications that use the higher-level `hcldec` package to decode nested
+configuration structures into `cty` values, the same specification can be used
+to automatically drive the recursive variable-detection walk described above.
+
+The helper function `ForEachVariablesHCLDec` allows an entire recursive
+configuration structure to be analyzed in a single call given a `hcldec.Spec`
+that describes the nested block structure. This means a `hcldec`-based
+application can support dynamic blocks with only a little additional effort:
+
+```go
+func decodeBody(body hcl.Body, spec hcldec.Spec) (cty.Value, hcl.Diagnostics) {
+        // Determine which variables are needed to expand dynamic blocks
+        neededForDynamic := dynblock.ForEachVariablesHCLDec(body, spec)
+
+        // Build a suitable EvalContext and expand dynamic blocks
+        dynCtx := buildEvalContext(neededForDynamic)
+        dynBody := dynblock.Expand(body, dynCtx)
+
+        // Determine which variables are needed to fully decode the expanded body
+        // This will analyze expressions that came both from static blocks in the
+        // original body and from blocks that were dynamically added by Expand.
+        neededForDecode := hcldec.Variables(dynBody, spec)
+
+        // Build a suitable EvalContext and then fully decode the body as per the
+        // hcldec specification.
+        decCtx := buildEvalContext(neededForDecode)
+        return hcldec.Decode(dynBody, spec, decCtx)
+}
+
+func buildEvalContext(needed []hcl.Traversal) *hcl.EvalContext {
+        // (to be implemented by your application)
+}
+```
+
+# Performance
+
+This extension is going quite harshly against the grain of the HCL API, and
+so it uses lots of wrapping objects and temporary data structures to get its
+work done. HCL in general is not suitable for use in high-performance situations
+or situations sensitive to memory pressure, but that is _especially_ true for
+this extension.
diff --git a/vendor/github.com/hashicorp/hcl2/ext/dynblock/expand_body.go b/vendor/github.com/hashicorp/hcl2/ext/dynblock/expand_body.go
new file mode 100644
index 0000000..dd30822
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/dynblock/expand_body.go
@@ -0,0 +1,262 @@
+package dynblock
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// expandBody wraps another hcl.Body and expands any "dynamic" blocks found
+// inside whenever Content or PartialContent is called.
+type expandBody struct {
+        original   hcl.Body
+        forEachCtx *hcl.EvalContext
+        iteration  *iteration // non-nil if we're nested inside another "dynamic" block
+
+        // These are used with PartialContent to produce a "remaining items"
+        // body to return. They are nil on all bodies fresh out of the transformer.
+        //
+        // Note that this is re-implemented here rather than delegating to the
+        // existing support required by the underlying body because we need to
+        // retain access to the entire original body on subsequent decode operations
+        // so we can retain any "dynamic" blocks for types we didn't take consume
+        // on the first pass.
+        hiddenAttrs  map[string]struct{}
+        hiddenBlocks map[string]hcl.BlockHeaderSchema
+}
+
+func (b *expandBody) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) {
+        extSchema := b.extendSchema(schema)
+        rawContent, diags := b.original.Content(extSchema)
+
+        blocks, blockDiags := b.expandBlocks(schema, rawContent.Blocks, false)
+        diags = append(diags, blockDiags...)
+        attrs := b.prepareAttributes(rawContent.Attributes)
+
+        content := &hcl.BodyContent{
+                Attributes:       attrs,
+                Blocks:           blocks,
+                MissingItemRange: b.original.MissingItemRange(),
+        }
+
+        return content, diags
+}
+
+func (b *expandBody) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) {
+        extSchema := b.extendSchema(schema)
+        rawContent, _, diags := b.original.PartialContent(extSchema)
+        // We discard the "remain" argument above because we're going to construct
+        // our own remain that also takes into account remaining "dynamic" blocks.
+
+        blocks, blockDiags := b.expandBlocks(schema, rawContent.Blocks, true)
+        diags = append(diags, blockDiags...)
+        attrs := b.prepareAttributes(rawContent.Attributes)
+
+        content := &hcl.BodyContent{
+                Attributes:       attrs,
+                Blocks:           blocks,
+                MissingItemRange: b.original.MissingItemRange(),
+        }
+
+        remain := &expandBody{
+                original:     b.original,
+                forEachCtx:   b.forEachCtx,
+                iteration:    b.iteration,
+                hiddenAttrs:  make(map[string]struct{}),
+                hiddenBlocks: make(map[string]hcl.BlockHeaderSchema),
+        }
+        for name := range b.hiddenAttrs {
+                remain.hiddenAttrs[name] = struct{}{}
+        }
+        for typeName, blockS := range b.hiddenBlocks {
+                remain.hiddenBlocks[typeName] = blockS
+        }
+        for _, attrS := range schema.Attributes {
+                remain.hiddenAttrs[attrS.Name] = struct{}{}
+        }
+        for _, blockS := range schema.Blocks {
+                remain.hiddenBlocks[blockS.Type] = blockS
+        }
+
+        return content, remain, diags
+}
+
+func (b *expandBody) extendSchema(schema *hcl.BodySchema) *hcl.BodySchema {
+        // We augment the requested schema to also include our special "dynamic"
+        // block type, since then we'll get instances of it interleaved with
+        // all of the literal child blocks we must also include.
+        extSchema := &hcl.BodySchema{
+                Attributes: schema.Attributes,
+                Blocks:     make([]hcl.BlockHeaderSchema, len(schema.Blocks), len(schema.Blocks)+len(b.hiddenBlocks)+1),
+        }
+        copy(extSchema.Blocks, schema.Blocks)
+        extSchema.Blocks = append(extSchema.Blocks, dynamicBlockHeaderSchema)
+
+        // If we have any hiddenBlocks then we also need to register those here
+        // so that a call to "Content" on the underlying body won't fail.
+        // (We'll filter these out again once we process the result of either
+        // Content or PartialContent.)
+        for _, blockS := range b.hiddenBlocks {
+                extSchema.Blocks = append(extSchema.Blocks, blockS)
+        }
+
+        // If we have any hiddenAttrs then we also need to register these, for
+        // the same reason as we deal with hiddenBlocks above.
+        if len(b.hiddenAttrs) != 0 {
+                newAttrs := make([]hcl.AttributeSchema, len(schema.Attributes), len(schema.Attributes)+len(b.hiddenAttrs))
+                copy(newAttrs, extSchema.Attributes)
+                for name := range b.hiddenAttrs {
+                        newAttrs = append(newAttrs, hcl.AttributeSchema{
+                                Name:     name,
+                                Required: false,
+                        })
+                }
+                extSchema.Attributes = newAttrs
+        }
+
+        return extSchema
+}
+
+func (b *expandBody) prepareAttributes(rawAttrs hcl.Attributes) hcl.Attributes {
+        if len(b.hiddenAttrs) == 0 && b.iteration == nil {
+                // Easy path: just pass through the attrs from the original body verbatim
+                return rawAttrs
+        }
+
+        // Otherwise we have some work to do: we must filter out any attributes
+        // that are hidden (since a previous PartialContent call already saw these)
+        // and wrap the expressions of the inner attributes so that they will
+        // have access to our iteration variables.
+        attrs := make(hcl.Attributes, len(rawAttrs))
+        for name, rawAttr := range rawAttrs {
+                if _, hidden := b.hiddenAttrs[name]; hidden {
+                        continue
+                }
+                if b.iteration != nil {
+                        attr := *rawAttr // shallow copy so we can mutate it
+                        attr.Expr = exprWrap{
+                                Expression: attr.Expr,
+                                i:          b.iteration,
+                        }
+                        attrs[name] = &attr
+                } else {
+                        // If we have no active iteration then no wrapping is required.
+                        attrs[name] = rawAttr
+                }
+        }
+        return attrs
+}
+
+func (b *expandBody) expandBlocks(schema *hcl.BodySchema, rawBlocks hcl.Blocks, partial bool) (hcl.Blocks, hcl.Diagnostics) {
+        var blocks hcl.Blocks
+        var diags hcl.Diagnostics
+
+        for _, rawBlock := range rawBlocks {
+                switch rawBlock.Type {
+                case "dynamic":
+                        realBlockType := rawBlock.Labels[0]
+                        if _, hidden := b.hiddenBlocks[realBlockType]; hidden {
+                                continue
+                        }
+
+                        var blockS *hcl.BlockHeaderSchema
+                        for _, candidate := range schema.Blocks {
+                                if candidate.Type == realBlockType {
+                                        blockS = &candidate
+                                        break
+                                }
+                        }
+                        if blockS == nil {
+                                // Not a block type that the caller requested.
+                                if !partial {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Unsupported block type",
+                                                Detail:   fmt.Sprintf("Blocks of type %q are not expected here.", realBlockType),
+                                                Subject:  &rawBlock.LabelRanges[0],
+                                        })
+                                }
+                                continue
+                        }
+
+                        spec, specDiags := b.decodeSpec(blockS, rawBlock)
+                        diags = append(diags, specDiags...)
+                        if specDiags.HasErrors() {
+                                continue
+                        }
+
+                        if spec.forEachVal.IsKnown() {
+                                for it := spec.forEachVal.ElementIterator(); it.Next(); {
+                                        key, value := it.Element()
+                                        i := b.iteration.MakeChild(spec.iteratorName, key, value)
+
+                                        block, blockDiags := spec.newBlock(i, b.forEachCtx)
+                                        diags = append(diags, blockDiags...)
+                                        if block != nil {
+                                                // Attach our new iteration context so that attributes
+                                                // and other nested blocks can refer to our iterator.
+                                                block.Body = b.expandChild(block.Body, i)
+                                                blocks = append(blocks, block)
+                                        }
+                                }
+                        } else {
+                                // If our top-level iteration value isn't known then we're forced
+                                // to compromise since HCL doesn't have any concept of an
+                                // "unknown block". In this case then, we'll produce a single
+                                // dynamic block with the iterator values set to DynamicVal,
+                                // which at least makes the potential for a block visible
+                                // in our result, even though it's not represented in a fully-accurate
+                                // way.
+                                i := b.iteration.MakeChild(spec.iteratorName, cty.DynamicVal, cty.DynamicVal)
+                                block, blockDiags := spec.newBlock(i, b.forEachCtx)
+                                diags = append(diags, blockDiags...)
+                                if block != nil {
+                                        block.Body = b.expandChild(block.Body, i)
+
+                                        // We additionally force all of the leaf attribute values
+                                        // in the result to be unknown so the calling application
+                                        // can, if necessary, use that as a heuristic to detect
+                                        // when a single nested block might be standing in for
+                                        // multiple blocks yet to be expanded. This retains the
+                                        // structure of the generated body but forces all of its
+                                        // leaf attribute values to be unknown.
+                                        block.Body = unknownBody{block.Body}
+
+                                        blocks = append(blocks, block)
+                                }
+                        }
+
+                default:
+                        if _, hidden := b.hiddenBlocks[rawBlock.Type]; !hidden {
+                                // A static block doesn't create a new iteration context, but
+                                // it does need to inherit _our own_ iteration context in
+                                // case it contains expressions that refer to our inherited
+                                // iterators, or nested "dynamic" blocks.
+                                expandedBlock := *rawBlock // shallow copy
+                                expandedBlock.Body = b.expandChild(rawBlock.Body, b.iteration)
+                                blocks = append(blocks, &expandedBlock)
+                        }
+                }
+        }
+
+        return blocks, diags
+}
+
+func (b *expandBody) expandChild(child hcl.Body, i *iteration) hcl.Body {
+        chiCtx := i.EvalContext(b.forEachCtx)
+        ret := Expand(child, chiCtx)
+        ret.(*expandBody).iteration = i
+        return ret
+}
+
+func (b *expandBody) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
+        // blocks aren't allowed in JustAttributes mode and this body can
+        // only produce blocks, so we'll just pass straight through to our
+        // underlying body here.
+        return b.original.JustAttributes()
+}
+
+func (b *expandBody) MissingItemRange() hcl.Range {
+        return b.original.MissingItemRange()
+}
diff --git a/vendor/github.com/hashicorp/hcl2/ext/dynblock/expand_spec.go b/vendor/github.com/hashicorp/hcl2/ext/dynblock/expand_spec.go
new file mode 100644
index 0000000..41c0be2
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/dynblock/expand_spec.go
@@ -0,0 +1,215 @@
+package dynblock
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+)
+
+type expandSpec struct {
+        blockType      string
+        blockTypeRange hcl.Range
+        defRange       hcl.Range
+        forEachVal     cty.Value
+        iteratorName   string
+        labelExprs     []hcl.Expression
+        contentBody    hcl.Body
+        inherited      map[string]*iteration
+}
+
+func (b *expandBody) decodeSpec(blockS *hcl.BlockHeaderSchema, rawSpec *hcl.Block) (*expandSpec, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        var schema *hcl.BodySchema
+        if len(blockS.LabelNames) != 0 {
+                schema = dynamicBlockBodySchemaLabels
+        } else {
+                schema = dynamicBlockBodySchemaNoLabels
+        }
+
+        specContent, specDiags := rawSpec.Body.Content(schema)
+        diags = append(diags, specDiags...)
+        if specDiags.HasErrors() {
+                return nil, diags
+        }
+
+        //// for_each attribute
+
+        eachAttr := specContent.Attributes["for_each"]
+        eachVal, eachDiags := eachAttr.Expr.Value(b.forEachCtx)
+        diags = append(diags, eachDiags...)
+
+        if !eachVal.CanIterateElements() && eachVal.Type() != cty.DynamicPseudoType {
+                // We skip this error for DynamicPseudoType because that means we either
+                // have a null (which is checked immediately below) or an unknown
+                // (which is handled in the expandBody Content methods).
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity:    hcl.DiagError,
+                        Summary:     "Invalid dynamic for_each value",
+                        Detail:      fmt.Sprintf("Cannot use a %s value in for_each. An iterable collection is required.", eachVal.Type().FriendlyName()),
+                        Subject:     eachAttr.Expr.Range().Ptr(),
+                        Expression:  eachAttr.Expr,
+                        EvalContext: b.forEachCtx,
+                })
+                return nil, diags
+        }
+        if eachVal.IsNull() {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity:    hcl.DiagError,
+                        Summary:     "Invalid dynamic for_each value",
+                        Detail:      "Cannot use a null value in for_each.",
+                        Subject:     eachAttr.Expr.Range().Ptr(),
+                        Expression:  eachAttr.Expr,
+                        EvalContext: b.forEachCtx,
+                })
+                return nil, diags
+        }
+
+        //// iterator attribute
+
+        iteratorName := blockS.Type
+        if iteratorAttr := specContent.Attributes["iterator"]; iteratorAttr != nil {
+                itTraversal, itDiags := hcl.AbsTraversalForExpr(iteratorAttr.Expr)
+                diags = append(diags, itDiags...)
+                if itDiags.HasErrors() {
+                        return nil, diags
+                }
+
+                if len(itTraversal) != 1 {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid dynamic iterator name",
+                                Detail:   "Dynamic iterator must be a single variable name.",
+                                Subject:  itTraversal.SourceRange().Ptr(),
+                        })
+                        return nil, diags
+                }
+
+                iteratorName = itTraversal.RootName()
+        }
+
+        var labelExprs []hcl.Expression
+        if labelsAttr := specContent.Attributes["labels"]; labelsAttr != nil {
+                var labelDiags hcl.Diagnostics
+                labelExprs, labelDiags = hcl.ExprList(labelsAttr.Expr)
+                diags = append(diags, labelDiags...)
+                if labelDiags.HasErrors() {
+                        return nil, diags
+                }
+
+                if len(labelExprs) > len(blockS.LabelNames) {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Extraneous dynamic block label",
+                                Detail:   fmt.Sprintf("Blocks of type %q require %d label(s).", blockS.Type, len(blockS.LabelNames)),
+                                Subject:  labelExprs[len(blockS.LabelNames)].Range().Ptr(),
+                        })
+                        return nil, diags
+                } else if len(labelExprs) < len(blockS.LabelNames) {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Insufficient dynamic block labels",
+                                Detail:   fmt.Sprintf("Blocks of type %q require %d label(s).", blockS.Type, len(blockS.LabelNames)),
+                                Subject:  labelsAttr.Expr.Range().Ptr(),
+                        })
+                        return nil, diags
+                }
+        }
+
+        // Since our schema requests only blocks of type "content", we can assume
+        // that all entries in specContent.Blocks are content blocks.
+        if len(specContent.Blocks) == 0 {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Missing dynamic content block",
+                        Detail:   "A dynamic block must have a nested block of type \"content\" to describe the body of each generated block.",
+                        Subject:  &specContent.MissingItemRange,
+                })
+                return nil, diags
+        }
+        if len(specContent.Blocks) > 1 {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Extraneous dynamic content block",
+                        Detail:   "Only one nested content block is allowed for each dynamic block.",
+                        Subject:  &specContent.Blocks[1].DefRange,
+                })
+                return nil, diags
+        }
+
+        return &expandSpec{
+                blockType:      blockS.Type,
+                blockTypeRange: rawSpec.LabelRanges[0],
+                defRange:       rawSpec.DefRange,
+                forEachVal:     eachVal,
+                iteratorName:   iteratorName,
+                labelExprs:     labelExprs,
+                contentBody:    specContent.Blocks[0].Body,
+        }, diags
+}
+
+func (s *expandSpec) newBlock(i *iteration, ctx *hcl.EvalContext) (*hcl.Block, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        var labels []string
+        var labelRanges []hcl.Range
+        lCtx := i.EvalContext(ctx)
+        for _, labelExpr := range s.labelExprs {
+                labelVal, labelDiags := labelExpr.Value(lCtx)
+                diags = append(diags, labelDiags...)
+                if labelDiags.HasErrors() {
+                        return nil, diags
+                }
+
+                var convErr error
+                labelVal, convErr = convert.Convert(labelVal, cty.String)
+                if convErr != nil {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity:    hcl.DiagError,
+                                Summary:     "Invalid dynamic block label",
+                                Detail:      fmt.Sprintf("Cannot use this value as a dynamic block label: %s.", convErr),
+                                Subject:     labelExpr.Range().Ptr(),
+                                Expression:  labelExpr,
+                                EvalContext: lCtx,
+                        })
+                        return nil, diags
+                }
+                if labelVal.IsNull() {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity:    hcl.DiagError,
+                                Summary:     "Invalid dynamic block label",
+                                Detail:      "Cannot use a null value as a dynamic block label.",
+                                Subject:     labelExpr.Range().Ptr(),
+                                Expression:  labelExpr,
+                                EvalContext: lCtx,
+                        })
+                        return nil, diags
+                }
+                if !labelVal.IsKnown() {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity:    hcl.DiagError,
+                                Summary:     "Invalid dynamic block label",
+                                Detail:      "This value is not yet known. Dynamic block labels must be immediately-known values.",
+                                Subject:     labelExpr.Range().Ptr(),
+                                Expression:  labelExpr,
+                                EvalContext: lCtx,
+                        })
+                        return nil, diags
+                }
+
+                labels = append(labels, labelVal.AsString())
+                labelRanges = append(labelRanges, labelExpr.Range())
+        }
+
+        block := &hcl.Block{
+                Type:        s.blockType,
+                TypeRange:   s.blockTypeRange,
+                Labels:      labels,
+                LabelRanges: labelRanges,
+                DefRange:    s.defRange,
+                Body:        s.contentBody,
+        }
+
+        return block, diags
+}
diff --git a/vendor/github.com/hashicorp/hcl2/ext/dynblock/expr_wrap.go b/vendor/github.com/hashicorp/hcl2/ext/dynblock/expr_wrap.go
new file mode 100644
index 0000000..6916fc1
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/dynblock/expr_wrap.go
@@ -0,0 +1,42 @@
+package dynblock
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+type exprWrap struct {
+        hcl.Expression
+        i *iteration
+}
+
+func (e exprWrap) Variables() []hcl.Traversal {
+        raw := e.Expression.Variables()
+        ret := make([]hcl.Traversal, 0, len(raw))
+
+        // Filter out traversals that refer to our iterator name or any
+        // iterator we've inherited; we're going to provide those in
+        // our Value wrapper, so the caller doesn't need to know about them.
+        for _, traversal := range raw {
+                rootName := traversal.RootName()
+                if rootName == e.i.IteratorName {
+                        continue
+                }
+                if _, inherited := e.i.Inherited[rootName]; inherited {
+                        continue
+                }
+                ret = append(ret, traversal)
+        }
+        return ret
+}
+
+func (e exprWrap) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        extCtx := e.i.EvalContext(ctx)
+        return e.Expression.Value(extCtx)
+}
+
+// UnwrapExpression returns the expression being wrapped by this instance.
+// This allows the original expression to be recovered by hcl.UnwrapExpression.
+func (e exprWrap) UnwrapExpression() hcl.Expression {
+        return e.Expression
+}
diff --git a/vendor/github.com/hashicorp/hcl2/ext/dynblock/iteration.go b/vendor/github.com/hashicorp/hcl2/ext/dynblock/iteration.go
new file mode 100644
index 0000000..7056d33
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/dynblock/iteration.go
@@ -0,0 +1,66 @@
+package dynblock
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+type iteration struct {
+        IteratorName string
+        Key          cty.Value
+        Value        cty.Value
+        Inherited    map[string]*iteration
+}
+
+func (s *expandSpec) MakeIteration(key, value cty.Value) *iteration {
+        return &iteration{
+                IteratorName: s.iteratorName,
+                Key:          key,
+                Value:        value,
+                Inherited:    s.inherited,
+        }
+}
+
+func (i *iteration) Object() cty.Value {
+        return cty.ObjectVal(map[string]cty.Value{
+                "key":   i.Key,
+                "value": i.Value,
+        })
+}
+
+func (i *iteration) EvalContext(base *hcl.EvalContext) *hcl.EvalContext {
+        new := base.NewChild()
+
+        if i != nil {
+                new.Variables = map[string]cty.Value{}
+                for name, otherIt := range i.Inherited {
+                        new.Variables[name] = otherIt.Object()
+                }
+                new.Variables[i.IteratorName] = i.Object()
+        }
+
+        return new
+}
+
+func (i *iteration) MakeChild(iteratorName string, key, value cty.Value) *iteration {
+        if i == nil {
+                // Create entirely new root iteration, then
+                return &iteration{
+                        IteratorName: iteratorName,
+                        Key:          key,
+                        Value:        value,
+                }
+        }
+
+        inherited := map[string]*iteration{}
+        for name, otherIt := range i.Inherited {
+                inherited[name] = otherIt
+        }
+        inherited[i.IteratorName] = i
+        return &iteration{
+                IteratorName: iteratorName,
+                Key:          key,
+                Value:        value,
+                Inherited:    inherited,
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/ext/dynblock/public.go b/vendor/github.com/hashicorp/hcl2/ext/dynblock/public.go
new file mode 100644
index 0000000..b7e8ca9
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/dynblock/public.go
@@ -0,0 +1,44 @@
+package dynblock
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// Expand "dynamic" blocks in the given body, returning a new body that
+// has those blocks expanded.
+//
+// The given EvalContext is used when evaluating "for_each" and "labels"
+// attributes within dynamic blocks, allowing those expressions access to
+// variables and functions beyond the iterator variable created by the
+// iteration.
+//
+// Expand returns no diagnostics because no blocks are actually expanded
+// until a call to Content or PartialContent on the returned body, which
+// will then expand only the blocks selected by the schema.
+//
+// "dynamic" blocks are also expanded automatically within nested blocks
+// in the given body, including within other dynamic blocks, thus allowing
+// multi-dimensional iteration. However, it is not possible to
+// dynamically-generate the "dynamic" blocks themselves except through nesting.
+//
+//     parent {
+//       dynamic "child" {
+//         for_each = child_objs
+//         content {
+//           dynamic "grandchild" {
+//             for_each = child.value.children
+//             labels   = [grandchild.key]
+//             content {
+//               parent_key = child.key
+//               value      = grandchild.value
+//             }
+//           }
+//         }
+//       }
+//     }
+func Expand(body hcl.Body, ctx *hcl.EvalContext) hcl.Body {
+        return &expandBody{
+                original:   body,
+                forEachCtx: ctx,
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/ext/dynblock/schema.go b/vendor/github.com/hashicorp/hcl2/ext/dynblock/schema.go
new file mode 100644
index 0000000..dc8ed5a
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/dynblock/schema.go
@@ -0,0 +1,50 @@
+package dynblock
+
+import "github.com/hashicorp/hcl2/hcl"
+
+var dynamicBlockHeaderSchema = hcl.BlockHeaderSchema{
+        Type:       "dynamic",
+        LabelNames: []string{"type"},
+}
+
+var dynamicBlockBodySchemaLabels = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name:     "for_each",
+                        Required: true,
+                },
+                {
+                        Name:     "iterator",
+                        Required: false,
+                },
+                {
+                        Name:     "labels",
+                        Required: true,
+                },
+        },
+        Blocks: []hcl.BlockHeaderSchema{
+                {
+                        Type:       "content",
+                        LabelNames: nil,
+                },
+        },
+}
+
+var dynamicBlockBodySchemaNoLabels = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name:     "for_each",
+                        Required: true,
+                },
+                {
+                        Name:     "iterator",
+                        Required: false,
+                },
+        },
+        Blocks: []hcl.BlockHeaderSchema{
+                {
+                        Type:       "content",
+                        LabelNames: nil,
+                },
+        },
+}
diff --git a/vendor/github.com/hashicorp/hcl2/ext/dynblock/unknown_body.go b/vendor/github.com/hashicorp/hcl2/ext/dynblock/unknown_body.go
new file mode 100644
index 0000000..932f6a3
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/dynblock/unknown_body.go
@@ -0,0 +1,84 @@
+package dynblock
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// unknownBody is a funny body that just reports everything inside it as
+// unknown. It uses a given other body as a sort of template for what attributes
+// and blocks are inside -- including source location information -- but
+// subsitutes unknown values of unknown type for all attributes.
+//
+// This rather odd process is used to handle expansion of dynamic blocks whose
+// for_each expression is unknown. Since a block cannot itself be unknown,
+// we instead arrange for everything _inside_ the block to be unknown instead,
+// to give the best possible approximation.
+type unknownBody struct {
+        template hcl.Body
+}
+
+var _ hcl.Body = unknownBody{}
+
+func (b unknownBody) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) {
+        content, diags := b.template.Content(schema)
+        content = b.fixupContent(content)
+
+        // We're intentionally preserving the diagnostics reported from the
+        // inner body so that we can still report where the template body doesn't
+        // match the requested schema.
+        return content, diags
+}
+
+func (b unknownBody) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) {
+        content, remain, diags := b.template.PartialContent(schema)
+        content = b.fixupContent(content)
+        remain = unknownBody{remain} // remaining content must also be wrapped
+
+        // We're intentionally preserving the diagnostics reported from the
+        // inner body so that we can still report where the template body doesn't
+        // match the requested schema.
+        return content, remain, diags
+}
+
+func (b unknownBody) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
+        attrs, diags := b.template.JustAttributes()
+        attrs = b.fixupAttrs(attrs)
+
+        // We're intentionally preserving the diagnostics reported from the
+        // inner body so that we can still report where the template body doesn't
+        // match the requested schema.
+        return attrs, diags
+}
+
+func (b unknownBody) MissingItemRange() hcl.Range {
+        return b.template.MissingItemRange()
+}
+
+func (b unknownBody) fixupContent(got *hcl.BodyContent) *hcl.BodyContent {
+        ret := &hcl.BodyContent{}
+        ret.Attributes = b.fixupAttrs(got.Attributes)
+        if len(got.Blocks) > 0 {
+                ret.Blocks = make(hcl.Blocks, 0, len(got.Blocks))
+                for _, gotBlock := range got.Blocks {
+                        new := *gotBlock                      // shallow copy
+                        new.Body = unknownBody{gotBlock.Body} // nested content must also be marked unknown
+                        ret.Blocks = append(ret.Blocks, &new)
+                }
+        }
+
+        return ret
+}
+
+func (b unknownBody) fixupAttrs(got hcl.Attributes) hcl.Attributes {
+        if len(got) == 0 {
+                return nil
+        }
+        ret := make(hcl.Attributes, len(got))
+        for name, gotAttr := range got {
+                new := *gotAttr // shallow copy
+                new.Expr = hcl.StaticExpr(cty.DynamicVal, gotAttr.Expr.Range())
+                ret[name] = &new
+        }
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/hcl2/ext/dynblock/variables.go b/vendor/github.com/hashicorp/hcl2/ext/dynblock/variables.go
new file mode 100644
index 0000000..ad838f3
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/dynblock/variables.go
@@ -0,0 +1,209 @@
+package dynblock
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// WalkVariables begins the recursive process of walking all expressions and
+// nested blocks in the given body and its child bodies while taking into
+// account any "dynamic" blocks.
+//
+// This function requires that the caller walk through the nested block
+// structure in the given body level-by-level so that an appropriate schema
+// can be provided at each level to inform further processing. This workflow
+// is thus easiest to use for calling applications that have some higher-level
+// schema representation available with which to drive this multi-step
+// process. If your application uses the hcldec package, you may be able to
+// use VariablesHCLDec instead for a more automatic approach.
+func WalkVariables(body hcl.Body) WalkVariablesNode {
+        return WalkVariablesNode{
+                body:           body,
+                includeContent: true,
+        }
+}
+
+// WalkExpandVariables is like Variables but it includes only the variables
+// required for successful block expansion, ignoring any variables referenced
+// inside block contents. The result is the minimal set of all variables
+// required for a call to Expand, excluding variables that would only be
+// needed to subsequently call Content or PartialContent on the expanded
+// body.
+func WalkExpandVariables(body hcl.Body) WalkVariablesNode {
+        return WalkVariablesNode{
+                body: body,
+        }
+}
+
+type WalkVariablesNode struct {
+        body hcl.Body
+        it   *iteration
+
+        includeContent bool
+}
+
+type WalkVariablesChild struct {
+        BlockTypeName string
+        Node          WalkVariablesNode
+}
+
+// Body returns the HCL Body associated with the child node, in case the caller
+// wants to do some sort of inspection of it in order to decide what schema
+// to pass to Visit.
+//
+// Most implementations should just fetch a fixed schema based on the
+// BlockTypeName field and not access this. Deciding on a schema dynamically
+// based on the body is a strange thing to do and generally necessary only if
+// your caller is already doing other bizarre things with HCL bodies.
+func (c WalkVariablesChild) Body() hcl.Body {
+        return c.Node.body
+}
+
+// Visit returns the variable traversals required for any "dynamic" blocks
+// directly in the body associated with this node, and also returns any child
+// nodes that must be visited in order to continue the walk.
+//
+// Each child node has its associated block type name given in its BlockTypeName
+// field, which the calling application should use to determine the appropriate
+// schema for the content of each child node and pass it to the child node's
+// own Visit method to continue the walk recursively.
+func (n WalkVariablesNode) Visit(schema *hcl.BodySchema) (vars []hcl.Traversal, children []WalkVariablesChild) {
+        extSchema := n.extendSchema(schema)
+        container, _, _ := n.body.PartialContent(extSchema)
+        if container == nil {
+                return vars, children
+        }
+
+        children = make([]WalkVariablesChild, 0, len(container.Blocks))
+
+        if n.includeContent {
+                for _, attr := range container.Attributes {
+                        for _, traversal := range attr.Expr.Variables() {
+                                var ours, inherited bool
+                                if n.it != nil {
+                                        ours = traversal.RootName() == n.it.IteratorName
+                                        _, inherited = n.it.Inherited[traversal.RootName()]
+                                }
+
+                                if !(ours || inherited) {
+                                        vars = append(vars, traversal)
+                                }
+                        }
+                }
+        }
+
+        for _, block := range container.Blocks {
+                switch block.Type {
+
+                case "dynamic":
+                        blockTypeName := block.Labels[0]
+                        inner, _, _ := block.Body.PartialContent(variableDetectionInnerSchema)
+                        if inner == nil {
+                                continue
+                        }
+
+                        iteratorName := blockTypeName
+                        if attr, exists := inner.Attributes["iterator"]; exists {
+                                iterTraversal, _ := hcl.AbsTraversalForExpr(attr.Expr)
+                                if len(iterTraversal) == 0 {
+                                        // Ignore this invalid dynamic block, since it'll produce
+                                        // an error if someone tries to extract content from it
+                                        // later anyway.
+                                        continue
+                                }
+                                iteratorName = iterTraversal.RootName()
+                        }
+                        blockIt := n.it.MakeChild(iteratorName, cty.DynamicVal, cty.DynamicVal)
+
+                        if attr, exists := inner.Attributes["for_each"]; exists {
+                                // Filter out iterator names inherited from parent blocks
+                                for _, traversal := range attr.Expr.Variables() {
+                                        if _, inherited := blockIt.Inherited[traversal.RootName()]; !inherited {
+                                                vars = append(vars, traversal)
+                                        }
+                                }
+                        }
+                        if attr, exists := inner.Attributes["labels"]; exists {
+                                // Filter out both our own iterator name _and_ those inherited
+                                // from parent blocks, since we provide _both_ of these to the
+                                // label expressions.
+                                for _, traversal := range attr.Expr.Variables() {
+                                        ours := traversal.RootName() == iteratorName
+                                        _, inherited := blockIt.Inherited[traversal.RootName()]
+
+                                        if !(ours || inherited) {
+                                                vars = append(vars, traversal)
+                                        }
+                                }
+                        }
+
+                        for _, contentBlock := range inner.Blocks {
+                                // We only request "content" blocks in our schema, so we know
+                                // any blocks we find here will be content blocks. We require
+                                // exactly one content block for actual expansion, but we'll
+                                // be more liberal here so that callers can still collect
+                                // variables from erroneous "dynamic" blocks.
+                                children = append(children, WalkVariablesChild{
+                                        BlockTypeName: blockTypeName,
+                                        Node: WalkVariablesNode{
+                                                body:           contentBlock.Body,
+                                                it:             blockIt,
+                                                includeContent: n.includeContent,
+                                        },
+                                })
+                        }
+
+                default:
+                        children = append(children, WalkVariablesChild{
+                                BlockTypeName: block.Type,
+                                Node: WalkVariablesNode{
+                                        body:           block.Body,
+                                        it:             n.it,
+                                        includeContent: n.includeContent,
+                                },
+                        })
+
+                }
+        }
+
+        return vars, children
+}
+
+func (n WalkVariablesNode) extendSchema(schema *hcl.BodySchema) *hcl.BodySchema {
+        // We augment the requested schema to also include our special "dynamic"
+        // block type, since then we'll get instances of it interleaved with
+        // all of the literal child blocks we must also include.
+        extSchema := &hcl.BodySchema{
+                Attributes: schema.Attributes,
+                Blocks:     make([]hcl.BlockHeaderSchema, len(schema.Blocks), len(schema.Blocks)+1),
+        }
+        copy(extSchema.Blocks, schema.Blocks)
+        extSchema.Blocks = append(extSchema.Blocks, dynamicBlockHeaderSchema)
+
+        return extSchema
+}
+
+// This is a more relaxed schema than what's in schema.go, since we
+// want to maximize the amount of variables we can find even if there
+// are erroneous blocks.
+var variableDetectionInnerSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name:     "for_each",
+                        Required: false,
+                },
+                {
+                        Name:     "labels",
+                        Required: false,
+                },
+                {
+                        Name:     "iterator",
+                        Required: false,
+                },
+        },
+        Blocks: []hcl.BlockHeaderSchema{
+                {
+                        Type: "content",
+                },
+        },
+}
diff --git a/vendor/github.com/hashicorp/hcl2/ext/dynblock/variables_hcldec.go b/vendor/github.com/hashicorp/hcl2/ext/dynblock/variables_hcldec.go
new file mode 100644
index 0000000..a078d91
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/dynblock/variables_hcldec.go
@@ -0,0 +1,43 @@
+package dynblock
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcldec"
+)
+
+// VariablesHCLDec is a wrapper around WalkVariables that uses the given hcldec
+// specification to automatically drive the recursive walk through nested
+// blocks in the given body.
+//
+// This is a drop-in replacement for hcldec.Variables which is able to treat
+// blocks of type "dynamic" in the same special way that dynblock.Expand would,
+// exposing both the variables referenced in the "for_each" and "labels"
+// arguments and variables used in the nested "content" block.
+func VariablesHCLDec(body hcl.Body, spec hcldec.Spec) []hcl.Traversal {
+        rootNode := WalkVariables(body)
+        return walkVariablesWithHCLDec(rootNode, spec)
+}
+
+// ExpandVariablesHCLDec is like VariablesHCLDec but it includes only the
+// minimal set of variables required to call Expand, ignoring variables that
+// are referenced only inside normal block contents. See WalkExpandVariables
+// for more information.
+func ExpandVariablesHCLDec(body hcl.Body, spec hcldec.Spec) []hcl.Traversal {
+        rootNode := WalkExpandVariables(body)
+        return walkVariablesWithHCLDec(rootNode, spec)
+}
+
+func walkVariablesWithHCLDec(node WalkVariablesNode, spec hcldec.Spec) []hcl.Traversal {
+        vars, children := node.Visit(hcldec.ImpliedSchema(spec))
+
+        if len(children) > 0 {
+                childSpecs := hcldec.ChildBlockTypes(spec)
+                for _, child := range children {
+                        if childSpec, exists := childSpecs[child.BlockTypeName]; exists {
+                                vars = append(vars, walkVariablesWithHCLDec(child.Node, childSpec)...)
+                        }
+                }
+        }
+
+        return vars
+}
diff --git a/vendor/github.com/hashicorp/hcl2/ext/typeexpr/README.md b/vendor/github.com/hashicorp/hcl2/ext/typeexpr/README.md
new file mode 100644
index 0000000..ff2b3f2
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/typeexpr/README.md
@@ -0,0 +1,67 @@
+# HCL Type Expressions Extension
+
+This HCL extension defines a convention for describing HCL types using function
+call and variable reference syntax, allowing configuration formats to include
+type information provided by users.
+
+The type syntax is processed statically from a hcl.Expression, so it cannot
+use any of the usual language operators. This is similar to type expressions
+in statically-typed programming languages.
+
+```hcl
+variable "example" {
+  type = list(string)
+}
+```
+
+The extension is built using the `hcl.ExprAsKeyword` and `hcl.ExprCall`
+functions, and so it relies on the underlying syntax to define how "keyword"
+and "call" are interpreted. The above shows how they are interpreted in
+the HCL native syntax, while the following shows the same information
+expressed in JSON:
+
+```json
+{
+  "variable": {
+    "example": {
+      "type": "list(string)"
+    }
+  }
+}
+```
+
+Notice that since we have additional contextual information that we intend
+to allow only calls and keywords the JSON syntax is able to parse the given
+string directly as an expression, rather than as a template as would be
+the case for normal expression evaluation.
+
+For more information, see [the godoc reference](http://godoc.org/github.com/hashicorp/hcl2/ext/typeexpr).
+
+## Type Expression Syntax
+
+When expressed in the native syntax, the following expressions are permitted
+in a type expression:
+
+* `string` - string
+* `bool` - boolean
+* `number` - number
+* `any` - `cty.DynamicPseudoType` (in function `TypeConstraint` only)
+* `list(<type_expr>)` - list of the type given as an argument
+* `set(<type_expr>)` - set of the type given as an argument
+* `map(<type_expr>)` - map of the type given as an argument
+* `tuple([<type_exprs...>])` - tuple with the element types given in the single list argument
+* `object({<attr_name>=<type_expr>, ...}` - object with the attributes and corresponding types given in the single map argument
+
+For example:
+
+* `list(string)`
+* `object({name=string,age=number})`
+* `map(object({name=string,age=number}))`
+
+Note that the object constructor syntax is not fully-general for all possible
+object types because it requires the attribute names to be valid identifiers.
+In practice it is expected that any time an object type is being fixed for
+type checking it will be one that has identifiers as its attributes; object
+types with weird attributes generally show up only from arbitrary object
+constructors in configuration files, which are usually treated either as maps
+or as the dynamic pseudo-type.
diff --git a/vendor/github.com/hashicorp/hcl2/ext/typeexpr/doc.go b/vendor/github.com/hashicorp/hcl2/ext/typeexpr/doc.go
new file mode 100644
index 0000000..c4b3795
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/typeexpr/doc.go
@@ -0,0 +1,11 @@
+// Package typeexpr extends HCL with a convention for describing HCL types
+// within configuration files.
+//
+// The type syntax is processed statically from a hcl.Expression, so it cannot
+// use any of the usual language operators. This is similar to type expressions
+// in statically-typed programming languages.
+//
+//     variable "example" {
+//       type = list(string)
+//     }
+package typeexpr
diff --git a/vendor/github.com/hashicorp/hcl2/ext/typeexpr/get_type.go b/vendor/github.com/hashicorp/hcl2/ext/typeexpr/get_type.go
new file mode 100644
index 0000000..a84338a
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/typeexpr/get_type.go
@@ -0,0 +1,196 @@
+package typeexpr
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+const invalidTypeSummary = "Invalid type specification"
+
+// getType is the internal implementation of both Type and TypeConstraint,
+// using the passed flag to distinguish. When constraint is false, the "any"
+// keyword will produce an error.
+func getType(expr hcl.Expression, constraint bool) (cty.Type, hcl.Diagnostics) {
+        // First we'll try for one of our keywords
+        kw := hcl.ExprAsKeyword(expr)
+        switch kw {
+        case "bool":
+                return cty.Bool, nil
+        case "string":
+                return cty.String, nil
+        case "number":
+                return cty.Number, nil
+        case "any":
+                if constraint {
+                        return cty.DynamicPseudoType, nil
+                }
+                return cty.DynamicPseudoType, hcl.Diagnostics{{
+                        Severity: hcl.DiagError,
+                        Summary:  invalidTypeSummary,
+                        Detail:   fmt.Sprintf("The keyword %q cannot be used in this type specification: an exact type is required.", kw),
+                        Subject:  expr.Range().Ptr(),
+                }}
+        case "list", "map", "set":
+                return cty.DynamicPseudoType, hcl.Diagnostics{{
+                        Severity: hcl.DiagError,
+                        Summary:  invalidTypeSummary,
+                        Detail:   fmt.Sprintf("The %s type constructor requires one argument specifying the element type.", kw),
+                        Subject:  expr.Range().Ptr(),
+                }}
+        case "object":
+                return cty.DynamicPseudoType, hcl.Diagnostics{{
+                        Severity: hcl.DiagError,
+                        Summary:  invalidTypeSummary,
+                        Detail:   "The object type constructor requires one argument specifying the attribute types and values as a map.",
+                        Subject:  expr.Range().Ptr(),
+                }}
+        case "tuple":
+                return cty.DynamicPseudoType, hcl.Diagnostics{{
+                        Severity: hcl.DiagError,
+                        Summary:  invalidTypeSummary,
+                        Detail:   "The tuple type constructor requires one argument specifying the element types as a list.",
+                        Subject:  expr.Range().Ptr(),
+                }}
+        case "":
+                // okay! we'll fall through and try processing as a call, then.
+        default:
+                return cty.DynamicPseudoType, hcl.Diagnostics{{
+                        Severity: hcl.DiagError,
+                        Summary:  invalidTypeSummary,
+                        Detail:   fmt.Sprintf("The keyword %q is not a valid type specification.", kw),
+                        Subject:  expr.Range().Ptr(),
+                }}
+        }
+
+        // If we get down here then our expression isn't just a keyword, so we'll
+        // try to process it as a call instead.
+        call, diags := hcl.ExprCall(expr)
+        if diags.HasErrors() {
+                return cty.DynamicPseudoType, hcl.Diagnostics{{
+                        Severity: hcl.DiagError,
+                        Summary:  invalidTypeSummary,
+                        Detail:   "A type specification is either a primitive type keyword (bool, number, string) or a complex type constructor call, like list(string).",
+                        Subject:  expr.Range().Ptr(),
+                }}
+        }
+
+        switch call.Name {
+        case "bool", "string", "number", "any":
+                return cty.DynamicPseudoType, hcl.Diagnostics{{
+                        Severity: hcl.DiagError,
+                        Summary:  invalidTypeSummary,
+                        Detail:   fmt.Sprintf("Primitive type keyword %q does not expect arguments.", call.Name),
+                        Subject:  &call.ArgsRange,
+                }}
+        }
+
+        if len(call.Arguments) != 1 {
+                contextRange := call.ArgsRange
+                subjectRange := call.ArgsRange
+                if len(call.Arguments) > 1 {
+                        // If we have too many arguments (as opposed to too _few_) then
+                        // we'll highlight the extraneous arguments as the diagnostic
+                        // subject.
+                        subjectRange = hcl.RangeBetween(call.Arguments[1].Range(), call.Arguments[len(call.Arguments)-1].Range())
+                }
+
+                switch call.Name {
+                case "list", "set", "map":
+                        return cty.DynamicPseudoType, hcl.Diagnostics{{
+                                Severity: hcl.DiagError,
+                                Summary:  invalidTypeSummary,
+                                Detail:   fmt.Sprintf("The %s type constructor requires one argument specifying the element type.", call.Name),
+                                Subject:  &subjectRange,
+                                Context:  &contextRange,
+                        }}
+                case "object":
+                        return cty.DynamicPseudoType, hcl.Diagnostics{{
+                                Severity: hcl.DiagError,
+                                Summary:  invalidTypeSummary,
+                                Detail:   "The object type constructor requires one argument specifying the attribute types and values as a map.",
+                                Subject:  &subjectRange,
+                                Context:  &contextRange,
+                        }}
+                case "tuple":
+                        return cty.DynamicPseudoType, hcl.Diagnostics{{
+                                Severity: hcl.DiagError,
+                                Summary:  invalidTypeSummary,
+                                Detail:   "The tuple type constructor requires one argument specifying the element types as a list.",
+                                Subject:  &subjectRange,
+                                Context:  &contextRange,
+                        }}
+                }
+        }
+
+        switch call.Name {
+
+        case "list":
+                ety, diags := getType(call.Arguments[0], constraint)
+                return cty.List(ety), diags
+        case "set":
+                ety, diags := getType(call.Arguments[0], constraint)
+                return cty.Set(ety), diags
+        case "map":
+                ety, diags := getType(call.Arguments[0], constraint)
+                return cty.Map(ety), diags
+        case "object":
+                attrDefs, diags := hcl.ExprMap(call.Arguments[0])
+                if diags.HasErrors() {
+                        return cty.DynamicPseudoType, hcl.Diagnostics{{
+                                Severity: hcl.DiagError,
+                                Summary:  invalidTypeSummary,
+                                Detail:   "Object type constructor requires a map whose keys are attribute names and whose values are the corresponding attribute types.",
+                                Subject:  call.Arguments[0].Range().Ptr(),
+                                Context:  expr.Range().Ptr(),
+                        }}
+                }
+
+                atys := make(map[string]cty.Type)
+                for _, attrDef := range attrDefs {
+                        attrName := hcl.ExprAsKeyword(attrDef.Key)
+                        if attrName == "" {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  invalidTypeSummary,
+                                        Detail:   "Object constructor map keys must be attribute names.",
+                                        Subject:  attrDef.Key.Range().Ptr(),
+                                        Context:  expr.Range().Ptr(),
+                                })
+                                continue
+                        }
+                        aty, attrDiags := getType(attrDef.Value, constraint)
+                        diags = append(diags, attrDiags...)
+                        atys[attrName] = aty
+                }
+                return cty.Object(atys), diags
+        case "tuple":
+                elemDefs, diags := hcl.ExprList(call.Arguments[0])
+                if diags.HasErrors() {
+                        return cty.DynamicPseudoType, hcl.Diagnostics{{
+                                Severity: hcl.DiagError,
+                                Summary:  invalidTypeSummary,
+                                Detail:   "Tuple type constructor requires a list of element types.",
+                                Subject:  call.Arguments[0].Range().Ptr(),
+                                Context:  expr.Range().Ptr(),
+                        }}
+                }
+                etys := make([]cty.Type, len(elemDefs))
+                for i, defExpr := range elemDefs {
+                        ety, elemDiags := getType(defExpr, constraint)
+                        diags = append(diags, elemDiags...)
+                        etys[i] = ety
+                }
+                return cty.Tuple(etys), diags
+        default:
+                // Can't access call.Arguments in this path because we've not validated
+                // that it contains exactly one expression here.
+                return cty.DynamicPseudoType, hcl.Diagnostics{{
+                        Severity: hcl.DiagError,
+                        Summary:  invalidTypeSummary,
+                        Detail:   fmt.Sprintf("Keyword %q is not a valid type constructor.", call.Name),
+                        Subject:  expr.Range().Ptr(),
+                }}
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/ext/typeexpr/public.go b/vendor/github.com/hashicorp/hcl2/ext/typeexpr/public.go
new file mode 100644
index 0000000..e3f5eef
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/ext/typeexpr/public.go
@@ -0,0 +1,129 @@
+package typeexpr
+
+import (
+        "bytes"
+        "fmt"
+        "sort"
+
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Type attempts to process the given expression as a type expression and, if
+// successful, returns the resulting type. If unsuccessful, error diagnostics
+// are returned.
+func Type(expr hcl.Expression) (cty.Type, hcl.Diagnostics) {
+        return getType(expr, false)
+}
+
+// TypeConstraint attempts to parse the given expression as a type constraint
+// and, if successful, returns the resulting type. If unsuccessful, error
+// diagnostics are returned.
+//
+// A type constraint has the same structure as a type, but it additionally
+// allows the keyword "any" to represent cty.DynamicPseudoType, which is often
+// used as a wildcard in type checking and type conversion operations.
+func TypeConstraint(expr hcl.Expression) (cty.Type, hcl.Diagnostics) {
+        return getType(expr, true)
+}
+
+// TypeString returns a string rendering of the given type as it would be
+// expected to appear in the HCL native syntax.
+//
+// This is primarily intended for showing types to the user in an application
+// that uses typexpr, where the user can be assumed to be familiar with the
+// type expression syntax. In applications that do not use typeexpr these
+// results may be confusing to the user and so type.FriendlyName may be
+// preferable, even though it's less precise.
+//
+// TypeString produces reasonable results only for types like what would be
+// produced by the Type and TypeConstraint functions. In particular, it cannot
+// support capsule types.
+func TypeString(ty cty.Type) string {
+        // Easy cases first
+        switch ty {
+        case cty.String:
+                return "string"
+        case cty.Bool:
+                return "bool"
+        case cty.Number:
+                return "number"
+        case cty.DynamicPseudoType:
+                return "any"
+        }
+
+        if ty.IsCapsuleType() {
+                panic("TypeString does not support capsule types")
+        }
+
+        if ty.IsCollectionType() {
+                ety := ty.ElementType()
+                etyString := TypeString(ety)
+                switch {
+                case ty.IsListType():
+                        return fmt.Sprintf("list(%s)", etyString)
+                case ty.IsSetType():
+                        return fmt.Sprintf("set(%s)", etyString)
+                case ty.IsMapType():
+                        return fmt.Sprintf("map(%s)", etyString)
+                default:
+                        // Should never happen because the above is exhaustive
+                        panic("unsupported collection type")
+                }
+        }
+
+        if ty.IsObjectType() {
+                var buf bytes.Buffer
+                buf.WriteString("object({")
+                atys := ty.AttributeTypes()
+                names := make([]string, 0, len(atys))
+                for name := range atys {
+                        names = append(names, name)
+                }
+                sort.Strings(names)
+                first := true
+                for _, name := range names {
+                        aty := atys[name]
+                        if !first {
+                                buf.WriteByte(',')
+                        }
+                        if !hclsyntax.ValidIdentifier(name) {
+                                // Should never happen for any type produced by this package,
+                                // but we'll do something reasonable here just so we don't
+                                // produce garbage if someone gives us a hand-assembled object
+                                // type that has weird attribute names.
+                                // Using Go-style quoting here isn't perfect, since it doesn't
+                                // exactly match HCL syntax, but it's fine for an edge-case.
+                                buf.WriteString(fmt.Sprintf("%q", name))
+                        } else {
+                                buf.WriteString(name)
+                        }
+                        buf.WriteByte('=')
+                        buf.WriteString(TypeString(aty))
+                        first = false
+                }
+                buf.WriteString("})")
+                return buf.String()
+        }
+
+        if ty.IsTupleType() {
+                var buf bytes.Buffer
+                buf.WriteString("tuple([")
+                etys := ty.TupleElementTypes()
+                first := true
+                for _, ety := range etys {
+                        if !first {
+                                buf.WriteByte(',')
+                        }
+                        buf.WriteString(TypeString(ety))
+                        first = false
+                }
+                buf.WriteString("])")
+                return buf.String()
+        }
+
+        // Should never happen because we covered all cases above.
+        panic(fmt.Errorf("unsupported type %#v", ty))
+}
diff --git a/vendor/github.com/hashicorp/hcl2/gohcl/doc.go b/vendor/github.com/hashicorp/hcl2/gohcl/doc.go
index 8500214..aa3c6ea 100644
--- a/vendor/github.com/hashicorp/hcl2/gohcl/doc.go
+++ b/vendor/github.com/hashicorp/hcl2/gohcl/doc.go
@@ -40,6 +40,10 @@
 // present then any attributes or blocks not matched by another valid tag
 // will cause an error diagnostic.
 //
+// Only a subset of this tagging/typing vocabulary is supported for the
+// "Encode" family of functions. See the EncodeIntoBody docs for full details
+// on the constraints there.
+//
 // Broadly-speaking this package deals with two types of error. The first is
 // errors in the configuration itself, which are returned as diagnostics
 // written with the configuration author as the target audience. The second
diff --git a/vendor/github.com/hashicorp/hcl2/gohcl/encode.go b/vendor/github.com/hashicorp/hcl2/gohcl/encode.go
new file mode 100644
index 0000000..3cbf7e4
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/gohcl/encode.go
@@ -0,0 +1,191 @@
+package gohcl
+
+import (
+        "fmt"
+        "reflect"
+        "sort"
+
+        "github.com/hashicorp/hcl2/hclwrite"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+// EncodeIntoBody replaces the contents of the given hclwrite Body with
+// attributes and blocks derived from the given value, which must be a
+// struct value or a pointer to a struct value with the struct tags defined
+// in this package.
+//
+// This function can work only with fully-decoded data. It will ignore any
+// fields tagged as "remain", any fields that decode attributes into either
+// hcl.Attribute or hcl.Expression values, and any fields that decode blocks
+// into hcl.Attributes values. This function does not have enough information
+// to complete the decoding of these types.
+//
+// Any fields tagged as "label" are ignored by this function. Use EncodeAsBlock
+// to produce a whole hclwrite.Block including block labels.
+//
+// As long as a suitable value is given to encode and the destination body
+// is non-nil, this function will always complete. It will panic in case of
+// any errors in the calling program, such as passing an inappropriate type
+// or a nil body.
+//
+// The layout of the resulting HCL source is derived from the ordering of
+// the struct fields, with blank lines around nested blocks of different types.
+// Fields representing attributes should usually precede those representing
+// blocks so that the attributes can group togather in the result. For more
+// control, use the hclwrite API directly.
+func EncodeIntoBody(val interface{}, dst *hclwrite.Body) {
+        rv := reflect.ValueOf(val)
+        ty := rv.Type()
+        if ty.Kind() == reflect.Ptr {
+                rv = rv.Elem()
+                ty = rv.Type()
+        }
+        if ty.Kind() != reflect.Struct {
+                panic(fmt.Sprintf("value is %s, not struct", ty.Kind()))
+        }
+
+        tags := getFieldTags(ty)
+        populateBody(rv, ty, tags, dst)
+}
+
+// EncodeAsBlock creates a new hclwrite.Block populated with the data from
+// the given value, which must be a struct or pointer to struct with the
+// struct tags defined in this package.
+//
+// If the given struct type has fields tagged with "label" tags then they
+// will be used in order to annotate the created block with labels.
+//
+// This function has the same constraints as EncodeIntoBody and will panic
+// if they are violated.
+func EncodeAsBlock(val interface{}, blockType string) *hclwrite.Block {
+        rv := reflect.ValueOf(val)
+        ty := rv.Type()
+        if ty.Kind() == reflect.Ptr {
+                rv = rv.Elem()
+                ty = rv.Type()
+        }
+        if ty.Kind() != reflect.Struct {
+                panic(fmt.Sprintf("value is %s, not struct", ty.Kind()))
+        }
+
+        tags := getFieldTags(ty)
+        labels := make([]string, len(tags.Labels))
+        for i, lf := range tags.Labels {
+                lv := rv.Field(lf.FieldIndex)
+                // We just stringify whatever we find. It should always be a string
+                // but if not then we'll still do something reasonable.
+                labels[i] = fmt.Sprintf("%s", lv.Interface())
+        }
+
+        block := hclwrite.NewBlock(blockType, labels)
+        populateBody(rv, ty, tags, block.Body())
+        return block
+}
+
+func populateBody(rv reflect.Value, ty reflect.Type, tags *fieldTags, dst *hclwrite.Body) {
+        nameIdxs := make(map[string]int, len(tags.Attributes)+len(tags.Blocks))
+        namesOrder := make([]string, 0, len(tags.Attributes)+len(tags.Blocks))
+        for n, i := range tags.Attributes {
+                nameIdxs[n] = i
+                namesOrder = append(namesOrder, n)
+        }
+        for n, i := range tags.Blocks {
+                nameIdxs[n] = i
+                namesOrder = append(namesOrder, n)
+        }
+        sort.SliceStable(namesOrder, func(i, j int) bool {
+                ni, nj := namesOrder[i], namesOrder[j]
+                return nameIdxs[ni] < nameIdxs[nj]
+        })
+
+        dst.Clear()
+
+        prevWasBlock := false
+        for _, name := range namesOrder {
+                fieldIdx := nameIdxs[name]
+                field := ty.Field(fieldIdx)
+                fieldTy := field.Type
+                fieldVal := rv.Field(fieldIdx)
+
+                if fieldTy.Kind() == reflect.Ptr {
+                        fieldTy = fieldTy.Elem()
+                        fieldVal = fieldVal.Elem()
+                }
+
+                if _, isAttr := tags.Attributes[name]; isAttr {
+
+                        if exprType.AssignableTo(fieldTy) || attrType.AssignableTo(fieldTy) {
+                                continue // ignore undecoded fields
+                        }
+                        if !fieldVal.IsValid() {
+                                continue // ignore (field value is nil pointer)
+                        }
+                        if fieldTy.Kind() == reflect.Ptr && fieldVal.IsNil() {
+                                continue // ignore
+                        }
+                        if prevWasBlock {
+                                dst.AppendNewline()
+                                prevWasBlock = false
+                        }
+
+                        valTy, err := gocty.ImpliedType(fieldVal.Interface())
+                        if err != nil {
+                                panic(fmt.Sprintf("cannot encode %T as HCL expression: %s", fieldVal.Interface(), err))
+                        }
+
+                        val, err := gocty.ToCtyValue(fieldVal.Interface(), valTy)
+                        if err != nil {
+                                // This should never happen, since we should always be able
+                                // to decode into the implied type.
+                                panic(fmt.Sprintf("failed to encode %T as %#v: %s", fieldVal.Interface(), valTy, err))
+                        }
+
+                        dst.SetAttributeValue(name, val)
+
+                } else { // must be a block, then
+                        elemTy := fieldTy
+                        isSeq := false
+                        if elemTy.Kind() == reflect.Slice || elemTy.Kind() == reflect.Array {
+                                isSeq = true
+                                elemTy = elemTy.Elem()
+                        }
+
+                        if bodyType.AssignableTo(elemTy) || attrsType.AssignableTo(elemTy) {
+                                continue // ignore undecoded fields
+                        }
+                        prevWasBlock = false
+
+                        if isSeq {
+                                l := fieldVal.Len()
+                                for i := 0; i < l; i++ {
+                                        elemVal := fieldVal.Index(i)
+                                        if !elemVal.IsValid() {
+                                                continue // ignore (elem value is nil pointer)
+                                        }
+                                        if elemTy.Kind() == reflect.Ptr && elemVal.IsNil() {
+                                                continue // ignore
+                                        }
+                                        block := EncodeAsBlock(elemVal.Interface(), name)
+                                        if !prevWasBlock {
+                                                dst.AppendNewline()
+                                                prevWasBlock = true
+                                        }
+                                        dst.AppendBlock(block)
+                                }
+                        } else {
+                                if !fieldVal.IsValid() {
+                                        continue // ignore (field value is nil pointer)
+                                }
+                                if elemTy.Kind() == reflect.Ptr && fieldVal.IsNil() {
+                                        continue // ignore
+                                }
+                                block := EncodeAsBlock(fieldVal.Interface(), name)
+                                if !prevWasBlock {
+                                        dst.AppendNewline()
+                                        prevWasBlock = true
+                                }
+                                dst.AppendBlock(block)
+                        }
+                }
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/diagnostic.go b/vendor/github.com/hashicorp/hcl2/hcl/diagnostic.go
index 6ecf744..c320961 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/diagnostic.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/diagnostic.go
@@ -26,14 +26,43 @@ const (
 type Diagnostic struct {
         Severity DiagnosticSeverity
 
-        // Summary and detail contain the English-language description of the
+        // Summary and Detail contain the English-language description of the
         // problem. Summary is a terse description of the general problem and
         // detail is a more elaborate, often-multi-sentence description of
         // the probem and what might be done to solve it.
         Summary string
         Detail  string
+
+        // Subject and Context are both source ranges relating to the diagnostic.
+        //
+        // Subject is a tight range referring to exactly the construct that
+        // is problematic, while Context is an optional broader range (which should
+        // fully contain Subject) that ought to be shown around Subject when
+        // generating isolated source-code snippets in diagnostic messages.
+        // If Context is nil, the Subject is also the Context.
+        //
+        // Some diagnostics have no source ranges at all. If Context is set then
+        // Subject should always also be set.
         Subject *Range
         Context *Range
+
+        // For diagnostics that occur when evaluating an expression, Expression
+        // may refer to that expression and EvalContext may point to the
+        // EvalContext that was active when evaluating it. This may allow for the
+        // inclusion of additional useful information when rendering a diagnostic
+        // message to the user.
+        //
+        // It is not always possible to select a single EvalContext for a
+        // diagnostic, and so in some cases this field may be nil even when an
+        // expression causes a problem.
+        //
+        // EvalContexts form a tree, so the given EvalContext may refer to a parent
+        // which in turn refers to another parent, etc. For a full picture of all
+        // of the active variables and functions the caller must walk up this
+        // chain, preferring definitions that are "closer" to the expression in
+        // case of colliding names.
+        Expression  Expression
+        EvalContext *EvalContext
 }
 
 // Diagnostics is a list of Diagnostic instances.
@@ -96,6 +125,17 @@ func (d Diagnostics) HasErrors() bool {
         return false
 }
 
+func (d Diagnostics) Errs() []error {
+        var errs []error
+        for _, diag := range d {
+                if diag.Severity == DiagError {
+                        errs = append(errs, diag)
+                }
+        }
+
+        return errs
+}
+
 // A DiagnosticWriter emits diagnostics somehow.
 type DiagnosticWriter interface {
         WriteDiagnostic(*Diagnostic) error
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/diagnostic_text.go b/vendor/github.com/hashicorp/hcl2/hcl/diagnostic_text.go
index dfa473a..0b4a262 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/diagnostic_text.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/diagnostic_text.go
@@ -2,11 +2,14 @@ package hcl
 
 import (
         "bufio"
+        "bytes"
         "errors"
         "fmt"
         "io"
+        "sort"
 
         wordwrap "github.com/mitchellh/go-wordwrap"
+        "github.com/zclconf/go-cty/cty"
 )
 
 type diagnosticTextWriter struct {
@@ -133,6 +136,62 @@ func (w *diagnosticTextWriter) WriteDiagnostic(diag *Diagnostic) error {
 
                         w.wr.Write([]byte{'\n'})
                 }
+
+                if diag.Expression != nil && diag.EvalContext != nil {
+                        // We will attempt to render the values for any variables
+                        // referenced in the given expression as additional context, for
+                        // situations where the same expression is evaluated multiple
+                        // times in different scopes.
+                        expr := diag.Expression
+                        ctx := diag.EvalContext
+
+                        vars := expr.Variables()
+                        stmts := make([]string, 0, len(vars))
+                        seen := make(map[string]struct{}, len(vars))
+                        for _, traversal := range vars {
+                                val, diags := traversal.TraverseAbs(ctx)
+                                if diags.HasErrors() {
+                                        // Skip anything that generates errors, since we probably
+                                        // already have the same error in our diagnostics set
+                                        // already.
+                                        continue
+                                }
+
+                                traversalStr := w.traversalStr(traversal)
+                                if _, exists := seen[traversalStr]; exists {
+                                        continue // don't show duplicates when the same variable is referenced multiple times
+                                }
+                                switch {
+                                case !val.IsKnown():
+                                        // Can't say anything about this yet, then.
+                                        continue
+                                case val.IsNull():
+                                        stmts = append(stmts, fmt.Sprintf("%s set to null", traversalStr))
+                                default:
+                                        stmts = append(stmts, fmt.Sprintf("%s as %s", traversalStr, w.valueStr(val)))
+                                }
+                                seen[traversalStr] = struct{}{}
+                        }
+
+                        sort.Strings(stmts) // FIXME: Should maybe use a traversal-aware sort that can sort numeric indexes properly?
+                        last := len(stmts) - 1
+
+                        for i, stmt := range stmts {
+                                switch i {
+                                case 0:
+                                        w.wr.Write([]byte{'w', 'i', 't', 'h', ' '})
+                                default:
+                                        w.wr.Write([]byte{' ', ' ', ' ', ' ', ' '})
+                                }
+                                w.wr.Write([]byte(stmt))
+                                switch i {
+                                case last:
+                                        w.wr.Write([]byte{'.', '\n', '\n'})
+                                default:
+                                        w.wr.Write([]byte{',', '\n'})
+                                }
+                        }
+                }
         }
 
         if diag.Detail != "" {
@@ -156,6 +215,90 @@ func (w *diagnosticTextWriter) WriteDiagnostics(diags Diagnostics) error {
         return nil
 }
 
+func (w *diagnosticTextWriter) traversalStr(traversal Traversal) string {
+        // This is a specialized subset of traversal rendering tailored to
+        // producing helpful contextual messages in diagnostics. It is not
+        // comprehensive nor intended to be used for other purposes.
+
+        var buf bytes.Buffer
+        for _, step := range traversal {
+                switch tStep := step.(type) {
+                case TraverseRoot:
+                        buf.WriteString(tStep.Name)
+                case TraverseAttr:
+                        buf.WriteByte('.')
+                        buf.WriteString(tStep.Name)
+                case TraverseIndex:
+                        buf.WriteByte('[')
+                        if keyTy := tStep.Key.Type(); keyTy.IsPrimitiveType() {
+                                buf.WriteString(w.valueStr(tStep.Key))
+                        } else {
+                                // We'll just use a placeholder for more complex values,
+                                // since otherwise our result could grow ridiculously long.
+                                buf.WriteString("...")
+                        }
+                        buf.WriteByte(']')
+                }
+        }
+        return buf.String()
+}
+
+func (w *diagnosticTextWriter) valueStr(val cty.Value) string {
+        // This is a specialized subset of value rendering tailored to producing
+        // helpful but concise messages in diagnostics. It is not comprehensive
+        // nor intended to be used for other purposes.
+
+        ty := val.Type()
+        switch {
+        case val.IsNull():
+                return "null"
+        case !val.IsKnown():
+                // Should never happen here because we should filter before we get
+                // in here, but we'll do something reasonable rather than panic.
+                return "(not yet known)"
+        case ty == cty.Bool:
+                if val.True() {
+                        return "true"
+                }
+                return "false"
+        case ty == cty.Number:
+                bf := val.AsBigFloat()
+                return bf.Text('g', 10)
+        case ty == cty.String:
+                // Go string syntax is not exactly the same as HCL native string syntax,
+                // but we'll accept the minor edge-cases where this is different here
+                // for now, just to get something reasonable here.
+                return fmt.Sprintf("%q", val.AsString())
+        case ty.IsCollectionType() || ty.IsTupleType():
+                l := val.LengthInt()
+                switch l {
+                case 0:
+                        return "empty " + ty.FriendlyName()
+                case 1:
+                        return ty.FriendlyName() + " with 1 element"
+                default:
+                        return fmt.Sprintf("%s with %d elements", ty.FriendlyName(), l)
+                }
+        case ty.IsObjectType():
+                atys := ty.AttributeTypes()
+                l := len(atys)
+                switch l {
+                case 0:
+                        return "object with no attributes"
+                case 1:
+                        var name string
+                        for k := range atys {
+                                name = k
+                        }
+                        return fmt.Sprintf("object with 1 attribute %q", name)
+                default:
+                        return fmt.Sprintf("object with %d attributes", l)
+                }
+        default:
+                return ty.FriendlyName()
+        }
+}
+
 func contextString(file *File, offset int) string {
         type contextStringer interface {
                 ContextString(offset int) string
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/diagnostics.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/diagnostics.go
new file mode 100644
index 0000000..94eaf58
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/diagnostics.go
@@ -0,0 +1,23 @@
+package hclsyntax
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// setDiagEvalContext is an internal helper that will impose a particular
+// EvalContext on a set of diagnostics in-place, for any diagnostic that
+// does not already have an EvalContext set.
+//
+// We generally expect diagnostics to be immutable, but this is safe to use
+// on any Diagnostics where none of the contained Diagnostic objects have yet
+// been seen by a caller. Its purpose is to apply additional context to a
+// set of diagnostics produced by a "deeper" component as the stack unwinds
+// during expression evaluation.
+func setDiagEvalContext(diags hcl.Diagnostics, expr hcl.Expression, ctx *hcl.EvalContext) {
+        for _, diag := range diags {
+                if diag.Expression == nil {
+                        diag.Expression = expr
+                        diag.EvalContext = ctx
+                }
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression.go
index cfc7cd9..26819a2 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression.go
@@ -2,6 +2,7 @@ package hclsyntax
 
 import (
         "fmt"
+        "sync"
 
         "github.com/hashicorp/hcl2/hcl"
         "github.com/zclconf/go-cty/cty"
@@ -104,7 +105,9 @@ func (e *ScopeTraversalExpr) walkChildNodes(w internalWalkFunc) {
 }
 
 func (e *ScopeTraversalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
-        return e.Traversal.TraverseAbs(ctx)
+        val, diags := e.Traversal.TraverseAbs(ctx)
+        setDiagEvalContext(diags, e, ctx)
+        return val, diags
 }
 
 func (e *ScopeTraversalExpr) Range() hcl.Range {
@@ -129,12 +132,13 @@ type RelativeTraversalExpr struct {
 }
 
 func (e *RelativeTraversalExpr) walkChildNodes(w internalWalkFunc) {
-        // Scope traversals have no child nodes
+        w(e.Source)
 }
 
 func (e *RelativeTraversalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
         src, diags := e.Source.Value(ctx)
         ret, travDiags := e.Traversal.TraverseRel(src)
+        setDiagEvalContext(travDiags, e, ctx)
         diags = append(diags, travDiags...)
         return ret, diags
 }
@@ -177,8 +181,8 @@ type FunctionCallExpr struct {
 }
 
 func (e *FunctionCallExpr) walkChildNodes(w internalWalkFunc) {
-        for i, arg := range e.Args {
-                e.Args[i] = w(arg).(Expression)
+        for _, arg := range e.Args {
+                w(arg)
         }
 }
 
@@ -206,10 +210,12 @@ func (e *FunctionCallExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
                 if !hasNonNilMap {
                         return cty.DynamicVal, hcl.Diagnostics{
                                 {
-                                        Severity: hcl.DiagError,
-                                        Summary:  "Function calls not allowed",
-                                        Detail:   "Functions may not be called here.",
-                                        Subject:  e.Range().Ptr(),
+                                        Severity:    hcl.DiagError,
+                                        Summary:     "Function calls not allowed",
+                                        Detail:      "Functions may not be called here.",
+                                        Subject:     e.Range().Ptr(),
+                                        Expression:  e,
+                                        EvalContext: ctx,
                                 },
                         }
                 }
@@ -225,11 +231,13 @@ func (e *FunctionCallExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
 
                 return cty.DynamicVal, hcl.Diagnostics{
                         {
-                                Severity: hcl.DiagError,
-                                Summary:  "Call to unknown function",
-                                Detail:   fmt.Sprintf("There is no function named %q.%s", e.Name, suggestion),
-                                Subject:  &e.NameRange,
-                                Context:  e.Range().Ptr(),
+                                Severity:    hcl.DiagError,
+                                Summary:     "Call to unknown function",
+                                Detail:      fmt.Sprintf("There is no function named %q.%s", e.Name, suggestion),
+                                Subject:     &e.NameRange,
+                                Context:     e.Range().Ptr(),
+                                Expression:  e,
+                                EvalContext: ctx,
                         },
                 }
         }
@@ -254,11 +262,13 @@ func (e *FunctionCallExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
                 case expandVal.Type().IsTupleType() || expandVal.Type().IsListType() || expandVal.Type().IsSetType():
                         if expandVal.IsNull() {
                                 diags = append(diags, &hcl.Diagnostic{
-                                        Severity: hcl.DiagError,
-                                        Summary:  "Invalid expanding argument value",
-                                        Detail:   "The expanding argument (indicated by ...) must not be null.",
-                                        Context:  expandExpr.Range().Ptr(),
-                                        Subject:  e.Range().Ptr(),
+                                        Severity:    hcl.DiagError,
+                                        Summary:     "Invalid expanding argument value",
+                                        Detail:      "The expanding argument (indicated by ...) must not be null.",
+                                        Subject:     expandExpr.Range().Ptr(),
+                                        Context:     e.Range().Ptr(),
+                                        Expression:  expandExpr,
+                                        EvalContext: ctx,
                                 })
                                 return cty.DynamicVal, diags
                         }
@@ -279,11 +289,13 @@ func (e *FunctionCallExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
                         args = newArgs
                 default:
                         diags = append(diags, &hcl.Diagnostic{
-                                Severity: hcl.DiagError,
-                                Summary:  "Invalid expanding argument value",
-                                Detail:   "The expanding argument (indicated by ...) must be of a tuple, list, or set type.",
-                                Context:  expandExpr.Range().Ptr(),
-                                Subject:  e.Range().Ptr(),
+                                Severity:    hcl.DiagError,
+                                Summary:     "Invalid expanding argument value",
+                                Detail:      "The expanding argument (indicated by ...) must be of a tuple, list, or set type.",
+                                Subject:     expandExpr.Range().Ptr(),
+                                Context:     e.Range().Ptr(),
+                                Expression:  expandExpr,
+                                EvalContext: ctx,
                         })
                         return cty.DynamicVal, diags
                 }
@@ -303,8 +315,10 @@ func (e *FunctionCallExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
                                         "Function %q expects%s %d argument(s). Missing value for %q.",
                                         e.Name, qual, len(params), missing.Name,
                                 ),
-                                Subject: &e.CloseParenRange,
-                                Context: e.Range().Ptr(),
+                                Subject:     &e.CloseParenRange,
+                                Context:     e.Range().Ptr(),
+                                Expression:  e,
+                                EvalContext: ctx,
                         },
                 }
         }
@@ -318,8 +332,10 @@ func (e *FunctionCallExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
                                         "Function %q expects only %d argument(s).",
                                         e.Name, len(params),
                                 ),
-                                Subject: args[len(params)].StartRange().Ptr(),
-                                Context: e.Range().Ptr(),
+                                Subject:     args[len(params)].StartRange().Ptr(),
+                                Context:     e.Range().Ptr(),
+                                Expression:  e,
+                                EvalContext: ctx,
                         },
                 }
         }
@@ -349,8 +365,10 @@ func (e *FunctionCallExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
                                         "Invalid value for %q parameter: %s.",
                                         param.Name, err,
                                 ),
-                                Subject: argExpr.StartRange().Ptr(),
-                                Context: e.Range().Ptr(),
+                                Subject:     argExpr.StartRange().Ptr(),
+                                Context:     e.Range().Ptr(),
+                                Expression:  argExpr,
+                                EvalContext: ctx,
                         })
                 }
 
@@ -386,8 +404,10 @@ func (e *FunctionCallExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
                                         "Invalid value for %q parameter: %s.",
                                         param.Name, err,
                                 ),
-                                Subject: argExpr.StartRange().Ptr(),
-                                Context: e.Range().Ptr(),
+                                Subject:     argExpr.StartRange().Ptr(),
+                                Context:     e.Range().Ptr(),
+                                Expression:  argExpr,
+                                EvalContext: ctx,
                         })
 
                 default:
@@ -398,8 +418,10 @@ func (e *FunctionCallExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
                                         "Call to function %q failed: %s.",
                                         e.Name, err,
                                 ),
-                                Subject: e.StartRange().Ptr(),
-                                Context: e.Range().Ptr(),
+                                Subject:     e.StartRange().Ptr(),
+                                Context:     e.Range().Ptr(),
+                                Expression:  e,
+                                EvalContext: ctx,
                         })
                 }
 
@@ -441,9 +463,9 @@ type ConditionalExpr struct {
 }
 
 func (e *ConditionalExpr) walkChildNodes(w internalWalkFunc) {
-        e.Condition = w(e.Condition).(Expression)
-        e.TrueResult = w(e.TrueResult).(Expression)
-        e.FalseResult = w(e.FalseResult).(Expression)
+        w(e.Condition)
+        w(e.TrueResult)
+        w(e.FalseResult)
 }
 
 func (e *ConditionalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
@@ -464,10 +486,12 @@ func (e *ConditionalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostic
                                         // "These expressions are object and object respectively" if the
                                         // object types don't exactly match.
                                         "The true and false result expressions must have consistent types. The given expressions are %s and %s, respectively.",
-                                        trueResult.Type(), falseResult.Type(),
+                                        trueResult.Type().FriendlyName(), falseResult.Type().FriendlyName(),
                                 ),
-                                Subject: hcl.RangeBetween(e.TrueResult.Range(), e.FalseResult.Range()).Ptr(),
-                                Context: &e.SrcRange,
+                                Subject:     hcl.RangeBetween(e.TrueResult.Range(), e.FalseResult.Range()).Ptr(),
+                                Context:     &e.SrcRange,
+                                Expression:  e,
+                                EvalContext: ctx,
                         },
                 }
         }
@@ -476,11 +500,13 @@ func (e *ConditionalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostic
         diags = append(diags, condDiags...)
         if condResult.IsNull() {
                 diags = append(diags, &hcl.Diagnostic{
-                        Severity: hcl.DiagError,
-                        Summary:  "Null condition",
-                        Detail:   "The condition value is null. Conditions must either be true or false.",
-                        Subject:  e.Condition.Range().Ptr(),
-                        Context:  &e.SrcRange,
+                        Severity:    hcl.DiagError,
+                        Summary:     "Null condition",
+                        Detail:      "The condition value is null. Conditions must either be true or false.",
+                        Subject:     e.Condition.Range().Ptr(),
+                        Context:     &e.SrcRange,
+                        Expression:  e.Condition,
+                        EvalContext: ctx,
                 })
                 return cty.UnknownVal(resultType), diags
         }
@@ -490,11 +516,13 @@ func (e *ConditionalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostic
         condResult, err := convert.Convert(condResult, cty.Bool)
         if err != nil {
                 diags = append(diags, &hcl.Diagnostic{
-                        Severity: hcl.DiagError,
-                        Summary:  "Incorrect condition type",
-                        Detail:   fmt.Sprintf("The condition expression must be of type bool."),
-                        Subject:  e.Condition.Range().Ptr(),
-                        Context:  &e.SrcRange,
+                        Severity:    hcl.DiagError,
+                        Summary:     "Incorrect condition type",
+                        Detail:      fmt.Sprintf("The condition expression must be of type bool."),
+                        Subject:     e.Condition.Range().Ptr(),
+                        Context:     &e.SrcRange,
+                        Expression:  e.Condition,
+                        EvalContext: ctx,
                 })
                 return cty.UnknownVal(resultType), diags
         }
@@ -513,8 +541,10 @@ func (e *ConditionalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostic
                                                 "The true result value has the wrong type: %s.",
                                                 err.Error(),
                                         ),
-                                        Subject: e.TrueResult.Range().Ptr(),
-                                        Context: &e.SrcRange,
+                                        Subject:     e.TrueResult.Range().Ptr(),
+                                        Context:     &e.SrcRange,
+                                        Expression:  e.TrueResult,
+                                        EvalContext: ctx,
                                 })
                                 trueResult = cty.UnknownVal(resultType)
                         }
@@ -534,8 +564,10 @@ func (e *ConditionalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostic
                                                 "The false result value has the wrong type: %s.",
                                                 err.Error(),
                                         ),
-                                        Subject: e.TrueResult.Range().Ptr(),
-                                        Context: &e.SrcRange,
+                                        Subject:     e.FalseResult.Range().Ptr(),
+                                        Context:     &e.SrcRange,
+                                        Expression:  e.FalseResult,
+                                        EvalContext: ctx,
                                 })
                                 falseResult = cty.UnknownVal(resultType)
                         }
@@ -561,8 +593,8 @@ type IndexExpr struct {
 }
 
 func (e *IndexExpr) walkChildNodes(w internalWalkFunc) {
-        e.Collection = w(e.Collection).(Expression)
-        e.Key = w(e.Key).(Expression)
+        w(e.Collection)
+        w(e.Key)
 }
 
 func (e *IndexExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
@@ -572,7 +604,10 @@ func (e *IndexExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
         diags = append(diags, collDiags...)
         diags = append(diags, keyDiags...)
 
-        return hcl.Index(coll, key, &e.SrcRange)
+        val, indexDiags := hcl.Index(coll, key, &e.SrcRange)
+        setDiagEvalContext(indexDiags, e, ctx)
+        diags = append(diags, indexDiags...)
+        return val, diags
 }
 
 func (e *IndexExpr) Range() hcl.Range {
@@ -591,8 +626,8 @@ type TupleConsExpr struct {
 }
 
 func (e *TupleConsExpr) walkChildNodes(w internalWalkFunc) {
-        for i, expr := range e.Exprs {
-                e.Exprs[i] = w(expr).(Expression)
+        for _, expr := range e.Exprs {
+                w(expr)
         }
 }
 
@@ -640,9 +675,9 @@ type ObjectConsItem struct {
 }
 
 func (e *ObjectConsExpr) walkChildNodes(w internalWalkFunc) {
-        for i, item := range e.Items {
-                e.Items[i].KeyExpr = w(item.KeyExpr).(Expression)
-                e.Items[i].ValueExpr = w(item.ValueExpr).(Expression)
+        for _, item := range e.Items {
+                w(item.KeyExpr)
+                w(item.ValueExpr)
         }
 }
 
@@ -675,10 +710,12 @@ func (e *ObjectConsExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics
 
                 if key.IsNull() {
                         diags = append(diags, &hcl.Diagnostic{
-                                Severity: hcl.DiagError,
-                                Summary:  "Null value as key",
-                                Detail:   "Can't use a null value as a key.",
-                                Subject:  item.ValueExpr.Range().Ptr(),
+                                Severity:    hcl.DiagError,
+                                Summary:     "Null value as key",
+                                Detail:      "Can't use a null value as a key.",
+                                Subject:     item.ValueExpr.Range().Ptr(),
+                                Expression:  item.KeyExpr,
+                                EvalContext: ctx,
                         })
                         known = false
                         continue
@@ -688,10 +725,12 @@ func (e *ObjectConsExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics
                 key, err = convert.Convert(key, cty.String)
                 if err != nil {
                         diags = append(diags, &hcl.Diagnostic{
-                                Severity: hcl.DiagError,
-                                Summary:  "Incorrect key type",
-                                Detail:   fmt.Sprintf("Can't use this value as a key: %s.", err.Error()),
-                                Subject:  item.ValueExpr.Range().Ptr(),
+                                Severity:    hcl.DiagError,
+                                Summary:     "Incorrect key type",
+                                Detail:      fmt.Sprintf("Can't use this value as a key: %s.", err.Error()),
+                                Subject:     item.KeyExpr.Range().Ptr(),
+                                Expression:  item.KeyExpr,
+                                EvalContext: ctx,
                         })
                         known = false
                         continue
@@ -754,11 +793,31 @@ func (e *ObjectConsKeyExpr) walkChildNodes(w internalWalkFunc) {
         // We only treat our wrapped expression as a real expression if we're
         // not going to interpret it as a literal.
         if e.literalName() == "" {
-                e.Wrapped = w(e.Wrapped).(Expression)
+                w(e.Wrapped)
         }
 }
 
 func (e *ObjectConsKeyExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        // Because we accept a naked identifier as a literal key rather than a
+        // reference, it's confusing to accept a traversal containing periods
+        // here since we can't tell if the user intends to create a key with
+        // periods or actually reference something. To avoid confusing downstream
+        // errors we'll just prohibit a naked multi-step traversal here and
+        // require the user to state their intent more clearly.
+        // (This is handled at evaluation time rather than parse time because
+        // an application using static analysis _can_ accept a naked multi-step
+        // traversal here, if desired.)
+        if travExpr, isTraversal := e.Wrapped.(*ScopeTraversalExpr); isTraversal && len(travExpr.Traversal) > 1 {
+                var diags hcl.Diagnostics
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Ambiguous attribute key",
+                        Detail:   "If this expression is intended to be a reference, wrap it in parentheses. If it's instead intended as a literal name containing periods, wrap it in quotes to create a string literal.",
+                        Subject:  e.Range().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
         if ln := e.literalName(); ln != "" {
                 return cty.StringVal(ln), nil
         }
@@ -818,11 +877,13 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
 
         if collVal.IsNull() {
                 diags = append(diags, &hcl.Diagnostic{
-                        Severity: hcl.DiagError,
-                        Summary:  "Iteration over null value",
-                        Detail:   "A null value cannot be used as the collection in a 'for' expression.",
-                        Subject:  e.CollExpr.Range().Ptr(),
-                        Context:  &e.SrcRange,
+                        Severity:    hcl.DiagError,
+                        Summary:     "Iteration over null value",
+                        Detail:      "A null value cannot be used as the collection in a 'for' expression.",
+                        Subject:     e.CollExpr.Range().Ptr(),
+                        Context:     &e.SrcRange,
+                        Expression:  e.CollExpr,
+                        EvalContext: ctx,
                 })
                 return cty.DynamicVal, diags
         }
@@ -837,8 +898,10 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                                 "A value of type %s cannot be used as the collection in a 'for' expression.",
                                 collVal.Type().FriendlyName(),
                         ),
-                        Subject: e.CollExpr.Range().Ptr(),
-                        Context: &e.SrcRange,
+                        Subject:     e.CollExpr.Range().Ptr(),
+                        Context:     &e.SrcRange,
+                        Expression:  e.CollExpr,
+                        EvalContext: ctx,
                 })
                 return cty.DynamicVal, diags
         }
@@ -846,14 +909,13 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                 return cty.DynamicVal, diags
         }
 
-        childCtx := ctx.NewChild()
-        childCtx.Variables = map[string]cty.Value{}
-
         // Before we start we'll do an early check to see if any CondExpr we've
         // been given is of the wrong type. This isn't 100% reliable (it may
         // be DynamicVal until real values are given) but it should catch some
         // straightforward cases and prevent a barrage of repeated errors.
         if e.CondExpr != nil {
+                childCtx := ctx.NewChild()
+                childCtx.Variables = map[string]cty.Value{}
                 if e.KeyVar != "" {
                         childCtx.Variables[e.KeyVar] = cty.DynamicVal
                 }
@@ -863,22 +925,26 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                 diags = append(diags, condDiags...)
                 if result.IsNull() {
                         diags = append(diags, &hcl.Diagnostic{
-                                Severity: hcl.DiagError,
-                                Summary:  "Condition is null",
-                                Detail:   "The value of the 'if' clause must not be null.",
-                                Subject:  e.CondExpr.Range().Ptr(),
-                                Context:  &e.SrcRange,
+                                Severity:    hcl.DiagError,
+                                Summary:     "Condition is null",
+                                Detail:      "The value of the 'if' clause must not be null.",
+                                Subject:     e.CondExpr.Range().Ptr(),
+                                Context:     &e.SrcRange,
+                                Expression:  e.CondExpr,
+                                EvalContext: ctx,
                         })
                         return cty.DynamicVal, diags
                 }
                 _, err := convert.Convert(result, cty.Bool)
                 if err != nil {
                         diags = append(diags, &hcl.Diagnostic{
-                                Severity: hcl.DiagError,
-                                Summary:  "Invalid 'for' condition",
-                                Detail:   fmt.Sprintf("The 'if' clause value is invalid: %s.", err.Error()),
-                                Subject:  e.CondExpr.Range().Ptr(),
-                                Context:  &e.SrcRange,
+                                Severity:    hcl.DiagError,
+                                Summary:     "Invalid 'for' condition",
+                                Detail:      fmt.Sprintf("The 'if' clause value is invalid: %s.", err.Error()),
+                                Subject:     e.CondExpr.Range().Ptr(),
+                                Context:     &e.SrcRange,
+                                Expression:  e.CondExpr,
+                                EvalContext: ctx,
                         })
                         return cty.DynamicVal, diags
                 }
@@ -902,6 +968,8 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                 known := true
                 for it.Next() {
                         k, v := it.Element()
+                        childCtx := ctx.NewChild()
+                        childCtx.Variables = map[string]cty.Value{}
                         if e.KeyVar != "" {
                                 childCtx.Variables[e.KeyVar] = k
                         }
@@ -913,11 +981,13 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                                 if includeRaw.IsNull() {
                                         if known {
                                                 diags = append(diags, &hcl.Diagnostic{
-                                                        Severity: hcl.DiagError,
-                                                        Summary:  "Condition is null",
-                                                        Detail:   "The value of the 'if' clause must not be null.",
-                                                        Subject:  e.CondExpr.Range().Ptr(),
-                                                        Context:  &e.SrcRange,
+                                                        Severity:    hcl.DiagError,
+                                                        Summary:     "Invalid 'for' condition",
+                                                        Detail:      "The value of the 'if' clause must not be null.",
+                                                        Subject:     e.CondExpr.Range().Ptr(),
+                                                        Context:     &e.SrcRange,
+                                                        Expression:  e.CondExpr,
+                                                        EvalContext: childCtx,
                                                 })
                                         }
                                         known = false
@@ -927,11 +997,13 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                                 if err != nil {
                                         if known {
                                                 diags = append(diags, &hcl.Diagnostic{
-                                                        Severity: hcl.DiagError,
-                                                        Summary:  "Invalid 'for' condition",
-                                                        Detail:   fmt.Sprintf("The 'if' clause value is invalid: %s.", err.Error()),
-                                                        Subject:  e.CondExpr.Range().Ptr(),
-                                                        Context:  &e.SrcRange,
+                                                        Severity:    hcl.DiagError,
+                                                        Summary:     "Invalid 'for' condition",
+                                                        Detail:      fmt.Sprintf("The 'if' clause value is invalid: %s.", err.Error()),
+                                                        Subject:     e.CondExpr.Range().Ptr(),
+                                                        Context:     &e.SrcRange,
+                                                        Expression:  e.CondExpr,
+                                                        EvalContext: childCtx,
                                                 })
                                         }
                                         known = false
@@ -953,11 +1025,13 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                         if keyRaw.IsNull() {
                                 if known {
                                         diags = append(diags, &hcl.Diagnostic{
-                                                Severity: hcl.DiagError,
-                                                Summary:  "Invalid object key",
-                                                Detail:   "Key expression in 'for' expression must not produce a null value.",
-                                                Subject:  e.KeyExpr.Range().Ptr(),
-                                                Context:  &e.SrcRange,
+                                                Severity:    hcl.DiagError,
+                                                Summary:     "Invalid object key",
+                                                Detail:      "Key expression in 'for' expression must not produce a null value.",
+                                                Subject:     e.KeyExpr.Range().Ptr(),
+                                                Context:     &e.SrcRange,
+                                                Expression:  e.KeyExpr,
+                                                EvalContext: childCtx,
                                         })
                                 }
                                 known = false
@@ -972,11 +1046,13 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                         if err != nil {
                                 if known {
                                         diags = append(diags, &hcl.Diagnostic{
-                                                Severity: hcl.DiagError,
-                                                Summary:  "Invalid object key",
-                                                Detail:   fmt.Sprintf("The key expression produced an invalid result: %s.", err.Error()),
-                                                Subject:  e.KeyExpr.Range().Ptr(),
-                                                Context:  &e.SrcRange,
+                                                Severity:    hcl.DiagError,
+                                                Summary:     "Invalid object key",
+                                                Detail:      fmt.Sprintf("The key expression produced an invalid result: %s.", err.Error()),
+                                                Subject:     e.KeyExpr.Range().Ptr(),
+                                                Context:     &e.SrcRange,
+                                                Expression:  e.KeyExpr,
+                                                EvalContext: childCtx,
                                         })
                                 }
                                 known = false
@@ -996,11 +1072,13 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                                                 Severity: hcl.DiagError,
                                                 Summary:  "Duplicate object key",
                                                 Detail: fmt.Sprintf(
-                                                        "Two different items produced the key %q in this for expression. If duplicates are expected, use the ellipsis (...) after the value expression to enable grouping by key.",
+                                                        "Two different items produced the key %q in this 'for' expression. If duplicates are expected, use the ellipsis (...) after the value expression to enable grouping by key.",
                                                         k,
                                                 ),
-                                                Subject: e.KeyExpr.Range().Ptr(),
-                                                Context: &e.SrcRange,
+                                                Subject:     e.KeyExpr.Range().Ptr(),
+                                                Context:     &e.SrcRange,
+                                                Expression:  e.KeyExpr,
+                                                EvalContext: childCtx,
                                         })
                                 } else {
                                         vals[key.AsString()] = val
@@ -1030,6 +1108,8 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                 known := true
                 for it.Next() {
                         k, v := it.Element()
+                        childCtx := ctx.NewChild()
+                        childCtx.Variables = map[string]cty.Value{}
                         if e.KeyVar != "" {
                                 childCtx.Variables[e.KeyVar] = k
                         }
@@ -1041,11 +1121,13 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                                 if includeRaw.IsNull() {
                                         if known {
                                                 diags = append(diags, &hcl.Diagnostic{
-                                                        Severity: hcl.DiagError,
-                                                        Summary:  "Condition is null",
-                                                        Detail:   "The value of the 'if' clause must not be null.",
-                                                        Subject:  e.CondExpr.Range().Ptr(),
-                                                        Context:  &e.SrcRange,
+                                                        Severity:    hcl.DiagError,
+                                                        Summary:     "Invalid 'for' condition",
+                                                        Detail:      "The value of the 'if' clause must not be null.",
+                                                        Subject:     e.CondExpr.Range().Ptr(),
+                                                        Context:     &e.SrcRange,
+                                                        Expression:  e.CondExpr,
+                                                        EvalContext: childCtx,
                                                 })
                                         }
                                         known = false
@@ -1063,11 +1145,13 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                                 if err != nil {
                                         if known {
                                                 diags = append(diags, &hcl.Diagnostic{
-                                                        Severity: hcl.DiagError,
-                                                        Summary:  "Invalid 'for' condition",
-                                                        Detail:   fmt.Sprintf("The 'if' clause value is invalid: %s.", err.Error()),
-                                                        Subject:  e.CondExpr.Range().Ptr(),
-                                                        Context:  &e.SrcRange,
+                                                        Severity:    hcl.DiagError,
+                                                        Summary:     "Invalid 'for' condition",
+                                                        Detail:      fmt.Sprintf("The 'if' clause value is invalid: %s.", err.Error()),
+                                                        Subject:     e.CondExpr.Range().Ptr(),
+                                                        Context:     &e.SrcRange,
+                                                        Expression:  e.CondExpr,
+                                                        EvalContext: childCtx,
                                                 })
                                         }
                                         known = false
@@ -1094,7 +1178,7 @@ func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
 }
 
 func (e *ForExpr) walkChildNodes(w internalWalkFunc) {
-        e.CollExpr = w(e.CollExpr).(Expression)
+        w(e.CollExpr)
 
         scopeNames := map[string]struct{}{}
         if e.KeyVar != "" {
@@ -1107,17 +1191,17 @@ func (e *ForExpr) walkChildNodes(w internalWalkFunc) {
         if e.KeyExpr != nil {
                 w(ChildScope{
                         LocalNames: scopeNames,
-                        Expr:       &e.KeyExpr,
+                        Expr:       e.KeyExpr,
                 })
         }
         w(ChildScope{
                 LocalNames: scopeNames,
-                Expr:       &e.ValExpr,
+                Expr:       e.ValExpr,
         })
         if e.CondExpr != nil {
                 w(ChildScope{
                         LocalNames: scopeNames,
-                        Expr:       &e.CondExpr,
+                        Expr:       e.CondExpr,
                 })
         }
 }
@@ -1151,26 +1235,78 @@ func (e *SplatExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                 return cty.DynamicVal, diags
         }
 
+        sourceTy := sourceVal.Type()
+        if sourceTy == cty.DynamicPseudoType {
+                // If we don't even know the _type_ of our source value yet then
+                // we'll need to defer all processing, since we can't decide our
+                // result type either.
+                return cty.DynamicVal, diags
+        }
+
+        // A "special power" of splat expressions is that they can be applied
+        // both to tuples/lists and to other values, and in the latter case
+        // the value will be treated as an implicit single-item tuple, or as
+        // an empty tuple if the value is null.
+        autoUpgrade := !(sourceTy.IsTupleType() || sourceTy.IsListType() || sourceTy.IsSetType())
+
         if sourceVal.IsNull() {
+                if autoUpgrade {
+                        return cty.EmptyTupleVal, diags
+                }
                 diags = append(diags, &hcl.Diagnostic{
-                        Severity: hcl.DiagError,
-                        Summary:  "Splat of null value",
-                        Detail:   "Splat expressions (with the * symbol) cannot be applied to null values.",
-                        Subject:  e.Source.Range().Ptr(),
-                        Context:  hcl.RangeBetween(e.Source.Range(), e.MarkerRange).Ptr(),
+                        Severity:    hcl.DiagError,
+                        Summary:     "Splat of null value",
+                        Detail:      "Splat expressions (with the * symbol) cannot be applied to null sequences.",
+                        Subject:     e.Source.Range().Ptr(),
+                        Context:     hcl.RangeBetween(e.Source.Range(), e.MarkerRange).Ptr(),
+                        Expression:  e.Source,
+                        EvalContext: ctx,
                 })
                 return cty.DynamicVal, diags
         }
-        if !sourceVal.IsKnown() {
-                return cty.DynamicVal, diags
+
+        if autoUpgrade {
+                sourceVal = cty.TupleVal([]cty.Value{sourceVal})
+                sourceTy = sourceVal.Type()
         }
 
-        // A "special power" of splat expressions is that they can be applied
-        // both to tuples/lists and to other values, and in the latter case
-        // the value will be treated as an implicit single-value list. We'll
-        // deal with that here first.
-        if !(sourceVal.Type().IsTupleType() || sourceVal.Type().IsListType()) {
-                sourceVal = cty.ListVal([]cty.Value{sourceVal})
+        // We'll compute our result type lazily if we need it. In the normal case
+        // it's inferred automatically from the value we construct.
+        resultTy := func() (cty.Type, hcl.Diagnostics) {
+                chiCtx := ctx.NewChild()
+                var diags hcl.Diagnostics
+                switch {
+                case sourceTy.IsListType() || sourceTy.IsSetType():
+                        ety := sourceTy.ElementType()
+                        e.Item.setValue(chiCtx, cty.UnknownVal(ety))
+                        val, itemDiags := e.Each.Value(chiCtx)
+                        diags = append(diags, itemDiags...)
+                        e.Item.clearValue(chiCtx) // clean up our temporary value
+                        return cty.List(val.Type()), diags
+                case sourceTy.IsTupleType():
+                        etys := sourceTy.TupleElementTypes()
+                        resultTys := make([]cty.Type, 0, len(etys))
+                        for _, ety := range etys {
+                                e.Item.setValue(chiCtx, cty.UnknownVal(ety))
+                                val, itemDiags := e.Each.Value(chiCtx)
+                                diags = append(diags, itemDiags...)
+                                e.Item.clearValue(chiCtx) // clean up our temporary value
+                                resultTys = append(resultTys, val.Type())
+                        }
+                        return cty.Tuple(resultTys), diags
+                default:
+                        // Should never happen because of our promotion to list above.
+                        return cty.DynamicPseudoType, diags
+                }
+        }
+
+        if !sourceVal.IsKnown() {
+                // We can't produce a known result in this case, but we'll still
+                // indicate what the result type would be, allowing any downstream type
+                // checking to proceed.
+                ty, tyDiags := resultTy()
+                diags = append(diags, tyDiags...)
+                return cty.UnknownVal(ty), diags
         }
 
         vals := make([]cty.Value, 0, sourceVal.LengthInt())
@@ -1194,15 +1330,28 @@ func (e *SplatExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
         e.Item.clearValue(ctx) // clean up our temporary value
 
         if !isKnown {
-                return cty.DynamicVal, diags
+                // We'll ingore the resultTy diagnostics in this case since they
+                // will just be the same errors we saw while iterating above.
+                ty, _ := resultTy()
+                return cty.UnknownVal(ty), diags
         }
 
-        return cty.TupleVal(vals), diags
+        switch {
+        case sourceTy.IsListType() || sourceTy.IsSetType():
+                if len(vals) == 0 {
+                        ty, tyDiags := resultTy()
+                        diags = append(diags, tyDiags...)
+                        return cty.ListValEmpty(ty.ElementType()), diags
+                }
+                return cty.ListVal(vals), diags
+        default:
+                return cty.TupleVal(vals), diags
+        }
 }
 
 func (e *SplatExpr) walkChildNodes(w internalWalkFunc) {
-        e.Source = w(e.Source).(Expression)
-        e.Each = w(e.Each).(Expression)
+        w(e.Source)
+        w(e.Each)
 }
 
 func (e *SplatExpr) Range() hcl.Range {
@@ -1226,13 +1375,24 @@ func (e *SplatExpr) StartRange() hcl.Range {
 // assigns it a value.
 type AnonSymbolExpr struct {
         SrcRange hcl.Range
-        values   map[*hcl.EvalContext]cty.Value
+
+        // values and its associated lock are used to isolate concurrent
+        // evaluations of a symbol from one another. It is the calling application's
+        // responsibility to ensure that the same splat expression is not evalauted
+        // concurrently within the _same_ EvalContext, but it is fine and safe to
+        // do cuncurrent evaluations with distinct EvalContexts.
+        values     map[*hcl.EvalContext]cty.Value
+        valuesLock sync.RWMutex
 }
 
 func (e *AnonSymbolExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
         if ctx == nil {
                 return cty.DynamicVal, nil
         }
+
+        e.valuesLock.RLock()
+        defer e.valuesLock.RUnlock()
+
         val, exists := e.values[ctx]
         if !exists {
                 return cty.DynamicVal, nil
@@ -1243,6 +1403,9 @@ func (e *AnonSymbolExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics
 // setValue sets a temporary local value for the expression when evaluated
 // in the given context, which must be non-nil.
 func (e *AnonSymbolExpr) setValue(ctx *hcl.EvalContext, val cty.Value) {
+        e.valuesLock.Lock()
+        defer e.valuesLock.Unlock()
+
         if e.values == nil {
                 e.values = make(map[*hcl.EvalContext]cty.Value)
         }
@@ -1253,6 +1416,9 @@ func (e *AnonSymbolExpr) setValue(ctx *hcl.EvalContext, val cty.Value) {
 }
 
 func (e *AnonSymbolExpr) clearValue(ctx *hcl.EvalContext) {
+        e.valuesLock.Lock()
+        defer e.valuesLock.Unlock()
+
         if e.values == nil {
                 return
         }
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_ops.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_ops.go
index 9a5da04..7f59f1a 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_ops.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_ops.go
@@ -129,8 +129,8 @@ type BinaryOpExpr struct {
 }
 
 func (e *BinaryOpExpr) walkChildNodes(w internalWalkFunc) {
-        e.LHS = w(e.LHS).(Expression)
-        e.RHS = w(e.RHS).(Expression)
+        w(e.LHS)
+        w(e.RHS)
 }
 
 func (e *BinaryOpExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
@@ -149,21 +149,25 @@ func (e *BinaryOpExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics)
         lhsVal, err := convert.Convert(givenLHSVal, lhsParam.Type)
         if err != nil {
                 diags = append(diags, &hcl.Diagnostic{
-                        Severity: hcl.DiagError,
-                        Summary:  "Invalid operand",
-                        Detail:   fmt.Sprintf("Unsuitable value for left operand: %s.", err),
-                        Subject:  e.LHS.Range().Ptr(),
-                        Context:  &e.SrcRange,
+                        Severity:    hcl.DiagError,
+                        Summary:     "Invalid operand",
+                        Detail:      fmt.Sprintf("Unsuitable value for left operand: %s.", err),
+                        Subject:     e.LHS.Range().Ptr(),
+                        Context:     &e.SrcRange,
+                        Expression:  e.LHS,
+                        EvalContext: ctx,
                 })
         }
         rhsVal, err := convert.Convert(givenRHSVal, rhsParam.Type)
         if err != nil {
                 diags = append(diags, &hcl.Diagnostic{
-                        Severity: hcl.DiagError,
-                        Summary:  "Invalid operand",
-                        Detail:   fmt.Sprintf("Unsuitable value for right operand: %s.", err),
-                        Subject:  e.RHS.Range().Ptr(),
-                        Context:  &e.SrcRange,
+                        Severity:    hcl.DiagError,
+                        Summary:     "Invalid operand",
+                        Detail:      fmt.Sprintf("Unsuitable value for right operand: %s.", err),
+                        Subject:     e.RHS.Range().Ptr(),
+                        Context:     &e.SrcRange,
+                        Expression:  e.RHS,
+                        EvalContext: ctx,
                 })
         }
 
@@ -178,10 +182,12 @@ func (e *BinaryOpExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics)
         if err != nil {
                 diags = append(diags, &hcl.Diagnostic{
                         // FIXME: This diagnostic is useless.
-                        Severity: hcl.DiagError,
-                        Summary:  "Operation failed",
-                        Detail:   fmt.Sprintf("Error during operation: %s.", err),
-                        Subject:  &e.SrcRange,
+                        Severity:    hcl.DiagError,
+                        Summary:     "Operation failed",
+                        Detail:      fmt.Sprintf("Error during operation: %s.", err),
+                        Subject:     &e.SrcRange,
+                        Expression:  e,
+                        EvalContext: ctx,
                 })
                 return cty.UnknownVal(e.Op.Type), diags
         }
@@ -206,7 +212,7 @@ type UnaryOpExpr struct {
 }
 
 func (e *UnaryOpExpr) walkChildNodes(w internalWalkFunc) {
-        e.Val = w(e.Val).(Expression)
+        w(e.Val)
 }
 
 func (e *UnaryOpExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
@@ -219,11 +225,13 @@ func (e *UnaryOpExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
         val, err := convert.Convert(givenVal, param.Type)
         if err != nil {
                 diags = append(diags, &hcl.Diagnostic{
-                        Severity: hcl.DiagError,
-                        Summary:  "Invalid operand",
-                        Detail:   fmt.Sprintf("Unsuitable value for unary operand: %s.", err),
-                        Subject:  e.Val.Range().Ptr(),
-                        Context:  &e.SrcRange,
+                        Severity:    hcl.DiagError,
+                        Summary:     "Invalid operand",
+                        Detail:      fmt.Sprintf("Unsuitable value for unary operand: %s.", err),
+                        Subject:     e.Val.Range().Ptr(),
+                        Context:     &e.SrcRange,
+                        Expression:  e.Val,
+                        EvalContext: ctx,
                 })
         }
 
@@ -238,10 +246,12 @@ func (e *UnaryOpExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
         if err != nil {
                 diags = append(diags, &hcl.Diagnostic{
                         // FIXME: This diagnostic is useless.
-                        Severity: hcl.DiagError,
-                        Summary:  "Operation failed",
-                        Detail:   fmt.Sprintf("Error during operation: %s.", err),
-                        Subject:  &e.SrcRange,
+                        Severity:    hcl.DiagError,
+                        Summary:     "Operation failed",
+                        Detail:      fmt.Sprintf("Error during operation: %s.", err),
+                        Subject:     &e.SrcRange,
+                        Expression:  e,
+                        EvalContext: ctx,
                 })
                 return cty.UnknownVal(e.Op.Type), diags
         }
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_template.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_template.go
index a1c4727..fa79e3d 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_template.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_template.go
@@ -16,8 +16,8 @@ type TemplateExpr struct {
 }
 
 func (e *TemplateExpr) walkChildNodes(w internalWalkFunc) {
-        for i, part := range e.Parts {
-                e.Parts[i] = w(part).(Expression)
+        for _, part := range e.Parts {
+                w(part)
         }
 }
 
@@ -37,8 +37,10 @@ func (e *TemplateExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics)
                                 Detail: fmt.Sprintf(
                                         "The expression result is null. Cannot include a null value in a string template.",
                                 ),
-                                Subject: part.Range().Ptr(),
-                                Context: &e.SrcRange,
+                                Subject:     part.Range().Ptr(),
+                                Context:     &e.SrcRange,
+                                Expression:  part,
+                                EvalContext: ctx,
                         })
                         continue
                 }
@@ -61,8 +63,10 @@ func (e *TemplateExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics)
                                         "Cannot include the given value in a string template: %s.",
                                         err.Error(),
                                 ),
-                                Subject: part.Range().Ptr(),
-                                Context: &e.SrcRange,
+                                Subject:     part.Range().Ptr(),
+                                Context:     &e.SrcRange,
+                                Expression:  part,
+                                EvalContext: ctx,
                         })
                         continue
                 }
@@ -94,7 +98,7 @@ type TemplateJoinExpr struct {
 }
 
 func (e *TemplateJoinExpr) walkChildNodes(w internalWalkFunc) {
-        e.Tuple = w(e.Tuple).(Expression)
+        w(e.Tuple)
 }
 
 func (e *TemplateJoinExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
@@ -127,7 +131,9 @@ func (e *TemplateJoinExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
                                 Detail: fmt.Sprintf(
                                         "An iteration result is null. Cannot include a null value in a string template.",
                                 ),
-                                Subject: e.Range().Ptr(),
+                                Subject:     e.Range().Ptr(),
+                                Expression:  e,
+                                EvalContext: ctx,
                         })
                         continue
                 }
@@ -143,7 +149,9 @@ func (e *TemplateJoinExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnosti
                                         "Cannot include one of the interpolation results into the string template: %s.",
                                         err.Error(),
                                 ),
-                                Subject: e.Range().Ptr(),
+                                Subject:     e.Range().Ptr(),
+                                Expression:  e,
+                                EvalContext: ctx,
                         })
                         continue
                 }
@@ -176,7 +184,7 @@ type TemplateWrapExpr struct {
 }
 
 func (e *TemplateWrapExpr) walkChildNodes(w internalWalkFunc) {
-        e.Wrapped = w(e.Wrapped).(Expression)
+        w(e.Wrapped)
 }
 
 func (e *TemplateWrapExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/navigation.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/navigation.go
index 4d41b6b..c8c97f3 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/navigation.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/navigation.go
@@ -3,6 +3,8 @@ package hclsyntax
 import (
         "bytes"
         "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
 )
 
 type navigation struct {
@@ -39,3 +41,19 @@ func (n navigation) ContextString(offset int) string {
         }
         return buf.String()
 }
+
+func (n navigation) ContextDefRange(offset int) hcl.Range {
+        var block *Block
+        for _, candidate := range n.root.Blocks {
+                if candidate.Range().ContainsOffset(offset) {
+                        block = candidate
+                        break
+                }
+        }
+
+        if block == nil {
+                return hcl.Range{}
+        }
+
+        return block.DefRange()
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/node.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/node.go
index fd426d4..75812e6 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/node.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/node.go
@@ -19,4 +19,4 @@ type Node interface {
         Range() hcl.Range
 }
 
-type internalWalkFunc func(Node) Node
+type internalWalkFunc func(Node)
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser.go
index 002858f..253ad50 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser.go
@@ -9,7 +9,6 @@ import (
         "github.com/apparentlymart/go-textseg/textseg"
         "github.com/hashicorp/hcl2/hcl"
         "github.com/zclconf/go-cty/cty"
-        "github.com/zclconf/go-cty/cty/convert"
 )
 
 type parser struct {
@@ -55,7 +54,7 @@ Token:
                                                 Severity: hcl.DiagError,
                                                 Summary:  "Attribute redefined",
                                                 Detail: fmt.Sprintf(
-                                                        "The attribute %q was already defined at %s. Each attribute may be defined only once.",
+                                                        "The argument %q was already set at %s. Each argument may be set only once.",
                                                         titem.Name, existing.NameRange.String(),
                                                 ),
                                                 Subject: &titem.NameRange,
@@ -80,15 +79,15 @@ Token:
                                 if bad.Type == TokenOQuote {
                                         diags = append(diags, &hcl.Diagnostic{
                                                 Severity: hcl.DiagError,
-                                                Summary:  "Invalid attribute name",
-                                                Detail:   "Attribute names must not be quoted.",
+                                                Summary:  "Invalid argument name",
+                                                Detail:   "Argument names must not be quoted.",
                                                 Subject:  &bad.Range,
                                         })
                                 } else {
                                         diags = append(diags, &hcl.Diagnostic{
                                                 Severity: hcl.DiagError,
-                                                Summary:  "Attribute or block definition required",
-                                                Detail:   "An attribute or block definition is required here.",
+                                                Summary:  "Argument or block definition required",
+                                                Detail:   "An argument or block definition is required here.",
                                                 Subject:  &bad.Range,
                                         })
                                 }
@@ -120,8 +119,8 @@ func (p *parser) ParseBodyItem() (Node, hcl.Diagnostics) {
                 return nil, hcl.Diagnostics{
                         {
                                 Severity: hcl.DiagError,
-                                Summary:  "Attribute or block definition required",
-                                Detail:   "An attribute or block definition is required here.",
+                                Summary:  "Argument or block definition required",
+                                Detail:   "An argument or block definition is required here.",
                                 Subject:  &ident.Range,
                         },
                 }
@@ -131,7 +130,7 @@ func (p *parser) ParseBodyItem() (Node, hcl.Diagnostics) {
 
         switch next.Type {
         case TokenEqual:
-                return p.finishParsingBodyAttribute(ident)
+                return p.finishParsingBodyAttribute(ident, false)
         case TokenOQuote, TokenOBrace, TokenIdent:
                 return p.finishParsingBodyBlock(ident)
         default:
@@ -139,8 +138,8 @@ func (p *parser) ParseBodyItem() (Node, hcl.Diagnostics) {
                 return nil, hcl.Diagnostics{
                         {
                                 Severity: hcl.DiagError,
-                                Summary:  "Attribute or block definition required",
-                                Detail:   "An attribute or block definition is required here. To define an attribute, use the equals sign \"=\" to introduce the attribute value.",
+                                Summary:  "Argument or block definition required",
+                                Detail:   "An argument or block definition is required here. To set an argument, use the equals sign \"=\" to introduce the argument value.",
                                 Subject:  &ident.Range,
                         },
                 }
@@ -149,7 +148,72 @@ func (p *parser) ParseBodyItem() (Node, hcl.Diagnostics) {
         return nil, nil
 }
 
-func (p *parser) finishParsingBodyAttribute(ident Token) (Node, hcl.Diagnostics) {
+// parseSingleAttrBody is a weird variant of ParseBody that deals with the
+// body of a nested block containing only one attribute value all on a single
+// line, like foo { bar = baz } . It expects to find a single attribute item
+// immediately followed by the end token type with no intervening newlines.
+func (p *parser) parseSingleAttrBody(end TokenType) (*Body, hcl.Diagnostics) {
+        ident := p.Read()
+        if ident.Type != TokenIdent {
+                p.recoverAfterBodyItem()
+                return nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Argument or block definition required",
+                                Detail:   "An argument or block definition is required here.",
+                                Subject:  &ident.Range,
+                        },
+                }
+        }
+
+        var attr *Attribute
+        var diags hcl.Diagnostics
+
+        next := p.Peek()
+
+        switch next.Type {
+        case TokenEqual:
+                node, attrDiags := p.finishParsingBodyAttribute(ident, true)
+                diags = append(diags, attrDiags...)
+                attr = node.(*Attribute)
+        case TokenOQuote, TokenOBrace, TokenIdent:
+                p.recoverAfterBodyItem()
+                return nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Argument definition required",
+                                Detail:   fmt.Sprintf("A single-line block definition can contain only a single argument. If you meant to define argument %q, use an equals sign to assign it a value. To define a nested block, place it on a line of its own within its parent block.", ident.Bytes),
+                                Subject:  hcl.RangeBetween(ident.Range, next.Range).Ptr(),
+                        },
+                }
+        default:
+                p.recoverAfterBodyItem()
+                return nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Argument or block definition required",
+                                Detail:   "An argument or block definition is required here. To set an argument, use the equals sign \"=\" to introduce the argument value.",
+                                Subject:  &ident.Range,
+                        },
+                }
+        }
+
+        return &Body{
+                Attributes: Attributes{
+                        string(ident.Bytes): attr,
+                },
+
+                SrcRange: attr.SrcRange,
+                EndRange: hcl.Range{
+                        Filename: attr.SrcRange.Filename,
+                        Start:    attr.SrcRange.End,
+                        End:      attr.SrcRange.End,
+                },
+        }, diags
+
+}
+
+func (p *parser) finishParsingBodyAttribute(ident Token, singleLine bool) (Node, hcl.Diagnostics) {
         eqTok := p.Read() // eat equals token
         if eqTok.Type != TokenEqual {
                 // should never happen if caller behaves
@@ -166,22 +230,33 @@ func (p *parser) finishParsingBodyAttribute(ident Token) (Node, hcl.Diagnostics)
                 endRange = p.PrevRange()
                 p.recoverAfterBodyItem()
         } else {
-                end := p.Peek()
-                if end.Type != TokenNewline && end.Type != TokenEOF {
-                        if !p.recovery {
-                                diags = append(diags, &hcl.Diagnostic{
-                                        Severity: hcl.DiagError,
-                                        Summary:  "Missing newline after attribute definition",
-                                        Detail:   "An attribute definition must end with a newline.",
-                                        Subject:  &end.Range,
-                                        Context:  hcl.RangeBetween(ident.Range, end.Range).Ptr(),
-                                })
+                endRange = p.PrevRange()
+                if !singleLine {
+                        end := p.Peek()
+                        if end.Type != TokenNewline && end.Type != TokenEOF {
+                                if !p.recovery {
+                                        summary := "Missing newline after argument"
+                                        detail := "An argument definition must end with a newline."
+
+                                        if end.Type == TokenComma {
+                                                summary = "Unexpected comma after argument"
+                                                detail = "Argument definitions must be separated by newlines, not commas. " + detail
+                                        }
+
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  summary,
+                                                Detail:   detail,
+                                                Subject:  &end.Range,
+                                                Context:  hcl.RangeBetween(ident.Range, end.Range).Ptr(),
+                                        })
+                                }
+                                endRange = p.PrevRange()
+                                p.recoverAfterBodyItem()
+                        } else {
+                                endRange = p.PrevRange()
+                                p.Read() // eat newline
                         }
-                        endRange = p.PrevRange()
-                        p.recoverAfterBodyItem()
-                } else {
-                        endRange = p.PrevRange()
-                        p.Read() // eat newline
                 }
         }
 
@@ -218,19 +293,9 @@ Token:
                         diags = append(diags, labelDiags...)
                         labels = append(labels, label)
                         labelRanges = append(labelRanges, labelRange)
-                        if labelDiags.HasErrors() {
-                                p.recoverAfterBodyItem()
-                                return &Block{
-                                        Type:   blockType,
-                                        Labels: labels,
-                                        Body:   nil,
-
-                                        TypeRange:       ident.Range,
-                                        LabelRanges:     labelRanges,
-                                        OpenBraceRange:  ident.Range, // placeholder
-                                        CloseBraceRange: ident.Range, // placeholder
-                                }, diags
-                        }
+                        // parseQuoteStringLiteral recovers up to the closing quote
+                        // if it encounters problems, so we can continue looking for
+                        // more labels and eventually the block body even.
 
                 case TokenIdent:
                         tok = p.Read() // eat token
@@ -244,7 +309,7 @@ Token:
                                 diags = append(diags, &hcl.Diagnostic{
                                         Severity: hcl.DiagError,
                                         Summary:  "Invalid block definition",
-                                        Detail:   "The equals sign \"=\" indicates an attribute definition, and must not be used when defining a block.",
+                                        Detail:   "The equals sign \"=\" indicates an argument definition, and must not be used when defining a block.",
                                         Subject:  &tok.Range,
                                         Context:  hcl.RangeBetween(ident.Range, tok.Range).Ptr(),
                                 })
@@ -273,7 +338,10 @@ Token:
                         return &Block{
                                 Type:   blockType,
                                 Labels: labels,
-                                Body:   nil,
+                                Body: &Body{
+                                        SrcRange: ident.Range,
+                                        EndRange: ident.Range,
+                                },
 
                                 TypeRange:       ident.Range,
                                 LabelRanges:     labelRanges,
@@ -285,7 +353,51 @@ Token:
 
         // Once we fall out here, the peeker is pointed just after our opening
         // brace, so we can begin our nested body parsing.
-        body, bodyDiags := p.ParseBody(TokenCBrace)
+        var body *Body
+        var bodyDiags hcl.Diagnostics
+        switch p.Peek().Type {
+        case TokenNewline, TokenEOF, TokenCBrace:
+                body, bodyDiags = p.ParseBody(TokenCBrace)
+        default:
+                // Special one-line, single-attribute block parsing mode.
+                body, bodyDiags = p.parseSingleAttrBody(TokenCBrace)
+                switch p.Peek().Type {
+                case TokenCBrace:
+                        p.Read() // the happy path - just consume the closing brace
+                case TokenComma:
+                        // User seems to be trying to use the object-constructor
+                        // comma-separated style, which isn't permitted for blocks.
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid single-argument block definition",
+                                Detail:   "Single-line block syntax can include only one argument definition. To define multiple arguments, use the multi-line block syntax with one argument definition per line.",
+                                Subject:  p.Peek().Range.Ptr(),
+                        })
+                        p.recover(TokenCBrace)
+                case TokenNewline:
+                        // We don't allow weird mixtures of single and multi-line syntax.
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid single-argument block definition",
+                                Detail:   "An argument definition on the same line as its containing block creates a single-line block definition, which must also be closed on the same line. Place the block's closing brace immediately after the argument definition.",
+                                Subject:  p.Peek().Range.Ptr(),
+                        })
+                        p.recover(TokenCBrace)
+                default:
+                        // Some other weird thing is going on. Since we can't guess a likely
+                        // user intent for this one, we'll skip it if we're already in
+                        // recovery mode.
+                        if !p.recovery {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid single-argument block definition",
+                                        Detail:   "A single-line block definition must end with a closing brace immediately after its single argument definition.",
+                                        Subject:  p.Peek().Range.Ptr(),
+                                })
+                        }
+                        p.recover(TokenCBrace)
+                }
+        }
         diags = append(diags, bodyDiags...)
         cBraceRange := p.PrevRange()
 
@@ -305,6 +417,17 @@ Token:
                 p.recoverAfterBodyItem()
         }
 
+        // We must never produce a nil body, since the caller may attempt to
+        // do analysis of a partial result when there's an error, so we'll
+        // insert a placeholder if we otherwise failed to produce a valid
+        // body due to one of the syntax error paths above.
+        if body == nil && diags.HasErrors() {
+                body = &Body{
+                        SrcRange: hcl.RangeBetween(oBrace.Range, cBraceRange),
+                        EndRange: cBraceRange,
+                }
+        }
+
         return &Block{
                 Type:   blockType,
                 Labels: labels,
@@ -459,7 +582,14 @@ func (p *parser) parseBinaryOps(ops []map[TokenType]*Operation) (Expression, hcl
 
 func (p *parser) parseExpressionWithTraversals() (Expression, hcl.Diagnostics) {
         term, diags := p.parseExpressionTerm()
-        ret := term
+        ret, moreDiags := p.parseExpressionTraversals(term)
+        diags = append(diags, moreDiags...)
+        return ret, diags
+}
+
+func (p *parser) parseExpressionTraversals(from Expression) (Expression, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        ret := from
 
 Traversal:
         for {
@@ -657,44 +787,81 @@ Traversal:
                         // the key value is something constant.
 
                         open := p.Read()
-                        // TODO: If we have a TokenStar inside our brackets, parse as
-                        // a Splat expression: foo[*].baz[0].
-                        var close Token
-                        p.PushIncludeNewlines(false) // arbitrary newlines allowed in brackets
-                        keyExpr, keyDiags := p.ParseExpression()
-                        diags = append(diags, keyDiags...)
-                        if p.recovery && keyDiags.HasErrors() {
-                                close = p.recover(TokenCBrack)
-                        } else {
-                                close = p.Read()
+                        switch p.Peek().Type {
+                        case TokenStar:
+                                // This is a full splat expression, like foo[*], which consumes
+                                // the rest of the traversal steps after it using a recursive
+                                // call to this function.
+                                p.Read() // consume star
+                                close := p.Read()
                                 if close.Type != TokenCBrack && !p.recovery {
                                         diags = append(diags, &hcl.Diagnostic{
                                                 Severity: hcl.DiagError,
-                                                Summary:  "Missing close bracket on index",
-                                                Detail:   "The index operator must end with a closing bracket (\"]\").",
+                                                Summary:  "Missing close bracket on splat index",
+                                                Detail:   "The star for a full splat operator must be immediately followed by a closing bracket (\"]\").",
                                                 Subject:  &close.Range,
                                         })
                                         close = p.recover(TokenCBrack)
                                 }
-                        }
-                        p.PopIncludeNewlines()
+                                // Splat expressions use a special "anonymous symbol"  as a
+                                // placeholder in an expression to be evaluated once for each
+                                // item in the source expression.
+                                itemExpr := &AnonSymbolExpr{
+                                        SrcRange: hcl.RangeBetween(open.Range, close.Range),
+                                }
+                                // Now we'll recursively call this same function to eat any
+                                // remaining traversal steps against the anonymous symbol.
+                                travExpr, nestedDiags := p.parseExpressionTraversals(itemExpr)
+                                diags = append(diags, nestedDiags...)
 
-                        if lit, isLit := keyExpr.(*LiteralValueExpr); isLit {
-                                litKey, _ := lit.Value(nil)
-                                rng := hcl.RangeBetween(open.Range, close.Range)
-                                step := hcl.TraverseIndex{
-                                        Key:      litKey,
-                                        SrcRange: rng,
+                                ret = &SplatExpr{
+                                        Source: ret,
+                                        Each:   travExpr,
+                                        Item:   itemExpr,
+
+                                        SrcRange:    hcl.RangeBetween(open.Range, travExpr.Range()),
+                                        MarkerRange: hcl.RangeBetween(open.Range, close.Range),
                                 }
-                                ret = makeRelativeTraversal(ret, step, rng)
-                        } else {
-                                rng := hcl.RangeBetween(open.Range, close.Range)
-                                ret = &IndexExpr{
-                                        Collection: ret,
-                                        Key:        keyExpr,
 
-                                        SrcRange:  rng,
-                                        OpenRange: open.Range,
+                        default:
+
+                                var close Token
+                                p.PushIncludeNewlines(false) // arbitrary newlines allowed in brackets
+                                keyExpr, keyDiags := p.ParseExpression()
+                                diags = append(diags, keyDiags...)
+                                if p.recovery && keyDiags.HasErrors() {
+                                        close = p.recover(TokenCBrack)
+                                } else {
+                                        close = p.Read()
+                                        if close.Type != TokenCBrack && !p.recovery {
+                                                diags = append(diags, &hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Missing close bracket on index",
+                                                        Detail:   "The index operator must end with a closing bracket (\"]\").",
+                                                        Subject:  &close.Range,
+                                                })
+                                                close = p.recover(TokenCBrack)
+                                        }
+                                }
+                                p.PopIncludeNewlines()
+
+                                if lit, isLit := keyExpr.(*LiteralValueExpr); isLit {
+                                        litKey, _ := lit.Value(nil)
+                                        rng := hcl.RangeBetween(open.Range, close.Range)
+                                        step := hcl.TraverseIndex{
+                                                Key:      litKey,
+                                                SrcRange: rng,
+                                        }
+                                        ret = makeRelativeTraversal(ret, step, rng)
+                                } else {
+                                        rng := hcl.RangeBetween(open.Range, close.Range)
+                                        ret = &IndexExpr{
+                                                Collection: ret,
+                                                Key:        keyExpr,
+
+                                                SrcRange:  rng,
+                                                OpenRange: open.Range,
+                                        }
                                 }
                         }
 
@@ -813,7 +980,7 @@ func (p *parser) parseExpressionTerm() (Expression, hcl.Diagnostics) {
         case TokenOQuote, TokenOHeredoc:
                 open := p.Read() // eat opening marker
                 closer := p.oppositeBracket(open.Type)
-                exprs, passthru, _, diags := p.parseTemplateInner(closer)
+                exprs, passthru, _, diags := p.parseTemplateInner(closer, tokenOpensFlushHeredoc(open))
 
                 closeRange := p.PrevRange()
 
@@ -891,11 +1058,10 @@ func (p *parser) parseExpressionTerm() (Expression, hcl.Diagnostics) {
 }
 
 func (p *parser) numberLitValue(tok Token) (cty.Value, hcl.Diagnostics) {
-        // We'll lean on the cty converter to do the conversion, to ensure that
-        // the behavior is the same as what would happen if converting a
-        // non-literal string to a number.
-        numStrVal := cty.StringVal(string(tok.Bytes))
-        numVal, err := convert.Convert(numStrVal, cty.Number)
+        // The cty.ParseNumberVal is always the same behavior as converting a
+        // string to a number, ensuring we always interpret decimal numbers in
+        // the same way.
+        numVal, err := cty.ParseNumberVal(string(tok.Bytes))
         if err != nil {
                 ret := cty.UnknownVal(cty.Number)
                 return ret, hcl.Diagnostics{
@@ -1087,13 +1253,19 @@ func (p *parser) parseObjectCons() (Expression, hcl.Diagnostics) {
                 panic("parseObjectCons called without peeker pointing to open brace")
         }
 
-        p.PushIncludeNewlines(true)
-        defer p.PopIncludeNewlines()
-
-        if forKeyword.TokenMatches(p.Peek()) {
+        // We must temporarily stop looking at newlines here while we check for
+        // a "for" keyword, since for expressions are _not_ newline-sensitive,
+        // even though object constructors are.
+        p.PushIncludeNewlines(false)
+        isFor := forKeyword.TokenMatches(p.Peek())
+        p.PopIncludeNewlines()
+        if isFor {
                 return p.finishParsingForExpr(open)
         }
 
+        p.PushIncludeNewlines(true)
+        defer p.PopIncludeNewlines()
+
         var close Token
 
         var diags hcl.Diagnostics
@@ -1132,19 +1304,36 @@ func (p *parser) parseObjectCons() (Expression, hcl.Diagnostics) {
                 next = p.Peek()
                 if next.Type != TokenEqual && next.Type != TokenColon {
                         if !p.recovery {
-                                if next.Type == TokenNewline || next.Type == TokenComma {
+                                switch next.Type {
+                                case TokenNewline, TokenComma:
                                         diags = append(diags, &hcl.Diagnostic{
                                                 Severity: hcl.DiagError,
-                                                Summary:  "Missing item value",
-                                                Detail:   "Expected an item value, introduced by an equals sign (\"=\").",
+                                                Summary:  "Missing attribute value",
+                                                Detail:   "Expected an attribute value, introduced by an equals sign (\"=\").",
                                                 Subject:  &next.Range,
                                                 Context:  hcl.RangeBetween(open.Range, next.Range).Ptr(),
                                         })
-                                } else {
+                                case TokenIdent:
+                                        // Although this might just be a plain old missing equals
+                                        // sign before a reference, one way to get here is to try
+                                        // to write an attribute name containing a period followed
+                                        // by a digit, which was valid in HCL1, like this:
+                                        //     foo1.2_bar = "baz"
+                                        // We can't know exactly what the user intended here, but
+                                        // we'll augment our message with an extra hint in this case
+                                        // in case it is helpful.
                                         diags = append(diags, &hcl.Diagnostic{
                                                 Severity: hcl.DiagError,
                                                 Summary:  "Missing key/value separator",
-                                                Detail:   "Expected an equals sign (\"=\") to mark the beginning of the item value.",
+                                                Detail:   "Expected an equals sign (\"=\") to mark the beginning of the attribute value. If you intended to given an attribute name containing periods or spaces, write the name in quotes to create a string literal.",
+                                                Subject:  &next.Range,
+                                                Context:  hcl.RangeBetween(open.Range, next.Range).Ptr(),
+                                        })
+                                default:
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Missing key/value separator",
+                                                Detail:   "Expected an equals sign (\"=\") to mark the beginning of the attribute value.",
                                                 Subject:  &next.Range,
                                                 Context:  hcl.RangeBetween(open.Range, next.Range).Ptr(),
                                         })
@@ -1182,8 +1371,8 @@ func (p *parser) parseObjectCons() (Expression, hcl.Diagnostics) {
                         if !p.recovery {
                                 diags = append(diags, &hcl.Diagnostic{
                                         Severity: hcl.DiagError,
-                                        Summary:  "Missing item separator",
-                                        Detail:   "Expected a newline or comma to mark the beginning of the next item.",
+                                        Summary:  "Missing attribute separator",
+                                        Detail:   "Expected a newline or comma to mark the beginning of the next attribute.",
                                         Subject:  &next.Range,
                                         Context:  hcl.RangeBetween(open.Range, next.Range).Ptr(),
                                 })
@@ -1205,6 +1394,8 @@ func (p *parser) parseObjectCons() (Expression, hcl.Diagnostics) {
 }
 
 func (p *parser) finishParsingForExpr(open Token) (Expression, hcl.Diagnostics) {
+        p.PushIncludeNewlines(false)
+        defer p.PopIncludeNewlines()
         introducer := p.Read()
         if !forKeyword.TokenMatches(introducer) {
                 // Should never happen if callers are behaving
@@ -1277,7 +1468,7 @@ func (p *parser) finishParsingForExpr(open Token) (Expression, hcl.Diagnostics)
                         diags = append(diags, &hcl.Diagnostic{
                                 Severity: hcl.DiagError,
                                 Summary:  "Invalid 'for' expression",
-                                Detail:   "For expression requires 'in' keyword after names.",
+                                Detail:   "For expression requires the 'in' keyword after its name declarations.",
                                 Subject:  p.Peek().Range.Ptr(),
                                 Context:  hcl.RangeBetween(open.Range, p.Peek().Range).Ptr(),
                         })
@@ -1305,7 +1496,7 @@ func (p *parser) finishParsingForExpr(open Token) (Expression, hcl.Diagnostics)
                         diags = append(diags, &hcl.Diagnostic{
                                 Severity: hcl.DiagError,
                                 Summary:  "Invalid 'for' expression",
-                                Detail:   "For expression requires colon after collection expression.",
+                                Detail:   "For expression requires a colon after the collection expression.",
                                 Subject:  p.Peek().Range.Ptr(),
                                 Context:  hcl.RangeBetween(open.Range, p.Peek().Range).Ptr(),
                         })
@@ -1459,7 +1650,7 @@ Token:
                 case TokenTemplateControl, TokenTemplateInterp:
                         which := "$"
                         if tok.Type == TokenTemplateControl {
-                                which = "!"
+                                which = "%"
                         }
 
                         diags = append(diags, &hcl.Diagnostic{
@@ -1472,7 +1663,16 @@ Token:
                                 Subject: &tok.Range,
                                 Context: hcl.RangeBetween(oQuote.Range, tok.Range).Ptr(),
                         })
-                        p.recover(TokenTemplateSeqEnd)
+
+                        // Now that we're returning an error callers won't attempt to use
+                        // the result for any real operations, but they might try to use
+                        // the partial AST for other analyses, so we'll leave a marker
+                        // to indicate that there was something invalid in the string to
+                        // help avoid misinterpretation of the partial result
+                        ret.WriteString(which)
+                        ret.WriteString("{ ... }")
+
+                        p.recover(TokenTemplateSeqEnd) // we'll try to keep parsing after the sequence ends
 
                 case TokenEOF:
                         diags = append(diags, &hcl.Diagnostic{
@@ -1493,7 +1693,7 @@ Token:
                                 Subject:  &tok.Range,
                                 Context:  hcl.RangeBetween(oQuote.Range, tok.Range).Ptr(),
                         })
-                        p.recover(TokenOQuote)
+                        p.recover(TokenCQuote)
                         break Token
 
                 }
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser_template.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser_template.go
index 3711067..a141626 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser_template.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser_template.go
@@ -5,16 +5,17 @@ import (
         "strings"
         "unicode"
 
+        "github.com/apparentlymart/go-textseg/textseg"
         "github.com/hashicorp/hcl2/hcl"
         "github.com/zclconf/go-cty/cty"
 )
 
 func (p *parser) ParseTemplate() (Expression, hcl.Diagnostics) {
-        return p.parseTemplate(TokenEOF)
+        return p.parseTemplate(TokenEOF, false)
 }
 
-func (p *parser) parseTemplate(end TokenType) (Expression, hcl.Diagnostics) {
-        exprs, passthru, rng, diags := p.parseTemplateInner(end)
+func (p *parser) parseTemplate(end TokenType, flushHeredoc bool) (Expression, hcl.Diagnostics) {
+        exprs, passthru, rng, diags := p.parseTemplateInner(end, flushHeredoc)
 
         if passthru {
                 if len(exprs) != 1 {
@@ -32,8 +33,11 @@ func (p *parser) parseTemplate(end TokenType) (Expression, hcl.Diagnostics) {
         }, diags
 }
 
-func (p *parser) parseTemplateInner(end TokenType) ([]Expression, bool, hcl.Range, hcl.Diagnostics) {
+func (p *parser) parseTemplateInner(end TokenType, flushHeredoc bool) ([]Expression, bool, hcl.Range, hcl.Diagnostics) {
         parts, diags := p.parseTemplateParts(end)
+        if flushHeredoc {
+                flushHeredocTemplateParts(parts) // Trim off leading spaces on lines per the flush heredoc spec
+        }
         tp := templateParser{
                 Tokens:   parts.Tokens,
                 SrcRange: parts.SrcRange,
@@ -649,6 +653,73 @@ Token:
         return ret, diags
 }
 
+// flushHeredocTemplateParts modifies in-place the line-leading literal strings
+// to apply the flush heredoc processing rule: find the line with the smallest
+// number of whitespace characters as prefix and then trim that number of
+// characters from all of the lines.
+//
+// This rule is applied to static tokens rather than to the rendered result,
+// so interpolating a string with leading whitespace cannot affect the chosen
+// prefix length.
+func flushHeredocTemplateParts(parts *templateParts) {
+        if len(parts.Tokens) == 0 {
+                // Nothing to do
+                return
+        }
+
+        const maxInt = int((^uint(0)) >> 1)
+
+        minSpaces := maxInt
+        newline := true
+        var adjust []*templateLiteralToken
+        for _, ttok := range parts.Tokens {
+                if newline {
+                        newline = false
+                        var spaces int
+                        if lit, ok := ttok.(*templateLiteralToken); ok {
+                                orig := lit.Val
+                                trimmed := strings.TrimLeftFunc(orig, unicode.IsSpace)
+                                // If a token is entirely spaces and ends with a newline
+                                // then it's a "blank line" and thus not considered for
+                                // space-prefix-counting purposes.
+                                if len(trimmed) == 0 && strings.HasSuffix(orig, "\n") {
+                                        spaces = maxInt
+                                } else {
+                                        spaceBytes := len(lit.Val) - len(trimmed)
+                                        spaces, _ = textseg.TokenCount([]byte(orig[:spaceBytes]), textseg.ScanGraphemeClusters)
+                                        adjust = append(adjust, lit)
+                                }
+                        } else if _, ok := ttok.(*templateEndToken); ok {
+                                break // don't process the end token since it never has spaces before it
+                        }
+                        if spaces < minSpaces {
+                                minSpaces = spaces
+                        }
+                }
+                if lit, ok := ttok.(*templateLiteralToken); ok {
+                        if strings.HasSuffix(lit.Val, "\n") {
+                                newline = true // The following token, if any, begins a new line
+                        }
+                }
+        }
+
+        for _, lit := range adjust {
+                // Since we want to count space _characters_ rather than space _bytes_,
+                // we can't just do a straightforward slice operation here and instead
+                // need to hunt for the split point with a scanner.
+                valBytes := []byte(lit.Val)
+                spaceByteCount := 0
+                for i := 0; i < minSpaces; i++ {
+                        adv, _, _ := textseg.ScanGraphemeClusters(valBytes, true)
+                        spaceByteCount += adv
+                        valBytes = valBytes[adv:]
+                }
+                lit.Val = lit.Val[spaceByteCount:]
+                lit.SrcRange.Start.Column += minSpaces
+                lit.SrcRange.Start.Byte += spaceByteCount
+        }
+}
+
 type templateParts struct {
         Tokens   []templateToken
         SrcRange hcl.Range
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_string_lit.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_string_lit.go
index de1f524..2895ade 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_string_lit.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_string_lit.go
@@ -1,10 +1,10 @@
-// line 1 "scan_string_lit.rl"
+//line scan_string_lit.rl:1
 
 package hclsyntax
 
 // This file is generated from scan_string_lit.rl. DO NOT EDIT.
 
-// line 9 "scan_string_lit.go"
+//line scan_string_lit.go:9
 var _hclstrtok_actions []byte = []byte{
         0, 1, 0, 1, 1, 2, 1, 0,
 }
@@ -114,12 +114,12 @@ const hclstrtok_error int = 0
 const hclstrtok_en_quoted int = 10
 const hclstrtok_en_unquoted int = 4
 
-// line 10 "scan_string_lit.rl"
+//line scan_string_lit.rl:10
 
 func scanStringLit(data []byte, quoted bool) [][]byte {
         var ret [][]byte
 
-        // line 61 "scan_string_lit.rl"
+//line scan_string_lit.rl:61
 
         // Ragel state
         p := 0          // "Pointer" into data
@@ -144,11 +144,11 @@ func scanStringLit(data []byte, quoted bool) [][]byte {
             ret = append(ret, data[ts:te])
         }*/
 
-        // line 154 "scan_string_lit.go"
+//line scan_string_lit.go:154
         {
         }
 
-        // line 158 "scan_string_lit.go"
+//line scan_string_lit.go:158
         {
                 var _klen int
                 var _trans int
@@ -229,7 +229,7 @@ func scanStringLit(data []byte, quoted bool) [][]byte {
                         _acts++
                         switch _hclstrtok_actions[_acts-1] {
                         case 0:
-                                // line 40 "scan_string_lit.rl"
+//line scan_string_lit.rl:40
 
                                 // If te is behind p then we've skipped over some literal
                                 // characters which we must now return.
@@ -239,12 +239,12 @@ func scanStringLit(data []byte, quoted bool) [][]byte {
                                 ts = p
 
                         case 1:
-                                // line 48 "scan_string_lit.rl"
+//line scan_string_lit.rl:48
 
                                 te = p
                                 ret = append(ret, data[ts:te])
 
-                                // line 255 "scan_string_lit.go"
+//line scan_string_lit.go:253
                         }
                 }
 
@@ -267,12 +267,12 @@ func scanStringLit(data []byte, quoted bool) [][]byte {
                                 __acts++
                                 switch _hclstrtok_actions[__acts-1] {
                                 case 1:
-                                        // line 48 "scan_string_lit.rl"
+//line scan_string_lit.rl:48
 
                                         te = p
                                         ret = append(ret, data[ts:te])
 
-                                        // line 281 "scan_string_lit.go"
+//line scan_string_lit.go:278
                                 }
                         }
                 }
@@ -282,7 +282,7 @@ func scanStringLit(data []byte, quoted bool) [][]byte {
                 }
         }
 
-        // line 89 "scan_string_lit.rl"
+//line scan_string_lit.rl:89
 
         if te < p {
                 // Collect any leftover literal characters at the end of the input
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.go
index 395e9c1..581e35e 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.go
@@ -1,4 +1,4 @@
-// line 1 "scan_tokens.rl"
+//line scan_tokens.rl:1
 
 package hclsyntax
 
@@ -10,570 +10,256 @@ import (
 
 // This file is generated from scan_tokens.rl. DO NOT EDIT.
 
-// line 15 "scan_tokens.go"
+//line scan_tokens.go:15
 var _hcltok_actions []byte = []byte{
-        0, 1, 0, 1, 1, 1, 2, 1, 3,
-        1, 4, 1, 6, 1, 7, 1, 8,
-        1, 9, 1, 10, 1, 11, 1, 12,
-        1, 13, 1, 14, 1, 15, 1, 16,
-        1, 17, 1, 18, 1, 19, 1, 22,
-        1, 23, 1, 24, 1, 25, 1, 26,
-        1, 27, 1, 28, 1, 29, 1, 30,
-        1, 31, 1, 34, 1, 35, 1, 36,
-        1, 37, 1, 38, 1, 39, 1, 40,
-        1, 41, 1, 42, 1, 43, 1, 46,
-        1, 47, 1, 48, 1, 49, 1, 50,
-        1, 51, 1, 52, 1, 58, 1, 59,
-        1, 60, 1, 61, 1, 62, 1, 63,
-        1, 64, 1, 65, 1, 66, 1, 67,
-        1, 68, 1, 69, 1, 70, 1, 71,
-        1, 72, 1, 73, 1, 74, 1, 75,
-        1, 76, 1, 77, 1, 78, 1, 79,
-        1, 80, 1, 81, 1, 82, 1, 83,
-        1, 84, 1, 85, 1, 86, 1, 87,
-        2, 0, 15, 2, 1, 15, 2, 2,
-        24, 2, 2, 28, 2, 3, 24, 2,
-        3, 28, 2, 4, 5, 2, 7, 0,
-        2, 7, 1, 2, 7, 20, 2, 7,
-        21, 2, 7, 32, 2, 7, 33, 2,
-        7, 44, 2, 7, 45, 2, 7, 53,
-        2, 7, 54, 2, 7, 55, 2, 7,
-        56, 2, 7, 57, 3, 7, 2, 20,
-        3, 7, 3, 20,
+        0, 1, 0, 1, 1, 1, 3, 1, 4,
+        1, 7, 1, 8, 1, 9, 1, 10,
+        1, 11, 1, 12, 1, 13, 1, 14,
+        1, 15, 1, 16, 1, 17, 1, 18,
+        1, 19, 1, 20, 1, 23, 1, 24,
+        1, 25, 1, 26, 1, 27, 1, 28,
+        1, 29, 1, 30, 1, 31, 1, 32,
+        1, 35, 1, 36, 1, 37, 1, 38,
+        1, 39, 1, 40, 1, 41, 1, 42,
+        1, 43, 1, 44, 1, 47, 1, 48,
+        1, 49, 1, 50, 1, 51, 1, 52,
+        1, 53, 1, 56, 1, 57, 1, 58,
+        1, 59, 1, 60, 1, 61, 1, 62,
+        1, 63, 1, 64, 1, 65, 1, 66,
+        1, 67, 1, 68, 1, 69, 1, 70,
+        1, 71, 1, 72, 1, 73, 1, 74,
+        1, 75, 1, 76, 1, 77, 1, 78,
+        1, 79, 1, 80, 1, 81, 1, 82,
+        1, 83, 1, 84, 1, 85, 2, 0,
+        14, 2, 0, 25, 2, 0, 29, 2,
+        0, 37, 2, 0, 41, 2, 1, 2,
+        2, 4, 5, 2, 4, 6, 2, 4,
+        21, 2, 4, 22, 2, 4, 33, 2,
+        4, 34, 2, 4, 45, 2, 4, 46,
+        2, 4, 54, 2, 4, 55,
 }
 
 var _hcltok_key_offsets []int16 = []int16{
-        0, 0, 1, 2, 3, 5, 10, 14,
-        16, 58, 99, 145, 146, 150, 156, 156,
-        158, 160, 169, 175, 182, 183, 186, 187,
-        191, 196, 205, 209, 213, 221, 223, 225,
-        227, 230, 262, 264, 266, 270, 274, 277,
-        288, 301, 320, 333, 349, 361, 377, 392,
-        413, 423, 435, 446, 460, 475, 485, 497,
-        506, 518, 520, 524, 545, 554, 564, 570,
-        576, 577, 626, 628, 632, 634, 640, 647,
-        655, 662, 665, 671, 675, 679, 681, 685,
-        689, 693, 699, 707, 715, 721, 723, 727,
-        729, 735, 739, 743, 747, 751, 756, 763,
-        769, 771, 773, 777, 779, 785, 789, 793,
-        803, 808, 822, 837, 839, 847, 849, 854,
-        868, 873, 875, 879, 880, 884, 890, 896,
-        906, 916, 927, 935, 938, 941, 945, 949,
-        951, 954, 954, 957, 959, 989, 991, 993,
-        997, 1002, 1006, 1011, 1013, 1015, 1017, 1026,
-        1030, 1034, 1040, 1042, 1050, 1058, 1070, 1073,
-        1079, 1083, 1085, 1089, 1109, 1111, 1113, 1124,
-        1130, 1132, 1134, 1136, 1140, 1146, 1152, 1154,
-        1159, 1163, 1165, 1173, 1191, 1231, 1241, 1245,
-        1247, 1249, 1250, 1254, 1258, 1262, 1266, 1270,
-        1275, 1279, 1283, 1287, 1289, 1291, 1295, 1305,
-        1309, 1311, 1315, 1319, 1323, 1336, 1338, 1340,
-        1344, 1346, 1350, 1352, 1354, 1384, 1388, 1392,
-        1396, 1399, 1406, 1411, 1422, 1426, 1442, 1456,
-        1460, 1465, 1469, 1473, 1479, 1481, 1487, 1489,
-        1493, 1495, 1501, 1506, 1511, 1521, 1523, 1525,
-        1529, 1533, 1535, 1548, 1550, 1554, 1558, 1566,
-        1568, 1572, 1574, 1575, 1578, 1583, 1585, 1587,
-        1591, 1593, 1597, 1603, 1623, 1629, 1635, 1637,
-        1638, 1648, 1649, 1657, 1664, 1666, 1669, 1671,
-        1673, 1675, 1680, 1684, 1688, 1693, 1703, 1713,
-        1717, 1721, 1735, 1761, 1771, 1773, 1775, 1778,
-        1780, 1783, 1785, 1789, 1791, 1792, 1796, 1798,
-        1801, 1808, 1816, 1818, 1820, 1824, 1826, 1832,
-        1843, 1846, 1848, 1852, 1857, 1887, 1892, 1894,
-        1897, 1902, 1916, 1923, 1937, 1942, 1955, 1959,
-        1972, 1977, 1995, 1996, 2005, 2009, 2021, 2026,
-        2033, 2040, 2047, 2049, 2053, 2075, 2080, 2081,
-        2085, 2087, 2137, 2140, 2151, 2155, 2157, 2163,
-        2169, 2171, 2176, 2178, 2182, 2184, 2185, 2187,
-        2189, 2195, 2197, 2199, 2203, 2209, 2222, 2224,
-        2230, 2234, 2242, 2253, 2261, 2264, 2294, 2300,
-        2303, 2308, 2310, 2314, 2318, 2322, 2324, 2331,
-        2333, 2342, 2349, 2357, 2359, 2379, 2391, 2395,
-        2397, 2415, 2454, 2456, 2460, 2462, 2469, 2473,
-        2501, 2503, 2505, 2507, 2509, 2512, 2514, 2518,
-        2522, 2524, 2527, 2529, 2531, 2534, 2536, 2538,
-        2539, 2541, 2543, 2547, 2551, 2554, 2567, 2569,
-        2575, 2579, 2581, 2585, 2589, 2603, 2606, 2615,
-        2617, 2621, 2627, 2627, 2629, 2631, 2640, 2646,
-        2653, 2654, 2657, 2658, 2662, 2667, 2676, 2680,
-        2684, 2692, 2694, 2696, 2698, 2701, 2733, 2735,
-        2737, 2741, 2745, 2748, 2759, 2772, 2791, 2804,
-        2820, 2832, 2848, 2863, 2884, 2894, 2906, 2917,
-        2931, 2946, 2956, 2968, 2977, 2989, 2991, 2995,
-        3016, 3025, 3035, 3041, 3047, 3048, 3097, 3099,
-        3103, 3105, 3111, 3118, 3126, 3133, 3136, 3142,
-        3146, 3150, 3152, 3156, 3160, 3164, 3170, 3178,
-        3186, 3192, 3194, 3198, 3200, 3206, 3210, 3214,
-        3218, 3222, 3227, 3234, 3240, 3242, 3244, 3248,
-        3250, 3256, 3260, 3264, 3274, 3279, 3293, 3308,
-        3310, 3318, 3320, 3325, 3339, 3344, 3346, 3350,
-        3351, 3355, 3361, 3367, 3377, 3387, 3398, 3406,
-        3409, 3412, 3416, 3420, 3422, 3425, 3425, 3428,
-        3430, 3460, 3462, 3464, 3468, 3473, 3477, 3482,
-        3484, 3486, 3488, 3497, 3501, 3505, 3511, 3513,
-        3521, 3529, 3541, 3544, 3550, 3554, 3556, 3560,
-        3580, 3582, 3584, 3595, 3601, 3603, 3605, 3607,
-        3611, 3617, 3623, 3625, 3630, 3634, 3636, 3644,
-        3662, 3702, 3712, 3716, 3718, 3720, 3721, 3725,
-        3729, 3733, 3737, 3741, 3746, 3750, 3754, 3758,
-        3760, 3762, 3766, 3776, 3780, 3782, 3786, 3790,
-        3794, 3807, 3809, 3811, 3815, 3817, 3821, 3823,
-        3825, 3855, 3859, 3863, 3867, 3870, 3877, 3882,
-        3893, 3897, 3913, 3927, 3931, 3936, 3940, 3944,
-        3950, 3952, 3958, 3960, 3964, 3966, 3972, 3977,
-        3982, 3992, 3994, 3996, 4000, 4004, 4006, 4019,
-        4021, 4025, 4029, 4037, 4039, 4043, 4045, 4046,
-        4049, 4054, 4056, 4058, 4062, 4064, 4068, 4074,
-        4094, 4100, 4106, 4108, 4109, 4119, 4120, 4128,
-        4135, 4137, 4140, 4142, 4144, 4146, 4151, 4155,
-        4159, 4164, 4174, 4184, 4188, 4192, 4206, 4232,
-        4242, 4244, 4246, 4249, 4251, 4254, 4256, 4260,
-        4262, 4263, 4267, 4269, 4271, 4278, 4282, 4289,
-        4296, 4305, 4321, 4333, 4351, 4362, 4374, 4382,
-        4400, 4408, 4438, 4441, 4451, 4461, 4473, 4484,
-        4493, 4506, 4518, 4522, 4528, 4555, 4564, 4567,
-        4572, 4578, 4583, 4604, 4608, 4614, 4614, 4621,
-        4630, 4638, 4641, 4645, 4651, 4657, 4660, 4664,
-        4671, 4677, 4686, 4695, 4699, 4703, 4707, 4711,
-        4718, 4722, 4726, 4736, 4742, 4746, 4752, 4756,
-        4759, 4765, 4771, 4783, 4787, 4791, 4801, 4805,
-        4816, 4818, 4820, 4824, 4836, 4841, 4865, 4869,
-        4875, 4897, 4906, 4910, 4913, 4914, 4922, 4930,
-        4936, 4946, 4953, 4971, 4974, 4977, 4985, 4991,
-        4995, 4999, 5003, 5009, 5017, 5022, 5028, 5032,
-        5040, 5047, 5051, 5058, 5064, 5072, 5080, 5086,
-        5092, 5103, 5107, 5119, 5128, 5145, 5162, 5165,
-        5169, 5171, 5177, 5179, 5183, 5198, 5202, 5206,
-        5210, 5214, 5218, 5220, 5226, 5231, 5235, 5241,
-        5248, 5251, 5269, 5271, 5316, 5322, 5328, 5332,
-        5336, 5342, 5346, 5352, 5358, 5365, 5367, 5373,
-        5379, 5383, 5387, 5395, 5408, 5414, 5421, 5429,
-        5435, 5444, 5450, 5454, 5459, 5463, 5471, 5475,
-        5479, 5509, 5515, 5521, 5527, 5533, 5540, 5546,
-        5553, 5558, 5568, 5572, 5579, 5585, 5589, 5596,
-        5600, 5606, 5609, 5613, 5617, 5621, 5625, 5630,
-        5635, 5639, 5650, 5654, 5658, 5664, 5672, 5676,
-        5693, 5697, 5703, 5713, 5719, 5725, 5728, 5733,
-        5742, 5746, 5750, 5756, 5760, 5766, 5774, 5792,
-        5793, 5803, 5804, 5813, 5821, 5823, 5826, 5828,
-        5830, 5832, 5837, 5850, 5854, 5869, 5898, 5909,
-        5911, 5915, 5919, 5924, 5928, 5930, 5937, 5941,
-        5949, 5953, 5954, 5955, 5957, 5959, 5961, 5963,
-        5965, 5966, 5967, 5968, 5970, 5972, 5974, 5975,
-        5976, 5977, 5978, 5980, 5982, 5984, 5985, 5986,
-        5990, 5996, 5996, 5998, 6000, 6009, 6015, 6022,
-        6023, 6026, 6027, 6031, 6036, 6045, 6049, 6053,
-        6061, 6063, 6065, 6067, 6070, 6102, 6104, 6106,
-        6110, 6114, 6117, 6128, 6141, 6160, 6173, 6189,
-        6201, 6217, 6232, 6253, 6263, 6275, 6286, 6300,
-        6315, 6325, 6337, 6346, 6358, 6360, 6364, 6385,
-        6394, 6404, 6410, 6416, 6417, 6466, 6468, 6472,
-        6474, 6480, 6487, 6495, 6502, 6505, 6511, 6515,
-        6519, 6521, 6525, 6529, 6533, 6539, 6547, 6555,
-        6561, 6563, 6567, 6569, 6575, 6579, 6583, 6587,
-        6591, 6596, 6603, 6609, 6611, 6613, 6617, 6619,
-        6625, 6629, 6633, 6643, 6648, 6662, 6677, 6679,
-        6687, 6689, 6694, 6708, 6713, 6715, 6719, 6720,
-        6724, 6730, 6736, 6746, 6756, 6767, 6775, 6778,
-        6781, 6785, 6789, 6791, 6794, 6794, 6797, 6799,
-        6829, 6831, 6833, 6837, 6842, 6846, 6851, 6853,
-        6855, 6857, 6866, 6870, 6874, 6880, 6882, 6890,
-        6898, 6910, 6913, 6919, 6923, 6925, 6929, 6949,
-        6951, 6953, 6964, 6970, 6972, 6974, 6976, 6980,
-        6986, 6992, 6994, 6999, 7003, 7005, 7013, 7031,
-        7071, 7081, 7085, 7087, 7089, 7090, 7094, 7098,
-        7102, 7106, 7110, 7115, 7119, 7123, 7127, 7129,
-        7131, 7135, 7145, 7149, 7151, 7155, 7159, 7163,
-        7176, 7178, 7180, 7184, 7186, 7190, 7192, 7194,
-        7224, 7228, 7232, 7236, 7239, 7246, 7251, 7262,
-        7266, 7282, 7296, 7300, 7305, 7309, 7313, 7319,
-        7321, 7327, 7329, 7333, 7335, 7341, 7346, 7351,
-        7361, 7363, 7365, 7369, 7373, 7375, 7388, 7390,
-        7394, 7398, 7406, 7408, 7412, 7414, 7415, 7418,
-        7423, 7425, 7427, 7431, 7433, 7437, 7443, 7463,
-        7469, 7475, 7477, 7478, 7488, 7489, 7497, 7504,
-        7506, 7509, 7511, 7513, 7515, 7520, 7524, 7528,
-        7533, 7543, 7553, 7557, 7561, 7575, 7601, 7611,
-        7613, 7615, 7618, 7620, 7623, 7625, 7629, 7631,
-        7632, 7636, 7638, 7640, 7647, 7651, 7658, 7665,
-        7674, 7690, 7702, 7720, 7731, 7743, 7751, 7769,
-        7777, 7807, 7810, 7820, 7830, 7842, 7853, 7862,
-        7875, 7887, 7891, 7897, 7924, 7933, 7936, 7941,
-        7947, 7952, 7973, 7977, 7983, 7983, 7990, 7999,
-        8007, 8010, 8014, 8020, 8026, 8029, 8033, 8040,
-        8046, 8055, 8064, 8068, 8072, 8076, 8080, 8087,
-        8091, 8095, 8105, 8111, 8115, 8121, 8125, 8128,
-        8134, 8140, 8152, 8156, 8160, 8170, 8174, 8185,
-        8187, 8189, 8193, 8205, 8210, 8234, 8238, 8244,
-        8266, 8275, 8279, 8282, 8283, 8291, 8299, 8305,
-        8315, 8322, 8340, 8343, 8346, 8354, 8360, 8364,
-        8368, 8372, 8378, 8386, 8391, 8397, 8401, 8409,
-        8416, 8420, 8427, 8433, 8441, 8449, 8455, 8461,
-        8472, 8476, 8488, 8497, 8514, 8531, 8534, 8538,
-        8540, 8546, 8548, 8552, 8567, 8571, 8575, 8579,
-        8583, 8587, 8589, 8595, 8600, 8604, 8610, 8617,
-        8620, 8638, 8640, 8685, 8691, 8697, 8701, 8705,
-        8711, 8715, 8721, 8727, 8734, 8736, 8742, 8748,
-        8752, 8756, 8764, 8777, 8783, 8790, 8798, 8804,
-        8813, 8819, 8823, 8828, 8832, 8840, 8844, 8848,
-        8878, 8884, 8890, 8896, 8902, 8909, 8915, 8922,
-        8927, 8937, 8941, 8948, 8954, 8958, 8965, 8969,
-        8975, 8978, 8982, 8986, 8990, 8994, 8999, 9004,
-        9008, 9019, 9023, 9027, 9033, 9041, 9045, 9062,
-        9066, 9072, 9082, 9088, 9094, 9097, 9102, 9111,
-        9115, 9119, 9125, 9129, 9135, 9143, 9161, 9162,
-        9172, 9173, 9182, 9190, 9192, 9195, 9197, 9199,
-        9201, 9206, 9219, 9223, 9238, 9267, 9278, 9280,
-        9284, 9288, 9293, 9297, 9299, 9306, 9310, 9318,
-        9322, 9398, 9400, 9401, 9402, 9403, 9404, 9405,
-        9407, 9408, 9413, 9415, 9417, 9418, 9462, 9463,
-        9464, 9466, 9471, 9475, 9475, 9477, 9479, 9490,
-        9500, 9508, 9509, 9511, 9512, 9516, 9520, 9530,
-        9534, 9541, 9552, 9559, 9563, 9569, 9580, 9612,
-        9661, 9676, 9691, 9696, 9698, 9703, 9735, 9743,
-        9745, 9767, 9789, 9791, 9807, 9823, 9839, 9855,
-        9870, 9880, 9897, 9914, 9931, 9947, 9957, 9974,
-        9990, 10006, 10022, 10038, 10054, 10070, 10086, 10087,
-        10088, 10089, 10090, 10092, 10094, 10096, 10110, 10124,
-        10138, 10152, 10153, 10154, 10156, 10158, 10160, 10174,
-        10188, 10189, 10190, 10192, 10194, 10196, 10245, 10289,
-        10291, 10296, 10300, 10300, 10302, 10304, 10315, 10325,
-        10333, 10334, 10336, 10337, 10341, 10345, 10355, 10359,
-        10366, 10377, 10384, 10388, 10394, 10405, 10437, 10486,
-        10501, 10516, 10521, 10523, 10528, 10560, 10568, 10570,
-        10592, 10614,
+        0, 0, 1, 2, 4, 9, 13, 15,
+        57, 98, 144, 145, 149, 155, 155, 157,
+        159, 168, 174, 181, 182, 185, 186, 190,
+        195, 204, 208, 212, 220, 222, 224, 226,
+        229, 261, 263, 265, 269, 273, 276, 287,
+        300, 319, 332, 348, 360, 376, 391, 412,
+        422, 434, 445, 459, 474, 484, 496, 505,
+        517, 519, 523, 544, 553, 563, 569, 575,
+        576, 625, 627, 631, 633, 639, 646, 654,
+        661, 664, 670, 674, 678, 680, 684, 688,
+        692, 698, 706, 714, 720, 722, 726, 728,
+        734, 738, 742, 746, 750, 755, 762, 768,
+        770, 772, 776, 778, 784, 788, 792, 802,
+        807, 821, 836, 838, 846, 848, 853, 867,
+        872, 874, 878, 879, 883, 889, 895, 905,
+        915, 926, 934, 937, 940, 944, 948, 950,
+        953, 953, 956, 958, 988, 990, 992, 996,
+        1001, 1005, 1010, 1012, 1014, 1016, 1025, 1029,
+        1033, 1039, 1041, 1049, 1057, 1069, 1072, 1078,
+        1082, 1084, 1088, 1108, 1110, 1112, 1123, 1129,
+        1131, 1133, 1135, 1139, 1145, 1151, 1153, 1158,
+        1162, 1164, 1172, 1190, 1230, 1240, 1244, 1246,
+        1248, 1249, 1253, 1257, 1261, 1265, 1269, 1274,
+        1278, 1282, 1286, 1288, 1290, 1294, 1304, 1308,
+        1310, 1314, 1318, 1322, 1335, 1337, 1339, 1343,
+        1345, 1349, 1351, 1353, 1383, 1387, 1391, 1395,
+        1398, 1405, 1410, 1421, 1425, 1441, 1455, 1459,
+        1464, 1468, 1472, 1478, 1480, 1486, 1488, 1492,
+        1494, 1500, 1505, 1510, 1520, 1522, 1524, 1528,
+        1532, 1534, 1547, 1549, 1553, 1557, 1565, 1567,
+        1571, 1573, 1574, 1577, 1582, 1584, 1586, 1590,
+        1592, 1596, 1602, 1622, 1628, 1634, 1636, 1637,
+        1647, 1648, 1656, 1663, 1665, 1668, 1670, 1672,
+        1674, 1679, 1683, 1687, 1692, 1702, 1712, 1716,
+        1720, 1734, 1760, 1770, 1772, 1774, 1777, 1779,
+        1782, 1784, 1788, 1790, 1791, 1795, 1797, 1800,
+        1807, 1815, 1817, 1819, 1823, 1825, 1831, 1842,
+        1845, 1847, 1851, 1856, 1886, 1891, 1893, 1896,
+        1901, 1915, 1922, 1936, 1941, 1954, 1958, 1971,
+        1976, 1994, 1995, 2004, 2008, 2020, 2025, 2032,
+        2039, 2046, 2048, 2052, 2074, 2079, 2080, 2084,
+        2086, 2136, 2139, 2150, 2154, 2156, 2162, 2168,
+        2170, 2175, 2177, 2181, 2183, 2184, 2186, 2188,
+        2194, 2196, 2198, 2202, 2208, 2221, 2223, 2229,
+        2233, 2241, 2252, 2260, 2263, 2293, 2299, 2302,
+        2307, 2309, 2313, 2317, 2321, 2323, 2330, 2332,
+        2341, 2348, 2356, 2358, 2378, 2390, 2394, 2396,
+        2414, 2453, 2455, 2459, 2461, 2468, 2472, 2500,
+        2502, 2504, 2506, 2508, 2511, 2513, 2517, 2521,
+        2523, 2526, 2528, 2530, 2533, 2535, 2537, 2538,
+        2540, 2542, 2546, 2550, 2553, 2566, 2568, 2574,
+        2578, 2580, 2584, 2588, 2602, 2605, 2614, 2616,
+        2620, 2626, 2626, 2628, 2630, 2639, 2645, 2652,
+        2653, 2656, 2657, 2661, 2666, 2675, 2679, 2683,
+        2691, 2693, 2695, 2697, 2700, 2732, 2734, 2736,
+        2740, 2744, 2747, 2758, 2771, 2790, 2803, 2819,
+        2831, 2847, 2862, 2883, 2893, 2905, 2916, 2930,
+        2945, 2955, 2967, 2976, 2988, 2990, 2994, 3015,
+        3024, 3034, 3040, 3046, 3047, 3096, 3098, 3102,
+        3104, 3110, 3117, 3125, 3132, 3135, 3141, 3145,
+        3149, 3151, 3155, 3159, 3163, 3169, 3177, 3185,
+        3191, 3193, 3197, 3199, 3205, 3209, 3213, 3217,
+        3221, 3226, 3233, 3239, 3241, 3243, 3247, 3249,
+        3255, 3259, 3263, 3273, 3278, 3292, 3307, 3309,
+        3317, 3319, 3324, 3338, 3343, 3345, 3349, 3350,
+        3354, 3360, 3366, 3376, 3386, 3397, 3405, 3408,
+        3411, 3415, 3419, 3421, 3424, 3424, 3427, 3429,
+        3459, 3461, 3463, 3467, 3472, 3476, 3481, 3483,
+        3485, 3487, 3496, 3500, 3504, 3510, 3512, 3520,
+        3528, 3540, 3543, 3549, 3553, 3555, 3559, 3579,
+        3581, 3583, 3594, 3600, 3602, 3604, 3606, 3610,
+        3616, 3622, 3624, 3629, 3633, 3635, 3643, 3661,
+        3701, 3711, 3715, 3717, 3719, 3720, 3724, 3728,
+        3732, 3736, 3740, 3745, 3749, 3753, 3757, 3759,
+        3761, 3765, 3775, 3779, 3781, 3785, 3789, 3793,
+        3806, 3808, 3810, 3814, 3816, 3820, 3822, 3824,
+        3854, 3858, 3862, 3866, 3869, 3876, 3881, 3892,
+        3896, 3912, 3926, 3930, 3935, 3939, 3943, 3949,
+        3951, 3957, 3959, 3963, 3965, 3971, 3976, 3981,
+        3991, 3993, 3995, 3999, 4003, 4005, 4018, 4020,
+        4024, 4028, 4036, 4038, 4042, 4044, 4045, 4048,
+        4053, 4055, 4057, 4061, 4063, 4067, 4073, 4093,
+        4099, 4105, 4107, 4108, 4118, 4119, 4127, 4134,
+        4136, 4139, 4141, 4143, 4145, 4150, 4154, 4158,
+        4163, 4173, 4183, 4187, 4191, 4205, 4231, 4241,
+        4243, 4245, 4248, 4250, 4253, 4255, 4259, 4261,
+        4262, 4266, 4268, 4270, 4277, 4281, 4288, 4295,
+        4304, 4320, 4332, 4350, 4361, 4373, 4381, 4399,
+        4407, 4437, 4440, 4450, 4460, 4472, 4483, 4492,
+        4505, 4517, 4521, 4527, 4554, 4563, 4566, 4571,
+        4577, 4582, 4603, 4607, 4613, 4613, 4620, 4629,
+        4637, 4640, 4644, 4650, 4656, 4659, 4663, 4670,
+        4676, 4685, 4694, 4698, 4702, 4706, 4710, 4717,
+        4721, 4725, 4735, 4741, 4745, 4751, 4755, 4758,
+        4764, 4770, 4782, 4786, 4790, 4800, 4804, 4815,
+        4817, 4819, 4823, 4835, 4840, 4864, 4868, 4874,
+        4896, 4905, 4909, 4912, 4913, 4921, 4929, 4935,
+        4945, 4952, 4970, 4973, 4976, 4984, 4990, 4994,
+        4998, 5002, 5008, 5016, 5021, 5027, 5031, 5039,
+        5046, 5050, 5057, 5063, 5071, 5079, 5085, 5091,
+        5102, 5106, 5118, 5127, 5144, 5161, 5164, 5168,
+        5170, 5176, 5178, 5182, 5197, 5201, 5205, 5209,
+        5213, 5217, 5219, 5225, 5230, 5234, 5240, 5247,
+        5250, 5268, 5270, 5315, 5321, 5327, 5331, 5335,
+        5341, 5345, 5351, 5357, 5364, 5366, 5372, 5378,
+        5382, 5386, 5394, 5407, 5413, 5420, 5428, 5434,
+        5443, 5449, 5453, 5458, 5462, 5470, 5474, 5478,
+        5508, 5514, 5520, 5526, 5532, 5539, 5545, 5552,
+        5557, 5567, 5571, 5578, 5584, 5588, 5595, 5599,
+        5605, 5608, 5612, 5616, 5620, 5624, 5629, 5634,
+        5638, 5649, 5653, 5657, 5663, 5671, 5675, 5692,
+        5696, 5702, 5712, 5718, 5724, 5727, 5732, 5741,
+        5745, 5749, 5755, 5759, 5765, 5773, 5791, 5792,
+        5802, 5803, 5812, 5820, 5822, 5825, 5827, 5829,
+        5831, 5836, 5849, 5853, 5868, 5897, 5908, 5910,
+        5914, 5918, 5923, 5927, 5929, 5936, 5940, 5948,
+        5952, 5964, 5966, 5968, 5970, 5972, 5974, 5975,
+        5977, 5979, 5981, 5983, 5985, 5986, 5988, 5990,
+        5992, 5994, 5996, 6000, 6006, 6006, 6008, 6010,
+        6019, 6025, 6032, 6033, 6036, 6037, 6041, 6046,
+        6055, 6059, 6063, 6071, 6073, 6075, 6077, 6080,
+        6112, 6114, 6116, 6120, 6124, 6127, 6138, 6151,
+        6170, 6183, 6199, 6211, 6227, 6242, 6263, 6273,
+        6285, 6296, 6310, 6325, 6335, 6347, 6356, 6368,
+        6370, 6374, 6395, 6404, 6414, 6420, 6426, 6427,
+        6476, 6478, 6482, 6484, 6490, 6497, 6505, 6512,
+        6515, 6521, 6525, 6529, 6531, 6535, 6539, 6543,
+        6549, 6557, 6565, 6571, 6573, 6577, 6579, 6585,
+        6589, 6593, 6597, 6601, 6606, 6613, 6619, 6621,
+        6623, 6627, 6629, 6635, 6639, 6643, 6653, 6658,
+        6672, 6687, 6689, 6697, 6699, 6704, 6718, 6723,
+        6725, 6729, 6730, 6734, 6740, 6746, 6756, 6766,
+        6777, 6785, 6788, 6791, 6795, 6799, 6801, 6804,
+        6804, 6807, 6809, 6839, 6841, 6843, 6847, 6852,
+        6856, 6861, 6863, 6865, 6867, 6876, 6880, 6884,
+        6890, 6892, 6900, 6908, 6920, 6923, 6929, 6933,
+        6935, 6939, 6959, 6961, 6963, 6974, 6980, 6982,
+        6984, 6986, 6990, 6996, 7002, 7004, 7009, 7013,
+        7015, 7023, 7041, 7081, 7091, 7095, 7097, 7099,
+        7100, 7104, 7108, 7112, 7116, 7120, 7125, 7129,
+        7133, 7137, 7139, 7141, 7145, 7155, 7159, 7161,
+        7165, 7169, 7173, 7186, 7188, 7190, 7194, 7196,
+        7200, 7202, 7204, 7234, 7238, 7242, 7246, 7249,
+        7256, 7261, 7272, 7276, 7292, 7306, 7310, 7315,
+        7319, 7323, 7329, 7331, 7337, 7339, 7343, 7345,
+        7351, 7356, 7361, 7371, 7373, 7375, 7379, 7383,
+        7385, 7398, 7400, 7404, 7408, 7416, 7418, 7422,
+        7424, 7425, 7428, 7433, 7435, 7437, 7441, 7443,
+        7447, 7453, 7473, 7479, 7485, 7487, 7488, 7498,
+        7499, 7507, 7514, 7516, 7519, 7521, 7523, 7525,
+        7530, 7534, 7538, 7543, 7553, 7563, 7567, 7571,
+        7585, 7611, 7621, 7623, 7625, 7628, 7630, 7633,
+        7635, 7639, 7641, 7642, 7646, 7648, 7650, 7657,
+        7661, 7668, 7675, 7684, 7700, 7712, 7730, 7741,
+        7753, 7761, 7779, 7787, 7817, 7820, 7830, 7840,
+        7852, 7863, 7872, 7885, 7897, 7901, 7907, 7934,
+        7943, 7946, 7951, 7957, 7962, 7983, 7987, 7993,
+        7993, 8000, 8009, 8017, 8020, 8024, 8030, 8036,
+        8039, 8043, 8050, 8056, 8065, 8074, 8078, 8082,
+        8086, 8090, 8097, 8101, 8105, 8115, 8121, 8125,
+        8131, 8135, 8138, 8144, 8150, 8162, 8166, 8170,
+        8180, 8184, 8195, 8197, 8199, 8203, 8215, 8220,
+        8244, 8248, 8254, 8276, 8285, 8289, 8292, 8293,
+        8301, 8309, 8315, 8325, 8332, 8350, 8353, 8356,
+        8364, 8370, 8374, 8378, 8382, 8388, 8396, 8401,
+        8407, 8411, 8419, 8426, 8430, 8437, 8443, 8451,
+        8459, 8465, 8471, 8482, 8486, 8498, 8507, 8524,
+        8541, 8544, 8548, 8550, 8556, 8558, 8562, 8577,
+        8581, 8585, 8589, 8593, 8597, 8599, 8605, 8610,
+        8614, 8620, 8627, 8630, 8648, 8650, 8695, 8701,
+        8707, 8711, 8715, 8721, 8725, 8731, 8737, 8744,
+        8746, 8752, 8758, 8762, 8766, 8774, 8787, 8793,
+        8800, 8808, 8814, 8823, 8829, 8833, 8838, 8842,
+        8850, 8854, 8858, 8888, 8894, 8900, 8906, 8912,
+        8919, 8925, 8932, 8937, 8947, 8951, 8958, 8964,
+        8968, 8975, 8979, 8985, 8988, 8992, 8996, 9000,
+        9004, 9009, 9014, 9018, 9029, 9033, 9037, 9043,
+        9051, 9055, 9072, 9076, 9082, 9092, 9098, 9104,
+        9107, 9112, 9121, 9125, 9129, 9135, 9139, 9145,
+        9153, 9171, 9172, 9182, 9183, 9192, 9200, 9202,
+        9205, 9207, 9209, 9211, 9216, 9229, 9233, 9248,
+        9277, 9288, 9290, 9294, 9298, 9303, 9307, 9309,
+        9316, 9320, 9328, 9332, 9407, 9409, 9410, 9411,
+        9412, 9413, 9414, 9416, 9421, 9423, 9425, 9426,
+        9470, 9471, 9472, 9474, 9479, 9483, 9483, 9485,
+        9487, 9498, 9508, 9516, 9517, 9519, 9520, 9524,
+        9528, 9538, 9542, 9549, 9560, 9567, 9571, 9577,
+        9588, 9620, 9669, 9684, 9699, 9704, 9706, 9711,
+        9743, 9751, 9753, 9775, 9797, 9799, 9815, 9831,
+        9833, 9835, 9835, 9836, 9837, 9838, 9840, 9841,
+        9853, 9855, 9857, 9859, 9873, 9887, 9889, 9892,
+        9895, 9897, 9898, 9899, 9901, 9903, 9905, 9919,
+        9933, 9935, 9938, 9941, 9943, 9944, 9945, 9947,
+        9949, 9951, 10000, 10044, 10046, 10051, 10055, 10055,
+        10057, 10059, 10070, 10080, 10088, 10089, 10091, 10092,
+        10096, 10100, 10110, 10114, 10121, 10132, 10139, 10143,
+        10149, 10160, 10192, 10241, 10256, 10271, 10276, 10278,
+        10283, 10315, 10323, 10325, 10347, 10369,
 }
 
 var _hcltok_trans_keys []byte = []byte{
-        10, 46, 42, 42, 47, 46, 69, 101,
-        48, 57, 43, 45, 48, 57, 48, 57,
-        45, 95, 194, 195, 198, 199, 203, 205,
+        46, 42, 42, 47, 46, 69, 101, 48,
+        57, 43, 45, 48, 57, 48, 57, 45,
+        95, 194, 195, 198, 199, 203, 205, 206,
+        207, 210, 212, 213, 214, 215, 216, 217,
+        219, 220, 221, 222, 223, 224, 225, 226,
+        227, 228, 233, 234, 237, 239, 240, 65,
+        90, 97, 122, 196, 202, 208, 218, 229,
+        236, 95, 194, 195, 198, 199, 203, 205,
         206, 207, 210, 212, 213, 214, 215, 216,
         217, 219, 220, 221, 222, 223, 224, 225,
         226, 227, 228, 233, 234, 237, 239, 240,
         65, 90, 97, 122, 196, 202, 208, 218,
-        229, 236, 95, 194, 195, 198, 199, 203,
-        205, 206, 207, 210, 212, 213, 214, 215,
-        216, 217, 219, 220, 221, 222, 223, 224,
-        225, 226, 227, 228, 233, 234, 237, 239,
-        240, 65, 90, 97, 122, 196, 202, 208,
-        218, 229, 236, 10, 13, 45, 95, 194,
-        195, 198, 199, 203, 204, 205, 206, 207,
-        210, 212, 213, 214, 215, 216, 217, 219,
-        220, 221, 222, 223, 224, 225, 226, 227,
-        228, 233, 234, 237, 239, 240, 243, 48,
-        57, 65, 90, 97, 122, 196, 218, 229,
-        236, 10, 170, 181, 183, 186, 128, 150,
-        152, 182, 184, 255, 192, 255, 0, 127,
-        173, 130, 133, 146, 159, 165, 171, 175,
-        255, 181, 190, 184, 185, 192, 255, 140,
-        134, 138, 142, 161, 163, 255, 182, 130,
-        136, 137, 176, 151, 152, 154, 160, 190,
-        136, 144, 192, 255, 135, 129, 130, 132,
-        133, 144, 170, 176, 178, 144, 154, 160,
-        191, 128, 169, 174, 255, 148, 169, 157,
-        158, 189, 190, 192, 255, 144, 255, 139,
-        140, 178, 255, 186, 128, 181, 160, 161,
-        162, 163, 164, 165, 166, 167, 168, 169,
-        170, 171, 172, 173, 174, 175, 176, 177,
-        178, 179, 180, 181, 182, 183, 184, 185,
-        186, 187, 188, 189, 190, 191, 128, 173,
-        128, 155, 160, 180, 182, 189, 148, 161,
-        163, 255, 176, 164, 165, 132, 169, 177,
-        141, 142, 145, 146, 179, 181, 186, 187,
-        158, 133, 134, 137, 138, 143, 150, 152,
-        155, 164, 165, 178, 255, 188, 129, 131,
-        133, 138, 143, 144, 147, 168, 170, 176,
-        178, 179, 181, 182, 184, 185, 190, 255,
-        157, 131, 134, 137, 138, 142, 144, 146,
-        152, 159, 165, 182, 255, 129, 131, 133,
-        141, 143, 145, 147, 168, 170, 176, 178,
-        179, 181, 185, 188, 255, 134, 138, 142,
-        143, 145, 159, 164, 165, 176, 184, 186,
-        255, 129, 131, 133, 140, 143, 144, 147,
-        168, 170, 176, 178, 179, 181, 185, 188,
-        191, 177, 128, 132, 135, 136, 139, 141,
-        150, 151, 156, 157, 159, 163, 166, 175,
-        156, 130, 131, 133, 138, 142, 144, 146,
-        149, 153, 154, 158, 159, 163, 164, 168,
-        170, 174, 185, 190, 191, 144, 151, 128,
-        130, 134, 136, 138, 141, 166, 175, 128,
-        131, 133, 140, 142, 144, 146, 168, 170,
-        185, 189, 255, 133, 137, 151, 142, 148,
-        155, 159, 164, 165, 176, 255, 128, 131,
-        133, 140, 142, 144, 146, 168, 170, 179,
-        181, 185, 188, 191, 158, 128, 132, 134,
-        136, 138, 141, 149, 150, 160, 163, 166,
-        175, 177, 178, 129, 131, 133, 140, 142,
-        144, 146, 186, 189, 255, 133, 137, 143,
-        147, 152, 158, 164, 165, 176, 185, 192,
-        255, 189, 130, 131, 133, 150, 154, 177,
-        179, 187, 138, 150, 128, 134, 143, 148,
-        152, 159, 166, 175, 178, 179, 129, 186,
-        128, 142, 144, 153, 132, 138, 141, 165,
-        167, 129, 130, 135, 136, 148, 151, 153,
-        159, 161, 163, 170, 171, 173, 185, 187,
-        189, 134, 128, 132, 136, 141, 144, 153,
-        156, 159, 128, 181, 183, 185, 152, 153,
-        160, 169, 190, 191, 128, 135, 137, 172,
-        177, 191, 128, 132, 134, 151, 153, 188,
-        134, 128, 129, 130, 131, 137, 138, 139,
-        140, 141, 142, 143, 144, 153, 154, 155,
-        156, 157, 158, 159, 160, 161, 162, 163,
-        164, 165, 166, 167, 168, 169, 170, 173,
-        175, 176, 177, 178, 179, 181, 182, 183,
-        188, 189, 190, 191, 132, 152, 172, 184,
-        185, 187, 128, 191, 128, 137, 144, 255,
-        158, 159, 134, 187, 136, 140, 142, 143,
-        137, 151, 153, 142, 143, 158, 159, 137,
-        177, 142, 143, 182, 183, 191, 255, 128,
-        130, 133, 136, 150, 152, 255, 145, 150,
-        151, 155, 156, 160, 168, 178, 255, 128,
-        143, 160, 255, 182, 183, 190, 255, 129,
-        255, 173, 174, 192, 255, 129, 154, 160,
-        255, 171, 173, 185, 255, 128, 140, 142,
-        148, 160, 180, 128, 147, 160, 172, 174,
-        176, 178, 179, 148, 150, 152, 155, 158,
-        159, 170, 255, 139, 141, 144, 153, 160,
-        255, 184, 255, 128, 170, 176, 255, 182,
-        255, 128, 158, 160, 171, 176, 187, 134,
-        173, 176, 180, 128, 171, 176, 255, 138,
-        143, 155, 255, 128, 155, 160, 255, 159,
-        189, 190, 192, 255, 167, 128, 137, 144,
-        153, 176, 189, 140, 143, 154, 170, 180,
-        255, 180, 255, 128, 183, 128, 137, 141,
-        189, 128, 136, 144, 146, 148, 182, 184,
-        185, 128, 181, 187, 191, 150, 151, 158,
-        159, 152, 154, 156, 158, 134, 135, 142,
-        143, 190, 255, 190, 128, 180, 182, 188,
-        130, 132, 134, 140, 144, 147, 150, 155,
-        160, 172, 178, 180, 182, 188, 128, 129,
-        130, 131, 132, 133, 134, 176, 177, 178,
-        179, 180, 181, 182, 183, 191, 255, 129,
-        147, 149, 176, 178, 190, 192, 255, 144,
-        156, 161, 144, 156, 165, 176, 130, 135,
-        149, 164, 166, 168, 138, 147, 152, 157,
-        170, 185, 188, 191, 142, 133, 137, 160,
-        255, 137, 255, 128, 174, 176, 255, 159,
-        165, 170, 180, 255, 167, 173, 128, 165,
-        176, 255, 168, 174, 176, 190, 192, 255,
-        128, 150, 160, 166, 168, 174, 176, 182,
-        184, 190, 128, 134, 136, 142, 144, 150,
-        152, 158, 160, 191, 128, 129, 130, 131,
-        132, 133, 134, 135, 144, 145, 255, 133,
-        135, 161, 175, 177, 181, 184, 188, 160,
-        151, 152, 187, 192, 255, 133, 173, 177,
-        255, 143, 159, 187, 255, 176, 191, 182,
-        183, 184, 191, 192, 255, 150, 255, 128,
-        146, 147, 148, 152, 153, 154, 155, 156,
-        158, 159, 160, 161, 162, 163, 164, 165,
-        166, 167, 168, 169, 170, 171, 172, 173,
-        174, 175, 176, 129, 255, 141, 255, 144,
-        189, 141, 143, 172, 255, 191, 128, 175,
-        180, 189, 151, 159, 162, 255, 175, 137,
-        138, 184, 255, 183, 255, 168, 255, 128,
-        179, 188, 134, 143, 154, 159, 184, 186,
-        190, 255, 128, 173, 176, 255, 148, 159,
-        189, 255, 129, 142, 154, 159, 191, 255,
-        128, 182, 128, 141, 144, 153, 160, 182,
-        186, 255, 128, 130, 155, 157, 160, 175,
-        178, 182, 129, 134, 137, 142, 145, 150,
-        160, 166, 168, 174, 176, 255, 155, 166,
-        175, 128, 170, 172, 173, 176, 185, 158,
-        159, 160, 255, 164, 175, 135, 138, 188,
-        255, 164, 169, 171, 172, 173, 174, 175,
-        180, 181, 182, 183, 184, 185, 187, 188,
-        189, 190, 191, 165, 186, 174, 175, 154,
-        255, 190, 128, 134, 147, 151, 157, 168,
-        170, 182, 184, 188, 128, 129, 131, 132,
-        134, 255, 147, 255, 190, 255, 144, 145,
-        136, 175, 188, 255, 128, 143, 160, 175,
-        179, 180, 141, 143, 176, 180, 182, 255,
-        189, 255, 191, 144, 153, 161, 186, 129,
-        154, 166, 255, 191, 255, 130, 135, 138,
-        143, 146, 151, 154, 156, 144, 145, 146,
-        147, 148, 150, 151, 152, 155, 157, 158,
-        160, 170, 171, 172, 175, 161, 169, 128,
-        129, 130, 131, 133, 135, 138, 139, 140,
-        141, 142, 143, 144, 145, 146, 147, 148,
-        149, 152, 156, 157, 160, 161, 162, 163,
-        164, 166, 168, 169, 170, 171, 172, 173,
-        174, 176, 177, 153, 155, 178, 179, 128,
-        139, 141, 166, 168, 186, 188, 189, 191,
-        255, 142, 143, 158, 255, 187, 255, 128,
-        180, 189, 128, 156, 160, 255, 145, 159,
-        161, 255, 128, 159, 176, 255, 139, 143,
-        187, 255, 128, 157, 160, 255, 144, 132,
-        135, 150, 255, 158, 159, 170, 175, 148,
-        151, 188, 255, 128, 167, 176, 255, 164,
-        255, 183, 255, 128, 149, 160, 167, 136,
-        188, 128, 133, 138, 181, 183, 184, 191,
-        255, 150, 159, 183, 255, 128, 158, 160,
-        178, 180, 181, 128, 149, 160, 185, 128,
-        183, 190, 191, 191, 128, 131, 133, 134,
-        140, 147, 149, 151, 153, 179, 184, 186,
-        160, 188, 128, 156, 128, 135, 137, 166,
-        128, 181, 128, 149, 160, 178, 128, 145,
-        128, 178, 129, 130, 131, 132, 133, 135,
-        136, 138, 139, 140, 141, 144, 145, 146,
-        147, 150, 151, 152, 153, 154, 155, 156,
-        162, 163, 171, 176, 177, 178, 128, 134,
-        135, 165, 176, 190, 144, 168, 176, 185,
-        128, 180, 182, 191, 182, 144, 179, 155,
-        133, 137, 141, 143, 157, 255, 190, 128,
-        145, 147, 183, 136, 128, 134, 138, 141,
-        143, 157, 159, 168, 176, 255, 171, 175,
-        186, 255, 128, 131, 133, 140, 143, 144,
-        147, 168, 170, 176, 178, 179, 181, 185,
-        188, 191, 144, 151, 128, 132, 135, 136,
-        139, 141, 157, 163, 166, 172, 176, 180,
-        128, 138, 144, 153, 134, 136, 143, 154,
-        255, 128, 181, 184, 255, 129, 151, 158,
-        255, 129, 131, 133, 143, 154, 255, 128,
-        137, 128, 153, 157, 171, 176, 185, 160,
-        255, 170, 190, 192, 255, 128, 184, 128,
-        136, 138, 182, 184, 191, 128, 144, 153,
-        178, 255, 168, 144, 145, 183, 255, 128,
-        142, 145, 149, 129, 141, 144, 146, 147,
-        148, 175, 255, 132, 255, 128, 144, 129,
-        143, 144, 153, 145, 152, 135, 255, 160,
-        168, 169, 171, 172, 173, 174, 188, 189,
-        190, 191, 161, 167, 185, 255, 128, 158,
-        160, 169, 144, 173, 176, 180, 128, 131,
-        144, 153, 163, 183, 189, 255, 144, 255,
-        133, 143, 191, 255, 143, 159, 160, 128,
-        129, 255, 159, 160, 171, 172, 255, 173,
-        255, 179, 255, 128, 176, 177, 178, 128,
-        129, 171, 175, 189, 255, 128, 136, 144,
-        153, 157, 158, 133, 134, 137, 144, 145,
-        146, 147, 148, 149, 154, 155, 156, 157,
-        158, 159, 168, 169, 170, 150, 153, 165,
-        169, 173, 178, 187, 255, 131, 132, 140,
-        169, 174, 255, 130, 132, 149, 157, 173,
-        186, 188, 160, 161, 163, 164, 167, 168,
-        132, 134, 149, 157, 186, 139, 140, 191,
-        255, 134, 128, 132, 138, 144, 146, 255,
-        166, 167, 129, 155, 187, 149, 181, 143,
-        175, 137, 169, 131, 140, 141, 192, 255,
-        128, 182, 187, 255, 173, 180, 182, 255,
-        132, 155, 159, 161, 175, 128, 160, 163,
-        164, 165, 184, 185, 186, 161, 162, 128,
-        134, 136, 152, 155, 161, 163, 164, 166,
-        170, 133, 143, 151, 255, 139, 143, 154,
-        255, 164, 167, 185, 187, 128, 131, 133,
-        159, 161, 162, 169, 178, 180, 183, 130,
-        135, 137, 139, 148, 151, 153, 155, 157,
-        159, 164, 190, 141, 143, 145, 146, 161,
-        162, 167, 170, 172, 178, 180, 183, 185,
-        188, 128, 137, 139, 155, 161, 163, 165,
-        169, 171, 187, 155, 156, 151, 255, 156,
-        157, 160, 181, 255, 186, 187, 255, 162,
-        255, 160, 168, 161, 167, 158, 255, 160,
-        132, 135, 133, 134, 176, 255, 170, 181,
-        186, 191, 176, 180, 182, 183, 186, 189,
-        134, 140, 136, 138, 142, 161, 163, 255,
-        130, 137, 136, 255, 144, 170, 176, 178,
-        160, 191, 128, 138, 174, 175, 177, 255,
-        148, 150, 164, 167, 173, 176, 185, 189,
-        190, 192, 255, 144, 146, 175, 141, 255,
-        166, 176, 178, 255, 186, 138, 170, 180,
-        181, 160, 161, 162, 164, 165, 166, 167,
-        168, 169, 170, 171, 172, 173, 174, 175,
-        176, 177, 178, 179, 180, 181, 182, 184,
-        186, 187, 188, 189, 190, 183, 185, 154,
-        164, 168, 128, 149, 128, 152, 189, 132,
-        185, 144, 152, 161, 177, 255, 169, 177,
-        129, 132, 141, 142, 145, 146, 179, 181,
-        186, 188, 190, 255, 142, 156, 157, 159,
-        161, 176, 177, 133, 138, 143, 144, 147,
-        168, 170, 176, 178, 179, 181, 182, 184,
-        185, 158, 153, 156, 178, 180, 189, 133,
-        141, 143, 145, 147, 168, 170, 176, 178,
-        179, 181, 185, 144, 185, 160, 161, 189,
-        133, 140, 143, 144, 147, 168, 170, 176,
-        178, 179, 181, 185, 177, 156, 157, 159,
-        161, 131, 156, 133, 138, 142, 144, 146,
-        149, 153, 154, 158, 159, 163, 164, 168,
-        170, 174, 185, 144, 189, 133, 140, 142,
-        144, 146, 168, 170, 185, 152, 154, 160,
-        161, 128, 189, 133, 140, 142, 144, 146,
-        168, 170, 179, 181, 185, 158, 160, 161,
-        177, 178, 189, 133, 140, 142, 144, 146,
-        186, 142, 148, 150, 159, 161, 186, 191,
-        189, 133, 150, 154, 177, 179, 187, 128,
-        134, 129, 176, 178, 179, 132, 138, 141,
-        165, 167, 189, 129, 130, 135, 136, 148,
-        151, 153, 159, 161, 163, 170, 171, 173,
-        176, 178, 179, 134, 128, 132, 156, 159,
-        128, 128, 135, 137, 172, 136, 140, 128,
-        129, 130, 131, 137, 138, 139, 140, 141,
-        142, 143, 144, 153, 154, 155, 156, 157,
-        158, 159, 160, 161, 162, 163, 164, 165,
-        166, 167, 168, 169, 170, 172, 173, 174,
-        175, 176, 177, 178, 179, 180, 181, 182,
-        184, 188, 189, 190, 191, 132, 152, 185,
-        187, 191, 128, 170, 161, 144, 149, 154,
-        157, 165, 166, 174, 176, 181, 255, 130,
-        141, 143, 159, 155, 255, 128, 140, 142,
-        145, 160, 177, 128, 145, 160, 172, 174,
-        176, 151, 156, 170, 128, 168, 176, 255,
-        138, 255, 128, 150, 160, 255, 149, 255,
-        167, 133, 179, 133, 139, 131, 160, 174,
-        175, 186, 255, 166, 255, 128, 163, 141,
-        143, 154, 189, 169, 172, 174, 177, 181,
-        182, 129, 130, 132, 133, 134, 176, 177,
-        178, 179, 180, 181, 182, 183, 177, 191,
-        165, 170, 175, 177, 180, 255, 168, 174,
-        176, 255, 128, 134, 136, 142, 144, 150,
-        152, 158, 128, 129, 130, 131, 132, 133,
-        134, 135, 144, 145, 255, 133, 135, 161,
-        169, 177, 181, 184, 188, 160, 151, 154,
-        128, 146, 147, 148, 152, 153, 154, 155,
-        156, 158, 159, 160, 161, 162, 163, 164,
-        165, 166, 167, 168, 169, 170, 171, 172,
-        173, 174, 175, 176, 129, 255, 141, 143,
-        160, 169, 172, 255, 191, 128, 174, 130,
-        134, 139, 163, 255, 130, 179, 187, 189,
-        178, 183, 138, 165, 176, 255, 135, 159,
-        189, 255, 132, 178, 143, 160, 164, 166,
-        175, 186, 190, 128, 168, 186, 128, 130,
-        132, 139, 160, 182, 190, 255, 176, 178,
-        180, 183, 184, 190, 255, 128, 130, 155,
-        157, 160, 170, 178, 180, 128, 162, 164,
-        169, 171, 172, 173, 174, 175, 180, 181,
-        182, 183, 185, 186, 187, 188, 189, 190,
-        191, 165, 179, 157, 190, 128, 134, 147,
-        151, 159, 168, 170, 182, 184, 188, 176,
-        180, 182, 255, 161, 186, 144, 145, 146,
-        147, 148, 150, 151, 152, 155, 157, 158,
-        160, 170, 171, 172, 175, 161, 169, 128,
-        129, 130, 131, 133, 138, 139, 140, 141,
-        142, 143, 144, 145, 146, 147, 148, 149,
-        152, 156, 157, 160, 161, 162, 163, 164,
-        166, 168, 169, 170, 171, 172, 173, 174,
-        176, 177, 153, 155, 178, 179, 145, 255,
-        139, 143, 182, 255, 158, 175, 128, 144,
-        147, 149, 151, 153, 179, 128, 135, 137,
-        164, 128, 130, 131, 132, 133, 134, 135,
-        136, 138, 139, 140, 141, 144, 145, 146,
-        147, 150, 151, 152, 153, 154, 156, 162,
-        163, 171, 176, 177, 178, 131, 183, 131,
-        175, 144, 168, 131, 166, 182, 144, 178,
-        131, 178, 154, 156, 129, 132, 128, 145,
-        147, 171, 159, 255, 144, 157, 161, 135,
-        138, 128, 175, 135, 132, 133, 128, 174,
-        152, 155, 132, 128, 170, 128, 153, 160,
-        190, 192, 255, 128, 136, 138, 174, 128,
-        178, 255, 160, 168, 169, 171, 172, 173,
-        174, 188, 189, 190, 191, 161, 167, 144,
-        173, 128, 131, 163, 183, 189, 255, 133,
-        143, 145, 255, 147, 159, 128, 176, 177,
-        178, 128, 136, 144, 153, 144, 145, 146,
-        147, 148, 149, 154, 155, 156, 157, 158,
-        159, 150, 153, 131, 140, 255, 160, 163,
-        164, 165, 184, 185, 186, 161, 162, 133,
-        255, 170, 181, 183, 186, 128, 150, 152,
+        229, 236, 10, 13, 45, 95, 194, 195,
+        198, 199, 203, 204, 205, 206, 207, 210,
+        212, 213, 214, 215, 216, 217, 219, 220,
+        221, 222, 223, 224, 225, 226, 227, 228,
+        233, 234, 237, 239, 240, 243, 48, 57,
+        65, 90, 97, 122, 196, 218, 229, 236,
+        10, 170, 181, 183, 186, 128, 150, 152,
         182, 184, 255, 192, 255, 128, 255, 173,
         130, 133, 146, 159, 165, 171, 175, 255,
         181, 190, 184, 185, 192, 255, 140, 134,
@@ -779,649 +465,959 @@ var _hcltok_trans_keys []byte = []byte{
         171, 187, 155, 156, 151, 255, 156, 157,
         160, 181, 255, 186, 187, 255, 162, 255,
         160, 168, 161, 167, 158, 255, 160, 132,
-        135, 133, 134, 176, 255, 128, 191, 154,
-        164, 168, 128, 149, 150, 191, 128, 152,
-        153, 191, 181, 128, 159, 160, 189, 190,
-        191, 189, 128, 131, 132, 185, 186, 191,
-        144, 128, 151, 152, 161, 162, 176, 177,
-        255, 169, 177, 129, 132, 141, 142, 145,
-        146, 179, 181, 186, 188, 190, 191, 192,
-        255, 142, 158, 128, 155, 156, 161, 162,
-        175, 176, 177, 178, 191, 169, 177, 180,
-        183, 128, 132, 133, 138, 139, 142, 143,
-        144, 145, 146, 147, 185, 186, 191, 157,
-        128, 152, 153, 158, 159, 177, 178, 180,
-        181, 191, 142, 146, 169, 177, 180, 189,
-        128, 132, 133, 185, 186, 191, 144, 185,
-        128, 159, 160, 161, 162, 191, 169, 177,
-        180, 189, 128, 132, 133, 140, 141, 142,
-        143, 144, 145, 146, 147, 185, 186, 191,
-        158, 177, 128, 155, 156, 161, 162, 191,
-        131, 145, 155, 157, 128, 132, 133, 138,
-        139, 141, 142, 149, 150, 152, 153, 159,
-        160, 162, 163, 164, 165, 167, 168, 170,
-        171, 173, 174, 185, 186, 191, 144, 128,
-        191, 141, 145, 169, 189, 128, 132, 133,
-        185, 186, 191, 128, 151, 152, 154, 155,
-        159, 160, 161, 162, 191, 128, 141, 145,
-        169, 180, 189, 129, 132, 133, 185, 186,
-        191, 158, 128, 159, 160, 161, 162, 176,
-        177, 178, 179, 191, 141, 145, 189, 128,
-        132, 133, 186, 187, 191, 142, 128, 147,
-        148, 150, 151, 158, 159, 161, 162, 185,
-        186, 191, 178, 188, 128, 132, 133, 150,
-        151, 153, 154, 189, 190, 191, 128, 134,
-        135, 191, 128, 177, 129, 179, 180, 191,
-        128, 131, 137, 141, 152, 160, 164, 166,
-        172, 177, 189, 129, 132, 133, 134, 135,
-        138, 139, 147, 148, 167, 168, 169, 170,
-        179, 180, 191, 133, 128, 134, 135, 155,
-        156, 159, 160, 191, 128, 129, 191, 136,
-        128, 172, 173, 191, 128, 135, 136, 140,
-        141, 191, 191, 128, 170, 171, 190, 161,
-        128, 143, 144, 149, 150, 153, 154, 157,
-        158, 164, 165, 166, 167, 173, 174, 176,
-        177, 180, 181, 255, 130, 141, 143, 159,
-        134, 187, 136, 140, 142, 143, 137, 151,
-        153, 142, 143, 158, 159, 137, 177, 191,
-        142, 143, 182, 183, 192, 255, 129, 151,
-        128, 133, 134, 135, 136, 255, 145, 150,
-        151, 155, 191, 192, 255, 128, 143, 144,
-        159, 160, 255, 182, 183, 190, 191, 192,
-        255, 128, 129, 255, 173, 174, 192, 255,
-        128, 129, 154, 155, 159, 160, 255, 171,
-        173, 185, 191, 192, 255, 141, 128, 145,
-        146, 159, 160, 177, 178, 191, 173, 128,
-        145, 146, 159, 160, 176, 177, 191, 128,
-        179, 180, 191, 151, 156, 128, 191, 128,
-        159, 160, 255, 184, 191, 192, 255, 169,
-        128, 170, 171, 175, 176, 255, 182, 191,
-        192, 255, 128, 158, 159, 191, 128, 143,
-        144, 173, 174, 175, 176, 180, 181, 191,
-        128, 171, 172, 175, 176, 255, 138, 191,
-        192, 255, 128, 150, 151, 159, 160, 255,
-        149, 191, 192, 255, 167, 128, 191, 128,
-        132, 133, 179, 180, 191, 128, 132, 133,
-        139, 140, 191, 128, 130, 131, 160, 161,
-        173, 174, 175, 176, 185, 186, 255, 166,
-        191, 192, 255, 128, 163, 164, 191, 128,
-        140, 141, 143, 144, 153, 154, 189, 190,
-        191, 128, 136, 137, 191, 173, 128, 168,
-        169, 177, 178, 180, 181, 182, 183, 191,
-        0, 127, 192, 255, 150, 151, 158, 159,
-        152, 154, 156, 158, 134, 135, 142, 143,
-        190, 191, 192, 255, 181, 189, 191, 128,
-        190, 133, 181, 128, 129, 130, 140, 141,
-        143, 144, 147, 148, 149, 150, 155, 156,
-        159, 160, 172, 173, 177, 178, 188, 189,
-        191, 177, 191, 128, 190, 128, 143, 144,
-        156, 157, 191, 130, 135, 148, 164, 166,
-        168, 128, 137, 138, 149, 150, 151, 152,
-        157, 158, 169, 170, 185, 186, 187, 188,
-        191, 142, 128, 132, 133, 137, 138, 159,
-        160, 255, 137, 191, 192, 255, 175, 128,
-        255, 159, 165, 170, 175, 177, 180, 191,
-        192, 255, 166, 173, 128, 167, 168, 175,
-        176, 255, 168, 174, 176, 191, 192, 255,
-        167, 175, 183, 191, 128, 150, 151, 159,
-        160, 190, 135, 143, 151, 128, 158, 159,
-        191, 128, 132, 133, 135, 136, 160, 161,
-        169, 170, 176, 177, 181, 182, 183, 184,
-        188, 189, 191, 160, 151, 154, 187, 192,
-        255, 128, 132, 133, 173, 174, 176, 177,
-        255, 143, 159, 187, 191, 192, 255, 128,
-        175, 176, 191, 150, 191, 192, 255, 141,
-        191, 192, 255, 128, 143, 144, 189, 190,
-        191, 141, 143, 160, 169, 172, 191, 192,
-        255, 191, 128, 174, 175, 190, 128, 157,
-        158, 159, 160, 255, 176, 191, 192, 255,
-        128, 150, 151, 159, 160, 161, 162, 255,
-        175, 137, 138, 184, 191, 192, 255, 128,
-        182, 183, 255, 130, 134, 139, 163, 191,
-        192, 255, 128, 129, 130, 179, 180, 191,
-        187, 189, 128, 177, 178, 183, 184, 191,
-        128, 137, 138, 165, 166, 175, 176, 255,
-        135, 159, 189, 191, 192, 255, 128, 131,
-        132, 178, 179, 191, 143, 165, 191, 128,
-        159, 160, 175, 176, 185, 186, 190, 128,
-        168, 169, 191, 131, 186, 128, 139, 140,
-        159, 160, 182, 183, 189, 190, 255, 176,
-        178, 180, 183, 184, 190, 191, 192, 255,
-        129, 128, 130, 131, 154, 155, 157, 158,
-        159, 160, 170, 171, 177, 178, 180, 181,
-        191, 128, 167, 175, 129, 134, 135, 136,
-        137, 142, 143, 144, 145, 150, 151, 159,
-        160, 255, 155, 166, 175, 128, 162, 163,
-        191, 164, 175, 135, 138, 188, 191, 192,
-        255, 174, 175, 154, 191, 192, 255, 157,
-        169, 183, 189, 191, 128, 134, 135, 146,
-        147, 151, 152, 158, 159, 190, 130, 133,
-        128, 255, 178, 191, 192, 255, 128, 146,
-        147, 255, 190, 191, 192, 255, 128, 143,
-        144, 255, 144, 145, 136, 175, 188, 191,
-        192, 255, 181, 128, 175, 176, 255, 189,
-        191, 192, 255, 128, 160, 161, 186, 187,
-        191, 128, 129, 154, 155, 165, 166, 255,
-        191, 192, 255, 128, 129, 130, 135, 136,
-        137, 138, 143, 144, 145, 146, 151, 152,
-        153, 154, 156, 157, 191, 128, 191, 128,
-        129, 130, 131, 133, 138, 139, 140, 141,
-        142, 143, 144, 145, 146, 147, 148, 149,
-        152, 156, 157, 160, 161, 162, 163, 164,
-        166, 168, 169, 170, 171, 172, 173, 174,
-        176, 177, 132, 151, 153, 155, 158, 175,
-        178, 179, 180, 191, 140, 167, 187, 190,
-        128, 255, 142, 143, 158, 191, 192, 255,
-        187, 191, 192, 255, 128, 180, 181, 191,
-        128, 156, 157, 159, 160, 255, 145, 191,
-        192, 255, 128, 159, 160, 175, 176, 255,
-        139, 143, 182, 191, 192, 255, 144, 132,
-        135, 150, 191, 192, 255, 158, 175, 148,
-        151, 188, 191, 192, 255, 128, 167, 168,
-        175, 176, 255, 164, 191, 192, 255, 183,
-        191, 192, 255, 128, 149, 150, 159, 160,
-        167, 168, 191, 136, 182, 188, 128, 133,
-        134, 137, 138, 184, 185, 190, 191, 255,
-        150, 159, 183, 191, 192, 255, 179, 128,
-        159, 160, 181, 182, 191, 128, 149, 150,
-        159, 160, 185, 186, 191, 128, 183, 184,
-        189, 190, 191, 128, 148, 152, 129, 143,
-        144, 179, 180, 191, 128, 159, 160, 188,
-        189, 191, 128, 156, 157, 191, 136, 128,
-        164, 165, 191, 128, 181, 182, 191, 128,
-        149, 150, 159, 160, 178, 179, 191, 128,
-        145, 146, 191, 128, 178, 179, 191, 128,
-        130, 131, 132, 133, 134, 135, 136, 138,
-        139, 140, 141, 144, 145, 146, 147, 150,
-        151, 152, 153, 154, 156, 162, 163, 171,
-        176, 177, 178, 129, 191, 128, 130, 131,
-        183, 184, 191, 128, 130, 131, 175, 176,
-        191, 128, 143, 144, 168, 169, 191, 128,
-        130, 131, 166, 167, 191, 182, 128, 143,
-        144, 178, 179, 191, 128, 130, 131, 178,
-        179, 191, 128, 154, 156, 129, 132, 133,
-        191, 146, 128, 171, 172, 191, 135, 137,
-        142, 158, 128, 168, 169, 175, 176, 255,
-        159, 191, 192, 255, 144, 128, 156, 157,
-        161, 162, 191, 128, 134, 135, 138, 139,
-        191, 128, 175, 176, 191, 134, 128, 131,
-        132, 135, 136, 191, 128, 174, 175, 191,
-        128, 151, 152, 155, 156, 191, 132, 128,
-        191, 128, 170, 171, 191, 128, 153, 154,
-        191, 160, 190, 192, 255, 128, 184, 185,
-        191, 137, 128, 174, 175, 191, 128, 129,
-        177, 178, 255, 144, 191, 192, 255, 128,
-        142, 143, 144, 145, 146, 149, 129, 148,
-        150, 191, 175, 191, 192, 255, 132, 191,
-        192, 255, 128, 144, 129, 143, 145, 191,
-        144, 153, 128, 143, 145, 152, 154, 191,
-        135, 191, 192, 255, 160, 168, 169, 171,
-        172, 173, 174, 188, 189, 190, 191, 128,
-        159, 161, 167, 170, 187, 185, 191, 192,
-        255, 128, 143, 144, 173, 174, 191, 128,
-        131, 132, 162, 163, 183, 184, 188, 189,
-        255, 133, 143, 145, 191, 192, 255, 128,
-        146, 147, 159, 160, 191, 160, 128, 191,
-        128, 129, 191, 192, 255, 159, 160, 171,
-        128, 170, 172, 191, 192, 255, 173, 191,
-        192, 255, 179, 191, 192, 255, 128, 176,
-        177, 178, 129, 191, 128, 129, 130, 191,
-        171, 175, 189, 191, 192, 255, 128, 136,
-        137, 143, 144, 153, 154, 191, 144, 145,
-        146, 147, 148, 149, 154, 155, 156, 157,
-        158, 159, 128, 143, 150, 153, 160, 191,
-        149, 157, 173, 186, 188, 160, 161, 163,
-        164, 167, 168, 132, 134, 149, 157, 186,
-        191, 139, 140, 192, 255, 133, 145, 128,
-        134, 135, 137, 138, 255, 166, 167, 129,
-        155, 187, 149, 181, 143, 175, 137, 169,
-        131, 140, 191, 192, 255, 160, 163, 164,
-        165, 184, 185, 186, 128, 159, 161, 162,
-        166, 191, 133, 191, 192, 255, 132, 160,
-        163, 167, 179, 184, 186, 128, 164, 165,
-        168, 169, 187, 188, 191, 130, 135, 137,
-        139, 144, 147, 151, 153, 155, 157, 159,
-        163, 171, 179, 184, 189, 191, 128, 140,
-        141, 148, 149, 160, 161, 164, 165, 166,
-        167, 190, 138, 164, 170, 128, 155, 156,
-        160, 161, 187, 188, 191, 128, 191, 155,
-        156, 128, 191, 151, 191, 192, 255, 156,
-        157, 160, 128, 191, 181, 191, 192, 255,
-        158, 159, 186, 128, 185, 187, 191, 192,
-        255, 162, 191, 192, 255, 160, 168, 128,
-        159, 161, 167, 169, 191, 158, 191, 192,
-        255, 123, 123, 128, 191, 128, 191, 128,
-        191, 128, 191, 128, 191, 10, 123, 123,
-        128, 191, 128, 191, 128, 191, 123, 123,
-        10, 123, 128, 191, 128, 191, 128, 191,
-        123, 123, 170, 181, 183, 186, 128, 150,
-        152, 182, 184, 255, 192, 255, 128, 255,
-        173, 130, 133, 146, 159, 165, 171, 175,
-        255, 181, 190, 184, 185, 192, 255, 140,
-        134, 138, 142, 161, 163, 255, 182, 130,
-        136, 137, 176, 151, 152, 154, 160, 190,
-        136, 144, 192, 255, 135, 129, 130, 132,
-        133, 144, 170, 176, 178, 144, 154, 160,
-        191, 128, 169, 174, 255, 148, 169, 157,
-        158, 189, 190, 192, 255, 144, 255, 139,
-        140, 178, 255, 186, 128, 181, 160, 161,
-        162, 163, 164, 165, 166, 167, 168, 169,
-        170, 171, 172, 173, 174, 175, 176, 177,
-        178, 179, 180, 181, 182, 183, 184, 185,
-        186, 187, 188, 189, 190, 191, 128, 173,
-        128, 155, 160, 180, 182, 189, 148, 161,
-        163, 255, 176, 164, 165, 132, 169, 177,
-        141, 142, 145, 146, 179, 181, 186, 187,
-        158, 133, 134, 137, 138, 143, 150, 152,
-        155, 164, 165, 178, 255, 188, 129, 131,
-        133, 138, 143, 144, 147, 168, 170, 176,
-        178, 179, 181, 182, 184, 185, 190, 255,
-        157, 131, 134, 137, 138, 142, 144, 146,
-        152, 159, 165, 182, 255, 129, 131, 133,
-        141, 143, 145, 147, 168, 170, 176, 178,
-        179, 181, 185, 188, 255, 134, 138, 142,
-        143, 145, 159, 164, 165, 176, 184, 186,
-        255, 129, 131, 133, 140, 143, 144, 147,
-        168, 170, 176, 178, 179, 181, 185, 188,
-        191, 177, 128, 132, 135, 136, 139, 141,
-        150, 151, 156, 157, 159, 163, 166, 175,
-        156, 130, 131, 133, 138, 142, 144, 146,
-        149, 153, 154, 158, 159, 163, 164, 168,
-        170, 174, 185, 190, 191, 144, 151, 128,
-        130, 134, 136, 138, 141, 166, 175, 128,
-        131, 133, 140, 142, 144, 146, 168, 170,
-        185, 189, 255, 133, 137, 151, 142, 148,
-        155, 159, 164, 165, 176, 255, 128, 131,
-        133, 140, 142, 144, 146, 168, 170, 179,
-        181, 185, 188, 191, 158, 128, 132, 134,
-        136, 138, 141, 149, 150, 160, 163, 166,
-        175, 177, 178, 129, 131, 133, 140, 142,
-        144, 146, 186, 189, 255, 133, 137, 143,
-        147, 152, 158, 164, 165, 176, 185, 192,
-        255, 189, 130, 131, 133, 150, 154, 177,
-        179, 187, 138, 150, 128, 134, 143, 148,
-        152, 159, 166, 175, 178, 179, 129, 186,
-        128, 142, 144, 153, 132, 138, 141, 165,
-        167, 129, 130, 135, 136, 148, 151, 153,
-        159, 161, 163, 170, 171, 173, 185, 187,
-        189, 134, 128, 132, 136, 141, 144, 153,
-        156, 159, 128, 181, 183, 185, 152, 153,
-        160, 169, 190, 191, 128, 135, 137, 172,
-        177, 191, 128, 132, 134, 151, 153, 188,
-        134, 128, 129, 130, 131, 137, 138, 139,
-        140, 141, 142, 143, 144, 153, 154, 155,
-        156, 157, 158, 159, 160, 161, 162, 163,
-        164, 165, 166, 167, 168, 169, 170, 173,
-        175, 176, 177, 178, 179, 181, 182, 183,
-        188, 189, 190, 191, 132, 152, 172, 184,
-        185, 187, 128, 191, 128, 137, 144, 255,
-        158, 159, 134, 187, 136, 140, 142, 143,
-        137, 151, 153, 142, 143, 158, 159, 137,
-        177, 142, 143, 182, 183, 191, 255, 128,
-        130, 133, 136, 150, 152, 255, 145, 150,
-        151, 155, 156, 160, 168, 178, 255, 128,
-        143, 160, 255, 182, 183, 190, 255, 129,
-        255, 173, 174, 192, 255, 129, 154, 160,
-        255, 171, 173, 185, 255, 128, 140, 142,
-        148, 160, 180, 128, 147, 160, 172, 174,
-        176, 178, 179, 148, 150, 152, 155, 158,
-        159, 170, 255, 139, 141, 144, 153, 160,
-        255, 184, 255, 128, 170, 176, 255, 182,
-        255, 128, 158, 160, 171, 176, 187, 134,
-        173, 176, 180, 128, 171, 176, 255, 138,
-        143, 155, 255, 128, 155, 160, 255, 159,
-        189, 190, 192, 255, 167, 128, 137, 144,
-        153, 176, 189, 140, 143, 154, 170, 180,
-        255, 180, 255, 128, 183, 128, 137, 141,
-        189, 128, 136, 144, 146, 148, 182, 184,
-        185, 128, 181, 187, 191, 150, 151, 158,
-        159, 152, 154, 156, 158, 134, 135, 142,
-        143, 190, 255, 190, 128, 180, 182, 188,
-        130, 132, 134, 140, 144, 147, 150, 155,
-        160, 172, 178, 180, 182, 188, 128, 129,
-        130, 131, 132, 133, 134, 176, 177, 178,
-        179, 180, 181, 182, 183, 191, 255, 129,
-        147, 149, 176, 178, 190, 192, 255, 144,
-        156, 161, 144, 156, 165, 176, 130, 135,
-        149, 164, 166, 168, 138, 147, 152, 157,
-        170, 185, 188, 191, 142, 133, 137, 160,
-        255, 137, 255, 128, 174, 176, 255, 159,
-        165, 170, 180, 255, 167, 173, 128, 165,
-        176, 255, 168, 174, 176, 190, 192, 255,
-        128, 150, 160, 166, 168, 174, 176, 182,
-        184, 190, 128, 134, 136, 142, 144, 150,
-        152, 158, 160, 191, 128, 129, 130, 131,
-        132, 133, 134, 135, 144, 145, 255, 133,
-        135, 161, 175, 177, 181, 184, 188, 160,
-        151, 152, 187, 192, 255, 133, 173, 177,
-        255, 143, 159, 187, 255, 176, 191, 182,
-        183, 184, 191, 192, 255, 150, 255, 128,
+        135, 133, 134, 176, 255, 170, 181, 186,
+        191, 176, 180, 182, 183, 186, 189, 134,
+        140, 136, 138, 142, 161, 163, 255, 130,
+        137, 136, 255, 144, 170, 176, 178, 160,
+        191, 128, 138, 174, 175, 177, 255, 148,
+        150, 164, 167, 173, 176, 185, 189, 190,
+        192, 255, 144, 146, 175, 141, 255, 166,
+        176, 178, 255, 186, 138, 170, 180, 181,
+        160, 161, 162, 164, 165, 166, 167, 168,
+        169, 170, 171, 172, 173, 174, 175, 176,
+        177, 178, 179, 180, 181, 182, 184, 186,
+        187, 188, 189, 190, 183, 185, 154, 164,
+        168, 128, 149, 128, 152, 189, 132, 185,
+        144, 152, 161, 177, 255, 169, 177, 129,
+        132, 141, 142, 145, 146, 179, 181, 186,
+        188, 190, 255, 142, 156, 157, 159, 161,
+        176, 177, 133, 138, 143, 144, 147, 168,
+        170, 176, 178, 179, 181, 182, 184, 185,
+        158, 153, 156, 178, 180, 189, 133, 141,
+        143, 145, 147, 168, 170, 176, 178, 179,
+        181, 185, 144, 185, 160, 161, 189, 133,
+        140, 143, 144, 147, 168, 170, 176, 178,
+        179, 181, 185, 177, 156, 157, 159, 161,
+        131, 156, 133, 138, 142, 144, 146, 149,
+        153, 154, 158, 159, 163, 164, 168, 170,
+        174, 185, 144, 189, 133, 140, 142, 144,
+        146, 168, 170, 185, 152, 154, 160, 161,
+        128, 189, 133, 140, 142, 144, 146, 168,
+        170, 179, 181, 185, 158, 160, 161, 177,
+        178, 189, 133, 140, 142, 144, 146, 186,
+        142, 148, 150, 159, 161, 186, 191, 189,
+        133, 150, 154, 177, 179, 187, 128, 134,
+        129, 176, 178, 179, 132, 138, 141, 165,
+        167, 189, 129, 130, 135, 136, 148, 151,
+        153, 159, 161, 163, 170, 171, 173, 176,
+        178, 179, 134, 128, 132, 156, 159, 128,
+        128, 135, 137, 172, 136, 140, 128, 129,
+        130, 131, 137, 138, 139, 140, 141, 142,
+        143, 144, 153, 154, 155, 156, 157, 158,
+        159, 160, 161, 162, 163, 164, 165, 166,
+        167, 168, 169, 170, 172, 173, 174, 175,
+        176, 177, 178, 179, 180, 181, 182, 184,
+        188, 189, 190, 191, 132, 152, 185, 187,
+        191, 128, 170, 161, 144, 149, 154, 157,
+        165, 166, 174, 176, 181, 255, 130, 141,
+        143, 159, 155, 255, 128, 140, 142, 145,
+        160, 177, 128, 145, 160, 172, 174, 176,
+        151, 156, 170, 128, 168, 176, 255, 138,
+        255, 128, 150, 160, 255, 149, 255, 167,
+        133, 179, 133, 139, 131, 160, 174, 175,
+        186, 255, 166, 255, 128, 163, 141, 143,
+        154, 189, 169, 172, 174, 177, 181, 182,
+        129, 130, 132, 133, 134, 176, 177, 178,
+        179, 180, 181, 182, 183, 177, 191, 165,
+        170, 175, 177, 180, 255, 168, 174, 176,
+        255, 128, 134, 136, 142, 144, 150, 152,
+        158, 128, 129, 130, 131, 132, 133, 134,
+        135, 144, 145, 255, 133, 135, 161, 169,
+        177, 181, 184, 188, 160, 151, 154, 128,
         146, 147, 148, 152, 153, 154, 155, 156,
         158, 159, 160, 161, 162, 163, 164, 165,
         166, 167, 168, 169, 170, 171, 172, 173,
-        174, 175, 176, 129, 255, 141, 255, 144,
-        189, 141, 143, 172, 255, 191, 128, 175,
-        180, 189, 151, 159, 162, 255, 175, 137,
-        138, 184, 255, 183, 255, 168, 255, 128,
-        179, 188, 134, 143, 154, 159, 184, 186,
-        190, 255, 128, 173, 176, 255, 148, 159,
-        189, 255, 129, 142, 154, 159, 191, 255,
-        128, 182, 128, 141, 144, 153, 160, 182,
-        186, 255, 128, 130, 155, 157, 160, 175,
-        178, 182, 129, 134, 137, 142, 145, 150,
-        160, 166, 168, 174, 176, 255, 155, 166,
-        175, 128, 170, 172, 173, 176, 185, 158,
-        159, 160, 255, 164, 175, 135, 138, 188,
-        255, 164, 169, 171, 172, 173, 174, 175,
-        180, 181, 182, 183, 184, 185, 187, 188,
-        189, 190, 191, 165, 186, 174, 175, 154,
-        255, 190, 128, 134, 147, 151, 157, 168,
-        170, 182, 184, 188, 128, 129, 131, 132,
-        134, 255, 147, 255, 190, 255, 144, 145,
-        136, 175, 188, 255, 128, 143, 160, 175,
-        179, 180, 141, 143, 176, 180, 182, 255,
-        189, 255, 191, 144, 153, 161, 186, 129,
-        154, 166, 255, 191, 255, 130, 135, 138,
-        143, 146, 151, 154, 156, 144, 145, 146,
-        147, 148, 150, 151, 152, 155, 157, 158,
-        160, 170, 171, 172, 175, 161, 169, 128,
-        129, 130, 131, 133, 135, 138, 139, 140,
-        141, 142, 143, 144, 145, 146, 147, 148,
-        149, 152, 156, 157, 160, 161, 162, 163,
-        164, 166, 168, 169, 170, 171, 172, 173,
-        174, 176, 177, 153, 155, 178, 179, 128,
-        139, 141, 166, 168, 186, 188, 189, 191,
-        255, 142, 143, 158, 255, 187, 255, 128,
-        180, 189, 128, 156, 160, 255, 145, 159,
-        161, 255, 128, 159, 176, 255, 139, 143,
-        187, 255, 128, 157, 160, 255, 144, 132,
-        135, 150, 255, 158, 159, 170, 175, 148,
-        151, 188, 255, 128, 167, 176, 255, 164,
-        255, 183, 255, 128, 149, 160, 167, 136,
-        188, 128, 133, 138, 181, 183, 184, 191,
-        255, 150, 159, 183, 255, 128, 158, 160,
-        178, 180, 181, 128, 149, 160, 185, 128,
-        183, 190, 191, 191, 128, 131, 133, 134,
-        140, 147, 149, 151, 153, 179, 184, 186,
-        160, 188, 128, 156, 128, 135, 137, 166,
-        128, 181, 128, 149, 160, 178, 128, 145,
-        128, 178, 129, 130, 131, 132, 133, 135,
-        136, 138, 139, 140, 141, 144, 145, 146,
-        147, 150, 151, 152, 153, 154, 155, 156,
-        162, 163, 171, 176, 177, 178, 128, 134,
-        135, 165, 176, 190, 144, 168, 176, 185,
-        128, 180, 182, 191, 182, 144, 179, 155,
-        133, 137, 141, 143, 157, 255, 190, 128,
-        145, 147, 183, 136, 128, 134, 138, 141,
-        143, 157, 159, 168, 176, 255, 171, 175,
-        186, 255, 128, 131, 133, 140, 143, 144,
-        147, 168, 170, 176, 178, 179, 181, 185,
-        188, 191, 144, 151, 128, 132, 135, 136,
-        139, 141, 157, 163, 166, 172, 176, 180,
-        128, 138, 144, 153, 134, 136, 143, 154,
-        255, 128, 181, 184, 255, 129, 151, 158,
-        255, 129, 131, 133, 143, 154, 255, 128,
-        137, 128, 153, 157, 171, 176, 185, 160,
-        255, 170, 190, 192, 255, 128, 184, 128,
-        136, 138, 182, 184, 191, 128, 144, 153,
-        178, 255, 168, 144, 145, 183, 255, 128,
-        142, 145, 149, 129, 141, 144, 146, 147,
-        148, 175, 255, 132, 255, 128, 144, 129,
-        143, 144, 153, 145, 152, 135, 255, 160,
-        168, 169, 171, 172, 173, 174, 188, 189,
-        190, 191, 161, 167, 185, 255, 128, 158,
-        160, 169, 144, 173, 176, 180, 128, 131,
-        144, 153, 163, 183, 189, 255, 144, 255,
-        133, 143, 191, 255, 143, 159, 160, 128,
-        129, 255, 159, 160, 171, 172, 255, 173,
-        255, 179, 255, 128, 176, 177, 178, 128,
-        129, 171, 175, 189, 255, 128, 136, 144,
-        153, 157, 158, 133, 134, 137, 144, 145,
-        146, 147, 148, 149, 154, 155, 156, 157,
-        158, 159, 168, 169, 170, 150, 153, 165,
-        169, 173, 178, 187, 255, 131, 132, 140,
-        169, 174, 255, 130, 132, 149, 157, 173,
-        186, 188, 160, 161, 163, 164, 167, 168,
-        132, 134, 149, 157, 186, 139, 140, 191,
-        255, 134, 128, 132, 138, 144, 146, 255,
-        166, 167, 129, 155, 187, 149, 181, 143,
-        175, 137, 169, 131, 140, 141, 192, 255,
-        128, 182, 187, 255, 173, 180, 182, 255,
-        132, 155, 159, 161, 175, 128, 160, 163,
-        164, 165, 184, 185, 186, 161, 162, 128,
-        134, 136, 152, 155, 161, 163, 164, 166,
-        170, 133, 143, 151, 255, 139, 143, 154,
-        255, 164, 167, 185, 187, 128, 131, 133,
-        159, 161, 162, 169, 178, 180, 183, 130,
-        135, 137, 139, 148, 151, 153, 155, 157,
-        159, 164, 190, 141, 143, 145, 146, 161,
-        162, 167, 170, 172, 178, 180, 183, 185,
-        188, 128, 137, 139, 155, 161, 163, 165,
-        169, 171, 187, 155, 156, 151, 255, 156,
-        157, 160, 181, 255, 186, 187, 255, 162,
-        255, 160, 168, 161, 167, 158, 255, 160,
-        132, 135, 133, 134, 176, 255, 128, 191,
-        154, 164, 168, 128, 149, 150, 191, 128,
-        152, 153, 191, 181, 128, 159, 160, 189,
-        190, 191, 189, 128, 131, 132, 185, 186,
-        191, 144, 128, 151, 152, 161, 162, 176,
-        177, 255, 169, 177, 129, 132, 141, 142,
-        145, 146, 179, 181, 186, 188, 190, 191,
-        192, 255, 142, 158, 128, 155, 156, 161,
-        162, 175, 176, 177, 178, 191, 169, 177,
-        180, 183, 128, 132, 133, 138, 139, 142,
-        143, 144, 145, 146, 147, 185, 186, 191,
-        157, 128, 152, 153, 158, 159, 177, 178,
-        180, 181, 191, 142, 146, 169, 177, 180,
-        189, 128, 132, 133, 185, 186, 191, 144,
-        185, 128, 159, 160, 161, 162, 191, 169,
-        177, 180, 189, 128, 132, 133, 140, 141,
-        142, 143, 144, 145, 146, 147, 185, 186,
-        191, 158, 177, 128, 155, 156, 161, 162,
-        191, 131, 145, 155, 157, 128, 132, 133,
-        138, 139, 141, 142, 149, 150, 152, 153,
-        159, 160, 162, 163, 164, 165, 167, 168,
-        170, 171, 173, 174, 185, 186, 191, 144,
-        128, 191, 141, 145, 169, 189, 128, 132,
-        133, 185, 186, 191, 128, 151, 152, 154,
-        155, 159, 160, 161, 162, 191, 128, 141,
-        145, 169, 180, 189, 129, 132, 133, 185,
-        186, 191, 158, 128, 159, 160, 161, 162,
-        176, 177, 178, 179, 191, 141, 145, 189,
-        128, 132, 133, 186, 187, 191, 142, 128,
-        147, 148, 150, 151, 158, 159, 161, 162,
-        185, 186, 191, 178, 188, 128, 132, 133,
-        150, 151, 153, 154, 189, 190, 191, 128,
-        134, 135, 191, 128, 177, 129, 179, 180,
-        191, 128, 131, 137, 141, 152, 160, 164,
-        166, 172, 177, 189, 129, 132, 133, 134,
-        135, 138, 139, 147, 148, 167, 168, 169,
-        170, 179, 180, 191, 133, 128, 134, 135,
-        155, 156, 159, 160, 191, 128, 129, 191,
-        136, 128, 172, 173, 191, 128, 135, 136,
-        140, 141, 191, 191, 128, 170, 171, 190,
-        161, 128, 143, 144, 149, 150, 153, 154,
-        157, 158, 164, 165, 166, 167, 173, 174,
-        176, 177, 180, 181, 255, 130, 141, 143,
-        159, 134, 187, 136, 140, 142, 143, 137,
-        151, 153, 142, 143, 158, 159, 137, 177,
-        191, 142, 143, 182, 183, 192, 255, 129,
-        151, 128, 133, 134, 135, 136, 255, 145,
-        150, 151, 155, 191, 192, 255, 128, 143,
-        144, 159, 160, 255, 182, 183, 190, 191,
-        192, 255, 128, 129, 255, 173, 174, 192,
-        255, 128, 129, 154, 155, 159, 160, 255,
-        171, 173, 185, 191, 192, 255, 141, 128,
-        145, 146, 159, 160, 177, 178, 191, 173,
-        128, 145, 146, 159, 160, 176, 177, 191,
-        128, 179, 180, 191, 151, 156, 128, 191,
-        128, 159, 160, 255, 184, 191, 192, 255,
-        169, 128, 170, 171, 175, 176, 255, 182,
-        191, 192, 255, 128, 158, 159, 191, 128,
-        143, 144, 173, 174, 175, 176, 180, 181,
-        191, 128, 171, 172, 175, 176, 255, 138,
-        191, 192, 255, 128, 150, 151, 159, 160,
-        255, 149, 191, 192, 255, 167, 128, 191,
-        128, 132, 133, 179, 180, 191, 128, 132,
-        133, 139, 140, 191, 128, 130, 131, 160,
-        161, 173, 174, 175, 176, 185, 186, 255,
-        166, 191, 192, 255, 128, 163, 164, 191,
-        128, 140, 141, 143, 144, 153, 154, 189,
-        190, 191, 128, 136, 137, 191, 173, 128,
-        168, 169, 177, 178, 180, 181, 182, 183,
-        191, 0, 127, 192, 255, 150, 151, 158,
-        159, 152, 154, 156, 158, 134, 135, 142,
-        143, 190, 191, 192, 255, 181, 189, 191,
-        128, 190, 133, 181, 128, 129, 130, 140,
-        141, 143, 144, 147, 148, 149, 150, 155,
-        156, 159, 160, 172, 173, 177, 178, 188,
-        189, 191, 177, 191, 128, 190, 128, 143,
-        144, 156, 157, 191, 130, 135, 148, 164,
-        166, 168, 128, 137, 138, 149, 150, 151,
-        152, 157, 158, 169, 170, 185, 186, 187,
-        188, 191, 142, 128, 132, 133, 137, 138,
-        159, 160, 255, 137, 191, 192, 255, 175,
-        128, 255, 159, 165, 170, 175, 177, 180,
-        191, 192, 255, 166, 173, 128, 167, 168,
-        175, 176, 255, 168, 174, 176, 191, 192,
-        255, 167, 175, 183, 191, 128, 150, 151,
-        159, 160, 190, 135, 143, 151, 128, 158,
-        159, 191, 128, 132, 133, 135, 136, 160,
-        161, 169, 170, 176, 177, 181, 182, 183,
-        184, 188, 189, 191, 160, 151, 154, 187,
-        192, 255, 128, 132, 133, 173, 174, 176,
-        177, 255, 143, 159, 187, 191, 192, 255,
-        128, 175, 176, 191, 150, 191, 192, 255,
-        141, 191, 192, 255, 128, 143, 144, 189,
-        190, 191, 141, 143, 160, 169, 172, 191,
-        192, 255, 191, 128, 174, 175, 190, 128,
-        157, 158, 159, 160, 255, 176, 191, 192,
-        255, 128, 150, 151, 159, 160, 161, 162,
-        255, 175, 137, 138, 184, 191, 192, 255,
-        128, 182, 183, 255, 130, 134, 139, 163,
-        191, 192, 255, 128, 129, 130, 179, 180,
-        191, 187, 189, 128, 177, 178, 183, 184,
-        191, 128, 137, 138, 165, 166, 175, 176,
-        255, 135, 159, 189, 191, 192, 255, 128,
-        131, 132, 178, 179, 191, 143, 165, 191,
-        128, 159, 160, 175, 176, 185, 186, 190,
-        128, 168, 169, 191, 131, 186, 128, 139,
-        140, 159, 160, 182, 183, 189, 190, 255,
-        176, 178, 180, 183, 184, 190, 191, 192,
-        255, 129, 128, 130, 131, 154, 155, 157,
-        158, 159, 160, 170, 171, 177, 178, 180,
-        181, 191, 128, 167, 175, 129, 134, 135,
-        136, 137, 142, 143, 144, 145, 150, 151,
-        159, 160, 255, 155, 166, 175, 128, 162,
-        163, 191, 164, 175, 135, 138, 188, 191,
-        192, 255, 174, 175, 154, 191, 192, 255,
-        157, 169, 183, 189, 191, 128, 134, 135,
-        146, 147, 151, 152, 158, 159, 190, 130,
-        133, 128, 255, 178, 191, 192, 255, 128,
-        146, 147, 255, 190, 191, 192, 255, 128,
-        143, 144, 255, 144, 145, 136, 175, 188,
-        191, 192, 255, 181, 128, 175, 176, 255,
-        189, 191, 192, 255, 128, 160, 161, 186,
-        187, 191, 128, 129, 154, 155, 165, 166,
-        255, 191, 192, 255, 128, 129, 130, 135,
-        136, 137, 138, 143, 144, 145, 146, 151,
-        152, 153, 154, 156, 157, 191, 128, 191,
-        128, 129, 130, 131, 133, 138, 139, 140,
-        141, 142, 143, 144, 145, 146, 147, 148,
-        149, 152, 156, 157, 160, 161, 162, 163,
-        164, 166, 168, 169, 170, 171, 172, 173,
-        174, 176, 177, 132, 151, 153, 155, 158,
-        175, 178, 179, 180, 191, 140, 167, 187,
-        190, 128, 255, 142, 143, 158, 191, 192,
-        255, 187, 191, 192, 255, 128, 180, 181,
-        191, 128, 156, 157, 159, 160, 255, 145,
-        191, 192, 255, 128, 159, 160, 175, 176,
-        255, 139, 143, 182, 191, 192, 255, 144,
-        132, 135, 150, 191, 192, 255, 158, 175,
-        148, 151, 188, 191, 192, 255, 128, 167,
-        168, 175, 176, 255, 164, 191, 192, 255,
-        183, 191, 192, 255, 128, 149, 150, 159,
-        160, 167, 168, 191, 136, 182, 188, 128,
-        133, 134, 137, 138, 184, 185, 190, 191,
-        255, 150, 159, 183, 191, 192, 255, 179,
-        128, 159, 160, 181, 182, 191, 128, 149,
-        150, 159, 160, 185, 186, 191, 128, 183,
-        184, 189, 190, 191, 128, 148, 152, 129,
-        143, 144, 179, 180, 191, 128, 159, 160,
-        188, 189, 191, 128, 156, 157, 191, 136,
-        128, 164, 165, 191, 128, 181, 182, 191,
-        128, 149, 150, 159, 160, 178, 179, 191,
-        128, 145, 146, 191, 128, 178, 179, 191,
+        174, 175, 176, 129, 255, 141, 143, 160,
+        169, 172, 255, 191, 128, 174, 130, 134,
+        139, 163, 255, 130, 179, 187, 189, 178,
+        183, 138, 165, 176, 255, 135, 159, 189,
+        255, 132, 178, 143, 160, 164, 166, 175,
+        186, 190, 128, 168, 186, 128, 130, 132,
+        139, 160, 182, 190, 255, 176, 178, 180,
+        183, 184, 190, 255, 128, 130, 155, 157,
+        160, 170, 178, 180, 128, 162, 164, 169,
+        171, 172, 173, 174, 175, 180, 181, 182,
+        183, 185, 186, 187, 188, 189, 190, 191,
+        165, 179, 157, 190, 128, 134, 147, 151,
+        159, 168, 170, 182, 184, 188, 176, 180,
+        182, 255, 161, 186, 144, 145, 146, 147,
+        148, 150, 151, 152, 155, 157, 158, 160,
+        170, 171, 172, 175, 161, 169, 128, 129,
+        130, 131, 133, 138, 139, 140, 141, 142,
+        143, 144, 145, 146, 147, 148, 149, 152,
+        156, 157, 160, 161, 162, 163, 164, 166,
+        168, 169, 170, 171, 172, 173, 174, 176,
+        177, 153, 155, 178, 179, 145, 255, 139,
+        143, 182, 255, 158, 175, 128, 144, 147,
+        149, 151, 153, 179, 128, 135, 137, 164,
         128, 130, 131, 132, 133, 134, 135, 136,
         138, 139, 140, 141, 144, 145, 146, 147,
         150, 151, 152, 153, 154, 156, 162, 163,
-        171, 176, 177, 178, 129, 191, 128, 130,
-        131, 183, 184, 191, 128, 130, 131, 175,
-        176, 191, 128, 143, 144, 168, 169, 191,
-        128, 130, 131, 166, 167, 191, 182, 128,
-        143, 144, 178, 179, 191, 128, 130, 131,
-        178, 179, 191, 128, 154, 156, 129, 132,
-        133, 191, 146, 128, 171, 172, 191, 135,
-        137, 142, 158, 128, 168, 169, 175, 176,
-        255, 159, 191, 192, 255, 144, 128, 156,
-        157, 161, 162, 191, 128, 134, 135, 138,
-        139, 191, 128, 175, 176, 191, 134, 128,
-        131, 132, 135, 136, 191, 128, 174, 175,
-        191, 128, 151, 152, 155, 156, 191, 132,
-        128, 191, 128, 170, 171, 191, 128, 153,
-        154, 191, 160, 190, 192, 255, 128, 184,
-        185, 191, 137, 128, 174, 175, 191, 128,
-        129, 177, 178, 255, 144, 191, 192, 255,
-        128, 142, 143, 144, 145, 146, 149, 129,
-        148, 150, 191, 175, 191, 192, 255, 132,
-        191, 192, 255, 128, 144, 129, 143, 145,
-        191, 144, 153, 128, 143, 145, 152, 154,
-        191, 135, 191, 192, 255, 160, 168, 169,
+        171, 176, 177, 178, 131, 183, 131, 175,
+        144, 168, 131, 166, 182, 144, 178, 131,
+        178, 154, 156, 129, 132, 128, 145, 147,
+        171, 159, 255, 144, 157, 161, 135, 138,
+        128, 175, 135, 132, 133, 128, 174, 152,
+        155, 132, 128, 170, 128, 153, 160, 190,
+        192, 255, 128, 136, 138, 174, 128, 178,
+        255, 160, 168, 169, 171, 172, 173, 174,
+        188, 189, 190, 191, 161, 167, 144, 173,
+        128, 131, 163, 183, 189, 255, 133, 143,
+        145, 255, 147, 159, 128, 176, 177, 178,
+        128, 136, 144, 153, 144, 145, 146, 147,
+        148, 149, 154, 155, 156, 157, 158, 159,
+        150, 153, 131, 140, 255, 160, 163, 164,
+        165, 184, 185, 186, 161, 162, 133, 255,
+        170, 181, 183, 186, 128, 150, 152, 182,
+        184, 255, 192, 255, 128, 255, 173, 130,
+        133, 146, 159, 165, 171, 175, 255, 181,
+        190, 184, 185, 192, 255, 140, 134, 138,
+        142, 161, 163, 255, 182, 130, 136, 137,
+        176, 151, 152, 154, 160, 190, 136, 144,
+        192, 255, 135, 129, 130, 132, 133, 144,
+        170, 176, 178, 144, 154, 160, 191, 128,
+        169, 174, 255, 148, 169, 157, 158, 189,
+        190, 192, 255, 144, 255, 139, 140, 178,
+        255, 186, 128, 181, 160, 161, 162, 163,
+        164, 165, 166, 167, 168, 169, 170, 171,
+        172, 173, 174, 175, 176, 177, 178, 179,
+        180, 181, 182, 183, 184, 185, 186, 187,
+        188, 189, 190, 191, 128, 173, 128, 155,
+        160, 180, 182, 189, 148, 161, 163, 255,
+        176, 164, 165, 132, 169, 177, 141, 142,
+        145, 146, 179, 181, 186, 187, 158, 133,
+        134, 137, 138, 143, 150, 152, 155, 164,
+        165, 178, 255, 188, 129, 131, 133, 138,
+        143, 144, 147, 168, 170, 176, 178, 179,
+        181, 182, 184, 185, 190, 255, 157, 131,
+        134, 137, 138, 142, 144, 146, 152, 159,
+        165, 182, 255, 129, 131, 133, 141, 143,
+        145, 147, 168, 170, 176, 178, 179, 181,
+        185, 188, 255, 134, 138, 142, 143, 145,
+        159, 164, 165, 176, 184, 186, 255, 129,
+        131, 133, 140, 143, 144, 147, 168, 170,
+        176, 178, 179, 181, 185, 188, 191, 177,
+        128, 132, 135, 136, 139, 141, 150, 151,
+        156, 157, 159, 163, 166, 175, 156, 130,
+        131, 133, 138, 142, 144, 146, 149, 153,
+        154, 158, 159, 163, 164, 168, 170, 174,
+        185, 190, 191, 144, 151, 128, 130, 134,
+        136, 138, 141, 166, 175, 128, 131, 133,
+        140, 142, 144, 146, 168, 170, 185, 189,
+        255, 133, 137, 151, 142, 148, 155, 159,
+        164, 165, 176, 255, 128, 131, 133, 140,
+        142, 144, 146, 168, 170, 179, 181, 185,
+        188, 191, 158, 128, 132, 134, 136, 138,
+        141, 149, 150, 160, 163, 166, 175, 177,
+        178, 129, 131, 133, 140, 142, 144, 146,
+        186, 189, 255, 133, 137, 143, 147, 152,
+        158, 164, 165, 176, 185, 192, 255, 189,
+        130, 131, 133, 150, 154, 177, 179, 187,
+        138, 150, 128, 134, 143, 148, 152, 159,
+        166, 175, 178, 179, 129, 186, 128, 142,
+        144, 153, 132, 138, 141, 165, 167, 129,
+        130, 135, 136, 148, 151, 153, 159, 161,
+        163, 170, 171, 173, 185, 187, 189, 134,
+        128, 132, 136, 141, 144, 153, 156, 159,
+        128, 181, 183, 185, 152, 153, 160, 169,
+        190, 191, 128, 135, 137, 172, 177, 191,
+        128, 132, 134, 151, 153, 188, 134, 128,
+        129, 130, 131, 137, 138, 139, 140, 141,
+        142, 143, 144, 153, 154, 155, 156, 157,
+        158, 159, 160, 161, 162, 163, 164, 165,
+        166, 167, 168, 169, 170, 173, 175, 176,
+        177, 178, 179, 181, 182, 183, 188, 189,
+        190, 191, 132, 152, 172, 184, 185, 187,
+        128, 191, 128, 137, 144, 255, 158, 159,
+        134, 187, 136, 140, 142, 143, 137, 151,
+        153, 142, 143, 158, 159, 137, 177, 142,
+        143, 182, 183, 191, 255, 128, 130, 133,
+        136, 150, 152, 255, 145, 150, 151, 155,
+        156, 160, 168, 178, 255, 128, 143, 160,
+        255, 182, 183, 190, 255, 129, 255, 173,
+        174, 192, 255, 129, 154, 160, 255, 171,
+        173, 185, 255, 128, 140, 142, 148, 160,
+        180, 128, 147, 160, 172, 174, 176, 178,
+        179, 148, 150, 152, 155, 158, 159, 170,
+        255, 139, 141, 144, 153, 160, 255, 184,
+        255, 128, 170, 176, 255, 182, 255, 128,
+        158, 160, 171, 176, 187, 134, 173, 176,
+        180, 128, 171, 176, 255, 138, 143, 155,
+        255, 128, 155, 160, 255, 159, 189, 190,
+        192, 255, 167, 128, 137, 144, 153, 176,
+        189, 140, 143, 154, 170, 180, 255, 180,
+        255, 128, 183, 128, 137, 141, 189, 128,
+        136, 144, 146, 148, 182, 184, 185, 128,
+        181, 187, 191, 150, 151, 158, 159, 152,
+        154, 156, 158, 134, 135, 142, 143, 190,
+        255, 190, 128, 180, 182, 188, 130, 132,
+        134, 140, 144, 147, 150, 155, 160, 172,
+        178, 180, 182, 188, 128, 129, 130, 131,
+        132, 133, 134, 176, 177, 178, 179, 180,
+        181, 182, 183, 191, 255, 129, 147, 149,
+        176, 178, 190, 192, 255, 144, 156, 161,
+        144, 156, 165, 176, 130, 135, 149, 164,
+        166, 168, 138, 147, 152, 157, 170, 185,
+        188, 191, 142, 133, 137, 160, 255, 137,
+        255, 128, 174, 176, 255, 159, 165, 170,
+        180, 255, 167, 173, 128, 165, 176, 255,
+        168, 174, 176, 190, 192, 255, 128, 150,
+        160, 166, 168, 174, 176, 182, 184, 190,
+        128, 134, 136, 142, 144, 150, 152, 158,
+        160, 191, 128, 129, 130, 131, 132, 133,
+        134, 135, 144, 145, 255, 133, 135, 161,
+        175, 177, 181, 184, 188, 160, 151, 152,
+        187, 192, 255, 133, 173, 177, 255, 143,
+        159, 187, 255, 176, 191, 182, 183, 184,
+        191, 192, 255, 150, 255, 128, 146, 147,
+        148, 152, 153, 154, 155, 156, 158, 159,
+        160, 161, 162, 163, 164, 165, 166, 167,
+        168, 169, 170, 171, 172, 173, 174, 175,
+        176, 129, 255, 141, 255, 144, 189, 141,
+        143, 172, 255, 191, 128, 175, 180, 189,
+        151, 159, 162, 255, 175, 137, 138, 184,
+        255, 183, 255, 168, 255, 128, 179, 188,
+        134, 143, 154, 159, 184, 186, 190, 255,
+        128, 173, 176, 255, 148, 159, 189, 255,
+        129, 142, 154, 159, 191, 255, 128, 182,
+        128, 141, 144, 153, 160, 182, 186, 255,
+        128, 130, 155, 157, 160, 175, 178, 182,
+        129, 134, 137, 142, 145, 150, 160, 166,
+        168, 174, 176, 255, 155, 166, 175, 128,
+        170, 172, 173, 176, 185, 158, 159, 160,
+        255, 164, 175, 135, 138, 188, 255, 164,
+        169, 171, 172, 173, 174, 175, 180, 181,
+        182, 183, 184, 185, 187, 188, 189, 190,
+        191, 165, 186, 174, 175, 154, 255, 190,
+        128, 134, 147, 151, 157, 168, 170, 182,
+        184, 188, 128, 129, 131, 132, 134, 255,
+        147, 255, 190, 255, 144, 145, 136, 175,
+        188, 255, 128, 143, 160, 175, 179, 180,
+        141, 143, 176, 180, 182, 255, 189, 255,
+        191, 144, 153, 161, 186, 129, 154, 166,
+        255, 191, 255, 130, 135, 138, 143, 146,
+        151, 154, 156, 144, 145, 146, 147, 148,
+        150, 151, 152, 155, 157, 158, 160, 170,
+        171, 172, 175, 161, 169, 128, 129, 130,
+        131, 133, 135, 138, 139, 140, 141, 142,
+        143, 144, 145, 146, 147, 148, 149, 152,
+        156, 157, 160, 161, 162, 163, 164, 166,
+        168, 169, 170, 171, 172, 173, 174, 176,
+        177, 153, 155, 178, 179, 128, 139, 141,
+        166, 168, 186, 188, 189, 191, 255, 142,
+        143, 158, 255, 187, 255, 128, 180, 189,
+        128, 156, 160, 255, 145, 159, 161, 255,
+        128, 159, 176, 255, 139, 143, 187, 255,
+        128, 157, 160, 255, 144, 132, 135, 150,
+        255, 158, 159, 170, 175, 148, 151, 188,
+        255, 128, 167, 176, 255, 164, 255, 183,
+        255, 128, 149, 160, 167, 136, 188, 128,
+        133, 138, 181, 183, 184, 191, 255, 150,
+        159, 183, 255, 128, 158, 160, 178, 180,
+        181, 128, 149, 160, 185, 128, 183, 190,
+        191, 191, 128, 131, 133, 134, 140, 147,
+        149, 151, 153, 179, 184, 186, 160, 188,
+        128, 156, 128, 135, 137, 166, 128, 181,
+        128, 149, 160, 178, 128, 145, 128, 178,
+        129, 130, 131, 132, 133, 135, 136, 138,
+        139, 140, 141, 144, 145, 146, 147, 150,
+        151, 152, 153, 154, 155, 156, 162, 163,
+        171, 176, 177, 178, 128, 134, 135, 165,
+        176, 190, 144, 168, 176, 185, 128, 180,
+        182, 191, 182, 144, 179, 155, 133, 137,
+        141, 143, 157, 255, 190, 128, 145, 147,
+        183, 136, 128, 134, 138, 141, 143, 157,
+        159, 168, 176, 255, 171, 175, 186, 255,
+        128, 131, 133, 140, 143, 144, 147, 168,
+        170, 176, 178, 179, 181, 185, 188, 191,
+        144, 151, 128, 132, 135, 136, 139, 141,
+        157, 163, 166, 172, 176, 180, 128, 138,
+        144, 153, 134, 136, 143, 154, 255, 128,
+        181, 184, 255, 129, 151, 158, 255, 129,
+        131, 133, 143, 154, 255, 128, 137, 128,
+        153, 157, 171, 176, 185, 160, 255, 170,
+        190, 192, 255, 128, 184, 128, 136, 138,
+        182, 184, 191, 128, 144, 153, 178, 255,
+        168, 144, 145, 183, 255, 128, 142, 145,
+        149, 129, 141, 144, 146, 147, 148, 175,
+        255, 132, 255, 128, 144, 129, 143, 144,
+        153, 145, 152, 135, 255, 160, 168, 169,
         171, 172, 173, 174, 188, 189, 190, 191,
-        128, 159, 161, 167, 170, 187, 185, 191,
-        192, 255, 128, 143, 144, 173, 174, 191,
-        128, 131, 132, 162, 163, 183, 184, 188,
-        189, 255, 133, 143, 145, 191, 192, 255,
-        128, 146, 147, 159, 160, 191, 160, 128,
-        191, 128, 129, 191, 192, 255, 159, 160,
-        171, 128, 170, 172, 191, 192, 255, 173,
-        191, 192, 255, 179, 191, 192, 255, 128,
-        176, 177, 178, 129, 191, 128, 129, 130,
-        191, 171, 175, 189, 191, 192, 255, 128,
-        136, 137, 143, 144, 153, 154, 191, 144,
-        145, 146, 147, 148, 149, 154, 155, 156,
-        157, 158, 159, 128, 143, 150, 153, 160,
-        191, 149, 157, 173, 186, 188, 160, 161,
-        163, 164, 167, 168, 132, 134, 149, 157,
-        186, 191, 139, 140, 192, 255, 133, 145,
-        128, 134, 135, 137, 138, 255, 166, 167,
+        161, 167, 185, 255, 128, 158, 160, 169,
+        144, 173, 176, 180, 128, 131, 144, 153,
+        163, 183, 189, 255, 144, 255, 133, 143,
+        191, 255, 143, 159, 160, 128, 129, 255,
+        159, 160, 171, 172, 255, 173, 255, 179,
+        255, 128, 176, 177, 178, 128, 129, 171,
+        175, 189, 255, 128, 136, 144, 153, 157,
+        158, 133, 134, 137, 144, 145, 146, 147,
+        148, 149, 154, 155, 156, 157, 158, 159,
+        168, 169, 170, 150, 153, 165, 169, 173,
+        178, 187, 255, 131, 132, 140, 169, 174,
+        255, 130, 132, 149, 157, 173, 186, 188,
+        160, 161, 163, 164, 167, 168, 132, 134,
+        149, 157, 186, 139, 140, 191, 255, 134,
+        128, 132, 138, 144, 146, 255, 166, 167,
         129, 155, 187, 149, 181, 143, 175, 137,
-        169, 131, 140, 191, 192, 255, 160, 163,
-        164, 165, 184, 185, 186, 128, 159, 161,
-        162, 166, 191, 133, 191, 192, 255, 132,
-        160, 163, 167, 179, 184, 186, 128, 164,
-        165, 168, 169, 187, 188, 191, 130, 135,
-        137, 139, 144, 147, 151, 153, 155, 157,
-        159, 163, 171, 179, 184, 189, 191, 128,
-        140, 141, 148, 149, 160, 161, 164, 165,
-        166, 167, 190, 138, 164, 170, 128, 155,
-        156, 160, 161, 187, 188, 191, 128, 191,
-        155, 156, 128, 191, 151, 191, 192, 255,
-        156, 157, 160, 128, 191, 181, 191, 192,
-        255, 158, 159, 186, 128, 185, 187, 191,
-        192, 255, 162, 191, 192, 255, 160, 168,
-        128, 159, 161, 167, 169, 191, 158, 191,
-        192, 255, 9, 10, 13, 32, 33, 34,
-        35, 37, 38, 46, 47, 60, 61, 62,
-        64, 92, 95, 123, 124, 125, 126, 127,
-        194, 195, 198, 199, 203, 204, 205, 206,
-        207, 210, 212, 213, 214, 215, 216, 217,
-        219, 220, 221, 222, 223, 224, 225, 226,
-        227, 228, 233, 234, 237, 238, 239, 240,
-        0, 39, 40, 45, 48, 57, 58, 63,
-        65, 90, 91, 96, 97, 122, 192, 193,
-        196, 218, 229, 236, 241, 247, 9, 32,
-        10, 61, 10, 38, 46, 42, 47, 42,
+        169, 131, 140, 141, 192, 255, 128, 182,
+        187, 255, 173, 180, 182, 255, 132, 155,
+        159, 161, 175, 128, 160, 163, 164, 165,
+        184, 185, 186, 161, 162, 128, 134, 136,
+        152, 155, 161, 163, 164, 166, 170, 133,
+        143, 151, 255, 139, 143, 154, 255, 164,
+        167, 185, 187, 128, 131, 133, 159, 161,
+        162, 169, 178, 180, 183, 130, 135, 137,
+        139, 148, 151, 153, 155, 157, 159, 164,
+        190, 141, 143, 145, 146, 161, 162, 167,
+        170, 172, 178, 180, 183, 185, 188, 128,
+        137, 139, 155, 161, 163, 165, 169, 171,
+        187, 155, 156, 151, 255, 156, 157, 160,
+        181, 255, 186, 187, 255, 162, 255, 160,
+        168, 161, 167, 158, 255, 160, 132, 135,
+        133, 134, 176, 255, 128, 191, 154, 164,
+        168, 128, 149, 150, 191, 128, 152, 153,
+        191, 181, 128, 159, 160, 189, 190, 191,
+        189, 128, 131, 132, 185, 186, 191, 144,
+        128, 151, 152, 161, 162, 176, 177, 255,
+        169, 177, 129, 132, 141, 142, 145, 146,
+        179, 181, 186, 188, 190, 191, 192, 255,
+        142, 158, 128, 155, 156, 161, 162, 175,
+        176, 177, 178, 191, 169, 177, 180, 183,
+        128, 132, 133, 138, 139, 142, 143, 144,
+        145, 146, 147, 185, 186, 191, 157, 128,
+        152, 153, 158, 159, 177, 178, 180, 181,
+        191, 142, 146, 169, 177, 180, 189, 128,
+        132, 133, 185, 186, 191, 144, 185, 128,
+        159, 160, 161, 162, 191, 169, 177, 180,
+        189, 128, 132, 133, 140, 141, 142, 143,
+        144, 145, 146, 147, 185, 186, 191, 158,
+        177, 128, 155, 156, 161, 162, 191, 131,
+        145, 155, 157, 128, 132, 133, 138, 139,
+        141, 142, 149, 150, 152, 153, 159, 160,
+        162, 163, 164, 165, 167, 168, 170, 171,
+        173, 174, 185, 186, 191, 144, 128, 191,
+        141, 145, 169, 189, 128, 132, 133, 185,
+        186, 191, 128, 151, 152, 154, 155, 159,
+        160, 161, 162, 191, 128, 141, 145, 169,
+        180, 189, 129, 132, 133, 185, 186, 191,
+        158, 128, 159, 160, 161, 162, 176, 177,
+        178, 179, 191, 141, 145, 189, 128, 132,
+        133, 186, 187, 191, 142, 128, 147, 148,
+        150, 151, 158, 159, 161, 162, 185, 186,
+        191, 178, 188, 128, 132, 133, 150, 151,
+        153, 154, 189, 190, 191, 128, 134, 135,
+        191, 128, 177, 129, 179, 180, 191, 128,
+        131, 137, 141, 152, 160, 164, 166, 172,
+        177, 189, 129, 132, 133, 134, 135, 138,
+        139, 147, 148, 167, 168, 169, 170, 179,
+        180, 191, 133, 128, 134, 135, 155, 156,
+        159, 160, 191, 128, 129, 191, 136, 128,
+        172, 173, 191, 128, 135, 136, 140, 141,
+        191, 191, 128, 170, 171, 190, 161, 128,
+        143, 144, 149, 150, 153, 154, 157, 158,
+        164, 165, 166, 167, 173, 174, 176, 177,
+        180, 181, 255, 130, 141, 143, 159, 134,
+        187, 136, 140, 142, 143, 137, 151, 153,
+        142, 143, 158, 159, 137, 177, 191, 142,
+        143, 182, 183, 192, 255, 129, 151, 128,
+        133, 134, 135, 136, 255, 145, 150, 151,
+        155, 191, 192, 255, 128, 143, 144, 159,
+        160, 255, 182, 183, 190, 191, 192, 255,
+        128, 129, 255, 173, 174, 192, 255, 128,
+        129, 154, 155, 159, 160, 255, 171, 173,
+        185, 191, 192, 255, 141, 128, 145, 146,
+        159, 160, 177, 178, 191, 173, 128, 145,
+        146, 159, 160, 176, 177, 191, 128, 179,
+        180, 191, 151, 156, 128, 191, 128, 159,
+        160, 255, 184, 191, 192, 255, 169, 128,
+        170, 171, 175, 176, 255, 182, 191, 192,
+        255, 128, 158, 159, 191, 128, 143, 144,
+        173, 174, 175, 176, 180, 181, 191, 128,
+        171, 172, 175, 176, 255, 138, 191, 192,
+        255, 128, 150, 151, 159, 160, 255, 149,
+        191, 192, 255, 167, 128, 191, 128, 132,
+        133, 179, 180, 191, 128, 132, 133, 139,
+        140, 191, 128, 130, 131, 160, 161, 173,
+        174, 175, 176, 185, 186, 255, 166, 191,
+        192, 255, 128, 163, 164, 191, 128, 140,
+        141, 143, 144, 153, 154, 189, 190, 191,
+        128, 136, 137, 191, 173, 128, 168, 169,
+        177, 178, 180, 181, 182, 183, 191, 0,
+        127, 192, 255, 150, 151, 158, 159, 152,
+        154, 156, 158, 134, 135, 142, 143, 190,
+        191, 192, 255, 181, 189, 191, 128, 190,
+        133, 181, 128, 129, 130, 140, 141, 143,
+        144, 147, 148, 149, 150, 155, 156, 159,
+        160, 172, 173, 177, 178, 188, 189, 191,
+        177, 191, 128, 190, 128, 143, 144, 156,
+        157, 191, 130, 135, 148, 164, 166, 168,
+        128, 137, 138, 149, 150, 151, 152, 157,
+        158, 169, 170, 185, 186, 187, 188, 191,
+        142, 128, 132, 133, 137, 138, 159, 160,
+        255, 137, 191, 192, 255, 175, 128, 255,
+        159, 165, 170, 175, 177, 180, 191, 192,
+        255, 166, 173, 128, 167, 168, 175, 176,
+        255, 168, 174, 176, 191, 192, 255, 167,
+        175, 183, 191, 128, 150, 151, 159, 160,
+        190, 135, 143, 151, 128, 158, 159, 191,
+        128, 132, 133, 135, 136, 160, 161, 169,
+        170, 176, 177, 181, 182, 183, 184, 188,
+        189, 191, 160, 151, 154, 187, 192, 255,
+        128, 132, 133, 173, 174, 176, 177, 255,
+        143, 159, 187, 191, 192, 255, 128, 175,
+        176, 191, 150, 191, 192, 255, 141, 191,
+        192, 255, 128, 143, 144, 189, 190, 191,
+        141, 143, 160, 169, 172, 191, 192, 255,
+        191, 128, 174, 175, 190, 128, 157, 158,
+        159, 160, 255, 176, 191, 192, 255, 128,
+        150, 151, 159, 160, 161, 162, 255, 175,
+        137, 138, 184, 191, 192, 255, 128, 182,
+        183, 255, 130, 134, 139, 163, 191, 192,
+        255, 128, 129, 130, 179, 180, 191, 187,
+        189, 128, 177, 178, 183, 184, 191, 128,
+        137, 138, 165, 166, 175, 176, 255, 135,
+        159, 189, 191, 192, 255, 128, 131, 132,
+        178, 179, 191, 143, 165, 191, 128, 159,
+        160, 175, 176, 185, 186, 190, 128, 168,
+        169, 191, 131, 186, 128, 139, 140, 159,
+        160, 182, 183, 189, 190, 255, 176, 178,
+        180, 183, 184, 190, 191, 192, 255, 129,
+        128, 130, 131, 154, 155, 157, 158, 159,
+        160, 170, 171, 177, 178, 180, 181, 191,
+        128, 167, 175, 129, 134, 135, 136, 137,
+        142, 143, 144, 145, 150, 151, 159, 160,
+        255, 155, 166, 175, 128, 162, 163, 191,
+        164, 175, 135, 138, 188, 191, 192, 255,
+        174, 175, 154, 191, 192, 255, 157, 169,
+        183, 189, 191, 128, 134, 135, 146, 147,
+        151, 152, 158, 159, 190, 130, 133, 128,
+        255, 178, 191, 192, 255, 128, 146, 147,
+        255, 190, 191, 192, 255, 128, 143, 144,
+        255, 144, 145, 136, 175, 188, 191, 192,
+        255, 181, 128, 175, 176, 255, 189, 191,
+        192, 255, 128, 160, 161, 186, 187, 191,
+        128, 129, 154, 155, 165, 166, 255, 191,
+        192, 255, 128, 129, 130, 135, 136, 137,
+        138, 143, 144, 145, 146, 151, 152, 153,
+        154, 156, 157, 191, 128, 191, 128, 129,
+        130, 131, 133, 138, 139, 140, 141, 142,
+        143, 144, 145, 146, 147, 148, 149, 152,
+        156, 157, 160, 161, 162, 163, 164, 166,
+        168, 169, 170, 171, 172, 173, 174, 176,
+        177, 132, 151, 153, 155, 158, 175, 178,
+        179, 180, 191, 140, 167, 187, 190, 128,
+        255, 142, 143, 158, 191, 192, 255, 187,
+        191, 192, 255, 128, 180, 181, 191, 128,
+        156, 157, 159, 160, 255, 145, 191, 192,
+        255, 128, 159, 160, 175, 176, 255, 139,
+        143, 182, 191, 192, 255, 144, 132, 135,
+        150, 191, 192, 255, 158, 175, 148, 151,
+        188, 191, 192, 255, 128, 167, 168, 175,
+        176, 255, 164, 191, 192, 255, 183, 191,
+        192, 255, 128, 149, 150, 159, 160, 167,
+        168, 191, 136, 182, 188, 128, 133, 134,
+        137, 138, 184, 185, 190, 191, 255, 150,
+        159, 183, 191, 192, 255, 179, 128, 159,
+        160, 181, 182, 191, 128, 149, 150, 159,
+        160, 185, 186, 191, 128, 183, 184, 189,
+        190, 191, 128, 148, 152, 129, 143, 144,
+        179, 180, 191, 128, 159, 160, 188, 189,
+        191, 128, 156, 157, 191, 136, 128, 164,
+        165, 191, 128, 181, 182, 191, 128, 149,
+        150, 159, 160, 178, 179, 191, 128, 145,
+        146, 191, 128, 178, 179, 191, 128, 130,
+        131, 132, 133, 134, 135, 136, 138, 139,
+        140, 141, 144, 145, 146, 147, 150, 151,
+        152, 153, 154, 156, 162, 163, 171, 176,
+        177, 178, 129, 191, 128, 130, 131, 183,
+        184, 191, 128, 130, 131, 175, 176, 191,
+        128, 143, 144, 168, 169, 191, 128, 130,
+        131, 166, 167, 191, 182, 128, 143, 144,
+        178, 179, 191, 128, 130, 131, 178, 179,
+        191, 128, 154, 156, 129, 132, 133, 191,
+        146, 128, 171, 172, 191, 135, 137, 142,
+        158, 128, 168, 169, 175, 176, 255, 159,
+        191, 192, 255, 144, 128, 156, 157, 161,
+        162, 191, 128, 134, 135, 138, 139, 191,
+        128, 175, 176, 191, 134, 128, 131, 132,
+        135, 136, 191, 128, 174, 175, 191, 128,
+        151, 152, 155, 156, 191, 132, 128, 191,
+        128, 170, 171, 191, 128, 153, 154, 191,
+        160, 190, 192, 255, 128, 184, 185, 191,
+        137, 128, 174, 175, 191, 128, 129, 177,
+        178, 255, 144, 191, 192, 255, 128, 142,
+        143, 144, 145, 146, 149, 129, 148, 150,
+        191, 175, 191, 192, 255, 132, 191, 192,
+        255, 128, 144, 129, 143, 145, 191, 144,
+        153, 128, 143, 145, 152, 154, 191, 135,
+        191, 192, 255, 160, 168, 169, 171, 172,
+        173, 174, 188, 189, 190, 191, 128, 159,
+        161, 167, 170, 187, 185, 191, 192, 255,
+        128, 143, 144, 173, 174, 191, 128, 131,
+        132, 162, 163, 183, 184, 188, 189, 255,
+        133, 143, 145, 191, 192, 255, 128, 146,
+        147, 159, 160, 191, 160, 128, 191, 128,
+        129, 191, 192, 255, 159, 160, 171, 128,
+        170, 172, 191, 192, 255, 173, 191, 192,
+        255, 179, 191, 192, 255, 128, 176, 177,
+        178, 129, 191, 128, 129, 130, 191, 171,
+        175, 189, 191, 192, 255, 128, 136, 137,
+        143, 144, 153, 154, 191, 144, 145, 146,
+        147, 148, 149, 154, 155, 156, 157, 158,
+        159, 128, 143, 150, 153, 160, 191, 149,
+        157, 173, 186, 188, 160, 161, 163, 164,
+        167, 168, 132, 134, 149, 157, 186, 191,
+        139, 140, 192, 255, 133, 145, 128, 134,
+        135, 137, 138, 255, 166, 167, 129, 155,
+        187, 149, 181, 143, 175, 137, 169, 131,
+        140, 191, 192, 255, 160, 163, 164, 165,
+        184, 185, 186, 128, 159, 161, 162, 166,
+        191, 133, 191, 192, 255, 132, 160, 163,
+        167, 179, 184, 186, 128, 164, 165, 168,
+        169, 187, 188, 191, 130, 135, 137, 139,
+        144, 147, 151, 153, 155, 157, 159, 163,
+        171, 179, 184, 189, 191, 128, 140, 141,
+        148, 149, 160, 161, 164, 165, 166, 167,
+        190, 138, 164, 170, 128, 155, 156, 160,
+        161, 187, 188, 191, 128, 191, 155, 156,
+        128, 191, 151, 191, 192, 255, 156, 157,
+        160, 128, 191, 181, 191, 192, 255, 158,
+        159, 186, 128, 185, 187, 191, 192, 255,
+        162, 191, 192, 255, 160, 168, 128, 159,
+        161, 167, 169, 191, 158, 191, 192, 255,
+        10, 13, 128, 191, 192, 223, 224, 239,
+        240, 247, 248, 255, 128, 191, 128, 191,
+        128, 191, 128, 191, 128, 191, 10, 128,
+        191, 128, 191, 128, 191, 36, 123, 37,
+        123, 10, 128, 191, 128, 191, 128, 191,
+        36, 123, 37, 123, 170, 181, 183, 186,
+        128, 150, 152, 182, 184, 255, 192, 255,
+        128, 255, 173, 130, 133, 146, 159, 165,
+        171, 175, 255, 181, 190, 184, 185, 192,
+        255, 140, 134, 138, 142, 161, 163, 255,
+        182, 130, 136, 137, 176, 151, 152, 154,
+        160, 190, 136, 144, 192, 255, 135, 129,
+        130, 132, 133, 144, 170, 176, 178, 144,
+        154, 160, 191, 128, 169, 174, 255, 148,
+        169, 157, 158, 189, 190, 192, 255, 144,
+        255, 139, 140, 178, 255, 186, 128, 181,
+        160, 161, 162, 163, 164, 165, 166, 167,
+        168, 169, 170, 171, 172, 173, 174, 175,
+        176, 177, 178, 179, 180, 181, 182, 183,
+        184, 185, 186, 187, 188, 189, 190, 191,
+        128, 173, 128, 155, 160, 180, 182, 189,
+        148, 161, 163, 255, 176, 164, 165, 132,
+        169, 177, 141, 142, 145, 146, 179, 181,
+        186, 187, 158, 133, 134, 137, 138, 143,
+        150, 152, 155, 164, 165, 178, 255, 188,
+        129, 131, 133, 138, 143, 144, 147, 168,
+        170, 176, 178, 179, 181, 182, 184, 185,
+        190, 255, 157, 131, 134, 137, 138, 142,
+        144, 146, 152, 159, 165, 182, 255, 129,
+        131, 133, 141, 143, 145, 147, 168, 170,
+        176, 178, 179, 181, 185, 188, 255, 134,
+        138, 142, 143, 145, 159, 164, 165, 176,
+        184, 186, 255, 129, 131, 133, 140, 143,
+        144, 147, 168, 170, 176, 178, 179, 181,
+        185, 188, 191, 177, 128, 132, 135, 136,
+        139, 141, 150, 151, 156, 157, 159, 163,
+        166, 175, 156, 130, 131, 133, 138, 142,
+        144, 146, 149, 153, 154, 158, 159, 163,
+        164, 168, 170, 174, 185, 190, 191, 144,
+        151, 128, 130, 134, 136, 138, 141, 166,
+        175, 128, 131, 133, 140, 142, 144, 146,
+        168, 170, 185, 189, 255, 133, 137, 151,
+        142, 148, 155, 159, 164, 165, 176, 255,
+        128, 131, 133, 140, 142, 144, 146, 168,
+        170, 179, 181, 185, 188, 191, 158, 128,
+        132, 134, 136, 138, 141, 149, 150, 160,
+        163, 166, 175, 177, 178, 129, 131, 133,
+        140, 142, 144, 146, 186, 189, 255, 133,
+        137, 143, 147, 152, 158, 164, 165, 176,
+        185, 192, 255, 189, 130, 131, 133, 150,
+        154, 177, 179, 187, 138, 150, 128, 134,
+        143, 148, 152, 159, 166, 175, 178, 179,
+        129, 186, 128, 142, 144, 153, 132, 138,
+        141, 165, 167, 129, 130, 135, 136, 148,
+        151, 153, 159, 161, 163, 170, 171, 173,
+        185, 187, 189, 134, 128, 132, 136, 141,
+        144, 153, 156, 159, 128, 181, 183, 185,
+        152, 153, 160, 169, 190, 191, 128, 135,
+        137, 172, 177, 191, 128, 132, 134, 151,
+        153, 188, 134, 128, 129, 130, 131, 137,
+        138, 139, 140, 141, 142, 143, 144, 153,
+        154, 155, 156, 157, 158, 159, 160, 161,
+        162, 163, 164, 165, 166, 167, 168, 169,
+        170, 173, 175, 176, 177, 178, 179, 181,
+        182, 183, 188, 189, 190, 191, 132, 152,
+        172, 184, 185, 187, 128, 191, 128, 137,
+        144, 255, 158, 159, 134, 187, 136, 140,
+        142, 143, 137, 151, 153, 142, 143, 158,
+        159, 137, 177, 142, 143, 182, 183, 191,
+        255, 128, 130, 133, 136, 150, 152, 255,
+        145, 150, 151, 155, 156, 160, 168, 178,
+        255, 128, 143, 160, 255, 182, 183, 190,
+        255, 129, 255, 173, 174, 192, 255, 129,
+        154, 160, 255, 171, 173, 185, 255, 128,
+        140, 142, 148, 160, 180, 128, 147, 160,
+        172, 174, 176, 178, 179, 148, 150, 152,
+        155, 158, 159, 170, 255, 139, 141, 144,
+        153, 160, 255, 184, 255, 128, 170, 176,
+        255, 182, 255, 128, 158, 160, 171, 176,
+        187, 134, 173, 176, 180, 128, 171, 176,
+        255, 138, 143, 155, 255, 128, 155, 160,
+        255, 159, 189, 190, 192, 255, 167, 128,
+        137, 144, 153, 176, 189, 140, 143, 154,
+        170, 180, 255, 180, 255, 128, 183, 128,
+        137, 141, 189, 128, 136, 144, 146, 148,
+        182, 184, 185, 128, 181, 187, 191, 150,
+        151, 158, 159, 152, 154, 156, 158, 134,
+        135, 142, 143, 190, 255, 190, 128, 180,
+        182, 188, 130, 132, 134, 140, 144, 147,
+        150, 155, 160, 172, 178, 180, 182, 188,
+        128, 129, 130, 131, 132, 133, 134, 176,
+        177, 178, 179, 180, 181, 182, 183, 191,
+        255, 129, 147, 149, 176, 178, 190, 192,
+        255, 144, 156, 161, 144, 156, 165, 176,
+        130, 135, 149, 164, 166, 168, 138, 147,
+        152, 157, 170, 185, 188, 191, 142, 133,
+        137, 160, 255, 137, 255, 128, 174, 176,
+        255, 159, 165, 170, 180, 255, 167, 173,
+        128, 165, 176, 255, 168, 174, 176, 190,
+        192, 255, 128, 150, 160, 166, 168, 174,
+        176, 182, 184, 190, 128, 134, 136, 142,
+        144, 150, 152, 158, 160, 191, 128, 129,
+        130, 131, 132, 133, 134, 135, 144, 145,
+        255, 133, 135, 161, 175, 177, 181, 184,
+        188, 160, 151, 152, 187, 192, 255, 133,
+        173, 177, 255, 143, 159, 187, 255, 176,
+        191, 182, 183, 184, 191, 192, 255, 150,
+        255, 128, 146, 147, 148, 152, 153, 154,
+        155, 156, 158, 159, 160, 161, 162, 163,
+        164, 165, 166, 167, 168, 169, 170, 171,
+        172, 173, 174, 175, 176, 129, 255, 141,
+        255, 144, 189, 141, 143, 172, 255, 191,
+        128, 175, 180, 189, 151, 159, 162, 255,
+        175, 137, 138, 184, 255, 183, 255, 168,
+        255, 128, 179, 188, 134, 143, 154, 159,
+        184, 186, 190, 255, 128, 173, 176, 255,
+        148, 159, 189, 255, 129, 142, 154, 159,
+        191, 255, 128, 182, 128, 141, 144, 153,
+        160, 182, 186, 255, 128, 130, 155, 157,
+        160, 175, 178, 182, 129, 134, 137, 142,
+        145, 150, 160, 166, 168, 174, 176, 255,
+        155, 166, 175, 128, 170, 172, 173, 176,
+        185, 158, 159, 160, 255, 164, 175, 135,
+        138, 188, 255, 164, 169, 171, 172, 173,
+        174, 175, 180, 181, 182, 183, 184, 185,
+        187, 188, 189, 190, 191, 165, 186, 174,
+        175, 154, 255, 190, 128, 134, 147, 151,
+        157, 168, 170, 182, 184, 188, 128, 129,
+        131, 132, 134, 255, 147, 255, 190, 255,
+        144, 145, 136, 175, 188, 255, 128, 143,
+        160, 175, 179, 180, 141, 143, 176, 180,
+        182, 255, 189, 255, 191, 144, 153, 161,
+        186, 129, 154, 166, 255, 191, 255, 130,
+        135, 138, 143, 146, 151, 154, 156, 144,
+        145, 146, 147, 148, 150, 151, 152, 155,
+        157, 158, 160, 170, 171, 172, 175, 161,
+        169, 128, 129, 130, 131, 133, 135, 138,
+        139, 140, 141, 142, 143, 144, 145, 146,
+        147, 148, 149, 152, 156, 157, 160, 161,
+        162, 163, 164, 166, 168, 169, 170, 171,
+        172, 173, 174, 176, 177, 153, 155, 178,
+        179, 128, 139, 141, 166, 168, 186, 188,
+        189, 191, 255, 142, 143, 158, 255, 187,
+        255, 128, 180, 189, 128, 156, 160, 255,
+        145, 159, 161, 255, 128, 159, 176, 255,
+        139, 143, 187, 255, 128, 157, 160, 255,
+        144, 132, 135, 150, 255, 158, 159, 170,
+        175, 148, 151, 188, 255, 128, 167, 176,
+        255, 164, 255, 183, 255, 128, 149, 160,
+        167, 136, 188, 128, 133, 138, 181, 183,
+        184, 191, 255, 150, 159, 183, 255, 128,
+        158, 160, 178, 180, 181, 128, 149, 160,
+        185, 128, 183, 190, 191, 191, 128, 131,
+        133, 134, 140, 147, 149, 151, 153, 179,
+        184, 186, 160, 188, 128, 156, 128, 135,
+        137, 166, 128, 181, 128, 149, 160, 178,
+        128, 145, 128, 178, 129, 130, 131, 132,
+        133, 135, 136, 138, 139, 140, 141, 144,
+        145, 146, 147, 150, 151, 152, 153, 154,
+        155, 156, 162, 163, 171, 176, 177, 178,
+        128, 134, 135, 165, 176, 190, 144, 168,
+        176, 185, 128, 180, 182, 191, 182, 144,
+        179, 155, 133, 137, 141, 143, 157, 255,
+        190, 128, 145, 147, 183, 136, 128, 134,
+        138, 141, 143, 157, 159, 168, 176, 255,
+        171, 175, 186, 255, 128, 131, 133, 140,
+        143, 144, 147, 168, 170, 176, 178, 179,
+        181, 185, 188, 191, 144, 151, 128, 132,
+        135, 136, 139, 141, 157, 163, 166, 172,
+        176, 180, 128, 138, 144, 153, 134, 136,
+        143, 154, 255, 128, 181, 184, 255, 129,
+        151, 158, 255, 129, 131, 133, 143, 154,
+        255, 128, 137, 128, 153, 157, 171, 176,
+        185, 160, 255, 170, 190, 192, 255, 128,
+        184, 128, 136, 138, 182, 184, 191, 128,
+        144, 153, 178, 255, 168, 144, 145, 183,
+        255, 128, 142, 145, 149, 129, 141, 144,
+        146, 147, 148, 175, 255, 132, 255, 128,
+        144, 129, 143, 144, 153, 145, 152, 135,
+        255, 160, 168, 169, 171, 172, 173, 174,
+        188, 189, 190, 191, 161, 167, 185, 255,
+        128, 158, 160, 169, 144, 173, 176, 180,
+        128, 131, 144, 153, 163, 183, 189, 255,
+        144, 255, 133, 143, 191, 255, 143, 159,
+        160, 128, 129, 255, 159, 160, 171, 172,
+        255, 173, 255, 179, 255, 128, 176, 177,
+        178, 128, 129, 171, 175, 189, 255, 128,
+        136, 144, 153, 157, 158, 133, 134, 137,
+        144, 145, 146, 147, 148, 149, 154, 155,
+        156, 157, 158, 159, 168, 169, 170, 150,
+        153, 165, 169, 173, 178, 187, 255, 131,
+        132, 140, 169, 174, 255, 130, 132, 149,
+        157, 173, 186, 188, 160, 161, 163, 164,
+        167, 168, 132, 134, 149, 157, 186, 139,
+        140, 191, 255, 134, 128, 132, 138, 144,
+        146, 255, 166, 167, 129, 155, 187, 149,
+        181, 143, 175, 137, 169, 131, 140, 141,
+        192, 255, 128, 182, 187, 255, 173, 180,
+        182, 255, 132, 155, 159, 161, 175, 128,
+        160, 163, 164, 165, 184, 185, 186, 161,
+        162, 128, 134, 136, 152, 155, 161, 163,
+        164, 166, 170, 133, 143, 151, 255, 139,
+        143, 154, 255, 164, 167, 185, 187, 128,
+        131, 133, 159, 161, 162, 169, 178, 180,
+        183, 130, 135, 137, 139, 148, 151, 153,
+        155, 157, 159, 164, 190, 141, 143, 145,
+        146, 161, 162, 167, 170, 172, 178, 180,
+        183, 185, 188, 128, 137, 139, 155, 161,
+        163, 165, 169, 171, 187, 155, 156, 151,
+        255, 156, 157, 160, 181, 255, 186, 187,
+        255, 162, 255, 160, 168, 161, 167, 158,
+        255, 160, 132, 135, 133, 134, 176, 255,
+        128, 191, 154, 164, 168, 128, 149, 150,
+        191, 128, 152, 153, 191, 181, 128, 159,
+        160, 189, 190, 191, 189, 128, 131, 132,
+        185, 186, 191, 144, 128, 151, 152, 161,
+        162, 176, 177, 255, 169, 177, 129, 132,
+        141, 142, 145, 146, 179, 181, 186, 188,
+        190, 191, 192, 255, 142, 158, 128, 155,
+        156, 161, 162, 175, 176, 177, 178, 191,
+        169, 177, 180, 183, 128, 132, 133, 138,
+        139, 142, 143, 144, 145, 146, 147, 185,
+        186, 191, 157, 128, 152, 153, 158, 159,
+        177, 178, 180, 181, 191, 142, 146, 169,
+        177, 180, 189, 128, 132, 133, 185, 186,
+        191, 144, 185, 128, 159, 160, 161, 162,
+        191, 169, 177, 180, 189, 128, 132, 133,
+        140, 141, 142, 143, 144, 145, 146, 147,
+        185, 186, 191, 158, 177, 128, 155, 156,
+        161, 162, 191, 131, 145, 155, 157, 128,
+        132, 133, 138, 139, 141, 142, 149, 150,
+        152, 153, 159, 160, 162, 163, 164, 165,
+        167, 168, 170, 171, 173, 174, 185, 186,
+        191, 144, 128, 191, 141, 145, 169, 189,
+        128, 132, 133, 185, 186, 191, 128, 151,
+        152, 154, 155, 159, 160, 161, 162, 191,
+        128, 141, 145, 169, 180, 189, 129, 132,
+        133, 185, 186, 191, 158, 128, 159, 160,
+        161, 162, 176, 177, 178, 179, 191, 141,
+        145, 189, 128, 132, 133, 186, 187, 191,
+        142, 128, 147, 148, 150, 151, 158, 159,
+        161, 162, 185, 186, 191, 178, 188, 128,
+        132, 133, 150, 151, 153, 154, 189, 190,
+        191, 128, 134, 135, 191, 128, 177, 129,
+        179, 180, 191, 128, 131, 137, 141, 152,
+        160, 164, 166, 172, 177, 189, 129, 132,
+        133, 134, 135, 138, 139, 147, 148, 167,
+        168, 169, 170, 179, 180, 191, 133, 128,
+        134, 135, 155, 156, 159, 160, 191, 128,
+        129, 191, 136, 128, 172, 173, 191, 128,
+        135, 136, 140, 141, 191, 191, 128, 170,
+        171, 190, 161, 128, 143, 144, 149, 150,
+        153, 154, 157, 158, 164, 165, 166, 167,
+        173, 174, 176, 177, 180, 181, 255, 130,
+        141, 143, 159, 134, 187, 136, 140, 142,
+        143, 137, 151, 153, 142, 143, 158, 159,
+        137, 177, 191, 142, 143, 182, 183, 192,
+        255, 129, 151, 128, 133, 134, 135, 136,
+        255, 145, 150, 151, 155, 191, 192, 255,
+        128, 143, 144, 159, 160, 255, 182, 183,
+        190, 191, 192, 255, 128, 129, 255, 173,
+        174, 192, 255, 128, 129, 154, 155, 159,
+        160, 255, 171, 173, 185, 191, 192, 255,
+        141, 128, 145, 146, 159, 160, 177, 178,
+        191, 173, 128, 145, 146, 159, 160, 176,
+        177, 191, 128, 179, 180, 191, 151, 156,
+        128, 191, 128, 159, 160, 255, 184, 191,
+        192, 255, 169, 128, 170, 171, 175, 176,
+        255, 182, 191, 192, 255, 128, 158, 159,
+        191, 128, 143, 144, 173, 174, 175, 176,
+        180, 181, 191, 128, 171, 172, 175, 176,
+        255, 138, 191, 192, 255, 128, 150, 151,
+        159, 160, 255, 149, 191, 192, 255, 167,
+        128, 191, 128, 132, 133, 179, 180, 191,
+        128, 132, 133, 139, 140, 191, 128, 130,
+        131, 160, 161, 173, 174, 175, 176, 185,
+        186, 255, 166, 191, 192, 255, 128, 163,
+        164, 191, 128, 140, 141, 143, 144, 153,
+        154, 189, 190, 191, 128, 136, 137, 191,
+        173, 128, 168, 169, 177, 178, 180, 181,
+        182, 183, 191, 0, 127, 192, 255, 150,
+        151, 158, 159, 152, 154, 156, 158, 134,
+        135, 142, 143, 190, 191, 192, 255, 181,
+        189, 191, 128, 190, 133, 181, 128, 129,
+        130, 140, 141, 143, 144, 147, 148, 149,
+        150, 155, 156, 159, 160, 172, 173, 177,
+        178, 188, 189, 191, 177, 191, 128, 190,
+        128, 143, 144, 156, 157, 191, 130, 135,
+        148, 164, 166, 168, 128, 137, 138, 149,
+        150, 151, 152, 157, 158, 169, 170, 185,
+        186, 187, 188, 191, 142, 128, 132, 133,
+        137, 138, 159, 160, 255, 137, 191, 192,
+        255, 175, 128, 255, 159, 165, 170, 175,
+        177, 180, 191, 192, 255, 166, 173, 128,
+        167, 168, 175, 176, 255, 168, 174, 176,
+        191, 192, 255, 167, 175, 183, 191, 128,
+        150, 151, 159, 160, 190, 135, 143, 151,
+        128, 158, 159, 191, 128, 132, 133, 135,
+        136, 160, 161, 169, 170, 176, 177, 181,
+        182, 183, 184, 188, 189, 191, 160, 151,
+        154, 187, 192, 255, 128, 132, 133, 173,
+        174, 176, 177, 255, 143, 159, 187, 191,
+        192, 255, 128, 175, 176, 191, 150, 191,
+        192, 255, 141, 191, 192, 255, 128, 143,
+        144, 189, 190, 191, 141, 143, 160, 169,
+        172, 191, 192, 255, 191, 128, 174, 175,
+        190, 128, 157, 158, 159, 160, 255, 176,
+        191, 192, 255, 128, 150, 151, 159, 160,
+        161, 162, 255, 175, 137, 138, 184, 191,
+        192, 255, 128, 182, 183, 255, 130, 134,
+        139, 163, 191, 192, 255, 128, 129, 130,
+        179, 180, 191, 187, 189, 128, 177, 178,
+        183, 184, 191, 128, 137, 138, 165, 166,
+        175, 176, 255, 135, 159, 189, 191, 192,
+        255, 128, 131, 132, 178, 179, 191, 143,
+        165, 191, 128, 159, 160, 175, 176, 185,
+        186, 190, 128, 168, 169, 191, 131, 186,
+        128, 139, 140, 159, 160, 182, 183, 189,
+        190, 255, 176, 178, 180, 183, 184, 190,
+        191, 192, 255, 129, 128, 130, 131, 154,
+        155, 157, 158, 159, 160, 170, 171, 177,
+        178, 180, 181, 191, 128, 167, 175, 129,
+        134, 135, 136, 137, 142, 143, 144, 145,
+        150, 151, 159, 160, 255, 155, 166, 175,
+        128, 162, 163, 191, 164, 175, 135, 138,
+        188, 191, 192, 255, 174, 175, 154, 191,
+        192, 255, 157, 169, 183, 189, 191, 128,
+        134, 135, 146, 147, 151, 152, 158, 159,
+        190, 130, 133, 128, 255, 178, 191, 192,
+        255, 128, 146, 147, 255, 190, 191, 192,
+        255, 128, 143, 144, 255, 144, 145, 136,
+        175, 188, 191, 192, 255, 181, 128, 175,
+        176, 255, 189, 191, 192, 255, 128, 160,
+        161, 186, 187, 191, 128, 129, 154, 155,
+        165, 166, 255, 191, 192, 255, 128, 129,
+        130, 135, 136, 137, 138, 143, 144, 145,
+        146, 151, 152, 153, 154, 156, 157, 191,
+        128, 191, 128, 129, 130, 131, 133, 138,
+        139, 140, 141, 142, 143, 144, 145, 146,
+        147, 148, 149, 152, 156, 157, 160, 161,
+        162, 163, 164, 166, 168, 169, 170, 171,
+        172, 173, 174, 176, 177, 132, 151, 153,
+        155, 158, 175, 178, 179, 180, 191, 140,
+        167, 187, 190, 128, 255, 142, 143, 158,
+        191, 192, 255, 187, 191, 192, 255, 128,
+        180, 181, 191, 128, 156, 157, 159, 160,
+        255, 145, 191, 192, 255, 128, 159, 160,
+        175, 176, 255, 139, 143, 182, 191, 192,
+        255, 144, 132, 135, 150, 191, 192, 255,
+        158, 175, 148, 151, 188, 191, 192, 255,
+        128, 167, 168, 175, 176, 255, 164, 191,
+        192, 255, 183, 191, 192, 255, 128, 149,
+        150, 159, 160, 167, 168, 191, 136, 182,
+        188, 128, 133, 134, 137, 138, 184, 185,
+        190, 191, 255, 150, 159, 183, 191, 192,
+        255, 179, 128, 159, 160, 181, 182, 191,
+        128, 149, 150, 159, 160, 185, 186, 191,
+        128, 183, 184, 189, 190, 191, 128, 148,
+        152, 129, 143, 144, 179, 180, 191, 128,
+        159, 160, 188, 189, 191, 128, 156, 157,
+        191, 136, 128, 164, 165, 191, 128, 181,
+        182, 191, 128, 149, 150, 159, 160, 178,
+        179, 191, 128, 145, 146, 191, 128, 178,
+        179, 191, 128, 130, 131, 132, 133, 134,
+        135, 136, 138, 139, 140, 141, 144, 145,
+        146, 147, 150, 151, 152, 153, 154, 156,
+        162, 163, 171, 176, 177, 178, 129, 191,
+        128, 130, 131, 183, 184, 191, 128, 130,
+        131, 175, 176, 191, 128, 143, 144, 168,
+        169, 191, 128, 130, 131, 166, 167, 191,
+        182, 128, 143, 144, 178, 179, 191, 128,
+        130, 131, 178, 179, 191, 128, 154, 156,
+        129, 132, 133, 191, 146, 128, 171, 172,
+        191, 135, 137, 142, 158, 128, 168, 169,
+        175, 176, 255, 159, 191, 192, 255, 144,
+        128, 156, 157, 161, 162, 191, 128, 134,
+        135, 138, 139, 191, 128, 175, 176, 191,
+        134, 128, 131, 132, 135, 136, 191, 128,
+        174, 175, 191, 128, 151, 152, 155, 156,
+        191, 132, 128, 191, 128, 170, 171, 191,
+        128, 153, 154, 191, 160, 190, 192, 255,
+        128, 184, 185, 191, 137, 128, 174, 175,
+        191, 128, 129, 177, 178, 255, 144, 191,
+        192, 255, 128, 142, 143, 144, 145, 146,
+        149, 129, 148, 150, 191, 175, 191, 192,
+        255, 132, 191, 192, 255, 128, 144, 129,
+        143, 145, 191, 144, 153, 128, 143, 145,
+        152, 154, 191, 135, 191, 192, 255, 160,
+        168, 169, 171, 172, 173, 174, 188, 189,
+        190, 191, 128, 159, 161, 167, 170, 187,
+        185, 191, 192, 255, 128, 143, 144, 173,
+        174, 191, 128, 131, 132, 162, 163, 183,
+        184, 188, 189, 255, 133, 143, 145, 191,
+        192, 255, 128, 146, 147, 159, 160, 191,
+        160, 128, 191, 128, 129, 191, 192, 255,
+        159, 160, 171, 128, 170, 172, 191, 192,
+        255, 173, 191, 192, 255, 179, 191, 192,
+        255, 128, 176, 177, 178, 129, 191, 128,
+        129, 130, 191, 171, 175, 189, 191, 192,
+        255, 128, 136, 137, 143, 144, 153, 154,
+        191, 144, 145, 146, 147, 148, 149, 154,
+        155, 156, 157, 158, 159, 128, 143, 150,
+        153, 160, 191, 149, 157, 173, 186, 188,
+        160, 161, 163, 164, 167, 168, 132, 134,
+        149, 157, 186, 191, 139, 140, 192, 255,
+        133, 145, 128, 134, 135, 137, 138, 255,
+        166, 167, 129, 155, 187, 149, 181, 143,
+        175, 137, 169, 131, 140, 191, 192, 255,
+        160, 163, 164, 165, 184, 185, 186, 128,
+        159, 161, 162, 166, 191, 133, 191, 192,
+        255, 132, 160, 163, 167, 179, 184, 186,
+        128, 164, 165, 168, 169, 187, 188, 191,
+        130, 135, 137, 139, 144, 147, 151, 153,
+        155, 157, 159, 163, 171, 179, 184, 189,
+        191, 128, 140, 141, 148, 149, 160, 161,
+        164, 165, 166, 167, 190, 138, 164, 170,
+        128, 155, 156, 160, 161, 187, 188, 191,
+        128, 191, 155, 156, 128, 191, 151, 191,
+        192, 255, 156, 157, 160, 128, 191, 181,
+        191, 192, 255, 158, 159, 186, 128, 185,
+        187, 191, 192, 255, 162, 191, 192, 255,
+        160, 168, 128, 159, 161, 167, 169, 191,
+        158, 191, 192, 255, 9, 10, 13, 32,
+        33, 34, 35, 38, 46, 47, 60, 61,
+        62, 64, 92, 95, 123, 124, 125, 126,
+        127, 194, 195, 198, 199, 203, 204, 205,
+        206, 207, 210, 212, 213, 214, 215, 216,
+        217, 219, 220, 221, 222, 223, 224, 225,
+        226, 227, 228, 233, 234, 237, 238, 239,
+        240, 0, 36, 37, 45, 48, 57, 58,
+        63, 65, 90, 91, 96, 97, 122, 192,
+        193, 196, 218, 229, 236, 241, 247, 9,
+        32, 10, 61, 10, 38, 46, 42, 47,
         46, 69, 101, 48, 57, 60, 61, 61,
         62, 61, 45, 95, 194, 195, 198, 199,
         203, 204, 205, 206, 207, 210, 212, 213,
@@ -1472,229 +1468,131 @@ var _hcltok_trans_keys []byte = []byte{
         159, 161, 169, 173, 191, 128, 191, 10,
         13, 34, 36, 37, 92, 128, 191, 192,
         223, 224, 239, 240, 247, 248, 255, 10,
-        13, 34, 36, 37, 92, 128, 191, 192,
+        13, 34, 92, 36, 37, 128, 191, 192,
         223, 224, 239, 240, 247, 248, 255, 10,
-        13, 34, 36, 37, 92, 128, 191, 192,
+        13, 36, 123, 123, 126, 126, 37, 123,
+        126, 10, 13, 128, 191, 192, 223, 224,
+        239, 240, 247, 248, 255, 128, 191, 128,
+        191, 128, 191, 10, 13, 36, 37, 128,
+        191, 192, 223, 224, 239, 240, 247, 248,
+        255, 10, 13, 36, 37, 128, 191, 192,
         223, 224, 239, 240, 247, 248, 255, 10,
-        13, 34, 36, 37, 92, 128, 191, 192,
+        13, 10, 13, 123, 10, 13, 126, 10,
+        13, 126, 126, 128, 191, 128, 191, 128,
+        191, 10, 13, 36, 37, 128, 191, 192,
         223, 224, 239, 240, 247, 248, 255, 10,
-        13, 36, 37, 92, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 36, 37,
-        92, 123, 192, 223, 224, 239, 240, 247,
-        10, 13, 34, 36, 37, 92, 123, 128,
-        191, 192, 223, 224, 239, 240, 247, 248,
-        255, 10, 13, 34, 36, 37, 92, 123,
-        128, 191, 192, 223, 224, 239, 240, 247,
-        248, 255, 10, 13, 34, 36, 37, 92,
-        123, 128, 191, 192, 223, 224, 239, 240,
-        247, 248, 255, 10, 13, 34, 36, 37,
-        92, 128, 191, 192, 223, 224, 239, 240,
-        247, 248, 255, 36, 37, 92, 123, 192,
-        223, 224, 239, 240, 247, 10, 13, 34,
-        36, 37, 92, 123, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 10, 13,
-        34, 36, 37, 92, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 10, 13,
-        34, 36, 37, 92, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 10, 13,
-        34, 36, 37, 92, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 10, 13,
-        34, 36, 37, 92, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 10, 13,
-        34, 36, 37, 92, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 10, 13,
-        34, 36, 37, 92, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 10, 13,
-        34, 36, 37, 92, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 123, 126,
-        123, 126, 128, 191, 128, 191, 128, 191,
-        10, 13, 36, 37, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 10, 13,
-        36, 37, 128, 191, 192, 223, 224, 239,
-        240, 247, 248, 255, 10, 13, 36, 37,
-        128, 191, 192, 223, 224, 239, 240, 247,
-        248, 255, 10, 13, 36, 37, 128, 191,
-        192, 223, 224, 239, 240, 247, 248, 255,
-        126, 126, 128, 191, 128, 191, 128, 191,
-        10, 13, 36, 37, 128, 191, 192, 223,
-        224, 239, 240, 247, 248, 255, 10, 13,
-        36, 37, 128, 191, 192, 223, 224, 239,
-        240, 247, 248, 255, 126, 126, 128, 191,
-        128, 191, 128, 191, 95, 194, 195, 198,
-        199, 203, 204, 205, 206, 207, 210, 212,
-        213, 214, 215, 216, 217, 219, 220, 221,
-        222, 223, 224, 225, 226, 227, 228, 233,
-        234, 237, 238, 239, 240, 65, 90, 97,
-        122, 128, 191, 192, 193, 196, 218, 229,
-        236, 241, 247, 248, 255, 45, 95, 194,
-        195, 198, 199, 203, 204, 205, 206, 207,
-        210, 212, 213, 214, 215, 216, 217, 219,
-        220, 221, 222, 223, 224, 225, 226, 227,
-        228, 233, 234, 237, 239, 240, 243, 48,
-        57, 65, 90, 97, 122, 196, 218, 229,
-        236, 128, 191, 170, 181, 186, 128, 191,
-        151, 183, 128, 255, 192, 255, 0, 127,
-        173, 130, 133, 146, 159, 165, 171, 175,
-        191, 192, 255, 181, 190, 128, 175, 176,
-        183, 184, 185, 186, 191, 134, 139, 141,
-        162, 128, 135, 136, 255, 182, 130, 137,
-        176, 151, 152, 154, 160, 136, 191, 192,
-        255, 128, 143, 144, 170, 171, 175, 176,
-        178, 179, 191, 128, 159, 160, 191, 176,
-        128, 138, 139, 173, 174, 255, 148, 150,
-        164, 167, 173, 176, 185, 189, 190, 192,
-        255, 144, 128, 145, 146, 175, 176, 191,
-        128, 140, 141, 255, 166, 176, 178, 191,
-        192, 255, 186, 128, 137, 138, 170, 171,
-        179, 180, 181, 182, 191, 160, 161, 162,
-        164, 165, 166, 167, 168, 169, 170, 171,
-        172, 173, 174, 175, 176, 177, 178, 179,
-        180, 181, 182, 183, 184, 185, 186, 187,
-        188, 189, 190, 128, 191, 128, 129, 130,
-        131, 137, 138, 139, 140, 141, 142, 143,
-        144, 153, 154, 155, 156, 157, 158, 159,
-        160, 161, 162, 163, 164, 165, 166, 167,
-        168, 169, 170, 171, 172, 173, 174, 175,
-        176, 177, 178, 179, 180, 182, 183, 184,
-        188, 189, 190, 191, 132, 187, 129, 130,
-        132, 133, 134, 176, 177, 178, 179, 180,
-        181, 182, 183, 128, 191, 128, 129, 130,
-        131, 132, 133, 134, 135, 144, 136, 143,
-        145, 191, 192, 255, 182, 183, 184, 128,
-        191, 128, 191, 191, 128, 190, 192, 255,
-        128, 146, 147, 148, 152, 153, 154, 155,
-        156, 158, 159, 160, 161, 162, 163, 164,
+        13, 36, 37, 128, 191, 192, 223, 224,
+        239, 240, 247, 248, 255, 10, 13, 10,
+        13, 123, 10, 13, 126, 10, 13, 126,
+        126, 128, 191, 128, 191, 128, 191, 95,
+        194, 195, 198, 199, 203, 204, 205, 206,
+        207, 210, 212, 213, 214, 215, 216, 217,
+        219, 220, 221, 222, 223, 224, 225, 226,
+        227, 228, 233, 234, 237, 238, 239, 240,
+        65, 90, 97, 122, 128, 191, 192, 193,
+        196, 218, 229, 236, 241, 247, 248, 255,
+        45, 95, 194, 195, 198, 199, 203, 204,
+        205, 206, 207, 210, 212, 213, 214, 215,
+        216, 217, 219, 220, 221, 222, 223, 224,
+        225, 226, 227, 228, 233, 234, 237, 239,
+        240, 243, 48, 57, 65, 90, 97, 122,
+        196, 218, 229, 236, 128, 191, 170, 181,
+        186, 128, 191, 151, 183, 128, 255, 192,
+        255, 0, 127, 173, 130, 133, 146, 159,
+        165, 171, 175, 191, 192, 255, 181, 190,
+        128, 175, 176, 183, 184, 185, 186, 191,
+        134, 139, 141, 162, 128, 135, 136, 255,
+        182, 130, 137, 176, 151, 152, 154, 160,
+        136, 191, 192, 255, 128, 143, 144, 170,
+        171, 175, 176, 178, 179, 191, 128, 159,
+        160, 191, 176, 128, 138, 139, 173, 174,
+        255, 148, 150, 164, 167, 173, 176, 185,
+        189, 190, 192, 255, 144, 128, 145, 146,
+        175, 176, 191, 128, 140, 141, 255, 166,
+        176, 178, 191, 192, 255, 186, 128, 137,
+        138, 170, 171, 179, 180, 181, 182, 191,
+        160, 161, 162, 164, 165, 166, 167, 168,
+        169, 170, 171, 172, 173, 174, 175, 176,
+        177, 178, 179, 180, 181, 182, 183, 184,
+        185, 186, 187, 188, 189, 190, 128, 191,
+        128, 129, 130, 131, 137, 138, 139, 140,
+        141, 142, 143, 144, 153, 154, 155, 156,
+        157, 158, 159, 160, 161, 162, 163, 164,
         165, 166, 167, 168, 169, 170, 171, 172,
-        173, 174, 175, 176, 129, 191, 192, 255,
-        158, 159, 128, 157, 160, 191, 192, 255,
-        128, 191, 164, 169, 171, 172, 173, 174,
-        175, 180, 181, 182, 183, 184, 185, 187,
-        188, 189, 190, 191, 128, 163, 165, 186,
-        144, 145, 146, 147, 148, 150, 151, 152,
-        155, 157, 158, 160, 170, 171, 172, 175,
-        128, 159, 161, 169, 173, 191, 128, 191,
+        173, 174, 175, 176, 177, 178, 179, 180,
+        182, 183, 184, 188, 189, 190, 191, 132,
+        187, 129, 130, 132, 133, 134, 176, 177,
+        178, 179, 180, 181, 182, 183, 128, 191,
+        128, 129, 130, 131, 132, 133, 134, 135,
+        144, 136, 143, 145, 191, 192, 255, 182,
+        183, 184, 128, 191, 128, 191, 191, 128,
+        190, 192, 255, 128, 146, 147, 148, 152,
+        153, 154, 155, 156, 158, 159, 160, 161,
+        162, 163, 164, 165, 166, 167, 168, 169,
+        170, 171, 172, 173, 174, 175, 176, 129,
+        191, 192, 255, 158, 159, 128, 157, 160,
+        191, 192, 255, 128, 191, 164, 169, 171,
+        172, 173, 174, 175, 180, 181, 182, 183,
+        184, 185, 187, 188, 189, 190, 191, 128,
+        163, 165, 186, 144, 145, 146, 147, 148,
+        150, 151, 152, 155, 157, 158, 160, 170,
+        171, 172, 175, 128, 159, 161, 169, 173,
+        191, 128, 191,
 }
 
 var _hcltok_single_lengths []byte = []byte{
-        0, 1, 1, 1, 2, 3, 2, 0,
-        32, 31, 36, 1, 4, 0, 0, 0,
-        0, 1, 2, 1, 1, 1, 1, 0,
-        1, 1, 0, 0, 2, 0, 0, 0,
-        1, 32, 0, 0, 0, 0, 1, 3,
-        1, 1, 1, 0, 2, 0, 1, 1,
-        2, 0, 3, 0, 1, 0, 2, 1,
-        2, 0, 0, 5, 1, 4, 0, 0,
-        1, 43, 0, 0, 0, 2, 3, 2,
-        1, 1, 0, 0, 0, 0, 0, 0,
+        0, 1, 1, 2, 3, 2, 0, 32,
+        31, 36, 1, 4, 0, 0, 0, 0,
+        1, 2, 1, 1, 1, 1, 0, 1,
+        1, 0, 0, 2, 0, 0, 0, 1,
+        32, 0, 0, 0, 0, 1, 3, 1,
+        1, 1, 0, 2, 0, 1, 1, 2,
+        0, 3, 0, 1, 0, 2, 1, 2,
+        0, 0, 5, 1, 4, 0, 0, 1,
+        43, 0, 0, 0, 2, 3, 2, 1,
+        1, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 1, 1, 0,
-        0, 0, 0, 0, 0, 0, 0, 4,
-        1, 0, 15, 0, 0, 0, 1, 6,
-        1, 0, 0, 1, 0, 2, 0, 0,
-        0, 9, 0, 1, 1, 0, 0, 0,
-        3, 0, 1, 0, 28, 0, 0, 0,
-        1, 0, 1, 0, 0, 0, 1, 0,
+        0, 0, 0, 0, 1, 1, 0, 0,
+        0, 0, 0, 0, 0, 0, 4, 1,
+        0, 15, 0, 0, 0, 1, 6, 1,
+        0, 0, 1, 0, 2, 0, 0, 0,
+        9, 0, 1, 1, 0, 0, 0, 3,
+        0, 1, 0, 28, 0, 0, 0, 1,
+        0, 1, 0, 0, 0, 1, 0, 0,
+        0, 0, 0, 0, 0, 1, 0, 2,
+        0, 0, 18, 0, 0, 1, 0, 0,
         0, 0, 0, 0, 0, 0, 1, 0,
-        2, 0, 0, 18, 0, 0, 1, 0,
-        0, 0, 0, 0, 0, 0, 0, 1,
-        0, 0, 0, 16, 36, 0, 0, 0,
-        0, 1, 0, 0, 0, 0, 0, 1,
-        0, 0, 0, 0, 0, 0, 2, 0,
-        0, 0, 0, 0, 1, 0, 0, 0,
-        0, 0, 0, 0, 28, 0, 0, 0,
-        1, 1, 1, 1, 0, 0, 2, 0,
-        1, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 1, 1, 4, 0, 0, 2,
-        2, 0, 11, 0, 0, 0, 0, 0,
-        0, 0, 1, 1, 3, 0, 0, 4,
-        0, 0, 0, 18, 0, 0, 0, 1,
-        4, 1, 4, 1, 0, 3, 2, 2,
-        2, 1, 0, 0, 1, 8, 0, 0,
-        0, 4, 12, 0, 2, 0, 3, 0,
-        1, 0, 2, 0, 1, 2, 0, 3,
-        1, 2, 0, 0, 0, 0, 0, 1,
-        1, 0, 0, 1, 28, 3, 0, 1,
-        1, 2, 1, 0, 1, 1, 2, 1,
-        1, 2, 1, 1, 0, 2, 1, 1,
-        1, 1, 0, 0, 6, 1, 1, 0,
-        0, 46, 1, 1, 0, 0, 0, 0,
-        2, 1, 0, 0, 0, 1, 0, 0,
-        0, 0, 0, 0, 0, 13, 2, 0,
-        0, 0, 9, 0, 1, 28, 0, 1,
-        3, 0, 2, 0, 0, 0, 1, 0,
-        1, 1, 2, 0, 18, 2, 0, 0,
-        16, 35, 0, 0, 0, 1, 0, 28,
-        0, 0, 0, 0, 1, 0, 2, 0,
-        0, 1, 0, 0, 1, 0, 0, 1,
-        0, 0, 0, 0, 1, 11, 0, 0,
-        0, 0, 4, 0, 12, 1, 7, 0,
-        4, 0, 0, 0, 0, 1, 2, 1,
-        1, 1, 1, 0, 1, 1, 0, 0,
-        2, 0, 0, 0, 1, 32, 0, 0,
-        0, 0, 1, 3, 1, 1, 1, 0,
-        2, 0, 1, 1, 2, 0, 3, 0,
-        1, 0, 2, 1, 2, 0, 0, 5,
-        1, 4, 0, 0, 1, 43, 0, 0,
-        0, 2, 3, 2, 1, 1, 0, 0,
-        0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 0, 0,
-        0, 1, 1, 0, 0, 0, 0, 0,
-        0, 0, 0, 4, 1, 0, 15, 0,
-        0, 0, 1, 6, 1, 0, 0, 1,
-        0, 2, 0, 0, 0, 9, 0, 1,
-        1, 0, 0, 0, 3, 0, 1, 0,
-        28, 0, 0, 0, 1, 0, 1, 0,
-        0, 0, 1, 0, 0, 0, 0, 0,
-        0, 0, 1, 0, 2, 0, 0, 18,
-        0, 0, 1, 0, 0, 0, 0, 0,
-        0, 0, 0, 1, 0, 0, 0, 16,
-        36, 0, 0, 0, 0, 1, 0, 0,
+        0, 0, 16, 36, 0, 0, 0, 0,
+        1, 0, 0, 0, 0, 0, 1, 0,
+        0, 0, 0, 0, 0, 2, 0, 0,
         0, 0, 0, 1, 0, 0, 0, 0,
-        0, 0, 2, 0, 0, 0, 0, 0,
-        1, 0, 0, 0, 0, 0, 0, 0,
-        28, 0, 0, 0, 1, 1, 1, 1,
-        0, 0, 2, 0, 1, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 1, 1,
-        4, 0, 0, 2, 2, 0, 11, 0,
-        0, 0, 0, 0, 0, 0, 1, 1,
-        3, 0, 0, 4, 0, 0, 0, 18,
-        0, 0, 0, 1, 4, 1, 4, 1,
-        0, 3, 2, 2, 2, 1, 0, 0,
-        1, 8, 0, 0, 0, 4, 12, 0,
-        2, 0, 3, 0, 1, 0, 2, 0,
-        1, 2, 0, 0, 3, 0, 1, 1,
-        1, 2, 2, 4, 1, 6, 2, 4,
-        2, 4, 1, 4, 0, 6, 1, 3,
-        1, 2, 0, 2, 11, 1, 1, 1,
-        0, 1, 1, 0, 2, 0, 3, 3,
-        2, 1, 0, 0, 0, 1, 0, 1,
-        0, 1, 1, 0, 2, 0, 0, 1,
-        0, 0, 0, 0, 0, 0, 0, 1,
-        0, 0, 0, 0, 0, 0, 0, 1,
-        0, 0, 0, 4, 3, 2, 2, 0,
-        6, 1, 0, 1, 1, 0, 2, 0,
-        4, 3, 0, 1, 1, 0, 0, 0,
-        0, 0, 0, 0, 1, 0, 0, 0,
-        1, 0, 3, 0, 2, 0, 0, 0,
-        3, 0, 2, 1, 1, 3, 1, 0,
-        0, 0, 0, 0, 5, 2, 0, 0,
-        0, 0, 0, 0, 1, 0, 0, 1,
-        1, 0, 0, 35, 4, 0, 0, 0,
-        0, 0, 0, 0, 1, 0, 0, 0,
-        0, 0, 0, 3, 0, 1, 0, 0,
-        3, 0, 0, 1, 0, 0, 0, 0,
-        28, 0, 0, 0, 0, 1, 0, 3,
-        1, 4, 0, 1, 0, 0, 1, 0,
-        0, 1, 0, 0, 0, 0, 1, 1,
-        0, 7, 0, 0, 2, 2, 0, 11,
-        0, 0, 0, 0, 0, 1, 1, 3,
-        0, 0, 4, 0, 0, 0, 12, 1,
-        4, 1, 5, 2, 0, 3, 2, 2,
-        2, 1, 7, 0, 7, 17, 3, 0,
-        2, 0, 3, 0, 0, 1, 0, 2,
-        0, 1, 1, 0, 0, 0, 0, 0,
-        1, 1, 1, 0, 0, 0, 1, 1,
-        1, 1, 0, 0, 0, 1, 1, 4,
+        0, 0, 0, 28, 0, 0, 0, 1,
+        1, 1, 1, 0, 0, 2, 0, 1,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 1, 1, 4, 0, 0, 2, 2,
+        0, 11, 0, 0, 0, 0, 0, 0,
+        0, 1, 1, 3, 0, 0, 4, 0,
+        0, 0, 18, 0, 0, 0, 1, 4,
+        1, 4, 1, 0, 3, 2, 2, 2,
+        1, 0, 0, 1, 8, 0, 0, 0,
+        4, 12, 0, 2, 0, 3, 0, 1,
+        0, 2, 0, 1, 2, 0, 3, 1,
+        2, 0, 0, 0, 0, 0, 1, 1,
+        0, 0, 1, 28, 3, 0, 1, 1,
+        2, 1, 0, 1, 1, 2, 1, 1,
+        2, 1, 1, 0, 2, 1, 1, 1,
+        1, 0, 0, 6, 1, 1, 0, 0,
+        46, 1, 1, 0, 0, 0, 0, 2,
+        1, 0, 0, 0, 1, 0, 0, 0,
+        0, 0, 0, 0, 13, 2, 0, 0,
+        0, 9, 0, 1, 28, 0, 1, 3,
+        0, 2, 0, 0, 0, 1, 0, 1,
+        1, 2, 0, 18, 2, 0, 0, 16,
+        35, 0, 0, 0, 1, 0, 28, 0,
+        0, 0, 0, 1, 0, 2, 0, 0,
+        1, 0, 0, 1, 0, 0, 1, 0,
+        0, 0, 0, 1, 11, 0, 0, 0,
+        0, 4, 0, 12, 1, 7, 0, 4,
         0, 0, 0, 0, 1, 2, 1, 1,
         1, 1, 0, 1, 1, 0, 0, 2,
         0, 0, 0, 1, 32, 0, 0, 0,
@@ -1759,145 +1657,143 @@ var _hcltok_single_lengths []byte = []byte{
         1, 5, 2, 0, 3, 2, 2, 2,
         1, 7, 0, 7, 17, 3, 0, 2,
         0, 3, 0, 0, 1, 0, 2, 0,
-        54, 2, 1, 1, 1, 1, 1, 2,
-        1, 3, 2, 2, 1, 34, 1, 1,
-        0, 3, 2, 0, 0, 0, 1, 2,
-        4, 1, 0, 1, 0, 0, 0, 0,
-        1, 1, 1, 0, 0, 1, 30, 47,
-        13, 9, 3, 0, 1, 28, 2, 0,
-        18, 16, 0, 6, 6, 6, 6, 5,
-        4, 7, 7, 7, 6, 4, 7, 6,
-        6, 6, 6, 6, 6, 6, 1, 1,
-        1, 1, 0, 0, 0, 4, 4, 4,
-        4, 1, 1, 0, 0, 0, 4, 2,
-        1, 1, 0, 0, 0, 33, 34, 0,
-        3, 2, 0, 0, 0, 1, 2, 4,
-        1, 0, 1, 0, 0, 0, 0, 1,
-        1, 1, 0, 0, 1, 30, 47, 13,
-        9, 3, 0, 1, 28, 2, 0, 18,
-        16, 0,
+        2, 0, 0, 0, 0, 0, 1, 0,
+        0, 0, 2, 2, 1, 0, 0, 0,
+        2, 2, 4, 0, 0, 0, 0, 1,
+        2, 1, 1, 1, 1, 0, 1, 1,
+        0, 0, 2, 0, 0, 0, 1, 32,
+        0, 0, 0, 0, 1, 3, 1, 1,
+        1, 0, 2, 0, 1, 1, 2, 0,
+        3, 0, 1, 0, 2, 1, 2, 0,
+        0, 5, 1, 4, 0, 0, 1, 43,
+        0, 0, 0, 2, 3, 2, 1, 1,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 1, 1, 0, 0, 0,
+        0, 0, 0, 0, 0, 4, 1, 0,
+        15, 0, 0, 0, 1, 6, 1, 0,
+        0, 1, 0, 2, 0, 0, 0, 9,
+        0, 1, 1, 0, 0, 0, 3, 0,
+        1, 0, 28, 0, 0, 0, 1, 0,
+        1, 0, 0, 0, 1, 0, 0, 0,
+        0, 0, 0, 0, 1, 0, 2, 0,
+        0, 18, 0, 0, 1, 0, 0, 0,
+        0, 0, 0, 0, 0, 1, 0, 0,
+        0, 16, 36, 0, 0, 0, 0, 1,
+        0, 0, 0, 0, 0, 1, 0, 0,
+        0, 0, 0, 0, 2, 0, 0, 0,
+        0, 0, 1, 0, 0, 0, 0, 0,
+        0, 0, 28, 0, 0, 0, 1, 1,
+        1, 1, 0, 0, 2, 0, 1, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        1, 1, 4, 0, 0, 2, 2, 0,
+        11, 0, 0, 0, 0, 0, 0, 0,
+        1, 1, 3, 0, 0, 4, 0, 0,
+        0, 18, 0, 0, 0, 1, 4, 1,
+        4, 1, 0, 3, 2, 2, 2, 1,
+        0, 0, 1, 8, 0, 0, 0, 4,
+        12, 0, 2, 0, 3, 0, 1, 0,
+        2, 0, 1, 2, 0, 0, 3, 0,
+        1, 1, 1, 2, 2, 4, 1, 6,
+        2, 4, 2, 4, 1, 4, 0, 6,
+        1, 3, 1, 2, 0, 2, 11, 1,
+        1, 1, 0, 1, 1, 0, 2, 0,
+        3, 3, 2, 1, 0, 0, 0, 1,
+        0, 1, 0, 1, 1, 0, 2, 0,
+        0, 1, 0, 0, 0, 0, 0, 0,
+        0, 1, 0, 0, 0, 0, 0, 0,
+        0, 1, 0, 0, 0, 4, 3, 2,
+        2, 0, 6, 1, 0, 1, 1, 0,
+        2, 0, 4, 3, 0, 1, 1, 0,
+        0, 0, 0, 0, 0, 0, 1, 0,
+        0, 0, 1, 0, 3, 0, 2, 0,
+        0, 0, 3, 0, 2, 1, 1, 3,
+        1, 0, 0, 0, 0, 0, 5, 2,
+        0, 0, 0, 0, 0, 0, 1, 0,
+        0, 1, 1, 0, 0, 35, 4, 0,
+        0, 0, 0, 0, 0, 0, 1, 0,
+        0, 0, 0, 0, 0, 3, 0, 1,
+        0, 0, 3, 0, 0, 1, 0, 0,
+        0, 0, 28, 0, 0, 0, 0, 1,
+        0, 3, 1, 4, 0, 1, 0, 0,
+        1, 0, 0, 1, 0, 0, 0, 0,
+        1, 1, 0, 7, 0, 0, 2, 2,
+        0, 11, 0, 0, 0, 0, 0, 1,
+        1, 3, 0, 0, 4, 0, 0, 0,
+        12, 1, 4, 1, 5, 2, 0, 3,
+        2, 2, 2, 1, 7, 0, 7, 17,
+        3, 0, 2, 0, 3, 0, 0, 1,
+        0, 2, 0, 53, 2, 1, 1, 1,
+        1, 1, 2, 3, 2, 2, 1, 34,
+        1, 1, 0, 3, 2, 0, 0, 0,
+        1, 2, 4, 1, 0, 1, 0, 0,
+        0, 0, 1, 1, 1, 0, 0, 1,
+        30, 47, 13, 9, 3, 0, 1, 28,
+        2, 0, 18, 16, 0, 6, 4, 2,
+        2, 0, 1, 1, 1, 2, 1, 2,
+        0, 0, 0, 4, 2, 2, 3, 3,
+        2, 1, 1, 0, 0, 0, 4, 2,
+        2, 3, 3, 2, 1, 1, 0, 0,
+        0, 33, 34, 0, 3, 2, 0, 0,
+        0, 1, 2, 4, 1, 0, 1, 0,
+        0, 0, 0, 1, 1, 1, 0, 0,
+        1, 30, 47, 13, 9, 3, 0, 1,
+        28, 2, 0, 18, 16, 0,
 }
 
 var _hcltok_range_lengths []byte = []byte{
-        0, 0, 0, 0, 0, 1, 1, 1,
-        5, 5, 5, 0, 0, 3, 0, 1,
-        1, 4, 2, 3, 0, 1, 0, 2,
-        2, 4, 2, 2, 3, 1, 1, 1,
-        1, 0, 1, 1, 2, 2, 1, 4,
-        6, 9, 6, 8, 5, 8, 7, 10,
-        4, 6, 4, 7, 7, 5, 5, 4,
-        5, 1, 2, 8, 4, 3, 3, 3,
-        0, 3, 1, 2, 1, 2, 2, 3,
-        3, 1, 3, 2, 2, 1, 2, 2,
-        2, 3, 4, 4, 3, 1, 2, 1,
-        3, 2, 2, 2, 2, 2, 3, 3,
-        1, 1, 2, 1, 3, 2, 2, 3,
-        2, 7, 0, 1, 4, 1, 2, 4,
-        2, 1, 2, 0, 2, 2, 3, 5,
-        5, 1, 4, 1, 1, 2, 2, 1,
-        0, 0, 1, 1, 1, 1, 1, 2,
-        2, 2, 2, 1, 1, 1, 4, 2,
-        2, 3, 1, 4, 4, 6, 1, 3,
-        1, 1, 2, 1, 1, 1, 5, 3,
-        1, 1, 1, 2, 3, 3, 1, 2,
-        2, 1, 4, 1, 2, 5, 2, 1,
-        1, 0, 2, 2, 2, 2, 2, 2,
-        2, 2, 2, 1, 1, 2, 4, 2,
-        1, 2, 2, 2, 6, 1, 1, 2,
-        1, 2, 1, 1, 1, 2, 2, 2,
-        1, 3, 2, 5, 2, 8, 6, 2,
-        2, 2, 2, 3, 1, 3, 1, 2,
-        1, 3, 2, 2, 3, 1, 1, 1,
-        1, 1, 1, 1, 2, 2, 4, 1,
-        2, 1, 0, 1, 1, 1, 1, 0,
-        1, 2, 3, 1, 3, 3, 1, 0,
-        3, 0, 2, 3, 1, 0, 0, 0,
-        0, 2, 2, 2, 2, 1, 5, 2,
-        2, 5, 7, 5, 0, 1, 0, 1,
-        1, 1, 1, 1, 0, 1, 1, 0,
-        3, 3, 1, 1, 2, 1, 3, 5,
-        1, 1, 2, 2, 1, 1, 1, 1,
-        2, 6, 3, 7, 2, 6, 1, 6,
-        2, 8, 0, 4, 2, 5, 2, 3,
-        3, 3, 1, 2, 8, 2, 0, 2,
-        1, 2, 1, 5, 2, 1, 3, 3,
-        0, 2, 1, 2, 1, 0, 1, 1,
-        3, 1, 1, 2, 3, 0, 0, 3,
-        2, 4, 1, 4, 1, 1, 3, 1,
-        1, 1, 1, 2, 2, 1, 3, 1,
-        4, 3, 3, 1, 1, 5, 2, 1,
-        1, 2, 1, 2, 1, 3, 2, 0,
-        1, 1, 1, 1, 1, 1, 1, 2,
-        1, 1, 1, 1, 1, 1, 1, 0,
-        1, 1, 2, 2, 1, 1, 1, 3,
-        2, 1, 0, 2, 1, 1, 1, 1,
-        0, 3, 0, 1, 1, 4, 2, 3,
-        0, 1, 0, 2, 2, 4, 2, 2,
-        3, 1, 1, 1, 1, 0, 1, 1,
-        2, 2, 1, 4, 6, 9, 6, 8,
-        5, 8, 7, 10, 4, 6, 4, 7,
-        7, 5, 5, 4, 5, 1, 2, 8,
-        4, 3, 3, 3, 0, 3, 1, 2,
-        1, 2, 2, 3, 3, 1, 3, 2,
-        2, 1, 2, 2, 2, 3, 4, 4,
-        3, 1, 2, 1, 3, 2, 2, 2,
-        2, 2, 3, 3, 1, 1, 2, 1,
-        3, 2, 2, 3, 2, 7, 0, 1,
-        4, 1, 2, 4, 2, 1, 2, 0,
-        2, 2, 3, 5, 5, 1, 4, 1,
-        1, 2, 2, 1, 0, 0, 1, 1,
-        1, 1, 1, 2, 2, 2, 2, 1,
-        1, 1, 4, 2, 2, 3, 1, 4,
-        4, 6, 1, 3, 1, 1, 2, 1,
-        1, 1, 5, 3, 1, 1, 1, 2,
-        3, 3, 1, 2, 2, 1, 4, 1,
-        2, 5, 2, 1, 1, 0, 2, 2,
-        2, 2, 2, 2, 2, 2, 2, 1,
-        1, 2, 4, 2, 1, 2, 2, 2,
-        6, 1, 1, 2, 1, 2, 1, 1,
-        1, 2, 2, 2, 1, 3, 2, 5,
-        2, 8, 6, 2, 2, 2, 2, 3,
-        1, 3, 1, 2, 1, 3, 2, 2,
-        3, 1, 1, 1, 1, 1, 1, 1,
-        2, 2, 4, 1, 2, 1, 0, 1,
-        1, 1, 1, 0, 1, 2, 3, 1,
-        3, 3, 1, 0, 3, 0, 2, 3,
-        1, 0, 0, 0, 0, 2, 2, 2,
-        2, 1, 5, 2, 2, 5, 7, 5,
-        0, 1, 0, 1, 1, 1, 1, 1,
-        0, 1, 1, 1, 2, 2, 3, 3,
-        4, 7, 5, 7, 5, 3, 3, 7,
-        3, 13, 1, 3, 5, 3, 5, 3,
-        6, 5, 2, 2, 8, 4, 1, 2,
-        3, 2, 10, 2, 2, 0, 2, 3,
-        3, 1, 2, 3, 3, 1, 2, 3,
-        3, 4, 4, 2, 1, 2, 2, 3,
-        2, 2, 5, 3, 2, 3, 2, 1,
-        3, 3, 6, 2, 2, 5, 2, 5,
-        1, 1, 2, 4, 1, 11, 1, 3,
-        8, 4, 2, 1, 0, 4, 3, 3,
-        3, 2, 9, 1, 1, 4, 3, 2,
-        2, 2, 3, 4, 2, 3, 2, 4,
-        3, 2, 2, 3, 3, 4, 3, 3,
-        4, 2, 5, 4, 8, 7, 1, 2,
-        1, 3, 1, 2, 5, 1, 2, 2,
-        2, 2, 1, 3, 2, 2, 3, 3,
-        1, 9, 1, 5, 1, 3, 2, 2,
-        3, 2, 3, 3, 3, 1, 3, 3,
-        2, 2, 4, 5, 3, 3, 4, 3,
-        3, 3, 2, 2, 2, 4, 2, 2,
-        1, 3, 3, 3, 3, 3, 3, 2,
-        2, 3, 2, 3, 3, 2, 3, 2,
-        3, 1, 2, 2, 2, 2, 2, 2,
-        2, 2, 2, 2, 2, 3, 2, 3,
-        2, 3, 5, 3, 3, 1, 2, 3,
-        2, 2, 1, 2, 3, 4, 3, 0,
-        3, 0, 2, 3, 1, 0, 0, 0,
-        0, 2, 3, 2, 4, 6, 4, 1,
-        1, 2, 1, 2, 1, 3, 2, 3,
-        2, 0, 0, 1, 1, 1, 1, 1,
-        0, 0, 0, 1, 1, 1, 0, 0,
-        0, 0, 1, 1, 1, 0, 0, 0,
+        0, 0, 0, 0, 1, 1, 1, 5,
+        5, 5, 0, 0, 3, 0, 1, 1,
+        4, 2, 3, 0, 1, 0, 2, 2,
+        4, 2, 2, 3, 1, 1, 1, 1,
+        0, 1, 1, 2, 2, 1, 4, 6,
+        9, 6, 8, 5, 8, 7, 10, 4,
+        6, 4, 7, 7, 5, 5, 4, 5,
+        1, 2, 8, 4, 3, 3, 3, 0,
+        3, 1, 2, 1, 2, 2, 3, 3,
+        1, 3, 2, 2, 1, 2, 2, 2,
+        3, 4, 4, 3, 1, 2, 1, 3,
+        2, 2, 2, 2, 2, 3, 3, 1,
+        1, 2, 1, 3, 2, 2, 3, 2,
+        7, 0, 1, 4, 1, 2, 4, 2,
+        1, 2, 0, 2, 2, 3, 5, 5,
+        1, 4, 1, 1, 2, 2, 1, 0,
+        0, 1, 1, 1, 1, 1, 2, 2,
+        2, 2, 1, 1, 1, 4, 2, 2,
+        3, 1, 4, 4, 6, 1, 3, 1,
+        1, 2, 1, 1, 1, 5, 3, 1,
+        1, 1, 2, 3, 3, 1, 2, 2,
+        1, 4, 1, 2, 5, 2, 1, 1,
+        0, 2, 2, 2, 2, 2, 2, 2,
+        2, 2, 1, 1, 2, 4, 2, 1,
+        2, 2, 2, 6, 1, 1, 2, 1,
+        2, 1, 1, 1, 2, 2, 2, 1,
+        3, 2, 5, 2, 8, 6, 2, 2,
+        2, 2, 3, 1, 3, 1, 2, 1,
+        3, 2, 2, 3, 1, 1, 1, 1,
+        1, 1, 1, 2, 2, 4, 1, 2,
+        1, 0, 1, 1, 1, 1, 0, 1,
+        2, 3, 1, 3, 3, 1, 0, 3,
+        0, 2, 3, 1, 0, 0, 0, 0,
+        2, 2, 2, 2, 1, 5, 2, 2,
+        5, 7, 5, 0, 1, 0, 1, 1,
+        1, 1, 1, 0, 1, 1, 0, 3,
+        3, 1, 1, 2, 1, 3, 5, 1,
+        1, 2, 2, 1, 1, 1, 1, 2,
+        6, 3, 7, 2, 6, 1, 6, 2,
+        8, 0, 4, 2, 5, 2, 3, 3,
+        3, 1, 2, 8, 2, 0, 2, 1,
+        2, 1, 5, 2, 1, 3, 3, 0,
+        2, 1, 2, 1, 0, 1, 1, 3,
+        1, 1, 2, 3, 0, 0, 3, 2,
+        4, 1, 4, 1, 1, 3, 1, 1,
+        1, 1, 2, 2, 1, 3, 1, 4,
+        3, 3, 1, 1, 5, 2, 1, 1,
+        2, 1, 2, 1, 3, 2, 0, 1,
+        1, 1, 1, 1, 1, 1, 2, 1,
+        1, 1, 1, 1, 1, 1, 0, 1,
+        1, 2, 2, 1, 1, 1, 3, 2,
+        1, 0, 2, 1, 1, 1, 1, 0,
         3, 0, 1, 1, 4, 2, 3, 0,
         1, 0, 2, 2, 4, 2, 2, 3,
         1, 1, 1, 1, 0, 1, 1, 2,
@@ -1962,826 +1858,889 @@ var _hcltok_range_lengths []byte = []byte{
         0, 2, 3, 1, 0, 0, 0, 0,
         2, 3, 2, 4, 6, 4, 1, 1,
         2, 1, 2, 1, 3, 2, 3, 2,
-        11, 0, 0, 0, 0, 0, 0, 0,
-        0, 1, 0, 0, 0, 5, 0, 0,
-        1, 1, 1, 0, 1, 1, 5, 4,
-        2, 0, 1, 0, 2, 2, 5, 2,
-        3, 5, 3, 2, 3, 5, 1, 1,
-        1, 3, 1, 1, 2, 2, 3, 1,
-        2, 3, 1, 5, 5, 5, 5, 5,
-        3, 5, 5, 5, 5, 3, 5, 5,
-        5, 5, 5, 5, 5, 5, 0, 0,
-        0, 0, 1, 1, 1, 5, 5, 5,
-        5, 0, 0, 1, 1, 1, 5, 6,
-        0, 0, 1, 1, 1, 8, 5, 1,
-        1, 1, 0, 1, 1, 5, 4, 2,
-        0, 1, 0, 2, 2, 5, 2, 3,
-        5, 3, 2, 3, 5, 1, 1, 1,
-        3, 1, 1, 2, 2, 3, 1, 2,
-        3, 1,
+        5, 1, 1, 1, 1, 1, 0, 1,
+        1, 1, 0, 0, 0, 1, 1, 1,
+        0, 0, 0, 3, 0, 1, 1, 4,
+        2, 3, 0, 1, 0, 2, 2, 4,
+        2, 2, 3, 1, 1, 1, 1, 0,
+        1, 1, 2, 2, 1, 4, 6, 9,
+        6, 8, 5, 8, 7, 10, 4, 6,
+        4, 7, 7, 5, 5, 4, 5, 1,
+        2, 8, 4, 3, 3, 3, 0, 3,
+        1, 2, 1, 2, 2, 3, 3, 1,
+        3, 2, 2, 1, 2, 2, 2, 3,
+        4, 4, 3, 1, 2, 1, 3, 2,
+        2, 2, 2, 2, 3, 3, 1, 1,
+        2, 1, 3, 2, 2, 3, 2, 7,
+        0, 1, 4, 1, 2, 4, 2, 1,
+        2, 0, 2, 2, 3, 5, 5, 1,
+        4, 1, 1, 2, 2, 1, 0, 0,
+        1, 1, 1, 1, 1, 2, 2, 2,
+        2, 1, 1, 1, 4, 2, 2, 3,
+        1, 4, 4, 6, 1, 3, 1, 1,
+        2, 1, 1, 1, 5, 3, 1, 1,
+        1, 2, 3, 3, 1, 2, 2, 1,
+        4, 1, 2, 5, 2, 1, 1, 0,
+        2, 2, 2, 2, 2, 2, 2, 2,
+        2, 1, 1, 2, 4, 2, 1, 2,
+        2, 2, 6, 1, 1, 2, 1, 2,
+        1, 1, 1, 2, 2, 2, 1, 3,
+        2, 5, 2, 8, 6, 2, 2, 2,
+        2, 3, 1, 3, 1, 2, 1, 3,
+        2, 2, 3, 1, 1, 1, 1, 1,
+        1, 1, 2, 2, 4, 1, 2, 1,
+        0, 1, 1, 1, 1, 0, 1, 2,
+        3, 1, 3, 3, 1, 0, 3, 0,
+        2, 3, 1, 0, 0, 0, 0, 2,
+        2, 2, 2, 1, 5, 2, 2, 5,
+        7, 5, 0, 1, 0, 1, 1, 1,
+        1, 1, 0, 1, 1, 1, 2, 2,
+        3, 3, 4, 7, 5, 7, 5, 3,
+        3, 7, 3, 13, 1, 3, 5, 3,
+        5, 3, 6, 5, 2, 2, 8, 4,
+        1, 2, 3, 2, 10, 2, 2, 0,
+        2, 3, 3, 1, 2, 3, 3, 1,
+        2, 3, 3, 4, 4, 2, 1, 2,
+        2, 3, 2, 2, 5, 3, 2, 3,
+        2, 1, 3, 3, 6, 2, 2, 5,
+        2, 5, 1, 1, 2, 4, 1, 11,
+        1, 3, 8, 4, 2, 1, 0, 4,
+        3, 3, 3, 2, 9, 1, 1, 4,
+        3, 2, 2, 2, 3, 4, 2, 3,
+        2, 4, 3, 2, 2, 3, 3, 4,
+        3, 3, 4, 2, 5, 4, 8, 7,
+        1, 2, 1, 3, 1, 2, 5, 1,
+        2, 2, 2, 2, 1, 3, 2, 2,
+        3, 3, 1, 9, 1, 5, 1, 3,
+        2, 2, 3, 2, 3, 3, 3, 1,
+        3, 3, 2, 2, 4, 5, 3, 3,
+        4, 3, 3, 3, 2, 2, 2, 4,
+        2, 2, 1, 3, 3, 3, 3, 3,
+        3, 2, 2, 3, 2, 3, 3, 2,
+        3, 2, 3, 1, 2, 2, 2, 2,
+        2, 2, 2, 2, 2, 2, 2, 3,
+        2, 3, 2, 3, 5, 3, 3, 1,
+        2, 3, 2, 2, 1, 2, 3, 4,
+        3, 0, 3, 0, 2, 3, 1, 0,
+        0, 0, 0, 2, 3, 2, 4, 6,
+        4, 1, 1, 2, 1, 2, 1, 3,
+        2, 3, 2, 11, 0, 0, 0, 0,
+        0, 0, 0, 1, 0, 0, 0, 5,
+        0, 0, 1, 1, 1, 0, 1, 1,
+        5, 4, 2, 0, 1, 0, 2, 2,
+        5, 2, 3, 5, 3, 2, 3, 5,
+        1, 1, 1, 3, 1, 1, 2, 2,
+        3, 1, 2, 3, 1, 5, 6, 0,
+        0, 0, 0, 0, 0, 0, 0, 5,
+        1, 1, 1, 5, 6, 0, 0, 0,
+        0, 0, 0, 1, 1, 1, 5, 6,
+        0, 0, 0, 0, 0, 0, 1, 1,
+        1, 8, 5, 1, 1, 1, 0, 1,
+        1, 5, 4, 2, 0, 1, 0, 2,
+        2, 5, 2, 3, 5, 3, 2, 3,
+        5, 1, 1, 1, 3, 1, 1, 2,
+        2, 3, 1, 2, 3, 1,
 }
 
 var _hcltok_index_offsets []int16 = []int16{
-        0, 0, 2, 4, 6, 9, 14, 18,
-        20, 58, 95, 137, 139, 144, 148, 149,
-        151, 153, 159, 164, 169, 171, 174, 176,
-        179, 183, 189, 192, 195, 201, 203, 205,
-        207, 210, 243, 245, 247, 250, 253, 256,
-        264, 272, 283, 291, 300, 308, 317, 326,
-        338, 345, 352, 360, 368, 377, 383, 391,
-        397, 405, 407, 410, 424, 430, 438, 442,
-        446, 448, 495, 497, 500, 502, 507, 513,
-        519, 524, 527, 531, 534, 537, 539, 542,
-        545, 548, 552, 557, 562, 566, 568, 571,
-        573, 577, 580, 583, 586, 589, 593, 598,
-        602, 604, 606, 609, 611, 615, 618, 621,
-        629, 633, 641, 657, 659, 664, 666, 670,
-        681, 685, 687, 690, 692, 695, 700, 704,
-        710, 716, 727, 732, 735, 738, 741, 744,
-        746, 750, 751, 754, 756, 786, 788, 790,
-        793, 797, 800, 804, 806, 808, 810, 816,
-        819, 822, 826, 828, 833, 838, 845, 848,
-        852, 856, 858, 861, 881, 883, 885, 892,
-        896, 898, 900, 902, 905, 909, 913, 915,
-        919, 922, 924, 929, 947, 986, 992, 995,
-        997, 999, 1001, 1004, 1007, 1010, 1013, 1016,
-        1020, 1023, 1026, 1029, 1031, 1033, 1036, 1043,
-        1046, 1048, 1051, 1054, 1057, 1065, 1067, 1069,
-        1072, 1074, 1077, 1079, 1081, 1111, 1114, 1117,
-        1120, 1123, 1128, 1132, 1139, 1142, 1151, 1160,
-        1163, 1167, 1170, 1173, 1177, 1179, 1183, 1185,
-        1188, 1190, 1194, 1198, 1202, 1210, 1212, 1214,
-        1218, 1222, 1224, 1237, 1239, 1242, 1245, 1250,
-        1252, 1255, 1257, 1259, 1262, 1267, 1269, 1271,
-        1276, 1278, 1281, 1285, 1305, 1309, 1313, 1315,
-        1317, 1325, 1327, 1334, 1339, 1341, 1345, 1348,
-        1351, 1354, 1358, 1361, 1364, 1368, 1378, 1384,
-        1387, 1390, 1400, 1420, 1426, 1429, 1431, 1435,
-        1437, 1440, 1442, 1446, 1448, 1450, 1454, 1456,
-        1460, 1465, 1471, 1473, 1475, 1478, 1480, 1484,
-        1491, 1494, 1496, 1499, 1503, 1533, 1538, 1540,
-        1543, 1547, 1556, 1561, 1569, 1573, 1581, 1585,
-        1593, 1597, 1608, 1610, 1616, 1619, 1627, 1631,
-        1636, 1641, 1646, 1648, 1651, 1666, 1670, 1672,
-        1675, 1677, 1726, 1729, 1736, 1739, 1741, 1745,
-        1749, 1752, 1756, 1758, 1761, 1763, 1765, 1767,
-        1769, 1773, 1775, 1777, 1780, 1784, 1798, 1801,
-        1805, 1808, 1813, 1824, 1829, 1832, 1862, 1866,
-        1869, 1874, 1876, 1880, 1883, 1886, 1888, 1893,
-        1895, 1901, 1906, 1912, 1914, 1934, 1942, 1945,
-        1947, 1965, 2003, 2005, 2008, 2010, 2015, 2018,
-        2047, 2049, 2051, 2053, 2055, 2058, 2060, 2064,
-        2067, 2069, 2072, 2074, 2076, 2079, 2081, 2083,
-        2085, 2087, 2089, 2092, 2095, 2098, 2111, 2113,
-        2117, 2120, 2122, 2127, 2130, 2144, 2147, 2156,
-        2158, 2163, 2167, 2168, 2170, 2172, 2178, 2183,
-        2188, 2190, 2193, 2195, 2198, 2202, 2208, 2211,
-        2214, 2220, 2222, 2224, 2226, 2229, 2262, 2264,
-        2266, 2269, 2272, 2275, 2283, 2291, 2302, 2310,
-        2319, 2327, 2336, 2345, 2357, 2364, 2371, 2379,
-        2387, 2396, 2402, 2410, 2416, 2424, 2426, 2429,
-        2443, 2449, 2457, 2461, 2465, 2467, 2514, 2516,
-        2519, 2521, 2526, 2532, 2538, 2543, 2546, 2550,
-        2553, 2556, 2558, 2561, 2564, 2567, 2571, 2576,
-        2581, 2585, 2587, 2590, 2592, 2596, 2599, 2602,
-        2605, 2608, 2612, 2617, 2621, 2623, 2625, 2628,
-        2630, 2634, 2637, 2640, 2648, 2652, 2660, 2676,
-        2678, 2683, 2685, 2689, 2700, 2704, 2706, 2709,
-        2711, 2714, 2719, 2723, 2729, 2735, 2746, 2751,
-        2754, 2757, 2760, 2763, 2765, 2769, 2770, 2773,
-        2775, 2805, 2807, 2809, 2812, 2816, 2819, 2823,
-        2825, 2827, 2829, 2835, 2838, 2841, 2845, 2847,
-        2852, 2857, 2864, 2867, 2871, 2875, 2877, 2880,
-        2900, 2902, 2904, 2911, 2915, 2917, 2919, 2921,
-        2924, 2928, 2932, 2934, 2938, 2941, 2943, 2948,
-        2966, 3005, 3011, 3014, 3016, 3018, 3020, 3023,
-        3026, 3029, 3032, 3035, 3039, 3042, 3045, 3048,
-        3050, 3052, 3055, 3062, 3065, 3067, 3070, 3073,
-        3076, 3084, 3086, 3088, 3091, 3093, 3096, 3098,
-        3100, 3130, 3133, 3136, 3139, 3142, 3147, 3151,
-        3158, 3161, 3170, 3179, 3182, 3186, 3189, 3192,
-        3196, 3198, 3202, 3204, 3207, 3209, 3213, 3217,
-        3221, 3229, 3231, 3233, 3237, 3241, 3243, 3256,
-        3258, 3261, 3264, 3269, 3271, 3274, 3276, 3278,
-        3281, 3286, 3288, 3290, 3295, 3297, 3300, 3304,
-        3324, 3328, 3332, 3334, 3336, 3344, 3346, 3353,
-        3358, 3360, 3364, 3367, 3370, 3373, 3377, 3380,
-        3383, 3387, 3397, 3403, 3406, 3409, 3419, 3439,
-        3445, 3448, 3450, 3454, 3456, 3459, 3461, 3465,
-        3467, 3469, 3473, 3475, 3477, 3483, 3486, 3491,
-        3496, 3502, 3512, 3520, 3532, 3539, 3549, 3555,
-        3567, 3573, 3591, 3594, 3602, 3608, 3618, 3625,
-        3632, 3640, 3648, 3651, 3656, 3676, 3682, 3685,
-        3689, 3693, 3697, 3709, 3712, 3717, 3718, 3724,
-        3731, 3737, 3740, 3743, 3747, 3751, 3754, 3757,
-        3762, 3766, 3772, 3778, 3781, 3785, 3788, 3791,
-        3796, 3799, 3802, 3808, 3812, 3815, 3819, 3822,
-        3825, 3829, 3833, 3840, 3843, 3846, 3852, 3855,
-        3862, 3864, 3866, 3869, 3878, 3883, 3897, 3901,
-        3905, 3920, 3926, 3929, 3932, 3934, 3939, 3945,
-        3949, 3957, 3963, 3973, 3976, 3979, 3984, 3988,
-        3991, 3994, 3997, 4001, 4006, 4010, 4014, 4017,
-        4022, 4027, 4030, 4036, 4040, 4046, 4051, 4055,
-        4059, 4067, 4070, 4078, 4084, 4094, 4105, 4108,
-        4111, 4113, 4117, 4119, 4122, 4133, 4137, 4140,
-        4143, 4146, 4149, 4151, 4155, 4159, 4162, 4166,
-        4171, 4174, 4184, 4186, 4227, 4233, 4237, 4240,
-        4243, 4247, 4250, 4254, 4258, 4263, 4265, 4269,
-        4273, 4276, 4279, 4284, 4293, 4297, 4302, 4307,
-        4311, 4318, 4322, 4325, 4329, 4332, 4337, 4340,
-        4343, 4373, 4377, 4381, 4385, 4389, 4394, 4398,
-        4404, 4408, 4416, 4419, 4424, 4428, 4431, 4436,
-        4439, 4443, 4446, 4449, 4452, 4455, 4458, 4462,
-        4466, 4469, 4479, 4482, 4485, 4490, 4496, 4499,
-        4514, 4517, 4521, 4527, 4531, 4535, 4538, 4542,
-        4549, 4552, 4555, 4561, 4564, 4568, 4573, 4589,
-        4591, 4599, 4601, 4609, 4615, 4617, 4621, 4624,
-        4627, 4630, 4634, 4645, 4648, 4660, 4684, 4692,
-        4694, 4698, 4701, 4706, 4709, 4711, 4716, 4719,
-        4725, 4728, 4730, 4732, 4734, 4736, 4738, 4740,
-        4742, 4744, 4746, 4748, 4750, 4752, 4754, 4756,
-        4758, 4760, 4762, 4764, 4766, 4768, 4770, 4772,
-        4777, 4781, 4782, 4784, 4786, 4792, 4797, 4802,
-        4804, 4807, 4809, 4812, 4816, 4822, 4825, 4828,
-        4834, 4836, 4838, 4840, 4843, 4876, 4878, 4880,
-        4883, 4886, 4889, 4897, 4905, 4916, 4924, 4933,
-        4941, 4950, 4959, 4971, 4978, 4985, 4993, 5001,
-        5010, 5016, 5024, 5030, 5038, 5040, 5043, 5057,
-        5063, 5071, 5075, 5079, 5081, 5128, 5130, 5133,
-        5135, 5140, 5146, 5152, 5157, 5160, 5164, 5167,
-        5170, 5172, 5175, 5178, 5181, 5185, 5190, 5195,
-        5199, 5201, 5204, 5206, 5210, 5213, 5216, 5219,
-        5222, 5226, 5231, 5235, 5237, 5239, 5242, 5244,
-        5248, 5251, 5254, 5262, 5266, 5274, 5290, 5292,
-        5297, 5299, 5303, 5314, 5318, 5320, 5323, 5325,
-        5328, 5333, 5337, 5343, 5349, 5360, 5365, 5368,
-        5371, 5374, 5377, 5379, 5383, 5384, 5387, 5389,
-        5419, 5421, 5423, 5426, 5430, 5433, 5437, 5439,
-        5441, 5443, 5449, 5452, 5455, 5459, 5461, 5466,
-        5471, 5478, 5481, 5485, 5489, 5491, 5494, 5514,
-        5516, 5518, 5525, 5529, 5531, 5533, 5535, 5538,
-        5542, 5546, 5548, 5552, 5555, 5557, 5562, 5580,
-        5619, 5625, 5628, 5630, 5632, 5634, 5637, 5640,
-        5643, 5646, 5649, 5653, 5656, 5659, 5662, 5664,
-        5666, 5669, 5676, 5679, 5681, 5684, 5687, 5690,
-        5698, 5700, 5702, 5705, 5707, 5710, 5712, 5714,
-        5744, 5747, 5750, 5753, 5756, 5761, 5765, 5772,
-        5775, 5784, 5793, 5796, 5800, 5803, 5806, 5810,
-        5812, 5816, 5818, 5821, 5823, 5827, 5831, 5835,
-        5843, 5845, 5847, 5851, 5855, 5857, 5870, 5872,
-        5875, 5878, 5883, 5885, 5888, 5890, 5892, 5895,
-        5900, 5902, 5904, 5909, 5911, 5914, 5918, 5938,
-        5942, 5946, 5948, 5950, 5958, 5960, 5967, 5972,
-        5974, 5978, 5981, 5984, 5987, 5991, 5994, 5997,
-        6001, 6011, 6017, 6020, 6023, 6033, 6053, 6059,
-        6062, 6064, 6068, 6070, 6073, 6075, 6079, 6081,
-        6083, 6087, 6089, 6091, 6097, 6100, 6105, 6110,
-        6116, 6126, 6134, 6146, 6153, 6163, 6169, 6181,
-        6187, 6205, 6208, 6216, 6222, 6232, 6239, 6246,
-        6254, 6262, 6265, 6270, 6290, 6296, 6299, 6303,
-        6307, 6311, 6323, 6326, 6331, 6332, 6338, 6345,
-        6351, 6354, 6357, 6361, 6365, 6368, 6371, 6376,
-        6380, 6386, 6392, 6395, 6399, 6402, 6405, 6410,
-        6413, 6416, 6422, 6426, 6429, 6433, 6436, 6439,
-        6443, 6447, 6454, 6457, 6460, 6466, 6469, 6476,
-        6478, 6480, 6483, 6492, 6497, 6511, 6515, 6519,
-        6534, 6540, 6543, 6546, 6548, 6553, 6559, 6563,
-        6571, 6577, 6587, 6590, 6593, 6598, 6602, 6605,
-        6608, 6611, 6615, 6620, 6624, 6628, 6631, 6636,
-        6641, 6644, 6650, 6654, 6660, 6665, 6669, 6673,
-        6681, 6684, 6692, 6698, 6708, 6719, 6722, 6725,
-        6727, 6731, 6733, 6736, 6747, 6751, 6754, 6757,
-        6760, 6763, 6765, 6769, 6773, 6776, 6780, 6785,
-        6788, 6798, 6800, 6841, 6847, 6851, 6854, 6857,
-        6861, 6864, 6868, 6872, 6877, 6879, 6883, 6887,
-        6890, 6893, 6898, 6907, 6911, 6916, 6921, 6925,
-        6932, 6936, 6939, 6943, 6946, 6951, 6954, 6957,
-        6987, 6991, 6995, 6999, 7003, 7008, 7012, 7018,
-        7022, 7030, 7033, 7038, 7042, 7045, 7050, 7053,
-        7057, 7060, 7063, 7066, 7069, 7072, 7076, 7080,
-        7083, 7093, 7096, 7099, 7104, 7110, 7113, 7128,
-        7131, 7135, 7141, 7145, 7149, 7152, 7156, 7163,
-        7166, 7169, 7175, 7178, 7182, 7187, 7203, 7205,
-        7213, 7215, 7223, 7229, 7231, 7235, 7238, 7241,
-        7244, 7248, 7259, 7262, 7274, 7298, 7306, 7308,
-        7312, 7315, 7320, 7323, 7325, 7330, 7333, 7339,
-        7342, 7408, 7411, 7413, 7415, 7417, 7419, 7421,
-        7424, 7426, 7431, 7434, 7437, 7439, 7479, 7481,
-        7483, 7485, 7490, 7494, 7495, 7497, 7499, 7506,
-        7513, 7520, 7522, 7524, 7526, 7529, 7532, 7538,
-        7541, 7546, 7553, 7558, 7561, 7565, 7572, 7604,
-        7653, 7668, 7681, 7686, 7688, 7692, 7723, 7729,
-        7731, 7752, 7772, 7774, 7786, 7798, 7810, 7822,
-        7833, 7841, 7854, 7867, 7880, 7892, 7900, 7913,
-        7925, 7937, 7949, 7961, 7973, 7985, 7997, 7999,
-        8001, 8003, 8005, 8007, 8009, 8011, 8021, 8031,
-        8041, 8051, 8053, 8055, 8057, 8059, 8061, 8071,
-        8080, 8082, 8084, 8086, 8088, 8090, 8132, 8172,
-        8174, 8179, 8183, 8184, 8186, 8188, 8195, 8202,
-        8209, 8211, 8213, 8215, 8218, 8221, 8227, 8230,
-        8235, 8242, 8247, 8250, 8254, 8261, 8293, 8342,
-        8357, 8370, 8375, 8377, 8381, 8412, 8418, 8420,
-        8441, 8461,
+        0, 0, 2, 4, 7, 12, 16, 18,
+        56, 93, 135, 137, 142, 146, 147, 149,
+        151, 157, 162, 167, 169, 172, 174, 177,
+        181, 187, 190, 193, 199, 201, 203, 205,
+        208, 241, 243, 245, 248, 251, 254, 262,
+        270, 281, 289, 298, 306, 315, 324, 336,
+        343, 350, 358, 366, 375, 381, 389, 395,
+        403, 405, 408, 422, 428, 436, 440, 444,
+        446, 493, 495, 498, 500, 505, 511, 517,
+        522, 525, 529, 532, 535, 537, 540, 543,
+        546, 550, 555, 560, 564, 566, 569, 571,
+        575, 578, 581, 584, 587, 591, 596, 600,
+        602, 604, 607, 609, 613, 616, 619, 627,
+        631, 639, 655, 657, 662, 664, 668, 679,
+        683, 685, 688, 690, 693, 698, 702, 708,
+        714, 725, 730, 733, 736, 739, 742, 744,
+        748, 749, 752, 754, 784, 786, 788, 791,
+        795, 798, 802, 804, 806, 808, 814, 817,
+        820, 824, 826, 831, 836, 843, 846, 850,
+        854, 856, 859, 879, 881, 883, 890, 894,
+        896, 898, 900, 903, 907, 911, 913, 917,
+        920, 922, 927, 945, 984, 990, 993, 995,
+        997, 999, 1002, 1005, 1008, 1011, 1014, 1018,
+        1021, 1024, 1027, 1029, 1031, 1034, 1041, 1044,
+        1046, 1049, 1052, 1055, 1063, 1065, 1067, 1070,
+        1072, 1075, 1077, 1079, 1109, 1112, 1115, 1118,
+        1121, 1126, 1130, 1137, 1140, 1149, 1158, 1161,
+        1165, 1168, 1171, 1175, 1177, 1181, 1183, 1186,
+        1188, 1192, 1196, 1200, 1208, 1210, 1212, 1216,
+        1220, 1222, 1235, 1237, 1240, 1243, 1248, 1250,
+        1253, 1255, 1257, 1260, 1265, 1267, 1269, 1274,
+        1276, 1279, 1283, 1303, 1307, 1311, 1313, 1315,
+        1323, 1325, 1332, 1337, 1339, 1343, 1346, 1349,
+        1352, 1356, 1359, 1362, 1366, 1376, 1382, 1385,
+        1388, 1398, 1418, 1424, 1427, 1429, 1433, 1435,
+        1438, 1440, 1444, 1446, 1448, 1452, 1454, 1458,
+        1463, 1469, 1471, 1473, 1476, 1478, 1482, 1489,
+        1492, 1494, 1497, 1501, 1531, 1536, 1538, 1541,
+        1545, 1554, 1559, 1567, 1571, 1579, 1583, 1591,
+        1595, 1606, 1608, 1614, 1617, 1625, 1629, 1634,
+        1639, 1644, 1646, 1649, 1664, 1668, 1670, 1673,
+        1675, 1724, 1727, 1734, 1737, 1739, 1743, 1747,
+        1750, 1754, 1756, 1759, 1761, 1763, 1765, 1767,
+        1771, 1773, 1775, 1778, 1782, 1796, 1799, 1803,
+        1806, 1811, 1822, 1827, 1830, 1860, 1864, 1867,
+        1872, 1874, 1878, 1881, 1884, 1886, 1891, 1893,
+        1899, 1904, 1910, 1912, 1932, 1940, 1943, 1945,
+        1963, 2001, 2003, 2006, 2008, 2013, 2016, 2045,
+        2047, 2049, 2051, 2053, 2056, 2058, 2062, 2065,
+        2067, 2070, 2072, 2074, 2077, 2079, 2081, 2083,
+        2085, 2087, 2090, 2093, 2096, 2109, 2111, 2115,
+        2118, 2120, 2125, 2128, 2142, 2145, 2154, 2156,
+        2161, 2165, 2166, 2168, 2170, 2176, 2181, 2186,
+        2188, 2191, 2193, 2196, 2200, 2206, 2209, 2212,
+        2218, 2220, 2222, 2224, 2227, 2260, 2262, 2264,
+        2267, 2270, 2273, 2281, 2289, 2300, 2308, 2317,
+        2325, 2334, 2343, 2355, 2362, 2369, 2377, 2385,
+        2394, 2400, 2408, 2414, 2422, 2424, 2427, 2441,
+        2447, 2455, 2459, 2463, 2465, 2512, 2514, 2517,
+        2519, 2524, 2530, 2536, 2541, 2544, 2548, 2551,
+        2554, 2556, 2559, 2562, 2565, 2569, 2574, 2579,
+        2583, 2585, 2588, 2590, 2594, 2597, 2600, 2603,
+        2606, 2610, 2615, 2619, 2621, 2623, 2626, 2628,
+        2632, 2635, 2638, 2646, 2650, 2658, 2674, 2676,
+        2681, 2683, 2687, 2698, 2702, 2704, 2707, 2709,
+        2712, 2717, 2721, 2727, 2733, 2744, 2749, 2752,
+        2755, 2758, 2761, 2763, 2767, 2768, 2771, 2773,
+        2803, 2805, 2807, 2810, 2814, 2817, 2821, 2823,
+        2825, 2827, 2833, 2836, 2839, 2843, 2845, 2850,
+        2855, 2862, 2865, 2869, 2873, 2875, 2878, 2898,
+        2900, 2902, 2909, 2913, 2915, 2917, 2919, 2922,
+        2926, 2930, 2932, 2936, 2939, 2941, 2946, 2964,
+        3003, 3009, 3012, 3014, 3016, 3018, 3021, 3024,
+        3027, 3030, 3033, 3037, 3040, 3043, 3046, 3048,
+        3050, 3053, 3060, 3063, 3065, 3068, 3071, 3074,
+        3082, 3084, 3086, 3089, 3091, 3094, 3096, 3098,
+        3128, 3131, 3134, 3137, 3140, 3145, 3149, 3156,
+        3159, 3168, 3177, 3180, 3184, 3187, 3190, 3194,
+        3196, 3200, 3202, 3205, 3207, 3211, 3215, 3219,
+        3227, 3229, 3231, 3235, 3239, 3241, 3254, 3256,
+        3259, 3262, 3267, 3269, 3272, 3274, 3276, 3279,
+        3284, 3286, 3288, 3293, 3295, 3298, 3302, 3322,
+        3326, 3330, 3332, 3334, 3342, 3344, 3351, 3356,
+        3358, 3362, 3365, 3368, 3371, 3375, 3378, 3381,
+        3385, 3395, 3401, 3404, 3407, 3417, 3437, 3443,
+        3446, 3448, 3452, 3454, 3457, 3459, 3463, 3465,
+        3467, 3471, 3473, 3475, 3481, 3484, 3489, 3494,
+        3500, 3510, 3518, 3530, 3537, 3547, 3553, 3565,
+        3571, 3589, 3592, 3600, 3606, 3616, 3623, 3630,
+        3638, 3646, 3649, 3654, 3674, 3680, 3683, 3687,
+        3691, 3695, 3707, 3710, 3715, 3716, 3722, 3729,
+        3735, 3738, 3741, 3745, 3749, 3752, 3755, 3760,
+        3764, 3770, 3776, 3779, 3783, 3786, 3789, 3794,
+        3797, 3800, 3806, 3810, 3813, 3817, 3820, 3823,
+        3827, 3831, 3838, 3841, 3844, 3850, 3853, 3860,
+        3862, 3864, 3867, 3876, 3881, 3895, 3899, 3903,
+        3918, 3924, 3927, 3930, 3932, 3937, 3943, 3947,
+        3955, 3961, 3971, 3974, 3977, 3982, 3986, 3989,
+        3992, 3995, 3999, 4004, 4008, 4012, 4015, 4020,
+        4025, 4028, 4034, 4038, 4044, 4049, 4053, 4057,
+        4065, 4068, 4076, 4082, 4092, 4103, 4106, 4109,
+        4111, 4115, 4117, 4120, 4131, 4135, 4138, 4141,
+        4144, 4147, 4149, 4153, 4157, 4160, 4164, 4169,
+        4172, 4182, 4184, 4225, 4231, 4235, 4238, 4241,
+        4245, 4248, 4252, 4256, 4261, 4263, 4267, 4271,
+        4274, 4277, 4282, 4291, 4295, 4300, 4305, 4309,
+        4316, 4320, 4323, 4327, 4330, 4335, 4338, 4341,
+        4371, 4375, 4379, 4383, 4387, 4392, 4396, 4402,
+        4406, 4414, 4417, 4422, 4426, 4429, 4434, 4437,
+        4441, 4444, 4447, 4450, 4453, 4456, 4460, 4464,
+        4467, 4477, 4480, 4483, 4488, 4494, 4497, 4512,
+        4515, 4519, 4525, 4529, 4533, 4536, 4540, 4547,
+        4550, 4553, 4559, 4562, 4566, 4571, 4587, 4589,
+        4597, 4599, 4607, 4613, 4615, 4619, 4622, 4625,
+        4628, 4632, 4643, 4646, 4658, 4682, 4690, 4692,
+        4696, 4699, 4704, 4707, 4709, 4714, 4717, 4723,
+        4726, 4734, 4736, 4738, 4740, 4742, 4744, 4746,
+        4748, 4750, 4752, 4755, 4758, 4760, 4762, 4764,
+        4766, 4769, 4772, 4777, 4781, 4782, 4784, 4786,
+        4792, 4797, 4802, 4804, 4807, 4809, 4812, 4816,
+        4822, 4825, 4828, 4834, 4836, 4838, 4840, 4843,
+        4876, 4878, 4880, 4883, 4886, 4889, 4897, 4905,
+        4916, 4924, 4933, 4941, 4950, 4959, 4971, 4978,
+        4985, 4993, 5001, 5010, 5016, 5024, 5030, 5038,
+        5040, 5043, 5057, 5063, 5071, 5075, 5079, 5081,
+        5128, 5130, 5133, 5135, 5140, 5146, 5152, 5157,
+        5160, 5164, 5167, 5170, 5172, 5175, 5178, 5181,
+        5185, 5190, 5195, 5199, 5201, 5204, 5206, 5210,
+        5213, 5216, 5219, 5222, 5226, 5231, 5235, 5237,
+        5239, 5242, 5244, 5248, 5251, 5254, 5262, 5266,
+        5274, 5290, 5292, 5297, 5299, 5303, 5314, 5318,
+        5320, 5323, 5325, 5328, 5333, 5337, 5343, 5349,
+        5360, 5365, 5368, 5371, 5374, 5377, 5379, 5383,
+        5384, 5387, 5389, 5419, 5421, 5423, 5426, 5430,
+        5433, 5437, 5439, 5441, 5443, 5449, 5452, 5455,
+        5459, 5461, 5466, 5471, 5478, 5481, 5485, 5489,
+        5491, 5494, 5514, 5516, 5518, 5525, 5529, 5531,
+        5533, 5535, 5538, 5542, 5546, 5548, 5552, 5555,
+        5557, 5562, 5580, 5619, 5625, 5628, 5630, 5632,
+        5634, 5637, 5640, 5643, 5646, 5649, 5653, 5656,
+        5659, 5662, 5664, 5666, 5669, 5676, 5679, 5681,
+        5684, 5687, 5690, 5698, 5700, 5702, 5705, 5707,
+        5710, 5712, 5714, 5744, 5747, 5750, 5753, 5756,
+        5761, 5765, 5772, 5775, 5784, 5793, 5796, 5800,
+        5803, 5806, 5810, 5812, 5816, 5818, 5821, 5823,
+        5827, 5831, 5835, 5843, 5845, 5847, 5851, 5855,
+        5857, 5870, 5872, 5875, 5878, 5883, 5885, 5888,
+        5890, 5892, 5895, 5900, 5902, 5904, 5909, 5911,
+        5914, 5918, 5938, 5942, 5946, 5948, 5950, 5958,
+        5960, 5967, 5972, 5974, 5978, 5981, 5984, 5987,
+        5991, 5994, 5997, 6001, 6011, 6017, 6020, 6023,
+        6033, 6053, 6059, 6062, 6064, 6068, 6070, 6073,
+        6075, 6079, 6081, 6083, 6087, 6089, 6091, 6097,
+        6100, 6105, 6110, 6116, 6126, 6134, 6146, 6153,
+        6163, 6169, 6181, 6187, 6205, 6208, 6216, 6222,
+        6232, 6239, 6246, 6254, 6262, 6265, 6270, 6290,
+        6296, 6299, 6303, 6307, 6311, 6323, 6326, 6331,
+        6332, 6338, 6345, 6351, 6354, 6357, 6361, 6365,
+        6368, 6371, 6376, 6380, 6386, 6392, 6395, 6399,
+        6402, 6405, 6410, 6413, 6416, 6422, 6426, 6429,
+        6433, 6436, 6439, 6443, 6447, 6454, 6457, 6460,
+        6466, 6469, 6476, 6478, 6480, 6483, 6492, 6497,
+        6511, 6515, 6519, 6534, 6540, 6543, 6546, 6548,
+        6553, 6559, 6563, 6571, 6577, 6587, 6590, 6593,
+        6598, 6602, 6605, 6608, 6611, 6615, 6620, 6624,
+        6628, 6631, 6636, 6641, 6644, 6650, 6654, 6660,
+        6665, 6669, 6673, 6681, 6684, 6692, 6698, 6708,
+        6719, 6722, 6725, 6727, 6731, 6733, 6736, 6747,
+        6751, 6754, 6757, 6760, 6763, 6765, 6769, 6773,
+        6776, 6780, 6785, 6788, 6798, 6800, 6841, 6847,
+        6851, 6854, 6857, 6861, 6864, 6868, 6872, 6877,
+        6879, 6883, 6887, 6890, 6893, 6898, 6907, 6911,
+        6916, 6921, 6925, 6932, 6936, 6939, 6943, 6946,
+        6951, 6954, 6957, 6987, 6991, 6995, 6999, 7003,
+        7008, 7012, 7018, 7022, 7030, 7033, 7038, 7042,
+        7045, 7050, 7053, 7057, 7060, 7063, 7066, 7069,
+        7072, 7076, 7080, 7083, 7093, 7096, 7099, 7104,
+        7110, 7113, 7128, 7131, 7135, 7141, 7145, 7149,
+        7152, 7156, 7163, 7166, 7169, 7175, 7178, 7182,
+        7187, 7203, 7205, 7213, 7215, 7223, 7229, 7231,
+        7235, 7238, 7241, 7244, 7248, 7259, 7262, 7274,
+        7298, 7306, 7308, 7312, 7315, 7320, 7323, 7325,
+        7330, 7333, 7339, 7342, 7407, 7410, 7412, 7414,
+        7416, 7418, 7420, 7423, 7428, 7431, 7434, 7436,
+        7476, 7478, 7480, 7482, 7487, 7491, 7492, 7494,
+        7496, 7503, 7510, 7517, 7519, 7521, 7523, 7526,
+        7529, 7535, 7538, 7543, 7550, 7555, 7558, 7562,
+        7569, 7601, 7650, 7665, 7678, 7683, 7685, 7689,
+        7720, 7726, 7728, 7749, 7769, 7771, 7783, 7794,
+        7797, 7800, 7801, 7803, 7805, 7807, 7810, 7812,
+        7820, 7822, 7824, 7826, 7836, 7845, 7848, 7852,
+        7856, 7859, 7861, 7863, 7865, 7867, 7869, 7879,
+        7888, 7891, 7895, 7899, 7902, 7904, 7906, 7908,
+        7910, 7912, 7954, 7994, 7996, 8001, 8005, 8006,
+        8008, 8010, 8017, 8024, 8031, 8033, 8035, 8037,
+        8040, 8043, 8049, 8052, 8057, 8064, 8069, 8072,
+        8076, 8083, 8115, 8164, 8179, 8192, 8197, 8199,
+        8203, 8234, 8240, 8242, 8263, 8283,
 }
 
 var _hcltok_indicies []int16 = []int16{
-        2, 1, 4, 3, 6, 5, 6, 7,
-        5, 9, 11, 11, 10, 8, 12, 12,
-        10, 8, 10, 8, 13, 14, 15, 16,
-        18, 19, 20, 21, 22, 23, 24, 25,
-        26, 27, 28, 29, 30, 31, 32, 33,
-        34, 35, 36, 37, 38, 39, 40, 42,
-        43, 44, 45, 46, 14, 14, 17, 17,
-        41, 3, 14, 15, 16, 18, 19, 20,
-        21, 22, 23, 24, 25, 26, 27, 28,
-        29, 30, 31, 32, 33, 34, 35, 36,
-        37, 38, 39, 40, 42, 43, 44, 45,
-        46, 14, 14, 17, 17, 41, 3, 47,
-        48, 14, 14, 49, 16, 18, 19, 20,
-        19, 50, 51, 23, 52, 25, 26, 53,
-        54, 55, 56, 57, 58, 59, 60, 61,
-        62, 63, 64, 65, 40, 42, 66, 44,
-        67, 68, 69, 14, 14, 14, 17, 41,
-        3, 47, 3, 14, 14, 14, 14, 3,
-        14, 14, 14, 3, 14, 3, 14, 3,
-        14, 3, 3, 3, 3, 3, 14, 3,
-        3, 3, 3, 14, 14, 14, 14, 14,
-        3, 3, 14, 3, 3, 14, 3, 14,
-        3, 3, 14, 3, 3, 3, 14, 14,
-        14, 14, 14, 14, 3, 14, 14, 3,
-        14, 14, 3, 3, 3, 3, 3, 3,
-        14, 14, 3, 3, 14, 3, 14, 14,
-        14, 3, 70, 71, 72, 73, 17, 74,
-        75, 76, 77, 78, 79, 80, 81, 82,
-        83, 84, 85, 86, 87, 88, 89, 90,
-        91, 92, 93, 94, 95, 96, 97, 98,
-        99, 100, 3, 14, 3, 14, 3, 14,
-        14, 3, 14, 14, 3, 3, 3, 14,
-        3, 3, 3, 3, 3, 3, 3, 14,
-        3, 3, 3, 3, 3, 3, 3, 14,
-        14, 14, 14, 14, 14, 14, 14, 14,
-        14, 14, 3, 3, 3, 3, 3, 3,
-        3, 3, 14, 14, 14, 14, 14, 14,
-        14, 14, 14, 3, 3, 3, 3, 3,
-        3, 3, 3, 14, 14, 14, 14, 14,
-        14, 14, 14, 14, 3, 14, 14, 14,
-        14, 14, 14, 14, 14, 3, 14, 14,
-        14, 14, 14, 14, 14, 14, 14, 14,
-        14, 3, 14, 14, 14, 14, 14, 14,
-        3, 14, 14, 14, 14, 14, 14, 3,
-        3, 3, 3, 3, 3, 3, 3, 14,
-        14, 14, 14, 14, 14, 14, 14, 3,
-        14, 14, 14, 14, 14, 14, 14, 14,
-        3, 14, 14, 14, 14, 14, 3, 3,
-        3, 3, 3, 3, 3, 3, 14, 14,
-        14, 14, 14, 14, 3, 14, 14, 14,
-        14, 14, 14, 14, 3, 14, 3, 14,
-        14, 3, 14, 14, 14, 14, 14, 14,
-        14, 14, 14, 14, 14, 14, 14, 3,
-        14, 14, 14, 14, 14, 3, 14, 14,
-        14, 14, 14, 14, 14, 3, 14, 14,
-        14, 3, 14, 14, 14, 3, 14, 3,
-        101, 102, 103, 104, 105, 106, 107, 108,
-        109, 110, 111, 112, 113, 114, 115, 116,
-        117, 19, 118, 119, 120, 121, 122, 123,
-        124, 125, 126, 127, 128, 129, 130, 131,
-        132, 133, 134, 135, 17, 18, 136, 137,
-        138, 139, 140, 17, 19, 17, 3, 14,
-        3, 14, 14, 3, 3, 14, 3, 3,
-        3, 3, 14, 3, 3, 3, 3, 3,
-        14, 3, 3, 3, 3, 3, 14, 14,
-        14, 14, 14, 3, 3, 3, 14, 3,
-        3, 3, 14, 14, 14, 3, 3, 3,
-        14, 14, 3, 3, 3, 14, 14, 14,
-        3, 3, 3, 14, 14, 14, 14, 3,
-        14, 14, 14, 14, 3, 3, 3, 3,
-        3, 14, 14, 14, 14, 3, 3, 14,
-        14, 14, 3, 3, 14, 14, 14, 14,
-        3, 14, 14, 3, 14, 14, 3, 3,
-        3, 14, 14, 14, 3, 3, 3, 3,
-        14, 14, 14, 14, 14, 3, 3, 3,
-        3, 14, 3, 14, 14, 3, 14, 14,
-        3, 14, 3, 14, 14, 14, 3, 14,
-        14, 3, 3, 3, 14, 3, 3, 3,
-        3, 3, 3, 3, 14, 14, 14, 14,
-        3, 14, 14, 14, 14, 14, 14, 14,
-        3, 141, 142, 143, 144, 145, 146, 147,
-        148, 149, 17, 150, 151, 152, 153, 154,
-        3, 14, 3, 3, 3, 3, 3, 14,
-        14, 3, 14, 14, 14, 3, 14, 14,
-        14, 14, 14, 14, 14, 14, 14, 14,
-        3, 14, 14, 14, 3, 3, 14, 14,
-        14, 3, 3, 14, 3, 3, 14, 14,
-        14, 14, 14, 3, 3, 3, 3, 14,
-        14, 14, 14, 14, 14, 3, 14, 14,
-        14, 14, 14, 3, 155, 112, 156, 157,
-        158, 17, 159, 160, 19, 17, 3, 14,
-        14, 14, 14, 3, 3, 3, 14, 3,
-        3, 14, 14, 14, 3, 3, 3, 14,
-        14, 3, 122, 3, 19, 17, 17, 161,
-        3, 17, 3, 14, 19, 162, 163, 19,
-        164, 165, 19, 60, 166, 167, 168, 169,
-        170, 19, 171, 172, 173, 19, 174, 175,
-        176, 18, 177, 178, 179, 18, 180, 19,
-        17, 3, 3, 14, 14, 3, 3, 3,
-        14, 14, 14, 14, 3, 14, 14, 3,
-        3, 3, 3, 14, 14, 3, 3, 14,
-        14, 3, 3, 3, 3, 3, 3, 14,
-        14, 14, 3, 3, 3, 14, 3, 3,
-        3, 14, 14, 3, 14, 14, 14, 14,
-        3, 14, 14, 14, 14, 3, 14, 14,
-        14, 14, 14, 14, 3, 3, 3, 14,
-        14, 14, 14, 3, 181, 182, 3, 17,
-        3, 14, 3, 3, 14, 19, 183, 184,
-        185, 186, 60, 187, 188, 58, 189, 190,
-        191, 192, 193, 194, 195, 196, 197, 17,
-        3, 3, 14, 3, 14, 14, 14, 14,
-        14, 14, 14, 3, 14, 14, 14, 3,
-        14, 3, 3, 14, 3, 14, 3, 3,
-        14, 14, 14, 14, 3, 14, 14, 14,
-        3, 3, 14, 14, 14, 14, 3, 14,
-        14, 3, 3, 14, 14, 14, 14, 14,
-        3, 198, 199, 200, 201, 202, 203, 204,
-        205, 206, 207, 208, 204, 209, 210, 211,
-        212, 41, 3, 213, 214, 19, 215, 216,
-        217, 218, 219, 220, 221, 222, 223, 19,
-        17, 224, 225, 226, 227, 19, 228, 229,
-        230, 231, 232, 233, 234, 235, 236, 237,
-        238, 239, 240, 241, 242, 19, 147, 17,
-        243, 3, 14, 14, 14, 14, 14, 3,
-        3, 3, 14, 3, 14, 14, 3, 14,
-        3, 14, 14, 3, 3, 3, 14, 14,
-        14, 3, 3, 3, 14, 14, 14, 3,
-        3, 3, 3, 14, 3, 3, 14, 3,
-        3, 14, 14, 14, 3, 3, 14, 3,
-        14, 14, 14, 3, 14, 14, 14, 14,
-        14, 14, 3, 3, 3, 14, 14, 3,
-        14, 14, 3, 14, 14, 3, 14, 14,
-        3, 14, 14, 14, 14, 14, 14, 14,
-        3, 14, 3, 14, 3, 14, 14, 3,
-        14, 3, 14, 14, 3, 14, 3, 14,
-        3, 244, 215, 245, 246, 247, 248, 249,
-        250, 251, 252, 253, 101, 254, 19, 255,
-        256, 257, 19, 258, 132, 259, 260, 261,
-        262, 263, 264, 265, 266, 19, 3, 3,
-        3, 14, 14, 14, 3, 14, 14, 3,
-        14, 14, 3, 3, 3, 3, 3, 14,
-        14, 14, 14, 3, 14, 14, 14, 14,
-        14, 14, 3, 3, 3, 14, 14, 14,
-        14, 14, 14, 14, 14, 14, 3, 14,
-        14, 14, 14, 14, 14, 14, 14, 3,
-        14, 14, 3, 3, 3, 3, 14, 14,
-        14, 3, 3, 3, 14, 3, 3, 3,
-        14, 14, 3, 14, 14, 14, 3, 14,
-        3, 3, 3, 14, 14, 3, 14, 14,
-        14, 3, 14, 14, 14, 3, 3, 3,
-        3, 14, 19, 184, 267, 268, 17, 19,
-        17, 3, 3, 14, 3, 14, 19, 267,
-        17, 3, 19, 269, 17, 3, 3, 14,
-        19, 270, 271, 272, 175, 273, 274, 19,
-        275, 276, 277, 17, 3, 3, 14, 14,
-        14, 3, 14, 14, 3, 14, 14, 14,
-        14, 3, 3, 14, 3, 3, 14, 14,
-        3, 14, 3, 19, 17, 3, 278, 19,
-        279, 3, 17, 3, 14, 3, 14, 280,
-        19, 281, 282, 3, 14, 3, 3, 3,
-        14, 14, 14, 14, 3, 283, 284, 285,
-        19, 286, 287, 288, 289, 290, 291, 292,
-        293, 294, 295, 296, 297, 298, 299, 17,
-        3, 14, 14, 14, 3, 3, 3, 3,
-        14, 14, 3, 3, 14, 3, 3, 3,
-        3, 3, 3, 3, 14, 3, 14, 3,
-        3, 3, 3, 3, 3, 14, 14, 14,
-        14, 14, 3, 3, 14, 3, 3, 3,
-        14, 3, 3, 14, 3, 3, 14, 3,
-        3, 14, 3, 3, 3, 14, 14, 14,
-        3, 3, 3, 14, 14, 14, 14, 3,
-        300, 19, 301, 19, 302, 303, 304, 305,
-        17, 3, 14, 14, 14, 14, 14, 3,
-        3, 3, 14, 3, 3, 14, 14, 14,
-        14, 14, 14, 14, 14, 14, 14, 3,
-        14, 14, 14, 14, 14, 14, 14, 14,
-        14, 14, 14, 14, 14, 14, 14, 14,
-        14, 14, 14, 3, 14, 14, 14, 14,
-        14, 3, 306, 19, 17, 3, 14, 307,
-        19, 103, 17, 3, 14, 308, 3, 17,
-        3, 14, 19, 309, 17, 3, 3, 14,
-        310, 3, 19, 311, 17, 3, 3, 14,
-        14, 14, 14, 3, 14, 14, 14, 14,
-        3, 14, 14, 14, 14, 14, 3, 3,
-        14, 3, 14, 14, 14, 3, 14, 3,
-        14, 14, 14, 3, 3, 3, 3, 3,
-        3, 3, 14, 14, 14, 3, 14, 3,
-        3, 3, 14, 14, 14, 14, 3, 312,
-        313, 72, 314, 315, 316, 317, 318, 319,
-        320, 321, 322, 323, 324, 325, 326, 327,
-        328, 329, 330, 331, 332, 334, 335, 336,
-        337, 338, 339, 333, 3, 14, 14, 14,
-        14, 3, 14, 3, 14, 14, 3, 14,
-        14, 14, 3, 3, 3, 3, 3, 3,
-        3, 3, 3, 14, 14, 14, 14, 14,
-        3, 14, 14, 14, 14, 14, 14, 14,
-        3, 14, 14, 14, 3, 14, 14, 14,
-        14, 14, 14, 14, 3, 14, 14, 14,
-        3, 14, 14, 14, 14, 14, 14, 14,
-        3, 14, 14, 14, 3, 14, 14, 14,
-        14, 14, 14, 14, 14, 14, 14, 3,
-        14, 3, 14, 14, 14, 14, 14, 3,
-        14, 14, 3, 14, 14, 14, 14, 14,
-        14, 14, 3, 14, 14, 14, 3, 14,
-        14, 14, 14, 3, 14, 14, 14, 14,
-        3, 14, 14, 14, 14, 3, 14, 3,
-        14, 14, 3, 14, 14, 14, 14, 14,
-        14, 14, 14, 14, 14, 14, 14, 14,
-        14, 3, 14, 14, 14, 3, 14, 3,
-        14, 14, 3, 14, 3, 340, 341, 342,
-        104, 105, 106, 107, 108, 343, 110, 111,
-        112, 113, 114, 115, 344, 345, 170, 346,
-        261, 120, 347, 122, 232, 272, 125, 348,
-        349, 350, 351, 352, 353, 354, 355, 356,
-        357, 134, 358, 19, 17, 18, 19, 137,
-        138, 139, 140, 17, 17, 3, 14, 14,
-        3, 14, 14, 14, 14, 14, 14, 3,
-        3, 3, 14, 3, 14, 14, 14, 14,
-        3, 14, 14, 14, 3, 14, 14, 3,
-        14, 14, 14, 3, 3, 14, 14, 14,
-        3, 3, 14, 14, 3, 14, 3, 14,
-        3, 14, 14, 14, 3, 3, 14, 14,
-        3, 14, 14, 3, 14, 14, 14, 3,
-        359, 143, 145, 146, 147, 148, 149, 17,
-        360, 151, 361, 153, 362, 3, 14, 14,
-        3, 3, 3, 3, 14, 3, 3, 14,
-        14, 14, 14, 14, 3, 363, 112, 364,
-        157, 158, 17, 159, 160, 19, 17, 3,
-        14, 14, 14, 14, 3, 3, 3, 14,
-        19, 162, 163, 19, 365, 366, 222, 311,
-        166, 167, 168, 367, 170, 368, 369, 370,
-        371, 372, 373, 374, 375, 376, 377, 178,
-        179, 18, 378, 19, 17, 3, 3, 3,
-        3, 14, 14, 14, 3, 3, 3, 3,
-        3, 14, 14, 3, 14, 14, 14, 3,
-        14, 14, 3, 3, 3, 14, 14, 3,
-        14, 14, 14, 14, 3, 14, 3, 14,
-        14, 14, 14, 14, 3, 3, 3, 3,
-        3, 14, 14, 14, 14, 14, 14, 3,
-        14, 3, 19, 183, 184, 379, 186, 60,
-        187, 188, 58, 189, 190, 380, 17, 193,
-        381, 195, 196, 197, 17, 3, 14, 14,
-        14, 14, 14, 14, 14, 3, 14, 14,
-        3, 14, 3, 382, 383, 200, 201, 202,
-        384, 204, 205, 385, 386, 387, 204, 209,
-        210, 211, 212, 41, 3, 213, 214, 19,
-        215, 216, 218, 388, 220, 389, 222, 223,
-        19, 17, 390, 225, 226, 227, 19, 228,
-        229, 230, 231, 232, 233, 234, 235, 391,
-        237, 238, 392, 240, 241, 242, 19, 147,
-        17, 243, 3, 3, 14, 3, 3, 14,
-        3, 14, 14, 14, 14, 14, 3, 14,
-        14, 3, 393, 394, 395, 396, 397, 398,
-        399, 400, 250, 401, 322, 402, 216, 403,
-        404, 405, 406, 407, 404, 408, 409, 410,
-        261, 411, 263, 412, 413, 274, 3, 14,
-        3, 14, 3, 14, 3, 14, 3, 14,
-        14, 3, 14, 3, 14, 14, 14, 3,
-        14, 14, 3, 3, 14, 14, 14, 3,
-        14, 3, 14, 3, 14, 14, 3, 14,
-        3, 14, 3, 14, 3, 14, 3, 14,
-        3, 3, 3, 14, 14, 14, 3, 14,
-        14, 3, 19, 270, 232, 414, 404, 415,
-        274, 19, 416, 417, 277, 17, 3, 14,
-        3, 14, 14, 14, 3, 3, 3, 14,
-        14, 3, 280, 19, 281, 418, 3, 14,
-        14, 3, 19, 286, 287, 288, 289, 290,
-        291, 292, 293, 294, 295, 419, 17, 3,
-        3, 3, 14, 19, 420, 19, 268, 303,
-        304, 305, 17, 3, 3, 14, 422, 422,
-        422, 422, 421, 422, 422, 422, 421, 422,
-        421, 422, 422, 421, 421, 421, 421, 421,
-        421, 422, 421, 421, 421, 421, 422, 422,
-        422, 422, 422, 421, 421, 422, 421, 421,
-        422, 421, 422, 421, 421, 422, 421, 421,
-        421, 422, 422, 422, 422, 422, 422, 421,
-        422, 422, 421, 422, 422, 421, 421, 421,
-        421, 421, 421, 422, 422, 421, 421, 422,
-        421, 422, 422, 422, 421, 423, 424, 425,
+        1, 0, 3, 2, 3, 4, 2, 6,
+        8, 8, 7, 5, 9, 9, 7, 5,
+        7, 5, 10, 11, 12, 13, 15, 16,
+        17, 18, 19, 20, 21, 22, 23, 24,
+        25, 26, 27, 28, 29, 30, 31, 32,
+        33, 34, 35, 36, 37, 39, 40, 41,
+        42, 43, 11, 11, 14, 14, 38, 0,
+        11, 12, 13, 15, 16, 17, 18, 19,
+        20, 21, 22, 23, 24, 25, 26, 27,
+        28, 29, 30, 31, 32, 33, 34, 35,
+        36, 37, 39, 40, 41, 42, 43, 11,
+        11, 14, 14, 38, 0, 44, 45, 11,
+        11, 46, 13, 15, 16, 17, 16, 47,
+        48, 20, 49, 22, 23, 50, 51, 52,
+        53, 54, 55, 56, 57, 58, 59, 60,
+        61, 62, 37, 39, 63, 41, 64, 65,
+        66, 11, 11, 11, 14, 38, 0, 44,
+        0, 11, 11, 11, 11, 0, 11, 11,
+        11, 0, 11, 0, 11, 11, 0, 0,
+        0, 0, 0, 0, 11, 0, 0, 0,
+        0, 11, 11, 11, 11, 11, 0, 0,
+        11, 0, 0, 11, 0, 11, 0, 0,
+        11, 0, 0, 0, 11, 11, 11, 11,
+        11, 11, 0, 11, 11, 0, 11, 11,
+        0, 0, 0, 0, 0, 0, 11, 11,
+        0, 0, 11, 0, 11, 11, 11, 0,
+        67, 68, 69, 70, 14, 71, 72, 73,
+        74, 75, 76, 77, 78, 79, 80, 81,
+        82, 83, 84, 85, 86, 87, 88, 89,
+        90, 91, 92, 93, 94, 95, 96, 97,
+        0, 11, 0, 11, 0, 11, 11, 0,
+        11, 11, 0, 0, 0, 11, 0, 0,
+        0, 0, 0, 0, 0, 11, 0, 0,
+        0, 0, 0, 0, 0, 11, 11, 11,
+        11, 11, 11, 11, 11, 11, 11, 11,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        11, 11, 11, 11, 11, 11, 11, 11,
+        11, 0, 0, 0, 0, 0, 0, 0,
+        0, 11, 11, 11, 11, 11, 11, 11,
+        11, 11, 0, 11, 11, 11, 11, 11,
+        11, 11, 11, 0, 11, 11, 11, 11,
+        11, 11, 11, 11, 11, 11, 11, 0,
+        11, 11, 11, 11, 11, 11, 0, 11,
+        11, 11, 11, 11, 11, 0, 0, 0,
+        0, 0, 0, 0, 0, 11, 11, 11,
+        11, 11, 11, 11, 11, 0, 11, 11,
+        11, 11, 11, 11, 11, 11, 0, 11,
+        11, 11, 11, 11, 0, 0, 0, 0,
+        0, 0, 0, 0, 11, 11, 11, 11,
+        11, 11, 0, 11, 11, 11, 11, 11,
+        11, 11, 0, 11, 0, 11, 11, 0,
+        11, 11, 11, 11, 11, 11, 11, 11,
+        11, 11, 11, 11, 11, 0, 11, 11,
+        11, 11, 11, 0, 11, 11, 11, 11,
+        11, 11, 11, 0, 11, 11, 11, 0,
+        11, 11, 11, 0, 11, 0, 98, 99,
+        100, 101, 102, 103, 104, 105, 106, 107,
+        108, 109, 110, 111, 112, 113, 114, 16,
+        115, 116, 117, 118, 119, 120, 121, 122,
+        123, 124, 125, 126, 127, 128, 129, 130,
+        131, 132, 14, 15, 133, 134, 135, 136,
+        137, 14, 16, 14, 0, 11, 0, 11,
+        11, 0, 0, 11, 0, 0, 0, 0,
+        11, 0, 0, 0, 0, 0, 11, 0,
+        0, 0, 0, 0, 11, 11, 11, 11,
+        11, 0, 0, 0, 11, 0, 0, 0,
+        11, 11, 11, 0, 0, 0, 11, 11,
+        0, 0, 0, 11, 11, 11, 0, 0,
+        0, 11, 11, 11, 11, 0, 11, 11,
+        11, 11, 0, 0, 0, 0, 0, 11,
+        11, 11, 11, 0, 0, 11, 11, 11,
+        0, 0, 11, 11, 11, 11, 0, 11,
+        11, 0, 11, 11, 0, 0, 0, 11,
+        11, 11, 0, 0, 0, 0, 11, 11,
+        11, 11, 11, 0, 0, 0, 0, 11,
+        0, 11, 11, 0, 11, 11, 0, 11,
+        0, 11, 11, 11, 0, 11, 11, 0,
+        0, 0, 11, 0, 0, 0, 0, 0,
+        0, 0, 11, 11, 11, 11, 0, 11,
+        11, 11, 11, 11, 11, 11, 0, 138,
+        139, 140, 141, 142, 143, 144, 145, 146,
+        14, 147, 148, 149, 150, 151, 0, 11,
+        0, 0, 0, 0, 0, 11, 11, 0,
+        11, 11, 11, 0, 11, 11, 11, 11,
+        11, 11, 11, 11, 11, 11, 0, 11,
+        11, 11, 0, 0, 11, 11, 11, 0,
+        0, 11, 0, 0, 11, 11, 11, 11,
+        11, 0, 0, 0, 0, 11, 11, 11,
+        11, 11, 11, 0, 11, 11, 11, 11,
+        11, 0, 152, 109, 153, 154, 155, 14,
+        156, 157, 16, 14, 0, 11, 11, 11,
+        11, 0, 0, 0, 11, 0, 0, 11,
+        11, 11, 0, 0, 0, 11, 11, 0,
+        119, 0, 16, 14, 14, 158, 0, 14,
+        0, 11, 16, 159, 160, 16, 161, 162,
+        16, 57, 163, 164, 165, 166, 167, 16,
+        168, 169, 170, 16, 171, 172, 173, 15,
+        174, 175, 176, 15, 177, 16, 14, 0,
+        0, 11, 11, 0, 0, 0, 11, 11,
+        11, 11, 0, 11, 11, 0, 0, 0,
+        0, 11, 11, 0, 0, 11, 11, 0,
+        0, 0, 0, 0, 0, 11, 11, 11,
+        0, 0, 0, 11, 0, 0, 0, 11,
+        11, 0, 11, 11, 11, 11, 0, 11,
+        11, 11, 11, 0, 11, 11, 11, 11,
+        11, 11, 0, 0, 0, 11, 11, 11,
+        11, 0, 178, 179, 0, 14, 0, 11,
+        0, 0, 11, 16, 180, 181, 182, 183,
+        57, 184, 185, 55, 186, 187, 188, 189,
+        190, 191, 192, 193, 194, 14, 0, 0,
+        11, 0, 11, 11, 11, 11, 11, 11,
+        11, 0, 11, 11, 11, 0, 11, 0,
+        0, 11, 0, 11, 0, 0, 11, 11,
+        11, 11, 0, 11, 11, 11, 0, 0,
+        11, 11, 11, 11, 0, 11, 11, 0,
+        0, 11, 11, 11, 11, 11, 0, 195,
+        196, 197, 198, 199, 200, 201, 202, 203,
+        204, 205, 201, 206, 207, 208, 209, 38,
+        0, 210, 211, 16, 212, 213, 214, 215,
+        216, 217, 218, 219, 220, 16, 14, 221,
+        222, 223, 224, 16, 225, 226, 227, 228,
+        229, 230, 231, 232, 233, 234, 235, 236,
+        237, 238, 239, 16, 144, 14, 240, 0,
+        11, 11, 11, 11, 11, 0, 0, 0,
+        11, 0, 11, 11, 0, 11, 0, 11,
+        11, 0, 0, 0, 11, 11, 11, 0,
+        0, 0, 11, 11, 11, 0, 0, 0,
+        0, 11, 0, 0, 11, 0, 0, 11,
+        11, 11, 0, 0, 11, 0, 11, 11,
+        11, 0, 11, 11, 11, 11, 11, 11,
+        0, 0, 0, 11, 11, 0, 11, 11,
+        0, 11, 11, 0, 11, 11, 0, 11,
+        11, 11, 11, 11, 11, 11, 0, 11,
+        0, 11, 0, 11, 11, 0, 11, 0,
+        11, 11, 0, 11, 0, 11, 0, 241,
+        212, 242, 243, 244, 245, 246, 247, 248,
+        249, 250, 98, 251, 16, 252, 253, 254,
+        16, 255, 129, 256, 257, 258, 259, 260,
+        261, 262, 263, 16, 0, 0, 0, 11,
+        11, 11, 0, 11, 11, 0, 11, 11,
+        0, 0, 0, 0, 0, 11, 11, 11,
+        11, 0, 11, 11, 11, 11, 11, 11,
+        0, 0, 0, 11, 11, 11, 11, 11,
+        11, 11, 11, 11, 0, 11, 11, 11,
+        11, 11, 11, 11, 11, 0, 11, 11,
+        0, 0, 0, 0, 11, 11, 11, 0,
+        0, 0, 11, 0, 0, 0, 11, 11,
+        0, 11, 11, 11, 0, 11, 0, 0,
+        0, 11, 11, 0, 11, 11, 11, 0,
+        11, 11, 11, 0, 0, 0, 0, 11,
+        16, 181, 264, 265, 14, 16, 14, 0,
+        0, 11, 0, 11, 16, 264, 14, 0,
+        16, 266, 14, 0, 0, 11, 16, 267,
+        268, 269, 172, 270, 271, 16, 272, 273,
+        274, 14, 0, 0, 11, 11, 11, 0,
+        11, 11, 0, 11, 11, 11, 11, 0,
+        0, 11, 0, 0, 11, 11, 0, 11,
+        0, 16, 14, 0, 275, 16, 276, 0,
+        14, 0, 11, 0, 11, 277, 16, 278,
+        279, 0, 11, 0, 0, 0, 11, 11,
+        11, 11, 0, 280, 281, 282, 16, 283,
+        284, 285, 286, 287, 288, 289, 290, 291,
+        292, 293, 294, 295, 296, 14, 0, 11,
+        11, 11, 0, 0, 0, 0, 11, 11,
+        0, 0, 11, 0, 0, 0, 0, 0,
+        0, 0, 11, 0, 11, 0, 0, 0,
+        0, 0, 0, 11, 11, 11, 11, 11,
+        0, 0, 11, 0, 0, 0, 11, 0,
+        0, 11, 0, 0, 11, 0, 0, 11,
+        0, 0, 0, 11, 11, 11, 0, 0,
+        0, 11, 11, 11, 11, 0, 297, 16,
+        298, 16, 299, 300, 301, 302, 14, 0,
+        11, 11, 11, 11, 11, 0, 0, 0,
+        11, 0, 0, 11, 11, 11, 11, 11,
+        11, 11, 11, 11, 11, 0, 11, 11,
+        11, 11, 11, 11, 11, 11, 11, 11,
+        11, 11, 11, 11, 11, 11, 11, 11,
+        11, 0, 11, 11, 11, 11, 11, 0,
+        303, 16, 14, 0, 11, 304, 16, 100,
+        14, 0, 11, 305, 0, 14, 0, 11,
+        16, 306, 14, 0, 0, 11, 307, 0,
+        16, 308, 14, 0, 0, 11, 11, 11,
+        11, 0, 11, 11, 11, 11, 0, 11,
+        11, 11, 11, 11, 0, 0, 11, 0,
+        11, 11, 11, 0, 11, 0, 11, 11,
+        11, 0, 0, 0, 0, 0, 0, 0,
+        11, 11, 11, 0, 11, 0, 0, 0,
+        11, 11, 11, 11, 0, 309, 310, 69,
+        311, 312, 313, 314, 315, 316, 317, 318,
+        319, 320, 321, 322, 323, 324, 325, 326,
+        327, 328, 329, 331, 332, 333, 334, 335,
+        336, 330, 0, 11, 11, 11, 11, 0,
+        11, 0, 11, 11, 0, 11, 11, 11,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 11, 11, 11, 11, 11, 0, 11,
+        11, 11, 11, 11, 11, 11, 0, 11,
+        11, 11, 0, 11, 11, 11, 11, 11,
+        11, 11, 0, 11, 11, 11, 0, 11,
+        11, 11, 11, 11, 11, 11, 0, 11,
+        11, 11, 0, 11, 11, 11, 11, 11,
+        11, 11, 11, 11, 11, 0, 11, 0,
+        11, 11, 11, 11, 11, 0, 11, 11,
+        0, 11, 11, 11, 11, 11, 11, 11,
+        0, 11, 11, 11, 0, 11, 11, 11,
+        11, 0, 11, 11, 11, 11, 0, 11,
+        11, 11, 11, 0, 11, 0, 11, 11,
+        0, 11, 11, 11, 11, 11, 11, 11,
+        11, 11, 11, 11, 11, 11, 11, 0,
+        11, 11, 11, 0, 11, 0, 11, 11,
+        0, 11, 0, 337, 338, 339, 101, 102,
+        103, 104, 105, 340, 107, 108, 109, 110,
+        111, 112, 341, 342, 167, 343, 258, 117,
+        344, 119, 229, 269, 122, 345, 346, 347,
+        348, 349, 350, 351, 352, 353, 354, 131,
+        355, 16, 14, 15, 16, 134, 135, 136,
+        137, 14, 14, 0, 11, 11, 0, 11,
+        11, 11, 11, 11, 11, 0, 0, 0,
+        11, 0, 11, 11, 11, 11, 0, 11,
+        11, 11, 0, 11, 11, 0, 11, 11,
+        11, 0, 0, 11, 11, 11, 0, 0,
+        11, 11, 0, 11, 0, 11, 0, 11,
+        11, 11, 0, 0, 11, 11, 0, 11,
+        11, 0, 11, 11, 11, 0, 356, 140,
+        142, 143, 144, 145, 146, 14, 357, 148,
+        358, 150, 359, 0, 11, 11, 0, 0,
+        0, 0, 11, 0, 0, 11, 11, 11,
+        11, 11, 0, 360, 109, 361, 154, 155,
+        14, 156, 157, 16, 14, 0, 11, 11,
+        11, 11, 0, 0, 0, 11, 16, 159,
+        160, 16, 362, 363, 219, 308, 163, 164,
+        165, 364, 167, 365, 366, 367, 368, 369,
+        370, 371, 372, 373, 374, 175, 176, 15,
+        375, 16, 14, 0, 0, 0, 0, 11,
+        11, 11, 0, 0, 0, 0, 0, 11,
+        11, 0, 11, 11, 11, 0, 11, 11,
+        0, 0, 0, 11, 11, 0, 11, 11,
+        11, 11, 0, 11, 0, 11, 11, 11,
+        11, 11, 0, 0, 0, 0, 0, 11,
+        11, 11, 11, 11, 11, 0, 11, 0,
+        16, 180, 181, 376, 183, 57, 184, 185,
+        55, 186, 187, 377, 14, 190, 378, 192,
+        193, 194, 14, 0, 11, 11, 11, 11,
+        11, 11, 11, 0, 11, 11, 0, 11,
+        0, 379, 380, 197, 198, 199, 381, 201,
+        202, 382, 383, 384, 201, 206, 207, 208,
+        209, 38, 0, 210, 211, 16, 212, 213,
+        215, 385, 217, 386, 219, 220, 16, 14,
+        387, 222, 223, 224, 16, 225, 226, 227,
+        228, 229, 230, 231, 232, 388, 234, 235,
+        389, 237, 238, 239, 16, 144, 14, 240,
+        0, 0, 11, 0, 0, 11, 0, 11,
+        11, 11, 11, 11, 0, 11, 11, 0,
+        390, 391, 392, 393, 394, 395, 396, 397,
+        247, 398, 319, 399, 213, 400, 401, 402,
+        403, 404, 401, 405, 406, 407, 258, 408,
+        260, 409, 410, 271, 0, 11, 0, 11,
+        0, 11, 0, 11, 0, 11, 11, 0,
+        11, 0, 11, 11, 11, 0, 11, 11,
+        0, 0, 11, 11, 11, 0, 11, 0,
+        11, 0, 11, 11, 0, 11, 0, 11,
+        0, 11, 0, 11, 0, 11, 0, 0,
+        0, 11, 11, 11, 0, 11, 11, 0,
+        16, 267, 229, 411, 401, 412, 271, 16,
+        413, 414, 274, 14, 0, 11, 0, 11,
+        11, 11, 0, 0, 0, 11, 11, 0,
+        277, 16, 278, 415, 0, 11, 11, 0,
+        16, 283, 284, 285, 286, 287, 288, 289,
+        290, 291, 292, 416, 14, 0, 0, 0,
+        11, 16, 417, 16, 265, 300, 301, 302,
+        14, 0, 0, 11, 419, 419, 419, 419,
+        418, 419, 419, 419, 418, 419, 418, 419,
+        419, 418, 418, 418, 418, 418, 418, 419,
+        418, 418, 418, 418, 419, 419, 419, 419,
+        419, 418, 418, 419, 418, 418, 419, 418,
+        419, 418, 418, 419, 418, 418, 418, 419,
+        419, 419, 419, 419, 419, 418, 419, 419,
+        418, 419, 419, 418, 418, 418, 418, 418,
+        418, 419, 419, 418, 418, 419, 418, 419,
+        419, 419, 418, 421, 422, 423, 424, 425,
         426, 427, 428, 429, 430, 431, 432, 433,
         434, 435, 436, 437, 438, 439, 440, 441,
         442, 443, 444, 445, 446, 447, 448, 449,
-        450, 451, 452, 453, 454, 421, 422, 421,
-        422, 421, 422, 422, 421, 422, 422, 421,
-        421, 421, 422, 421, 421, 421, 421, 421,
-        421, 421, 422, 421, 421, 421, 421, 421,
-        421, 421, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 421, 421, 421,
-        421, 421, 421, 421, 421, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 421, 421,
-        421, 421, 421, 421, 421, 421, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 421,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        421, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 421, 422, 422, 422,
-        422, 422, 422, 421, 422, 422, 422, 422,
-        422, 422, 421, 421, 421, 421, 421, 421,
-        421, 421, 422, 422, 422, 422, 422, 422,
-        422, 422, 421, 422, 422, 422, 422, 422,
-        422, 422, 422, 421, 422, 422, 422, 422,
-        422, 421, 421, 421, 421, 421, 421, 421,
-        421, 422, 422, 422, 422, 422, 422, 421,
-        422, 422, 422, 422, 422, 422, 422, 421,
-        422, 421, 422, 422, 421, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 421, 422, 422, 422, 422, 422,
-        421, 422, 422, 422, 422, 422, 422, 422,
-        421, 422, 422, 422, 421, 422, 422, 422,
-        421, 422, 421, 455, 456, 457, 458, 459,
+        450, 451, 452, 418, 419, 418, 419, 418,
+        419, 419, 418, 419, 419, 418, 418, 418,
+        419, 418, 418, 418, 418, 418, 418, 418,
+        419, 418, 418, 418, 418, 418, 418, 418,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 418, 418, 418, 418, 418,
+        418, 418, 418, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 418, 418, 418, 418,
+        418, 418, 418, 418, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 418, 419, 419,
+        419, 419, 419, 419, 419, 419, 418, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 418, 419, 419, 419, 419, 419,
+        419, 418, 419, 419, 419, 419, 419, 419,
+        418, 418, 418, 418, 418, 418, 418, 418,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        418, 419, 419, 419, 419, 419, 419, 419,
+        419, 418, 419, 419, 419, 419, 419, 418,
+        418, 418, 418, 418, 418, 418, 418, 419,
+        419, 419, 419, 419, 419, 418, 419, 419,
+        419, 419, 419, 419, 419, 418, 419, 418,
+        419, 419, 418, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        418, 419, 419, 419, 419, 419, 418, 419,
+        419, 419, 419, 419, 419, 419, 418, 419,
+        419, 419, 418, 419, 419, 419, 418, 419,
+        418, 453, 454, 455, 456, 457, 458, 459,
         460, 461, 462, 463, 464, 465, 466, 467,
         468, 469, 470, 471, 472, 473, 474, 475,
         476, 477, 478, 479, 480, 481, 482, 483,
-        484, 485, 486, 487, 488, 489, 490, 427,
-        491, 492, 493, 494, 495, 496, 427, 472,
-        427, 421, 422, 421, 422, 422, 421, 421,
-        422, 421, 421, 421, 421, 422, 421, 421,
-        421, 421, 421, 422, 421, 421, 421, 421,
-        421, 422, 422, 422, 422, 422, 421, 421,
-        421, 422, 421, 421, 421, 422, 422, 422,
-        421, 421, 421, 422, 422, 421, 421, 421,
-        422, 422, 422, 421, 421, 421, 422, 422,
-        422, 422, 421, 422, 422, 422, 422, 421,
-        421, 421, 421, 421, 422, 422, 422, 422,
-        421, 421, 422, 422, 422, 421, 421, 422,
-        422, 422, 422, 421, 422, 422, 421, 422,
-        422, 421, 421, 421, 422, 422, 422, 421,
-        421, 421, 421, 422, 422, 422, 422, 422,
-        421, 421, 421, 421, 422, 421, 422, 422,
-        421, 422, 422, 421, 422, 421, 422, 422,
-        422, 421, 422, 422, 421, 421, 421, 422,
-        421, 421, 421, 421, 421, 421, 421, 422,
-        422, 422, 422, 421, 422, 422, 422, 422,
-        422, 422, 422, 421, 497, 498, 499, 500,
-        501, 502, 503, 504, 505, 427, 506, 507,
-        508, 509, 510, 421, 422, 421, 421, 421,
-        421, 421, 422, 422, 421, 422, 422, 422,
-        421, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 421, 422, 422, 422, 421,
-        421, 422, 422, 422, 421, 421, 422, 421,
-        421, 422, 422, 422, 422, 422, 421, 421,
-        421, 421, 422, 422, 422, 422, 422, 422,
-        421, 422, 422, 422, 422, 422, 421, 511,
-        466, 512, 513, 514, 427, 515, 516, 472,
-        427, 421, 422, 422, 422, 422, 421, 421,
-        421, 422, 421, 421, 422, 422, 422, 421,
-        421, 421, 422, 422, 421, 477, 421, 472,
-        427, 427, 517, 421, 427, 421, 422, 472,
-        518, 519, 472, 520, 521, 472, 522, 523,
-        524, 525, 526, 527, 472, 528, 529, 530,
-        472, 531, 532, 533, 491, 534, 535, 536,
-        491, 537, 472, 427, 421, 421, 422, 422,
-        421, 421, 421, 422, 422, 422, 422, 421,
-        422, 422, 421, 421, 421, 421, 422, 422,
-        421, 421, 422, 422, 421, 421, 421, 421,
-        421, 421, 422, 422, 422, 421, 421, 421,
-        422, 421, 421, 421, 422, 422, 421, 422,
-        422, 422, 422, 421, 422, 422, 422, 422,
-        421, 422, 422, 422, 422, 422, 422, 421,
-        421, 421, 422, 422, 422, 422, 421, 538,
-        539, 421, 427, 421, 422, 421, 421, 422,
-        472, 540, 541, 542, 543, 522, 544, 545,
+        484, 485, 486, 487, 488, 425, 489, 490,
+        491, 492, 493, 494, 425, 470, 425, 418,
+        419, 418, 419, 419, 418, 418, 419, 418,
+        418, 418, 418, 419, 418, 418, 418, 418,
+        418, 419, 418, 418, 418, 418, 418, 419,
+        419, 419, 419, 419, 418, 418, 418, 419,
+        418, 418, 418, 419, 419, 419, 418, 418,
+        418, 419, 419, 418, 418, 418, 419, 419,
+        419, 418, 418, 418, 419, 419, 419, 419,
+        418, 419, 419, 419, 419, 418, 418, 418,
+        418, 418, 419, 419, 419, 419, 418, 418,
+        419, 419, 419, 418, 418, 419, 419, 419,
+        419, 418, 419, 419, 418, 419, 419, 418,
+        418, 418, 419, 419, 419, 418, 418, 418,
+        418, 419, 419, 419, 419, 419, 418, 418,
+        418, 418, 419, 418, 419, 419, 418, 419,
+        419, 418, 419, 418, 419, 419, 419, 418,
+        419, 419, 418, 418, 418, 419, 418, 418,
+        418, 418, 418, 418, 418, 419, 419, 419,
+        419, 418, 419, 419, 419, 419, 419, 419,
+        419, 418, 495, 496, 497, 498, 499, 500,
+        501, 502, 503, 425, 504, 505, 506, 507,
+        508, 418, 419, 418, 418, 418, 418, 418,
+        419, 419, 418, 419, 419, 419, 418, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 418, 419, 419, 419, 418, 418, 419,
+        419, 419, 418, 418, 419, 418, 418, 419,
+        419, 419, 419, 419, 418, 418, 418, 418,
+        419, 419, 419, 419, 419, 419, 418, 419,
+        419, 419, 419, 419, 418, 509, 464, 510,
+        511, 512, 425, 513, 514, 470, 425, 418,
+        419, 419, 419, 419, 418, 418, 418, 419,
+        418, 418, 419, 419, 419, 418, 418, 418,
+        419, 419, 418, 475, 418, 470, 425, 425,
+        515, 418, 425, 418, 419, 470, 516, 517,
+        470, 518, 519, 470, 520, 521, 522, 523,
+        524, 525, 470, 526, 527, 528, 470, 529,
+        530, 531, 489, 532, 533, 534, 489, 535,
+        470, 425, 418, 418, 419, 419, 418, 418,
+        418, 419, 419, 419, 419, 418, 419, 419,
+        418, 418, 418, 418, 419, 419, 418, 418,
+        419, 419, 418, 418, 418, 418, 418, 418,
+        419, 419, 419, 418, 418, 418, 419, 418,
+        418, 418, 419, 419, 418, 419, 419, 419,
+        419, 418, 419, 419, 419, 419, 418, 419,
+        419, 419, 419, 419, 419, 418, 418, 418,
+        419, 419, 419, 419, 418, 536, 537, 418,
+        425, 418, 419, 418, 418, 419, 470, 538,
+        539, 540, 541, 520, 542, 543, 544, 545,
         546, 547, 548, 549, 550, 551, 552, 553,
-        554, 555, 427, 421, 421, 422, 421, 422,
-        422, 422, 422, 422, 422, 422, 421, 422,
-        422, 422, 421, 422, 421, 421, 422, 421,
-        422, 421, 421, 422, 422, 422, 422, 421,
-        422, 422, 422, 421, 421, 422, 422, 422,
-        422, 421, 422, 422, 421, 421, 422, 422,
-        422, 422, 422, 421, 556, 557, 558, 559,
-        560, 561, 562, 563, 564, 565, 566, 562,
-        568, 569, 570, 571, 567, 421, 572, 573,
-        472, 574, 575, 576, 577, 578, 579, 580,
-        581, 582, 472, 427, 583, 584, 585, 586,
-        472, 587, 588, 589, 590, 591, 592, 593,
-        594, 595, 596, 597, 598, 599, 600, 601,
-        472, 503, 427, 602, 421, 422, 422, 422,
-        422, 422, 421, 421, 421, 422, 421, 422,
-        422, 421, 422, 421, 422, 422, 421, 421,
-        421, 422, 422, 422, 421, 421, 421, 422,
-        422, 422, 421, 421, 421, 421, 422, 421,
-        421, 422, 421, 421, 422, 422, 422, 421,
-        421, 422, 421, 422, 422, 422, 421, 422,
-        422, 422, 422, 422, 422, 421, 421, 421,
-        422, 422, 421, 422, 422, 421, 422, 422,
-        421, 422, 422, 421, 422, 422, 422, 422,
-        422, 422, 422, 421, 422, 421, 422, 421,
-        422, 422, 421, 422, 421, 422, 422, 421,
-        422, 421, 422, 421, 603, 574, 604, 605,
-        606, 607, 608, 609, 610, 611, 612, 455,
-        613, 472, 614, 615, 616, 472, 617, 487,
-        618, 619, 620, 621, 622, 623, 624, 625,
-        472, 421, 421, 421, 422, 422, 422, 421,
-        422, 422, 421, 422, 422, 421, 421, 421,
-        421, 421, 422, 422, 422, 422, 421, 422,
-        422, 422, 422, 422, 422, 421, 421, 421,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 421, 422, 422, 422, 422, 422, 422,
-        422, 422, 421, 422, 422, 421, 421, 421,
-        421, 422, 422, 422, 421, 421, 421, 422,
-        421, 421, 421, 422, 422, 421, 422, 422,
-        422, 421, 422, 421, 421, 421, 422, 422,
-        421, 422, 422, 422, 421, 422, 422, 422,
-        421, 421, 421, 421, 422, 472, 541, 626,
-        627, 427, 472, 427, 421, 421, 422, 421,
-        422, 472, 626, 427, 421, 472, 628, 427,
-        421, 421, 422, 472, 629, 630, 631, 532,
-        632, 633, 472, 634, 635, 636, 427, 421,
-        421, 422, 422, 422, 421, 422, 422, 421,
-        422, 422, 422, 422, 421, 421, 422, 421,
-        421, 422, 422, 421, 422, 421, 472, 427,
-        421, 637, 472, 638, 421, 427, 421, 422,
-        421, 422, 639, 472, 640, 641, 421, 422,
-        421, 421, 421, 422, 422, 422, 422, 421,
-        642, 643, 644, 472, 645, 646, 647, 648,
+        425, 418, 418, 419, 418, 419, 419, 419,
+        419, 419, 419, 419, 418, 419, 419, 419,
+        418, 419, 418, 418, 419, 418, 419, 418,
+        418, 419, 419, 419, 419, 418, 419, 419,
+        419, 418, 418, 419, 419, 419, 419, 418,
+        419, 419, 418, 418, 419, 419, 419, 419,
+        419, 418, 554, 555, 556, 557, 558, 559,
+        560, 561, 562, 563, 564, 560, 566, 567,
+        568, 569, 565, 418, 570, 571, 470, 572,
+        573, 574, 575, 576, 577, 578, 579, 580,
+        470, 425, 581, 582, 583, 584, 470, 585,
+        586, 587, 588, 589, 590, 591, 592, 593,
+        594, 595, 596, 597, 598, 599, 470, 501,
+        425, 600, 418, 419, 419, 419, 419, 419,
+        418, 418, 418, 419, 418, 419, 419, 418,
+        419, 418, 419, 419, 418, 418, 418, 419,
+        419, 419, 418, 418, 418, 419, 419, 419,
+        418, 418, 418, 418, 419, 418, 418, 419,
+        418, 418, 419, 419, 419, 418, 418, 419,
+        418, 419, 419, 419, 418, 419, 419, 419,
+        419, 419, 419, 418, 418, 418, 419, 419,
+        418, 419, 419, 418, 419, 419, 418, 419,
+        419, 418, 419, 419, 419, 419, 419, 419,
+        419, 418, 419, 418, 419, 418, 419, 419,
+        418, 419, 418, 419, 419, 418, 419, 418,
+        419, 418, 601, 572, 602, 603, 604, 605,
+        606, 607, 608, 609, 610, 453, 611, 470,
+        612, 613, 614, 470, 615, 485, 616, 617,
+        618, 619, 620, 621, 622, 623, 470, 418,
+        418, 418, 419, 419, 419, 418, 419, 419,
+        418, 419, 419, 418, 418, 418, 418, 418,
+        419, 419, 419, 419, 418, 419, 419, 419,
+        419, 419, 419, 418, 418, 418, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 418,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        418, 419, 419, 418, 418, 418, 418, 419,
+        419, 419, 418, 418, 418, 419, 418, 418,
+        418, 419, 419, 418, 419, 419, 419, 418,
+        419, 418, 418, 418, 419, 419, 418, 419,
+        419, 419, 418, 419, 419, 419, 418, 418,
+        418, 418, 419, 470, 539, 624, 625, 425,
+        470, 425, 418, 418, 419, 418, 419, 470,
+        624, 425, 418, 470, 626, 425, 418, 418,
+        419, 470, 627, 628, 629, 530, 630, 631,
+        470, 632, 633, 634, 425, 418, 418, 419,
+        419, 419, 418, 419, 419, 418, 419, 419,
+        419, 419, 418, 418, 419, 418, 418, 419,
+        419, 418, 419, 418, 470, 425, 418, 635,
+        470, 636, 418, 425, 418, 419, 418, 419,
+        637, 470, 638, 639, 418, 419, 418, 418,
+        418, 419, 419, 419, 419, 418, 640, 641,
+        642, 470, 643, 644, 645, 646, 647, 648,
         649, 650, 651, 652, 653, 654, 655, 656,
-        657, 658, 427, 421, 422, 422, 422, 421,
-        421, 421, 421, 422, 422, 421, 421, 422,
-        421, 421, 421, 421, 421, 421, 421, 422,
-        421, 422, 421, 421, 421, 421, 421, 421,
-        422, 422, 422, 422, 422, 421, 421, 422,
-        421, 421, 421, 422, 421, 421, 422, 421,
-        421, 422, 421, 421, 422, 421, 421, 421,
-        422, 422, 422, 421, 421, 421, 422, 422,
-        422, 422, 421, 659, 472, 660, 472, 661,
-        662, 663, 664, 427, 421, 422, 422, 422,
-        422, 422, 421, 421, 421, 422, 421, 421,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 421, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 421, 422,
-        422, 422, 422, 422, 421, 665, 472, 427,
-        421, 422, 666, 472, 457, 427, 421, 422,
-        667, 421, 427, 421, 422, 472, 668, 427,
-        421, 421, 422, 669, 421, 472, 670, 427,
-        421, 421, 422, 672, 671, 422, 422, 422,
-        422, 672, 671, 422, 672, 671, 672, 672,
-        422, 672, 671, 422, 672, 422, 672, 671,
-        422, 672, 422, 672, 422, 671, 672, 672,
-        672, 672, 672, 672, 672, 672, 671, 422,
-        422, 672, 672, 422, 672, 422, 672, 671,
-        672, 672, 672, 672, 672, 422, 672, 422,
-        672, 422, 672, 671, 672, 672, 422, 672,
-        422, 672, 671, 672, 672, 672, 672, 672,
-        422, 672, 422, 672, 671, 422, 422, 672,
-        422, 672, 671, 672, 672, 672, 422, 672,
-        422, 672, 422, 672, 422, 672, 671, 672,
-        422, 672, 422, 672, 671, 422, 672, 672,
-        672, 672, 422, 672, 422, 672, 422, 672,
-        422, 672, 422, 672, 422, 672, 671, 422,
-        672, 671, 672, 672, 672, 422, 672, 422,
-        672, 671, 672, 422, 672, 422, 672, 671,
-        422, 672, 672, 672, 672, 422, 672, 422,
-        672, 671, 422, 672, 422, 672, 422, 672,
-        671, 672, 672, 422, 672, 422, 672, 671,
-        422, 672, 422, 672, 422, 672, 422, 671,
-        672, 672, 672, 422, 672, 422, 672, 671,
-        422, 672, 671, 672, 672, 422, 672, 671,
-        672, 672, 672, 422, 672, 672, 672, 672,
-        672, 672, 422, 422, 672, 422, 672, 422,
-        672, 422, 672, 671, 672, 422, 672, 422,
-        672, 671, 422, 672, 671, 672, 422, 672,
-        671, 672, 422, 672, 671, 422, 422, 672,
-        671, 422, 672, 422, 672, 422, 672, 422,
-        672, 422, 672, 422, 671, 672, 672, 422,
-        672, 672, 672, 672, 422, 422, 672, 672,
-        672, 672, 672, 422, 672, 672, 672, 672,
-        672, 671, 422, 672, 672, 422, 672, 422,
-        671, 672, 672, 422, 672, 671, 422, 422,
-        672, 422, 671, 672, 672, 671, 422, 672,
-        422, 671, 672, 671, 422, 672, 422, 672,
-        422, 671, 672, 672, 671, 422, 672, 422,
-        672, 422, 672, 671, 672, 422, 672, 422,
-        672, 671, 422, 672, 671, 422, 422, 672,
-        671, 672, 422, 671, 672, 671, 422, 672,
-        422, 672, 422, 671, 672, 671, 422, 422,
-        672, 671, 672, 422, 672, 422, 672, 671,
-        422, 672, 422, 671, 672, 671, 422, 422,
-        672, 422, 671, 672, 671, 422, 422, 672,
-        671, 672, 422, 672, 671, 672, 422, 672,
-        671, 672, 422, 672, 422, 672, 422, 671,
-        672, 671, 422, 422, 672, 671, 672, 422,
-        672, 422, 672, 671, 422, 672, 671, 672,
-        672, 422, 672, 422, 672, 671, 671, 422,
-        671, 422, 672, 672, 422, 672, 672, 672,
-        672, 672, 672, 672, 671, 422, 672, 672,
-        672, 422, 671, 672, 672, 672, 422, 672,
-        422, 672, 422, 672, 422, 672, 422, 672,
-        671, 422, 422, 672, 671, 672, 422, 672,
-        671, 422, 422, 672, 422, 422, 422, 672,
-        422, 672, 422, 672, 422, 672, 422, 671,
-        422, 672, 422, 672, 422, 671, 672, 671,
-        422, 672, 422, 671, 672, 422, 672, 672,
-        672, 671, 422, 672, 422, 422, 672, 422,
-        671, 672, 672, 671, 422, 672, 672, 672,
-        672, 422, 672, 422, 671, 672, 672, 672,
-        422, 672, 671, 672, 422, 672, 422, 672,
-        422, 672, 422, 672, 671, 672, 672, 422,
-        672, 671, 422, 672, 422, 672, 422, 671,
-        672, 672, 671, 422, 672, 422, 671, 672,
-        671, 422, 672, 671, 422, 672, 422, 672,
-        671, 672, 672, 672, 671, 422, 422, 422,
-        672, 671, 422, 672, 422, 671, 672, 671,
-        422, 672, 422, 672, 422, 671, 672, 672,
-        672, 671, 422, 672, 422, 671, 672, 672,
-        672, 672, 671, 422, 672, 422, 672, 671,
-        422, 422, 672, 422, 672, 671, 672, 422,
-        672, 422, 671, 672, 672, 671, 422, 672,
-        422, 672, 671, 422, 672, 672, 672, 422,
-        672, 422, 671, 422, 672, 671, 672, 422,
-        422, 672, 422, 672, 422, 671, 672, 672,
-        672, 672, 671, 422, 672, 422, 672, 422,
-        672, 422, 672, 422, 672, 671, 672, 672,
-        672, 422, 672, 422, 672, 422, 672, 422,
-        671, 672, 672, 422, 422, 672, 671, 672,
-        422, 672, 672, 671, 422, 672, 422, 672,
-        671, 422, 422, 672, 672, 672, 672, 422,
-        672, 422, 672, 422, 671, 672, 672, 422,
-        671, 672, 671, 422, 672, 422, 671, 672,
-        671, 422, 672, 422, 671, 672, 422, 672,
-        672, 671, 422, 672, 672, 422, 671, 672,
-        671, 422, 672, 422, 672, 671, 672, 422,
-        672, 422, 671, 672, 671, 422, 672, 422,
-        672, 422, 672, 422, 672, 422, 672, 671,
-        673, 671, 674, 675, 676, 677, 678, 679,
-        680, 681, 682, 683, 684, 676, 685, 686,
-        687, 688, 689, 676, 690, 691, 692, 693,
+        425, 418, 419, 419, 419, 418, 418, 418,
+        418, 419, 419, 418, 418, 419, 418, 418,
+        418, 418, 418, 418, 418, 419, 418, 419,
+        418, 418, 418, 418, 418, 418, 419, 419,
+        419, 419, 419, 418, 418, 419, 418, 418,
+        418, 419, 418, 418, 419, 418, 418, 419,
+        418, 418, 419, 418, 418, 418, 419, 419,
+        419, 418, 418, 418, 419, 419, 419, 419,
+        418, 657, 470, 658, 470, 659, 660, 661,
+        662, 425, 418, 419, 419, 419, 419, 419,
+        418, 418, 418, 419, 418, 418, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        418, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 418, 419, 419, 419,
+        419, 419, 418, 663, 470, 425, 418, 419,
+        664, 470, 455, 425, 418, 419, 665, 418,
+        425, 418, 419, 470, 666, 425, 418, 418,
+        419, 667, 418, 470, 668, 425, 418, 418,
+        419, 670, 669, 419, 419, 419, 419, 670,
+        669, 419, 670, 669, 670, 670, 419, 670,
+        669, 419, 670, 419, 670, 669, 419, 670,
+        419, 670, 419, 669, 670, 670, 670, 670,
+        670, 670, 670, 670, 669, 419, 419, 670,
+        670, 419, 670, 419, 670, 669, 670, 670,
+        670, 670, 670, 419, 670, 419, 670, 419,
+        670, 669, 670, 670, 419, 670, 419, 670,
+        669, 670, 670, 670, 670, 670, 419, 670,
+        419, 670, 669, 419, 419, 670, 419, 670,
+        669, 670, 670, 670, 419, 670, 419, 670,
+        419, 670, 419, 670, 669, 670, 419, 670,
+        419, 670, 669, 419, 670, 670, 670, 670,
+        419, 670, 419, 670, 419, 670, 419, 670,
+        419, 670, 419, 670, 669, 419, 670, 669,
+        670, 670, 670, 419, 670, 419, 670, 669,
+        670, 419, 670, 419, 670, 669, 419, 670,
+        670, 670, 670, 419, 670, 419, 670, 669,
+        419, 670, 419, 670, 419, 670, 669, 670,
+        670, 419, 670, 419, 670, 669, 419, 670,
+        419, 670, 419, 670, 419, 669, 670, 670,
+        670, 419, 670, 419, 670, 669, 419, 670,
+        669, 670, 670, 419, 670, 669, 670, 670,
+        670, 419, 670, 670, 670, 670, 670, 670,
+        419, 419, 670, 419, 670, 419, 670, 419,
+        670, 669, 670, 419, 670, 419, 670, 669,
+        419, 670, 669, 670, 419, 670, 669, 670,
+        419, 670, 669, 419, 419, 670, 669, 419,
+        670, 419, 670, 419, 670, 419, 670, 419,
+        670, 419, 669, 670, 670, 419, 670, 670,
+        670, 670, 419, 419, 670, 670, 670, 670,
+        670, 419, 670, 670, 670, 670, 670, 669,
+        419, 670, 670, 419, 670, 419, 669, 670,
+        670, 419, 670, 669, 419, 419, 670, 419,
+        669, 670, 670, 669, 419, 670, 419, 669,
+        670, 669, 419, 670, 419, 670, 419, 669,
+        670, 670, 669, 419, 670, 419, 670, 419,
+        670, 669, 670, 419, 670, 419, 670, 669,
+        419, 670, 669, 419, 419, 670, 669, 670,
+        419, 669, 670, 669, 419, 670, 419, 670,
+        419, 669, 670, 669, 419, 419, 670, 669,
+        670, 419, 670, 419, 670, 669, 419, 670,
+        419, 669, 670, 669, 419, 419, 670, 419,
+        669, 670, 669, 419, 419, 670, 669, 670,
+        419, 670, 669, 670, 419, 670, 669, 670,
+        419, 670, 419, 670, 419, 669, 670, 669,
+        419, 419, 670, 669, 670, 419, 670, 419,
+        670, 669, 419, 670, 669, 670, 670, 419,
+        670, 419, 670, 669, 669, 419, 669, 419,
+        670, 670, 419, 670, 670, 670, 670, 670,
+        670, 670, 669, 419, 670, 670, 670, 419,
+        669, 670, 670, 670, 419, 670, 419, 670,
+        419, 670, 419, 670, 419, 670, 669, 419,
+        419, 670, 669, 670, 419, 670, 669, 419,
+        419, 670, 419, 419, 419, 670, 419, 670,
+        419, 670, 419, 670, 419, 669, 419, 670,
+        419, 670, 419, 669, 670, 669, 419, 670,
+        419, 669, 670, 419, 670, 670, 670, 669,
+        419, 670, 419, 419, 670, 419, 669, 670,
+        670, 669, 419, 670, 670, 670, 670, 419,
+        670, 419, 669, 670, 670, 670, 419, 670,
+        669, 670, 419, 670, 419, 670, 419, 670,
+        419, 670, 669, 670, 670, 419, 670, 669,
+        419, 670, 419, 670, 419, 669, 670, 670,
+        669, 419, 670, 419, 669, 670, 669, 419,
+        670, 669, 419, 670, 419, 670, 669, 670,
+        670, 670, 669, 419, 419, 419, 670, 669,
+        419, 670, 419, 669, 670, 669, 419, 670,
+        419, 670, 419, 669, 670, 670, 670, 669,
+        419, 670, 419, 669, 670, 670, 670, 670,
+        669, 419, 670, 419, 670, 669, 419, 419,
+        670, 419, 670, 669, 670, 419, 670, 419,
+        669, 670, 670, 669, 419, 670, 419, 670,
+        669, 419, 670, 670, 670, 419, 670, 419,
+        669, 419, 670, 669, 670, 419, 419, 670,
+        419, 670, 419, 669, 670, 670, 670, 670,
+        669, 419, 670, 419, 670, 419, 670, 419,
+        670, 419, 670, 669, 670, 670, 670, 419,
+        670, 419, 670, 419, 670, 419, 669, 670,
+        670, 419, 419, 670, 669, 670, 419, 670,
+        670, 669, 419, 670, 419, 670, 669, 419,
+        419, 670, 670, 670, 670, 419, 670, 419,
+        670, 419, 669, 670, 670, 419, 669, 670,
+        669, 419, 670, 419, 669, 670, 669, 419,
+        670, 419, 669, 670, 419, 670, 670, 669,
+        419, 670, 670, 419, 669, 670, 669, 419,
+        670, 419, 670, 669, 670, 419, 670, 419,
+        669, 670, 669, 419, 670, 419, 670, 419,
+        670, 419, 670, 419, 670, 669, 671, 669,
+        672, 673, 674, 675, 676, 677, 678, 679,
+        680, 681, 682, 674, 683, 684, 685, 686,
+        687, 674, 688, 689, 690, 691, 692, 693,
         694, 695, 696, 697, 698, 699, 700, 701,
-        702, 703, 704, 676, 705, 673, 685, 673,
-        706, 673, 671, 672, 672, 672, 672, 422,
-        671, 672, 672, 671, 422, 672, 671, 422,
-        422, 672, 671, 422, 672, 422, 671, 672,
-        671, 422, 422, 672, 422, 671, 672, 672,
-        671, 422, 672, 672, 672, 671, 422, 672,
-        422, 672, 672, 671, 422, 422, 672, 422,
-        671, 672, 671, 422, 672, 671, 422, 422,
-        672, 422, 672, 671, 422, 672, 422, 422,
-        672, 422, 672, 422, 671, 672, 672, 671,
-        422, 672, 672, 422, 672, 671, 422, 672,
-        422, 672, 671, 422, 672, 422, 671, 422,
-        672, 672, 672, 422, 672, 671, 672, 422,
-        672, 671, 422, 672, 671, 672, 422, 672,
-        671, 422, 672, 671, 422, 672, 422, 672,
-        671, 422, 672, 671, 422, 672, 671, 707,
+        702, 674, 703, 671, 683, 671, 704, 671,
+        669, 670, 670, 670, 670, 419, 669, 670,
+        670, 669, 419, 670, 669, 419, 419, 670,
+        669, 419, 670, 419, 669, 670, 669, 419,
+        419, 670, 419, 669, 670, 670, 669, 419,
+        670, 670, 670, 669, 419, 670, 419, 670,
+        670, 669, 419, 419, 670, 419, 669, 670,
+        669, 419, 670, 669, 419, 419, 670, 419,
+        670, 669, 419, 670, 419, 419, 670, 419,
+        670, 419, 669, 670, 670, 669, 419, 670,
+        670, 419, 670, 669, 419, 670, 419, 670,
+        669, 419, 670, 419, 669, 419, 670, 670,
+        670, 419, 670, 669, 670, 419, 670, 669,
+        419, 670, 669, 670, 419, 670, 669, 419,
+        670, 669, 419, 670, 419, 670, 669, 419,
+        670, 669, 419, 670, 669, 705, 706, 707,
         708, 709, 710, 711, 712, 713, 714, 715,
-        716, 717, 718, 678, 719, 720, 721, 722,
-        723, 720, 724, 725, 726, 727, 728, 729,
-        730, 731, 732, 673, 671, 672, 422, 672,
-        671, 672, 422, 672, 671, 672, 422, 672,
-        671, 672, 422, 672, 671, 422, 672, 422,
-        672, 671, 672, 422, 672, 671, 672, 422,
-        422, 422, 672, 671, 672, 422, 672, 671,
-        672, 672, 672, 672, 422, 672, 422, 671,
-        672, 671, 422, 422, 672, 422, 672, 671,
-        672, 422, 672, 671, 422, 672, 671, 672,
-        672, 422, 672, 671, 422, 672, 671, 672,
-        422, 672, 671, 422, 672, 671, 422, 672,
-        671, 422, 672, 671, 672, 671, 422, 422,
-        672, 671, 672, 422, 672, 671, 422, 672,
-        422, 671, 672, 671, 422, 676, 733, 673,
-        676, 734, 676, 735, 685, 673, 671, 672,
-        671, 422, 672, 671, 422, 676, 734, 685,
-        673, 671, 676, 736, 673, 685, 673, 671,
-        672, 671, 422, 676, 737, 694, 738, 720,
-        739, 732, 676, 740, 741, 742, 673, 685,
-        673, 671, 672, 671, 422, 672, 422, 672,
-        671, 422, 672, 422, 672, 422, 671, 672,
-        672, 671, 422, 672, 422, 672, 671, 422,
-        672, 671, 676, 685, 427, 671, 743, 676,
-        744, 685, 673, 671, 427, 672, 671, 422,
-        672, 671, 422, 745, 676, 746, 747, 673,
-        671, 422, 672, 671, 672, 672, 671, 422,
-        422, 672, 422, 672, 671, 676, 748, 749,
-        750, 751, 752, 753, 754, 755, 756, 757,
-        758, 673, 685, 673, 671, 672, 422, 672,
-        672, 672, 672, 672, 672, 672, 422, 672,
-        422, 672, 672, 672, 672, 672, 672, 671,
-        422, 672, 672, 422, 672, 422, 671, 672,
-        422, 672, 672, 672, 422, 672, 672, 422,
-        672, 672, 422, 672, 672, 422, 672, 672,
-        671, 422, 676, 759, 676, 735, 760, 761,
-        762, 673, 685, 673, 671, 672, 671, 422,
-        672, 672, 672, 422, 672, 672, 672, 422,
-        672, 422, 672, 671, 422, 422, 422, 422,
-        672, 672, 422, 422, 422, 422, 422, 672,
-        672, 672, 672, 672, 672, 672, 422, 672,
-        422, 672, 422, 671, 672, 672, 672, 422,
-        672, 422, 672, 671, 685, 427, 763, 676,
-        685, 427, 672, 671, 422, 764, 676, 765,
-        685, 427, 672, 671, 422, 672, 422, 766,
-        685, 673, 671, 427, 672, 671, 422, 676,
-        767, 673, 685, 673, 671, 672, 671, 422,
-        768, 769, 768, 770, 771, 768, 772, 768,
-        773, 768, 771, 774, 775, 774, 777, 776,
-        778, 779, 778, 780, 781, 776, 782, 776,
-        783, 778, 784, 779, 785, 780, 787, 786,
-        788, 789, 789, 786, 790, 786, 791, 788,
-        792, 789, 793, 789, 795, 795, 795, 795,
+        716, 676, 717, 718, 719, 720, 721, 718,
+        722, 723, 724, 725, 726, 727, 728, 729,
+        730, 671, 669, 670, 419, 670, 669, 670,
+        419, 670, 669, 670, 419, 670, 669, 670,
+        419, 670, 669, 419, 670, 419, 670, 669,
+        670, 419, 670, 669, 670, 419, 419, 419,
+        670, 669, 670, 419, 670, 669, 670, 670,
+        670, 670, 419, 670, 419, 669, 670, 669,
+        419, 419, 670, 419, 670, 669, 670, 419,
+        670, 669, 419, 670, 669, 670, 670, 419,
+        670, 669, 419, 670, 669, 670, 419, 670,
+        669, 419, 670, 669, 419, 670, 669, 419,
+        670, 669, 670, 669, 419, 419, 670, 669,
+        670, 419, 670, 669, 419, 670, 419, 669,
+        670, 669, 419, 674, 731, 671, 674, 732,
+        674, 733, 683, 671, 669, 670, 669, 419,
+        670, 669, 419, 674, 732, 683, 671, 669,
+        674, 734, 671, 683, 671, 669, 670, 669,
+        419, 674, 735, 692, 736, 718, 737, 730,
+        674, 738, 739, 740, 671, 683, 671, 669,
+        670, 669, 419, 670, 419, 670, 669, 419,
+        670, 419, 670, 419, 669, 670, 670, 669,
+        419, 670, 419, 670, 669, 419, 670, 669,
+        674, 683, 425, 669, 741, 674, 742, 683,
+        671, 669, 425, 670, 669, 419, 670, 669,
+        419, 743, 674, 744, 745, 671, 669, 419,
+        670, 669, 670, 670, 669, 419, 419, 670,
+        419, 670, 669, 674, 746, 747, 748, 749,
+        750, 751, 752, 753, 754, 755, 756, 671,
+        683, 671, 669, 670, 419, 670, 670, 670,
+        670, 670, 670, 670, 419, 670, 419, 670,
+        670, 670, 670, 670, 670, 669, 419, 670,
+        670, 419, 670, 419, 669, 670, 419, 670,
+        670, 670, 419, 670, 670, 419, 670, 670,
+        419, 670, 670, 419, 670, 670, 669, 419,
+        674, 757, 674, 733, 758, 759, 760, 671,
+        683, 671, 669, 670, 669, 419, 670, 670,
+        670, 419, 670, 670, 670, 419, 670, 419,
+        670, 669, 419, 419, 419, 419, 670, 670,
+        419, 419, 419, 419, 419, 670, 670, 670,
+        670, 670, 670, 670, 419, 670, 419, 670,
+        419, 669, 670, 670, 670, 419, 670, 419,
+        670, 669, 683, 425, 761, 674, 683, 425,
+        670, 669, 419, 762, 674, 763, 683, 425,
+        670, 669, 419, 670, 419, 764, 683, 671,
+        669, 425, 670, 669, 419, 674, 765, 671,
+        683, 671, 669, 670, 669, 419, 766, 766,
+        766, 768, 769, 770, 766, 767, 767, 771,
+        768, 771, 769, 771, 767, 772, 773, 772,
+        775, 774, 776, 774, 777, 774, 779, 778,
+        781, 782, 780, 781, 783, 780, 785, 784,
+        786, 784, 787, 784, 789, 788, 791, 792,
+        790, 791, 793, 790, 795, 795, 795, 795,
         794, 795, 795, 795, 794, 795, 794, 795,
         795, 794, 794, 794, 794, 794, 794, 795,
         794, 794, 794, 794, 795, 795, 795, 795,
@@ -3103,375 +3062,343 @@ var _hcltok_indicies []int16 = []int16{
         1046, 1045, 795, 1046, 795, 1140, 1059, 1047,
         1045, 801, 1046, 1045, 795, 1050, 1141, 1047,
         1059, 1047, 1045, 1046, 1045, 795, 1142, 1143,
-        1144, 1142, 1145, 1146, 1147, 1148, 1149, 1150,
-        1151, 1152, 1153, 1154, 672, 672, 422, 1155,
-        1156, 1157, 1158, 672, 1161, 1162, 1164, 1165,
-        1166, 1160, 1167, 1168, 1169, 1170, 1171, 1172,
-        1173, 1174, 1175, 1176, 1177, 1178, 1179, 1180,
-        1181, 1182, 1183, 1184, 1185, 1186, 1188, 1189,
-        1190, 1191, 1192, 1193, 672, 1148, 10, 1148,
-        422, 1148, 422, 1160, 1163, 1187, 1194, 1159,
-        1142, 1142, 1195, 1143, 1196, 1198, 1197, 2,
-        1, 1199, 1197, 1200, 1197, 5, 1, 1197,
-        6, 5, 9, 11, 11, 10, 1202, 1203,
-        1204, 1197, 1205, 1206, 1197, 1207, 1197, 422,
-        422, 1209, 1210, 491, 472, 1211, 472, 1212,
-        1213, 1214, 1215, 1216, 1217, 1218, 1219, 1220,
-        1221, 1222, 546, 1223, 522, 1224, 1225, 1226,
-        1227, 1228, 1229, 1230, 1231, 1232, 1233, 1234,
-        1235, 422, 422, 422, 427, 567, 1208, 1236,
-        1197, 1237, 1197, 672, 1238, 422, 422, 422,
-        672, 1238, 672, 672, 422, 1238, 422, 1238,
-        422, 1238, 422, 672, 672, 672, 672, 672,
-        1238, 422, 672, 672, 672, 422, 672, 422,
-        1238, 422, 672, 672, 672, 672, 422, 1238,
-        672, 422, 672, 422, 672, 422, 672, 672,
-        422, 672, 1238, 422, 672, 422, 672, 422,
-        672, 1238, 672, 422, 1238, 672, 422, 672,
-        422, 1238, 672, 672, 672, 672, 672, 1238,
-        422, 422, 672, 422, 672, 1238, 672, 422,
-        1238, 672, 672, 1238, 422, 422, 672, 422,
-        672, 422, 672, 1238, 1239, 1240, 1241, 1242,
-        1243, 1244, 1245, 1246, 1247, 1248, 1249, 717,
-        1250, 1251, 1252, 1253, 1254, 1255, 1256, 1257,
-        1258, 1259, 1260, 1261, 1260, 1262, 1263, 1264,
-        1265, 1266, 673, 1238, 1267, 1268, 1269, 1270,
-        1271, 1272, 1273, 1274, 1275, 1276, 1277, 1278,
-        1279, 1280, 1281, 1282, 1283, 1284, 1285, 727,
-        1286, 1287, 1288, 694, 1289, 1290, 1291, 1292,
-        1293, 1294, 673, 1295, 1296, 1297, 1298, 1299,
-        1300, 1301, 1302, 676, 1303, 673, 676, 1304,
-        1305, 1306, 1307, 685, 1238, 1308, 1309, 1310,
-        1311, 705, 1312, 1313, 685, 1314, 1315, 1316,
-        1317, 1318, 673, 1238, 1319, 1278, 1320, 1321,
-        1322, 685, 1323, 1324, 676, 673, 685, 427,
-        1238, 1288, 673, 676, 685, 427, 685, 427,
-        1325, 685, 1238, 427, 676, 1326, 1327, 676,
-        1328, 1329, 683, 1330, 1331, 1332, 1333, 1334,
-        1284, 1335, 1336, 1337, 1338, 1339, 1340, 1341,
-        1342, 1343, 1344, 1345, 1346, 1303, 1347, 676,
-        685, 427, 1238, 1348, 1349, 685, 673, 1238,
-        427, 673, 1238, 676, 1350, 733, 1351, 1352,
-        1353, 1354, 1355, 1356, 1357, 1358, 673, 1359,
-        1360, 1361, 1362, 1363, 1364, 673, 685, 1238,
-        1366, 1367, 1368, 1369, 1370, 1371, 1372, 1373,
-        1374, 1375, 1376, 1372, 1378, 1379, 1380, 1381,
-        1365, 1377, 1365, 1238, 1365, 1238, 1382, 1382,
-        1383, 1384, 1385, 1386, 1387, 1388, 1389, 1390,
-        1387, 771, 1391, 1391, 1391, 1392, 1393, 1386,
-        1391, 772, 773, 1394, 1391, 771, 1395, 1395,
-        1395, 1397, 1398, 1399, 1395, 1400, 1401, 1402,
-        1395, 1396, 1403, 1403, 1403, 1405, 1406, 1407,
-        1403, 1408, 1409, 1410, 1403, 1404, 1391, 1391,
-        1411, 1412, 1386, 1391, 772, 773, 1394, 1391,
-        771, 1413, 1414, 1415, 771, 1416, 1417, 1418,
-        769, 769, 769, 769, 1420, 1421, 1422, 1396,
-        769, 1423, 1424, 1425, 769, 1419, 770, 770,
-        770, 1427, 1428, 1429, 1396, 770, 1430, 1431,
-        1432, 770, 1426, 769, 769, 769, 1434, 1435,
-        1436, 1404, 769, 1437, 1438, 1439, 769, 1433,
-        1395, 1395, 771, 1440, 1441, 1399, 1395, 1400,
-        1401, 1402, 1395, 1396, 1442, 1443, 1444, 771,
-        1445, 1446, 1447, 770, 770, 770, 770, 1449,
-        1450, 1451, 1404, 770, 1452, 1453, 1454, 770,
-        1448, 1403, 1403, 771, 1455, 1456, 1407, 1403,
-        1408, 1409, 1410, 1403, 1404, 1403, 1403, 1403,
-        1405, 1406, 1407, 771, 1408, 1409, 1410, 1403,
-        1404, 1403, 1403, 1403, 1405, 1406, 1407, 772,
-        1408, 1409, 1410, 1403, 1404, 1403, 1403, 1403,
-        1405, 1406, 1407, 773, 1408, 1409, 1410, 1403,
-        1404, 1395, 1395, 1395, 1397, 1398, 1399, 771,
-        1400, 1401, 1402, 1395, 1396, 1395, 1395, 1395,
-        1397, 1398, 1399, 772, 1400, 1401, 1402, 1395,
-        1396, 1395, 1395, 1395, 1397, 1398, 1399, 773,
-        1400, 1401, 1402, 1395, 1396, 1458, 769, 1460,
-        1459, 1461, 770, 1463, 1462, 771, 1464, 775,
-        1464, 1465, 1464, 777, 1466, 1467, 1468, 1469,
-        1470, 1471, 1472, 1469, 781, 777, 1466, 1474,
-        1475, 1473, 782, 783, 1476, 1473, 781, 1479,
-        1480, 1481, 1482, 1477, 1483, 1484, 1485, 1477,
-        1478, 1488, 1489, 1490, 1491, 1486, 1492, 1493,
-        1494, 1486, 1487, 1496, 1495, 1498, 1497, 781,
-        1499, 782, 1499, 783, 1499, 787, 1500, 1501,
-        1502, 1503, 1504, 1505, 1506, 1503, 789, 787,
-        1500, 1508, 1507, 790, 791, 1509, 1507, 789,
-        1511, 1510, 1513, 1512, 789, 1514, 790, 1514,
-        791, 1514, 795, 1517, 1518, 1520, 1521, 1522,
-        1516, 1523, 1524, 1525, 1526, 1527, 1528, 1529,
-        1530, 1531, 1532, 1533, 1534, 1535, 1536, 1537,
-        1538, 1539, 1540, 1541, 1542, 1544, 1545, 1546,
-        1547, 1548, 1549, 795, 795, 1515, 1516, 1519,
-        1543, 1550, 1515, 1046, 795, 795, 1552, 1553,
-        865, 846, 1554, 846, 1555, 1556, 1557, 1558,
-        1559, 1560, 1561, 1562, 1563, 1564, 1565, 920,
-        1566, 896, 1567, 1568, 1569, 1570, 1571, 1572,
-        1573, 1574, 1575, 1576, 1577, 1578, 795, 795,
-        795, 801, 941, 1551, 1046, 1579, 795, 795,
-        795, 1046, 1579, 1046, 1046, 795, 1579, 795,
-        1579, 795, 1579, 795, 1046, 1046, 1046, 1046,
-        1046, 1579, 795, 1046, 1046, 1046, 795, 1046,
-        795, 1579, 795, 1046, 1046, 1046, 1046, 795,
-        1579, 1046, 795, 1046, 795, 1046, 795, 1046,
-        1046, 795, 1046, 1579, 795, 1046, 795, 1046,
-        795, 1046, 1579, 1046, 795, 1579, 1046, 795,
-        1046, 795, 1579, 1046, 1046, 1046, 1046, 1046,
-        1579, 795, 795, 1046, 795, 1046, 1579, 1046,
-        795, 1579, 1046, 1046, 1579, 795, 795, 1046,
-        795, 1046, 795, 1046, 1579, 1580, 1581, 1582,
-        1583, 1584, 1585, 1586, 1587, 1588, 1589, 1590,
-        1091, 1591, 1592, 1593, 1594, 1595, 1596, 1597,
-        1598, 1599, 1600, 1601, 1602, 1601, 1603, 1604,
-        1605, 1606, 1607, 1047, 1579, 1608, 1609, 1610,
-        1611, 1612, 1613, 1614, 1615, 1616, 1617, 1618,
-        1619, 1620, 1621, 1622, 1623, 1624, 1625, 1626,
-        1101, 1627, 1628, 1629, 1068, 1630, 1631, 1632,
-        1633, 1634, 1635, 1047, 1636, 1637, 1638, 1639,
-        1640, 1641, 1642, 1643, 1050, 1644, 1047, 1050,
-        1645, 1646, 1647, 1648, 1059, 1579, 1649, 1650,
-        1651, 1652, 1079, 1653, 1654, 1059, 1655, 1656,
-        1657, 1658, 1659, 1047, 1579, 1660, 1619, 1661,
-        1662, 1663, 1059, 1664, 1665, 1050, 1047, 1059,
-        801, 1579, 1629, 1047, 1050, 1059, 801, 1059,
-        801, 1666, 1059, 1579, 801, 1050, 1667, 1668,
-        1050, 1669, 1670, 1057, 1671, 1672, 1673, 1674,
-        1675, 1625, 1676, 1677, 1678, 1679, 1680, 1681,
-        1682, 1683, 1684, 1685, 1686, 1687, 1644, 1688,
-        1050, 1059, 801, 1579, 1689, 1690, 1059, 1047,
-        1579, 801, 1047, 1579, 1050, 1691, 1107, 1692,
-        1693, 1694, 1695, 1696, 1697, 1698, 1699, 1047,
-        1700, 1701, 1702, 1703, 1704, 1705, 1047, 1059,
-        1579, 1707, 1708, 1709, 1710, 1711, 1712, 1713,
-        1714, 1715, 1716, 1717, 1713, 1719, 1720, 1721,
-        1722, 1706, 1718, 1706, 1579, 1706, 1579,
+        1144, 1142, 1145, 1146, 1147, 1149, 1150, 1151,
+        1152, 1153, 1154, 670, 670, 419, 1155, 1156,
+        1157, 1158, 670, 1161, 1162, 1164, 1165, 1166,
+        1160, 1167, 1168, 1169, 1170, 1171, 1172, 1173,
+        1174, 1175, 1176, 1177, 1178, 1179, 1180, 1181,
+        1182, 1183, 1184, 1185, 1186, 1188, 1189, 1190,
+        1191, 1192, 1193, 670, 1148, 7, 1148, 419,
+        1148, 419, 1160, 1163, 1187, 1194, 1159, 1142,
+        1142, 1195, 1143, 1196, 1198, 1197, 4, 1147,
+        1200, 1197, 1201, 1197, 2, 1147, 1197, 6,
+        8, 8, 7, 1202, 1203, 1204, 1197, 1205,
+        1206, 1197, 1207, 1197, 419, 419, 1209, 1210,
+        489, 470, 1211, 470, 1212, 1213, 1214, 1215,
+        1216, 1217, 1218, 1219, 1220, 1221, 1222, 544,
+        1223, 520, 1224, 1225, 1226, 1227, 1228, 1229,
+        1230, 1231, 1232, 1233, 1234, 1235, 419, 419,
+        419, 425, 565, 1208, 1236, 1197, 1237, 1197,
+        670, 1238, 419, 419, 419, 670, 1238, 670,
+        670, 419, 1238, 419, 1238, 419, 1238, 419,
+        670, 670, 670, 670, 670, 1238, 419, 670,
+        670, 670, 419, 670, 419, 1238, 419, 670,
+        670, 670, 670, 419, 1238, 670, 419, 670,
+        419, 670, 419, 670, 670, 419, 670, 1238,
+        419, 670, 419, 670, 419, 670, 1238, 670,
+        419, 1238, 670, 419, 670, 419, 1238, 670,
+        670, 670, 670, 670, 1238, 419, 419, 670,
+        419, 670, 1238, 670, 419, 1238, 670, 670,
+        1238, 419, 419, 670, 419, 670, 419, 670,
+        1238, 1239, 1240, 1241, 1242, 1243, 1244, 1245,
+        1246, 1247, 1248, 1249, 715, 1250, 1251, 1252,
+        1253, 1254, 1255, 1256, 1257, 1258, 1259, 1260,
+        1261, 1260, 1262, 1263, 1264, 1265, 1266, 671,
+        1238, 1267, 1268, 1269, 1270, 1271, 1272, 1273,
+        1274, 1275, 1276, 1277, 1278, 1279, 1280, 1281,
+        1282, 1283, 1284, 1285, 725, 1286, 1287, 1288,
+        692, 1289, 1290, 1291, 1292, 1293, 1294, 671,
+        1295, 1296, 1297, 1298, 1299, 1300, 1301, 1302,
+        674, 1303, 671, 674, 1304, 1305, 1306, 1307,
+        683, 1238, 1308, 1309, 1310, 1311, 703, 1312,
+        1313, 683, 1314, 1315, 1316, 1317, 1318, 671,
+        1238, 1319, 1278, 1320, 1321, 1322, 683, 1323,
+        1324, 674, 671, 683, 425, 1238, 1288, 671,
+        674, 683, 425, 683, 425, 1325, 683, 1238,
+        425, 674, 1326, 1327, 674, 1328, 1329, 681,
+        1330, 1331, 1332, 1333, 1334, 1284, 1335, 1336,
+        1337, 1338, 1339, 1340, 1341, 1342, 1343, 1344,
+        1345, 1346, 1303, 1347, 674, 683, 425, 1238,
+        1348, 1349, 683, 671, 1238, 425, 671, 1238,
+        674, 1350, 731, 1351, 1352, 1353, 1354, 1355,
+        1356, 1357, 1358, 671, 1359, 1360, 1361, 1362,
+        1363, 1364, 671, 683, 1238, 1366, 1367, 1368,
+        1369, 1370, 1371, 1372, 1373, 1374, 1375, 1376,
+        1372, 1378, 1379, 1380, 1381, 1365, 1377, 1365,
+        1238, 1365, 1238, 1382, 1382, 1383, 1384, 1385,
+        1386, 1387, 1388, 1389, 1390, 1387, 767, 1391,
+        1391, 1391, 1392, 1391, 1391, 768, 769, 770,
+        1391, 767, 1382, 1382, 1393, 1396, 1397, 1395,
+        1398, 1399, 1398, 1400, 1391, 1402, 1401, 1396,
+        1403, 1395, 1405, 1404, 1394, 1394, 1394, 768,
+        769, 770, 1394, 767, 767, 1406, 773, 1406,
+        1407, 1406, 775, 1408, 1409, 1410, 1411, 1412,
+        1413, 1414, 1411, 776, 775, 1408, 1415, 1415,
+        777, 779, 1416, 1415, 776, 1418, 1419, 1417,
+        1418, 1419, 1420, 1417, 775, 1408, 1421, 1415,
+        775, 1408, 1415, 1423, 1422, 1425, 1424, 776,
+        1426, 777, 1426, 779, 1426, 785, 1427, 1428,
+        1429, 1430, 1431, 1432, 1433, 1430, 786, 785,
+        1427, 1434, 1434, 787, 789, 1435, 1434, 786,
+        1437, 1438, 1436, 1437, 1438, 1439, 1436, 785,
+        1427, 1440, 1434, 785, 1427, 1434, 1442, 1441,
+        1444, 1443, 786, 1445, 787, 1445, 789, 1445,
+        795, 1448, 1449, 1451, 1452, 1453, 1447, 1454,
+        1455, 1456, 1457, 1458, 1459, 1460, 1461, 1462,
+        1463, 1464, 1465, 1466, 1467, 1468, 1469, 1470,
+        1471, 1472, 1473, 1475, 1476, 1477, 1478, 1479,
+        1480, 795, 795, 1446, 1447, 1450, 1474, 1481,
+        1446, 1046, 795, 795, 1483, 1484, 865, 846,
+        1485, 846, 1486, 1487, 1488, 1489, 1490, 1491,
+        1492, 1493, 1494, 1495, 1496, 920, 1497, 896,
+        1498, 1499, 1500, 1501, 1502, 1503, 1504, 1505,
+        1506, 1507, 1508, 1509, 795, 795, 795, 801,
+        941, 1482, 1046, 1510, 795, 795, 795, 1046,
+        1510, 1046, 1046, 795, 1510, 795, 1510, 795,
+        1510, 795, 1046, 1046, 1046, 1046, 1046, 1510,
+        795, 1046, 1046, 1046, 795, 1046, 795, 1510,
+        795, 1046, 1046, 1046, 1046, 795, 1510, 1046,
+        795, 1046, 795, 1046, 795, 1046, 1046, 795,
+        1046, 1510, 795, 1046, 795, 1046, 795, 1046,
+        1510, 1046, 795, 1510, 1046, 795, 1046, 795,
+        1510, 1046, 1046, 1046, 1046, 1046, 1510, 795,
+        795, 1046, 795, 1046, 1510, 1046, 795, 1510,
+        1046, 1046, 1510, 795, 795, 1046, 795, 1046,
+        795, 1046, 1510, 1511, 1512, 1513, 1514, 1515,
+        1516, 1517, 1518, 1519, 1520, 1521, 1091, 1522,
+        1523, 1524, 1525, 1526, 1527, 1528, 1529, 1530,
+        1531, 1532, 1533, 1532, 1534, 1535, 1536, 1537,
+        1538, 1047, 1510, 1539, 1540, 1541, 1542, 1543,
+        1544, 1545, 1546, 1547, 1548, 1549, 1550, 1551,
+        1552, 1553, 1554, 1555, 1556, 1557, 1101, 1558,
+        1559, 1560, 1068, 1561, 1562, 1563, 1564, 1565,
+        1566, 1047, 1567, 1568, 1569, 1570, 1571, 1572,
+        1573, 1574, 1050, 1575, 1047, 1050, 1576, 1577,
+        1578, 1579, 1059, 1510, 1580, 1581, 1582, 1583,
+        1079, 1584, 1585, 1059, 1586, 1587, 1588, 1589,
+        1590, 1047, 1510, 1591, 1550, 1592, 1593, 1594,
+        1059, 1595, 1596, 1050, 1047, 1059, 801, 1510,
+        1560, 1047, 1050, 1059, 801, 1059, 801, 1597,
+        1059, 1510, 801, 1050, 1598, 1599, 1050, 1600,
+        1601, 1057, 1602, 1603, 1604, 1605, 1606, 1556,
+        1607, 1608, 1609, 1610, 1611, 1612, 1613, 1614,
+        1615, 1616, 1617, 1618, 1575, 1619, 1050, 1059,
+        801, 1510, 1620, 1621, 1059, 1047, 1510, 801,
+        1047, 1510, 1050, 1622, 1107, 1623, 1624, 1625,
+        1626, 1627, 1628, 1629, 1630, 1047, 1631, 1632,
+        1633, 1634, 1635, 1636, 1047, 1059, 1510, 1638,
+        1639, 1640, 1641, 1642, 1643, 1644, 1645, 1646,
+        1647, 1648, 1644, 1650, 1651, 1652, 1653, 1637,
+        1649, 1637, 1510, 1637, 1510,
 }
 
 var _hcltok_trans_targs []int16 = []int16{
-        1464, 1, 1464, 1464, 1464, 3, 4, 1472,
-        1464, 5, 1473, 6, 7, 9, 10, 287,
-        13, 14, 15, 16, 17, 288, 289, 20,
-        290, 22, 23, 291, 292, 293, 294, 295,
-        296, 297, 298, 299, 300, 329, 349, 354,
-        128, 129, 130, 357, 152, 372, 376, 1464,
-        11, 12, 18, 19, 21, 24, 25, 26,
-        27, 28, 29, 30, 31, 32, 33, 65,
-        106, 121, 132, 155, 171, 284, 34, 35,
-        36, 37, 38, 39, 40, 41, 42, 43,
-        44, 45, 46, 47, 48, 49, 50, 51,
-        52, 53, 54, 55, 56, 57, 58, 59,
-        60, 61, 62, 63, 64, 66, 67, 68,
-        69, 70, 71, 72, 73, 74, 75, 76,
-        77, 78, 79, 80, 81, 82, 83, 84,
-        85, 86, 87, 88, 89, 90, 91, 92,
-        93, 94, 95, 96, 97, 98, 99, 100,
-        101, 102, 103, 104, 105, 107, 108, 109,
-        110, 111, 112, 113, 114, 115, 116, 117,
-        118, 119, 120, 122, 123, 124, 125, 126,
-        127, 131, 133, 134, 135, 136, 137, 138,
-        139, 140, 141, 142, 143, 144, 145, 146,
-        147, 148, 149, 150, 151, 153, 154, 156,
-        157, 158, 159, 160, 161, 162, 163, 164,
-        165, 166, 167, 168, 169, 170, 172, 204,
-        228, 231, 232, 234, 243, 244, 247, 251,
-        269, 276, 278, 280, 282, 173, 174, 175,
-        176, 177, 178, 179, 180, 181, 182, 183,
-        184, 185, 186, 187, 188, 189, 190, 191,
-        192, 193, 194, 195, 196, 197, 198, 199,
-        200, 201, 202, 203, 205, 206, 207, 208,
-        209, 210, 211, 212, 213, 214, 215, 216,
-        217, 218, 219, 220, 221, 222, 223, 224,
-        225, 226, 227, 229, 230, 233, 235, 236,
-        237, 238, 239, 240, 241, 242, 245, 246,
-        248, 249, 250, 252, 253, 254, 255, 256,
-        257, 258, 259, 260, 261, 262, 263, 264,
-        265, 266, 267, 268, 270, 271, 272, 273,
-        274, 275, 277, 279, 281, 283, 285, 286,
-        301, 302, 303, 304, 305, 306, 307, 308,
-        309, 310, 311, 312, 313, 314, 315, 316,
-        317, 318, 319, 320, 321, 322, 323, 324,
-        325, 326, 327, 328, 330, 331, 332, 333,
-        334, 335, 336, 337, 338, 339, 340, 341,
-        342, 343, 344, 345, 346, 347, 348, 350,
-        351, 352, 353, 355, 356, 358, 359, 360,
-        361, 362, 363, 364, 365, 366, 367, 368,
-        369, 370, 371, 373, 374, 375, 377, 383,
-        405, 410, 412, 414, 378, 379, 380, 381,
-        382, 384, 385, 386, 387, 388, 389, 390,
-        391, 392, 393, 394, 395, 396, 397, 398,
-        399, 400, 401, 402, 403, 404, 406, 407,
-        408, 409, 411, 413, 415, 1464, 1477, 438,
-        439, 440, 441, 418, 442, 443, 444, 445,
-        446, 447, 448, 449, 450, 451, 452, 453,
-        454, 455, 456, 457, 458, 459, 460, 461,
-        462, 463, 464, 465, 466, 467, 468, 470,
-        471, 472, 473, 474, 475, 476, 477, 478,
-        479, 480, 481, 482, 483, 484, 485, 486,
-        420, 487, 488, 489, 490, 491, 492, 493,
-        494, 495, 496, 497, 498, 499, 500, 501,
-        502, 503, 504, 419, 505, 506, 507, 508,
-        509, 511, 512, 513, 514, 515, 516, 517,
-        518, 519, 520, 521, 522, 523, 524, 526,
-        527, 528, 529, 530, 531, 535, 537, 538,
-        539, 540, 435, 541, 542, 543, 544, 545,
-        546, 547, 548, 549, 550, 551, 552, 553,
-        554, 555, 557, 558, 560, 561, 562, 563,
-        564, 565, 433, 566, 567, 568, 569, 570,
-        571, 572, 573, 574, 576, 608, 632, 635,
-        636, 638, 647, 648, 651, 655, 673, 533,
-        680, 682, 684, 686, 577, 578, 579, 580,
-        581, 582, 583, 584, 585, 586, 587, 588,
-        589, 590, 591, 592, 593, 594, 595, 596,
-        597, 598, 599, 600, 601, 602, 603, 604,
-        605, 606, 607, 609, 610, 611, 612, 613,
-        614, 615, 616, 617, 618, 619, 620, 621,
-        622, 623, 624, 625, 626, 627, 628, 629,
-        630, 631, 633, 634, 637, 639, 640, 641,
-        642, 643, 644, 645, 646, 649, 650, 652,
-        653, 654, 656, 657, 658, 659, 660, 661,
-        662, 663, 664, 665, 666, 667, 668, 669,
-        670, 671, 672, 674, 675, 676, 677, 678,
-        679, 681, 683, 685, 687, 689, 690, 1464,
-        1464, 691, 828, 829, 760, 830, 831, 832,
-        833, 834, 835, 789, 836, 725, 837, 838,
-        839, 840, 841, 842, 843, 844, 745, 845,
-        846, 847, 848, 849, 850, 851, 852, 853,
-        854, 770, 855, 857, 858, 859, 860, 861,
-        862, 863, 864, 865, 866, 703, 867, 868,
-        869, 870, 871, 872, 873, 874, 875, 741,
-        876, 877, 878, 879, 880, 811, 882, 883,
-        886, 888, 889, 890, 891, 892, 893, 896,
-        897, 899, 900, 901, 903, 904, 905, 906,
-        907, 908, 909, 910, 911, 912, 913, 915,
-        916, 917, 918, 921, 923, 924, 926, 928,
-        1515, 1517, 1518, 1516, 931, 932, 1515, 934,
-        1541, 1541, 1541, 1543, 1544, 1542, 939, 940,
-        1545, 1546, 1550, 1550, 1550, 1551, 946, 947,
-        1552, 1553, 1557, 1558, 1557, 973, 974, 975,
-        976, 953, 977, 978, 979, 980, 981, 982,
-        983, 984, 985, 986, 987, 988, 989, 990,
-        991, 992, 993, 994, 995, 996, 997, 998,
-        999, 1000, 1001, 1002, 1003, 1005, 1006, 1007,
-        1008, 1009, 1010, 1011, 1012, 1013, 1014, 1015,
-        1016, 1017, 1018, 1019, 1020, 1021, 955, 1022,
-        1023, 1024, 1025, 1026, 1027, 1028, 1029, 1030,
-        1031, 1032, 1033, 1034, 1035, 1036, 1037, 1038,
-        1039, 954, 1040, 1041, 1042, 1043, 1044, 1046,
-        1047, 1048, 1049, 1050, 1051, 1052, 1053, 1054,
-        1055, 1056, 1057, 1058, 1059, 1061, 1062, 1063,
-        1064, 1065, 1066, 1070, 1072, 1073, 1074, 1075,
-        970, 1076, 1077, 1078, 1079, 1080, 1081, 1082,
-        1083, 1084, 1085, 1086, 1087, 1088, 1089, 1090,
-        1092, 1093, 1095, 1096, 1097, 1098, 1099, 1100,
-        968, 1101, 1102, 1103, 1104, 1105, 1106, 1107,
-        1108, 1109, 1111, 1143, 1167, 1170, 1171, 1173,
-        1182, 1183, 1186, 1190, 1208, 1068, 1215, 1217,
-        1219, 1221, 1112, 1113, 1114, 1115, 1116, 1117,
-        1118, 1119, 1120, 1121, 1122, 1123, 1124, 1125,
-        1126, 1127, 1128, 1129, 1130, 1131, 1132, 1133,
-        1134, 1135, 1136, 1137, 1138, 1139, 1140, 1141,
-        1142, 1144, 1145, 1146, 1147, 1148, 1149, 1150,
-        1151, 1152, 1153, 1154, 1155, 1156, 1157, 1158,
-        1159, 1160, 1161, 1162, 1163, 1164, 1165, 1166,
-        1168, 1169, 1172, 1174, 1175, 1176, 1177, 1178,
-        1179, 1180, 1181, 1184, 1185, 1187, 1188, 1189,
-        1191, 1192, 1193, 1194, 1195, 1196, 1197, 1198,
-        1199, 1200, 1201, 1202, 1203, 1204, 1205, 1206,
-        1207, 1209, 1210, 1211, 1212, 1213, 1214, 1216,
-        1218, 1220, 1222, 1224, 1225, 1557, 1557, 1226,
-        1363, 1364, 1295, 1365, 1366, 1367, 1368, 1369,
-        1370, 1324, 1371, 1260, 1372, 1373, 1374, 1375,
-        1376, 1377, 1378, 1379, 1280, 1380, 1381, 1382,
-        1383, 1384, 1385, 1386, 1387, 1388, 1389, 1305,
-        1390, 1392, 1393, 1394, 1395, 1396, 1397, 1398,
-        1399, 1400, 1401, 1238, 1402, 1403, 1404, 1405,
-        1406, 1407, 1408, 1409, 1410, 1276, 1411, 1412,
-        1413, 1414, 1415, 1346, 1417, 1418, 1421, 1423,
-        1424, 1425, 1426, 1427, 1428, 1431, 1432, 1434,
-        1435, 1436, 1438, 1439, 1440, 1441, 1442, 1443,
-        1444, 1445, 1446, 1447, 1448, 1450, 1451, 1452,
-        1453, 1456, 1458, 1459, 1461, 1463, 1465, 1464,
-        1466, 1467, 1464, 1468, 1464, 1469, 1470, 1471,
-        1474, 1475, 1476, 1464, 1478, 1464, 1479, 1464,
-        1480, 1481, 1482, 1483, 1484, 1485, 1486, 1487,
-        1488, 1489, 1490, 1491, 1492, 1493, 1494, 1495,
-        1496, 1497, 1498, 1499, 1500, 1501, 1502, 1503,
-        1504, 1505, 1506, 1507, 1508, 1509, 1510, 1511,
-        1512, 1513, 1514, 1464, 1464, 1464, 1464, 1464,
-        2, 1464, 1464, 8, 1464, 1464, 1464, 1464,
-        1464, 416, 417, 421, 422, 423, 424, 425,
-        426, 427, 428, 429, 430, 431, 432, 434,
-        436, 437, 469, 510, 525, 532, 534, 536,
-        556, 559, 575, 688, 1464, 1464, 1464, 692,
-        693, 694, 695, 696, 697, 698, 699, 700,
-        701, 702, 704, 705, 706, 707, 708, 709,
-        710, 711, 712, 713, 714, 715, 716, 717,
-        718, 719, 720, 721, 722, 723, 724, 726,
-        727, 728, 729, 730, 731, 732, 733, 734,
-        735, 736, 737, 738, 739, 740, 742, 743,
-        744, 746, 747, 748, 749, 750, 751, 752,
-        753, 754, 755, 756, 757, 758, 759, 761,
-        762, 763, 764, 765, 766, 767, 768, 769,
-        771, 772, 773, 774, 775, 776, 777, 778,
-        779, 780, 781, 782, 783, 784, 785, 786,
-        787, 788, 790, 791, 792, 793, 794, 795,
-        796, 797, 798, 799, 800, 801, 802, 803,
-        804, 805, 806, 807, 808, 809, 810, 812,
-        813, 814, 815, 816, 817, 818, 819, 820,
-        821, 822, 823, 824, 825, 826, 827, 856,
-        881, 884, 885, 887, 894, 895, 898, 902,
-        914, 919, 920, 922, 925, 927, 1515, 1515,
-        1534, 1536, 1519, 1515, 1538, 1539, 1540, 1515,
-        929, 930, 933, 1515, 1516, 929, 930, 1519,
-        931, 932, 933, 1515, 1516, 929, 930, 1519,
-        931, 932, 933, 1520, 1525, 1521, 1522, 1524,
-        1531, 1532, 1533, 1517, 1521, 1522, 1524, 1531,
-        1532, 1533, 1518, 1523, 1526, 1527, 1528, 1529,
-        1530, 1517, 1521, 1522, 1524, 1531, 1532, 1533,
-        1520, 1525, 1523, 1526, 1527, 1528, 1529, 1530,
-        1518, 1523, 1526, 1527, 1528, 1529, 1530, 1520,
-        1525, 1515, 1535, 1515, 1515, 1537, 1515, 1515,
-        1515, 935, 936, 942, 943, 1541, 1547, 1548,
-        1549, 1541, 937, 938, 941, 1541, 1542, 1541,
-        936, 937, 938, 939, 940, 941, 1541, 1542,
-        1541, 936, 937, 938, 939, 940, 941, 1541,
-        1541, 1541, 1541, 1541, 944, 949, 950, 1550,
-        1554, 1555, 1556, 1550, 945, 948, 1550, 1550,
-        1550, 1550, 1550, 1557, 1559, 1560, 1561, 1562,
-        1563, 1564, 1565, 1566, 1567, 1568, 1569, 1570,
-        1571, 1572, 1573, 1574, 1575, 1576, 1577, 1578,
-        1579, 1580, 1581, 1582, 1583, 1584, 1585, 1586,
-        1587, 1588, 1589, 1590, 1591, 1592, 1593, 1557,
-        951, 952, 956, 957, 958, 959, 960, 961,
-        962, 963, 964, 965, 966, 967, 969, 971,
-        972, 1004, 1045, 1060, 1067, 1069, 1071, 1091,
-        1094, 1110, 1223, 1557, 1227, 1228, 1229, 1230,
-        1231, 1232, 1233, 1234, 1235, 1236, 1237, 1239,
+        1459, 1459, 2, 3, 1459, 1459, 4, 1467,
+        5, 6, 8, 9, 286, 12, 13, 14,
+        15, 16, 287, 288, 19, 289, 21, 22,
+        290, 291, 292, 293, 294, 295, 296, 297,
+        298, 299, 328, 348, 353, 127, 128, 129,
+        356, 151, 371, 375, 1459, 10, 11, 17,
+        18, 20, 23, 24, 25, 26, 27, 28,
+        29, 30, 31, 32, 64, 105, 120, 131,
+        154, 170, 283, 33, 34, 35, 36, 37,
+        38, 39, 40, 41, 42, 43, 44, 45,
+        46, 47, 48, 49, 50, 51, 52, 53,
+        54, 55, 56, 57, 58, 59, 60, 61,
+        62, 63, 65, 66, 67, 68, 69, 70,
+        71, 72, 73, 74, 75, 76, 77, 78,
+        79, 80, 81, 82, 83, 84, 85, 86,
+        87, 88, 89, 90, 91, 92, 93, 94,
+        95, 96, 97, 98, 99, 100, 101, 102,
+        103, 104, 106, 107, 108, 109, 110, 111,
+        112, 113, 114, 115, 116, 117, 118, 119,
+        121, 122, 123, 124, 125, 126, 130, 132,
+        133, 134, 135, 136, 137, 138, 139, 140,
+        141, 142, 143, 144, 145, 146, 147, 148,
+        149, 150, 152, 153, 155, 156, 157, 158,
+        159, 160, 161, 162, 163, 164, 165, 166,
+        167, 168, 169, 171, 203, 227, 230, 231,
+        233, 242, 243, 246, 250, 268, 275, 277,
+        279, 281, 172, 173, 174, 175, 176, 177,
+        178, 179, 180, 181, 182, 183, 184, 185,
+        186, 187, 188, 189, 190, 191, 192, 193,
+        194, 195, 196, 197, 198, 199, 200, 201,
+        202, 204, 205, 206, 207, 208, 209, 210,
+        211, 212, 213, 214, 215, 216, 217, 218,
+        219, 220, 221, 222, 223, 224, 225, 226,
+        228, 229, 232, 234, 235, 236, 237, 238,
+        239, 240, 241, 244, 245, 247, 248, 249,
+        251, 252, 253, 254, 255, 256, 257, 258,
+        259, 260, 261, 262, 263, 264, 265, 266,
+        267, 269, 270, 271, 272, 273, 274, 276,
+        278, 280, 282, 284, 285, 300, 301, 302,
+        303, 304, 305, 306, 307, 308, 309, 310,
+        311, 312, 313, 314, 315, 316, 317, 318,
+        319, 320, 321, 322, 323, 324, 325, 326,
+        327, 329, 330, 331, 332, 333, 334, 335,
+        336, 337, 338, 339, 340, 341, 342, 343,
+        344, 345, 346, 347, 349, 350, 351, 352,
+        354, 355, 357, 358, 359, 360, 361, 362,
+        363, 364, 365, 366, 367, 368, 369, 370,
+        372, 373, 374, 376, 382, 404, 409, 411,
+        413, 377, 378, 379, 380, 381, 383, 384,
+        385, 386, 387, 388, 389, 390, 391, 392,
+        393, 394, 395, 396, 397, 398, 399, 400,
+        401, 402, 403, 405, 406, 407, 408, 410,
+        412, 414, 1459, 1471, 1459, 437, 438, 439,
+        440, 417, 441, 442, 443, 444, 445, 446,
+        447, 448, 449, 450, 451, 452, 453, 454,
+        455, 456, 457, 458, 459, 460, 461, 462,
+        463, 464, 465, 466, 467, 469, 470, 471,
+        472, 473, 474, 475, 476, 477, 478, 479,
+        480, 481, 482, 483, 484, 485, 419, 486,
+        487, 488, 489, 490, 491, 492, 493, 494,
+        495, 496, 497, 498, 499, 500, 501, 502,
+        503, 418, 504, 505, 506, 507, 508, 510,
+        511, 512, 513, 514, 515, 516, 517, 518,
+        519, 520, 521, 522, 523, 525, 526, 527,
+        528, 529, 530, 534, 536, 537, 538, 539,
+        434, 540, 541, 542, 543, 544, 545, 546,
+        547, 548, 549, 550, 551, 552, 553, 554,
+        556, 557, 559, 560, 561, 562, 563, 564,
+        432, 565, 566, 567, 568, 569, 570, 571,
+        572, 573, 575, 607, 631, 634, 635, 637,
+        646, 647, 650, 654, 672, 532, 679, 681,
+        683, 685, 576, 577, 578, 579, 580, 581,
+        582, 583, 584, 585, 586, 587, 588, 589,
+        590, 591, 592, 593, 594, 595, 596, 597,
+        598, 599, 600, 601, 602, 603, 604, 605,
+        606, 608, 609, 610, 611, 612, 613, 614,
+        615, 616, 617, 618, 619, 620, 621, 622,
+        623, 624, 625, 626, 627, 628, 629, 630,
+        632, 633, 636, 638, 639, 640, 641, 642,
+        643, 644, 645, 648, 649, 651, 652, 653,
+        655, 656, 657, 658, 659, 660, 661, 662,
+        663, 664, 665, 666, 667, 668, 669, 670,
+        671, 673, 674, 675, 676, 677, 678, 680,
+        682, 684, 686, 688, 689, 1459, 1459, 690,
+        827, 828, 759, 829, 830, 831, 832, 833,
+        834, 788, 835, 724, 836, 837, 838, 839,
+        840, 841, 842, 843, 744, 844, 845, 846,
+        847, 848, 849, 850, 851, 852, 853, 769,
+        854, 856, 857, 858, 859, 860, 861, 862,
+        863, 864, 865, 702, 866, 867, 868, 869,
+        870, 871, 872, 873, 874, 740, 875, 876,
+        877, 878, 879, 810, 881, 882, 885, 887,
+        888, 889, 890, 891, 892, 895, 896, 898,
+        899, 900, 902, 903, 904, 905, 906, 907,
+        908, 909, 910, 911, 912, 914, 915, 916,
+        917, 920, 922, 923, 925, 927, 1509, 1510,
+        929, 930, 931, 1509, 1509, 932, 1523, 1523,
+        1524, 935, 1523, 936, 1525, 1526, 1529, 1530,
+        1534, 1534, 1535, 941, 1534, 942, 1536, 1537,
+        1540, 1541, 1545, 1546, 1545, 968, 969, 970,
+        971, 948, 972, 973, 974, 975, 976, 977,
+        978, 979, 980, 981, 982, 983, 984, 985,
+        986, 987, 988, 989, 990, 991, 992, 993,
+        994, 995, 996, 997, 998, 1000, 1001, 1002,
+        1003, 1004, 1005, 1006, 1007, 1008, 1009, 1010,
+        1011, 1012, 1013, 1014, 1015, 1016, 950, 1017,
+        1018, 1019, 1020, 1021, 1022, 1023, 1024, 1025,
+        1026, 1027, 1028, 1029, 1030, 1031, 1032, 1033,
+        1034, 949, 1035, 1036, 1037, 1038, 1039, 1041,
+        1042, 1043, 1044, 1045, 1046, 1047, 1048, 1049,
+        1050, 1051, 1052, 1053, 1054, 1056, 1057, 1058,
+        1059, 1060, 1061, 1065, 1067, 1068, 1069, 1070,
+        965, 1071, 1072, 1073, 1074, 1075, 1076, 1077,
+        1078, 1079, 1080, 1081, 1082, 1083, 1084, 1085,
+        1087, 1088, 1090, 1091, 1092, 1093, 1094, 1095,
+        963, 1096, 1097, 1098, 1099, 1100, 1101, 1102,
+        1103, 1104, 1106, 1138, 1162, 1165, 1166, 1168,
+        1177, 1178, 1181, 1185, 1203, 1063, 1210, 1212,
+        1214, 1216, 1107, 1108, 1109, 1110, 1111, 1112,
+        1113, 1114, 1115, 1116, 1117, 1118, 1119, 1120,
+        1121, 1122, 1123, 1124, 1125, 1126, 1127, 1128,
+        1129, 1130, 1131, 1132, 1133, 1134, 1135, 1136,
+        1137, 1139, 1140, 1141, 1142, 1143, 1144, 1145,
+        1146, 1147, 1148, 1149, 1150, 1151, 1152, 1153,
+        1154, 1155, 1156, 1157, 1158, 1159, 1160, 1161,
+        1163, 1164, 1167, 1169, 1170, 1171, 1172, 1173,
+        1174, 1175, 1176, 1179, 1180, 1182, 1183, 1184,
+        1186, 1187, 1188, 1189, 1190, 1191, 1192, 1193,
+        1194, 1195, 1196, 1197, 1198, 1199, 1200, 1201,
+        1202, 1204, 1205, 1206, 1207, 1208, 1209, 1211,
+        1213, 1215, 1217, 1219, 1220, 1545, 1545, 1221,
+        1358, 1359, 1290, 1360, 1361, 1362, 1363, 1364,
+        1365, 1319, 1366, 1255, 1367, 1368, 1369, 1370,
+        1371, 1372, 1373, 1374, 1275, 1375, 1376, 1377,
+        1378, 1379, 1380, 1381, 1382, 1383, 1384, 1300,
+        1385, 1387, 1388, 1389, 1390, 1391, 1392, 1393,
+        1394, 1395, 1396, 1233, 1397, 1398, 1399, 1400,
+        1401, 1402, 1403, 1404, 1405, 1271, 1406, 1407,
+        1408, 1409, 1410, 1341, 1412, 1413, 1416, 1418,
+        1419, 1420, 1421, 1422, 1423, 1426, 1427, 1429,
+        1430, 1431, 1433, 1434, 1435, 1436, 1437, 1438,
+        1439, 1440, 1441, 1442, 1443, 1445, 1446, 1447,
+        1448, 1451, 1453, 1454, 1456, 1458, 1460, 1459,
+        1461, 1462, 1459, 1463, 1459, 1464, 1465, 1466,
+        1468, 1469, 1470, 1459, 1472, 1459, 1473, 1459,
+        1474, 1475, 1476, 1477, 1478, 1479, 1480, 1481,
+        1482, 1483, 1484, 1485, 1486, 1487, 1488, 1489,
+        1490, 1491, 1492, 1493, 1494, 1495, 1496, 1497,
+        1498, 1499, 1500, 1501, 1502, 1503, 1504, 1505,
+        1506, 1507, 1508, 1459, 1459, 1459, 1459, 1459,
+        1459, 1, 1459, 7, 1459, 1459, 1459, 1459,
+        1459, 415, 416, 420, 421, 422, 423, 424,
+        425, 426, 427, 428, 429, 430, 431, 433,
+        435, 436, 468, 509, 524, 531, 533, 535,
+        555, 558, 574, 687, 1459, 1459, 1459, 691,
+        692, 693, 694, 695, 696, 697, 698, 699,
+        700, 701, 703, 704, 705, 706, 707, 708,
+        709, 710, 711, 712, 713, 714, 715, 716,
+        717, 718, 719, 720, 721, 722, 723, 725,
+        726, 727, 728, 729, 730, 731, 732, 733,
+        734, 735, 736, 737, 738, 739, 741, 742,
+        743, 745, 746, 747, 748, 749, 750, 751,
+        752, 753, 754, 755, 756, 757, 758, 760,
+        761, 762, 763, 764, 765, 766, 767, 768,
+        770, 771, 772, 773, 774, 775, 776, 777,
+        778, 779, 780, 781, 782, 783, 784, 785,
+        786, 787, 789, 790, 791, 792, 793, 794,
+        795, 796, 797, 798, 799, 800, 801, 802,
+        803, 804, 805, 806, 807, 808, 809, 811,
+        812, 813, 814, 815, 816, 817, 818, 819,
+        820, 821, 822, 823, 824, 825, 826, 855,
+        880, 883, 884, 886, 893, 894, 897, 901,
+        913, 918, 919, 921, 924, 926, 1511, 1509,
+        1512, 1517, 1519, 1509, 1520, 1521, 1522, 1509,
+        928, 1509, 1509, 1513, 1514, 1516, 1509, 1515,
+        1509, 1509, 1509, 1518, 1509, 1509, 1509, 933,
+        934, 938, 939, 1523, 1531, 1532, 1533, 1523,
+        937, 1523, 1523, 934, 1527, 1528, 1523, 1523,
+        1523, 1523, 1523, 940, 944, 945, 1534, 1542,
+        1543, 1544, 1534, 943, 1534, 1534, 940, 1538,
+        1539, 1534, 1534, 1534, 1534, 1534, 1545, 1547,
+        1548, 1549, 1550, 1551, 1552, 1553, 1554, 1555,
+        1556, 1557, 1558, 1559, 1560, 1561, 1562, 1563,
+        1564, 1565, 1566, 1567, 1568, 1569, 1570, 1571,
+        1572, 1573, 1574, 1575, 1576, 1577, 1578, 1579,
+        1580, 1581, 1545, 946, 947, 951, 952, 953,
+        954, 955, 956, 957, 958, 959, 960, 961,
+        962, 964, 966, 967, 999, 1040, 1055, 1062,
+        1064, 1066, 1086, 1089, 1105, 1218, 1545, 1222,
+        1223, 1224, 1225, 1226, 1227, 1228, 1229, 1230,
+        1231, 1232, 1234, 1235, 1236, 1237, 1238, 1239,
         1240, 1241, 1242, 1243, 1244, 1245, 1246, 1247,
-        1248, 1249, 1250, 1251, 1252, 1253, 1254, 1255,
-        1256, 1257, 1258, 1259, 1261, 1262, 1263, 1264,
-        1265, 1266, 1267, 1268, 1269, 1270, 1271, 1272,
-        1273, 1274, 1275, 1277, 1278, 1279, 1281, 1282,
-        1283, 1284, 1285, 1286, 1287, 1288, 1289, 1290,
-        1291, 1292, 1293, 1294, 1296, 1297, 1298, 1299,
-        1300, 1301, 1302, 1303, 1304, 1306, 1307, 1308,
+        1248, 1249, 1250, 1251, 1252, 1253, 1254, 1256,
+        1257, 1258, 1259, 1260, 1261, 1262, 1263, 1264,
+        1265, 1266, 1267, 1268, 1269, 1270, 1272, 1273,
+        1274, 1276, 1277, 1278, 1279, 1280, 1281, 1282,
+        1283, 1284, 1285, 1286, 1287, 1288, 1289, 1291,
+        1292, 1293, 1294, 1295, 1296, 1297, 1298, 1299,
+        1301, 1302, 1303, 1304, 1305, 1306, 1307, 1308,
         1309, 1310, 1311, 1312, 1313, 1314, 1315, 1316,
-        1317, 1318, 1319, 1320, 1321, 1322, 1323, 1325,
+        1317, 1318, 1320, 1321, 1322, 1323, 1324, 1325,
         1326, 1327, 1328, 1329, 1330, 1331, 1332, 1333,
-        1334, 1335, 1336, 1337, 1338, 1339, 1340, 1341,
-        1342, 1343, 1344, 1345, 1347, 1348, 1349, 1350,
-        1351, 1352, 1353, 1354, 1355, 1356, 1357, 1358,
-        1359, 1360, 1361, 1362, 1391, 1416, 1419, 1420,
-        1422, 1429, 1430, 1433, 1437, 1449, 1454, 1455,
-        1457, 1460, 1462,
+        1334, 1335, 1336, 1337, 1338, 1339, 1340, 1342,
+        1343, 1344, 1345, 1346, 1347, 1348, 1349, 1350,
+        1351, 1352, 1353, 1354, 1355, 1356, 1357, 1386,
+        1411, 1414, 1415, 1417, 1424, 1425, 1428, 1432,
+        1444, 1449, 1450, 1452, 1455, 1457,
 }
 
 var _hcltok_trans_actions []byte = []byte{
-        151, 0, 93, 147, 109, 0, 0, 201,
-        143, 0, 13, 0, 0, 0, 0, 0,
+        145, 107, 0, 0, 91, 141, 0, 7,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 0, 123,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 121, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
@@ -3517,8 +3444,8 @@ var _hcltok_trans_actions []byte = []byte{
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 145, 198, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 143, 193, 149, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
@@ -3548,9 +3475,8 @@ var _hcltok_trans_actions []byte = []byte{
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 0, 149,
-        127, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 147, 125, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
@@ -3561,11 +3487,12 @@ var _hcltok_trans_actions []byte = []byte{
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        35, 13, 13, 13, 0, 0, 37, 0,
-        57, 43, 55, 180, 180, 180, 0, 0,
-        0, 0, 77, 63, 75, 186, 0, 0,
-        0, 0, 87, 192, 91, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 31, 169,
+        0, 0, 0, 35, 33, 0, 55, 41,
+        175, 0, 53, 0, 175, 175, 0, 0,
+        75, 61, 181, 0, 73, 0, 181, 181,
+        0, 0, 85, 187, 89, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
@@ -3595,8 +3522,8 @@ var _hcltok_trans_actions []byte = []byte{
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 89, 81, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 87, 79, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
@@ -3607,20 +3534,20 @@ var _hcltok_trans_actions []byte = []byte{
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 0, 95,
-        0, 0, 121, 210, 113, 0, 13, 204,
-        13, 0, 0, 115, 0, 117, 0, 125,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 93,
+        0, 0, 119, 0, 111, 0, 7, 7,
+        7, 0, 0, 113, 0, 115, 0, 123,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 13, 13,
-        13, 207, 207, 207, 207, 207, 207, 13,
-        13, 207, 13, 129, 141, 137, 99, 105,
-        0, 135, 131, 0, 103, 97, 111, 101,
-        133, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 7, 7,
+        7, 196, 196, 196, 196, 196, 196, 7,
+        7, 196, 7, 127, 139, 135, 97, 133,
+        103, 0, 129, 0, 101, 95, 109, 99,
+        131, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 107, 119, 139, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 105, 117, 137, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
@@ -3637,32 +3564,24 @@ var _hcltok_trans_actions []byte = []byte{
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 21, 19,
-        0, 0, 13, 23, 0, 13, 13, 29,
-        0, 0, 0, 153, 174, 1, 1, 174,
-        1, 1, 1, 156, 177, 3, 3, 177,
-        3, 3, 3, 0, 0, 0, 0, 13,
-        13, 13, 13, 174, 1, 1, 174, 174,
-        174, 174, 174, 1, 1, 174, 174, 174,
-        174, 177, 3, 3, 177, 177, 177, 177,
-        1, 1, 0, 0, 13, 13, 13, 13,
-        177, 3, 3, 177, 177, 177, 177, 3,
-        3, 31, 0, 25, 15, 0, 27, 17,
-        33, 0, 0, 0, 0, 45, 0, 183,
-        183, 51, 0, 0, 0, 162, 213, 159,
-        5, 5, 5, 5, 5, 5, 168, 217,
-        165, 7, 7, 7, 7, 7, 7, 47,
-        39, 49, 41, 53, 0, 0, 0, 65,
-        0, 189, 189, 71, 0, 0, 67, 59,
-        69, 61, 73, 79, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 13,
+        0, 0, 172, 17, 0, 7, 7, 23,
+        0, 25, 27, 0, 0, 0, 151, 0,
+        15, 19, 9, 0, 21, 11, 29, 0,
+        0, 0, 0, 43, 0, 178, 178, 49,
+        0, 157, 154, 1, 175, 175, 45, 37,
+        47, 39, 51, 0, 0, 0, 63, 0,
+        184, 184, 69, 0, 163, 160, 1, 181,
+        181, 65, 57, 67, 59, 71, 77, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 13, 13, 13, 195, 195, 195,
-        195, 195, 195, 13, 13, 195, 13, 83,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 7, 7, 7,
+        190, 190, 190, 190, 190, 190, 7, 7,
+        190, 7, 81, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 85, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 83, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
@@ -3680,7 +3599,7 @@ var _hcltok_trans_actions []byte = []byte{
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0,
+        0, 0, 0, 0, 0, 0,
 }
 
 var _hcltok_to_state_actions []byte = []byte{
@@ -3866,24 +3785,22 @@ var _hcltok_to_state_actions []byte = []byte{
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 0, 0,
-        9, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 3, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 9, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 3, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 171, 0, 0,
-        0, 0, 0, 0, 0, 0, 171, 0,
-        0, 0, 0, 0, 0, 9, 0, 0,
+        0, 0, 0, 166, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 166, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 3, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0,
+        0, 0, 0, 0, 0, 0,
 }
 
 var _hcltok_from_state_actions []byte = []byte{
@@ -4069,147 +3986,144 @@ var _hcltok_from_state_actions []byte = []byte{
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 5, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        11, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 5, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 11, 0, 0, 0, 0,
+        0, 0, 0, 5, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 5, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
+        0, 5, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 11, 0, 0,
-        0, 0, 0, 0, 0, 0, 11, 0,
-        0, 0, 0, 0, 0, 11, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0,
+        0, 0, 0, 0, 0, 0,
 }
 
 var _hcltok_eof_trans []int16 = []int16{
-        0, 1, 4, 1, 1, 9, 9, 9,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        4, 4, 4, 4, 4, 4, 4, 4,
-        422, 422, 1, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 422, 422, 422, 422, 422,
-        422, 422, 422, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 672, 672, 672, 672, 672, 672, 672,
-        672, 769, 769, 769, 769, 769, 775, 775,
-        777, 779, 779, 777, 777, 779, 0, 0,
-        787, 789, 787, 787, 789, 0, 0, 795,
-        795, 797, 795, 795, 795, 795, 795, 795,
+        0, 1, 1, 1, 6, 6, 6, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 1,
+        1, 1, 1, 1, 1, 1, 1, 419,
+        419, 421, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 419, 419, 419, 419, 419, 419,
+        419, 419, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        670, 670, 670, 670, 670, 670, 670, 670,
+        767, 772, 772, 772, 773, 773, 775, 775,
+        775, 779, 0, 0, 785, 785, 785, 789,
+        0, 0, 795, 795, 797, 795, 795, 795,
         795, 795, 795, 795, 795, 795, 795, 795,
         795, 795, 795, 795, 795, 795, 795, 795,
         795, 795, 795, 795, 795, 795, 795, 795,
@@ -4243,7 +4157,7 @@ var _hcltok_eof_trans []int16 = []int16{
         795, 795, 795, 795, 795, 795, 795, 795,
         795, 795, 795, 795, 795, 795, 795, 795,
         795, 795, 795, 795, 795, 795, 795, 795,
-        795, 795, 1046, 1046, 1046, 1046, 1046, 1046,
+        795, 795, 795, 795, 795, 1046, 1046, 1046,
         1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
         1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
         1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
@@ -4273,45 +4187,49 @@ var _hcltok_eof_trans []int16 = []int16{
         1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
         1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
         1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
-        0, 1196, 1197, 1198, 1197, 1198, 1198, 1198,
-        1202, 1203, 1198, 1198, 1198, 1209, 1198, 1198,
+        1046, 1046, 1046, 0, 1196, 1197, 1198, 1200,
+        1198, 1198, 1198, 1203, 1198, 1198, 1198, 1209,
+        1198, 1198, 1239, 1239, 1239, 1239, 1239, 1239,
         1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239,
         1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239,
         1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239,
-        1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239,
-        1239, 1239, 1239, 0, 1392, 1396, 1404, 1392,
-        1392, 1396, 1396, 1404, 1396, 1392, 1404, 1404,
-        1404, 1404, 1404, 1396, 1396, 1396, 1458, 1460,
-        1458, 1463, 1465, 1465, 1465, 0, 1474, 1478,
-        1487, 1496, 1498, 1500, 1500, 1500, 0, 1508,
-        1511, 1513, 1515, 1515, 1515, 0, 1552, 1580,
-        1580, 1580, 1580, 1580, 1580, 1580, 1580, 1580,
-        1580, 1580, 1580, 1580, 1580, 1580, 1580, 1580,
-        1580, 1580, 1580, 1580, 1580, 1580, 1580, 1580,
-        1580, 1580, 1580, 1580, 1580, 1580, 1580, 1580,
-        1580, 1580,
+        1239, 1239, 1239, 1239, 1239, 0, 1392, 1394,
+        1395, 1399, 1399, 1392, 1402, 1395, 1405, 1395,
+        1407, 1407, 1407, 0, 1416, 1418, 1418, 1416,
+        1416, 1423, 1425, 1427, 1427, 1427, 0, 1435,
+        1437, 1437, 1435, 1435, 1442, 1444, 1446, 1446,
+        1446, 0, 1483, 1511, 1511, 1511, 1511, 1511,
+        1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511,
+        1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511,
+        1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511,
+        1511, 1511, 1511, 1511, 1511, 1511,
 }
 
-const hcltok_start int = 1464
-const hcltok_first_final int = 1464
+const hcltok_start int = 1459
+const hcltok_first_final int = 1459
 const hcltok_error int = 0
 
-const hcltok_en_stringTemplate int = 1515
-const hcltok_en_heredocTemplate int = 1541
-const hcltok_en_bareTemplate int = 1550
-const hcltok_en_identOnly int = 1557
-const hcltok_en_main int = 1464
+const hcltok_en_stringTemplate int = 1509
+const hcltok_en_heredocTemplate int = 1523
+const hcltok_en_bareTemplate int = 1534
+const hcltok_en_identOnly int = 1545
+const hcltok_en_main int = 1459
 
-// line 16 "scan_tokens.rl"
+//line scan_tokens.rl:16
 
 func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []Token {
+        stripData := stripUTF8BOM(data)
+        start.Byte += len(data) - len(stripData)
+        data = stripData
+
         f := &tokenAccum{
-                Filename: filename,
-                Bytes:    data,
-                Pos:      start,
+                Filename:  filename,
+                Bytes:     data,
+                Pos:       start,
+                StartByte: start.Byte,
         }
 
-        // line 294 "scan_tokens.rl"
+//line scan_tokens.rl:305
 
         // Ragel state
         p := 0          // "Pointer" into data
@@ -4339,7 +4257,7 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
         var retBraces []int              // stack of brace levels that cause us to use fret
         var heredocs []heredocInProgress // stack of heredocs we're currently processing
 
-        // line 329 "scan_tokens.rl"
+//line scan_tokens.rl:340
 
         // Make Go compiler happy
         _ = ts
@@ -4359,7 +4277,7 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                 f.emitToken(TokenType(b[0]), ts, te)
         }
 
-        // line 4372 "scan_tokens.go"
+//line scan_tokens.go:4289
         {
                 top = 0
                 ts = 0
@@ -4367,7 +4285,7 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                 act = 0
         }
 
-        // line 4380 "scan_tokens.go"
+//line scan_tokens.go:4297
         {
                 var _klen int
                 var _trans int
@@ -4387,12 +4305,11 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                 for ; _nacts > 0; _nacts-- {
                         _acts++
                         switch _hcltok_actions[_acts-1] {
-                        case 6:
-                                // line 1 "NONE"
-
+                        case 3:
+//line NONE:1
                                 ts = p
 
-                                // line 4404 "scan_tokens.go"
+//line scan_tokens.go:4320
                         }
                 }
 
@@ -4464,33 +4381,21 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                         _acts++
                         switch _hcltok_actions[_acts-1] {
                         case 0:
-                                // line 218 "scan_tokens.rl"
-
-                                p--
-
-                        case 1:
-                                // line 219 "scan_tokens.rl"
-
-                                p--
-
-                        case 2:
-                                // line 224 "scan_tokens.rl"
-
-                                p--
-
-                        case 3:
-                                // line 225 "scan_tokens.rl"
-
+//line scan_tokens.rl:224
                                 p--
 
-                        case 7:
-                                // line 1 "NONE"
-
+                        case 4:
+//line NONE:1
                                 te = p + 1
 
-                        case 8:
-                                // line 155 "scan_tokens.rl"
-
+                        case 5:
+//line scan_tokens.rl:248
+                                act = 4
+                        case 6:
+//line scan_tokens.rl:250
+                                act = 6
+                        case 7:
+//line scan_tokens.rl:160
                                 te = p + 1
                                 {
                                         token(TokenTemplateInterp)
@@ -4503,13 +4408,12 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 9:
-                                // line 165 "scan_tokens.rl"
-
+                        case 8:
+//line scan_tokens.rl:170
                                 te = p + 1
                                 {
                                         token(TokenTemplateControl)
@@ -4522,13 +4426,12 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 10:
-                                // line 79 "scan_tokens.rl"
-
+                        case 9:
+//line scan_tokens.rl:84
                                 te = p + 1
                                 {
                                         token(TokenCQuote)
@@ -4540,23 +4443,20 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                         goto _again
 
                                 }
-                        case 11:
-                                // line 239 "scan_tokens.rl"
-
+                        case 10:
+//line scan_tokens.rl:248
                                 te = p + 1
                                 {
-                                        token(TokenInvalid)
+                                        token(TokenQuotedLit)
                                 }
-                        case 12:
-                                // line 240 "scan_tokens.rl"
-
+                        case 11:
+//line scan_tokens.rl:251
                                 te = p + 1
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 13:
-                                // line 155 "scan_tokens.rl"
-
+                        case 12:
+//line scan_tokens.rl:160
                                 te = p
                                 p--
                                 {
@@ -4570,13 +4470,12 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 14:
-                                // line 165 "scan_tokens.rl"
-
+                        case 13:
+//line scan_tokens.rl:170
                                 te = p
                                 p--
                                 {
@@ -4590,59 +4489,73 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 15:
-                                // line 238 "scan_tokens.rl"
-
+                        case 14:
+//line scan_tokens.rl:248
                                 te = p
                                 p--
                                 {
                                         token(TokenQuotedLit)
                                 }
+                        case 15:
+//line scan_tokens.rl:249
+                                te = p
+                                p--
+                                {
+                                        token(TokenQuotedNewline)
+                                }
                         case 16:
-                                // line 239 "scan_tokens.rl"
-
+//line scan_tokens.rl:250
                                 te = p
                                 p--
                                 {
                                         token(TokenInvalid)
                                 }
                         case 17:
-                                // line 240 "scan_tokens.rl"
-
+//line scan_tokens.rl:251
                                 te = p
                                 p--
                                 {
                                         token(TokenBadUTF8)
                                 }
                         case 18:
-                                // line 238 "scan_tokens.rl"
-
+//line scan_tokens.rl:248
                                 p = (te) - 1
                                 {
                                         token(TokenQuotedLit)
                                 }
                         case 19:
-                                // line 240 "scan_tokens.rl"
-
+//line scan_tokens.rl:251
                                 p = (te) - 1
                                 {
                                         token(TokenBadUTF8)
                                 }
                         case 20:
-                                // line 143 "scan_tokens.rl"
+//line NONE:1
+                                switch act {
+                                case 4:
+                                        {
+                                                p = (te) - 1
+                                                token(TokenQuotedLit)
+                                        }
+                                case 6:
+                                        {
+                                                p = (te) - 1
+                                                token(TokenInvalid)
+                                        }
+                                }
 
-                                act = 10
                         case 21:
-                                // line 248 "scan_tokens.rl"
-
+//line scan_tokens.rl:148
                                 act = 11
                         case 22:
-                                // line 155 "scan_tokens.rl"
-
+//line scan_tokens.rl:259
+                                act = 12
+                        case 23:
+//line scan_tokens.rl:160
                                 te = p + 1
                                 {
                                         token(TokenTemplateInterp)
@@ -4655,13 +4568,12 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 23:
-                                // line 165 "scan_tokens.rl"
-
+                        case 24:
+//line scan_tokens.rl:170
                                 te = p + 1
                                 {
                                         token(TokenTemplateControl)
@@ -4674,13 +4586,12 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 24:
-                                // line 106 "scan_tokens.rl"
-
+                        case 25:
+//line scan_tokens.rl:111
                                 te = p + 1
                                 {
                                         // This action is called specificially when a heredoc literal
@@ -4724,16 +4635,14 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                         topdoc.StartOfLine = true
                                         token(TokenStringLit)
                                 }
-                        case 25:
-                                // line 248 "scan_tokens.rl"
-
+                        case 26:
+//line scan_tokens.rl:259
                                 te = p + 1
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 26:
-                                // line 155 "scan_tokens.rl"
-
+                        case 27:
+//line scan_tokens.rl:160
                                 te = p
                                 p--
                                 {
@@ -4747,13 +4656,12 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 27:
-                                // line 165 "scan_tokens.rl"
-
+                        case 28:
+//line scan_tokens.rl:170
                                 te = p
                                 p--
                                 {
@@ -4767,13 +4675,12 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 28:
-                                // line 143 "scan_tokens.rl"
-
+                        case 29:
+//line scan_tokens.rl:148
                                 te = p
                                 p--
                                 {
@@ -4783,17 +4690,15 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                         heredocs[len(heredocs)-1].StartOfLine = false
                                         token(TokenStringLit)
                                 }
-                        case 29:
-                                // line 248 "scan_tokens.rl"
-
+                        case 30:
+//line scan_tokens.rl:259
                                 te = p
                                 p--
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 30:
-                                // line 143 "scan_tokens.rl"
-
+                        case 31:
+//line scan_tokens.rl:148
                                 p = (te) - 1
                                 {
                                         // This action is called when a heredoc literal _doesn't_ end
@@ -4802,16 +4707,15 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                         heredocs[len(heredocs)-1].StartOfLine = false
                                         token(TokenStringLit)
                                 }
-                        case 31:
-                                // line 1 "NONE"
-
+                        case 32:
+//line NONE:1
                                 switch act {
                                 case 0:
                                         {
                                                 cs = 0
                                                 goto _again
                                         }
-                                case 10:
+                                case 11:
                                         {
                                                 p = (te) - 1
 
@@ -4821,24 +4725,21 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 heredocs[len(heredocs)-1].StartOfLine = false
                                                 token(TokenStringLit)
                                         }
-                                case 11:
+                                case 12:
                                         {
                                                 p = (te) - 1
                                                 token(TokenBadUTF8)
                                         }
                                 }
 
-                        case 32:
-                                // line 151 "scan_tokens.rl"
-
-                                act = 14
                         case 33:
-                                // line 255 "scan_tokens.rl"
-
+//line scan_tokens.rl:156
                                 act = 15
                         case 34:
-                                // line 155 "scan_tokens.rl"
-
+//line scan_tokens.rl:266
+                                act = 16
+                        case 35:
+//line scan_tokens.rl:160
                                 te = p + 1
                                 {
                                         token(TokenTemplateInterp)
@@ -4851,13 +4752,12 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 35:
-                                // line 165 "scan_tokens.rl"
-
+                        case 36:
+//line scan_tokens.rl:170
                                 te = p + 1
                                 {
                                         token(TokenTemplateControl)
@@ -4870,27 +4770,24 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 36:
-                                // line 151 "scan_tokens.rl"
-
+                        case 37:
+//line scan_tokens.rl:156
                                 te = p + 1
                                 {
                                         token(TokenStringLit)
                                 }
-                        case 37:
-                                // line 255 "scan_tokens.rl"
-
+                        case 38:
+//line scan_tokens.rl:266
                                 te = p + 1
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 38:
-                                // line 155 "scan_tokens.rl"
-
+                        case 39:
+//line scan_tokens.rl:160
                                 te = p
                                 p--
                                 {
@@ -4904,13 +4801,12 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 39:
-                                // line 165 "scan_tokens.rl"
-
+                        case 40:
+//line scan_tokens.rl:170
                                 te = p
                                 p--
                                 {
@@ -4924,231 +4820,191 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1464
+                                                cs = 1459
                                                 goto _again
                                         }
                                 }
-                        case 40:
-                                // line 151 "scan_tokens.rl"
-
+                        case 41:
+//line scan_tokens.rl:156
                                 te = p
                                 p--
                                 {
                                         token(TokenStringLit)
                                 }
-                        case 41:
-                                // line 255 "scan_tokens.rl"
-
+                        case 42:
+//line scan_tokens.rl:266
                                 te = p
                                 p--
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 42:
-                                // line 151 "scan_tokens.rl"
-
+                        case 43:
+//line scan_tokens.rl:156
                                 p = (te) - 1
                                 {
                                         token(TokenStringLit)
                                 }
-                        case 43:
-                                // line 1 "NONE"
-
+                        case 44:
+//line NONE:1
                                 switch act {
                                 case 0:
                                         {
                                                 cs = 0
                                                 goto _again
                                         }
-                                case 14:
+                                case 15:
                                         {
                                                 p = (te) - 1
 
                                                 token(TokenStringLit)
                                         }
-                                case 15:
+                                case 16:
                                         {
                                                 p = (te) - 1
                                                 token(TokenBadUTF8)
                                         }
                                 }
 
-                        case 44:
-                                // line 259 "scan_tokens.rl"
-
-                                act = 16
                         case 45:
-                                // line 260 "scan_tokens.rl"
-
+//line scan_tokens.rl:270
                                 act = 17
                         case 46:
-                                // line 260 "scan_tokens.rl"
-
+//line scan_tokens.rl:271
+                                act = 18
+                        case 47:
+//line scan_tokens.rl:271
                                 te = p + 1
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 47:
-                                // line 261 "scan_tokens.rl"
-
+                        case 48:
+//line scan_tokens.rl:272
                                 te = p + 1
                                 {
                                         token(TokenInvalid)
                                 }
-                        case 48:
-                                // line 259 "scan_tokens.rl"
-
+                        case 49:
+//line scan_tokens.rl:270
                                 te = p
                                 p--
                                 {
                                         token(TokenIdent)
                                 }
-                        case 49:
-                                // line 260 "scan_tokens.rl"
-
+                        case 50:
+//line scan_tokens.rl:271
                                 te = p
                                 p--
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 50:
-                                // line 259 "scan_tokens.rl"
-
+                        case 51:
+//line scan_tokens.rl:270
                                 p = (te) - 1
                                 {
                                         token(TokenIdent)
                                 }
-                        case 51:
-                                // line 260 "scan_tokens.rl"
-
+                        case 52:
+//line scan_tokens.rl:271
                                 p = (te) - 1
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 52:
-                                // line 1 "NONE"
-
+                        case 53:
+//line NONE:1
                                 switch act {
-                                case 16:
+                                case 17:
                                         {
                                                 p = (te) - 1
                                                 token(TokenIdent)
                                         }
-                                case 17:
+                                case 18:
                                         {
                                                 p = (te) - 1
                                                 token(TokenBadUTF8)
                                         }
                                 }
 
-                        case 53:
-                                // line 267 "scan_tokens.rl"
-
-                                act = 21
                         case 54:
-                                // line 269 "scan_tokens.rl"
-
+//line scan_tokens.rl:278
                                 act = 22
                         case 55:
-                                // line 280 "scan_tokens.rl"
-
-                                act = 32
-                        case 56:
-                                // line 290 "scan_tokens.rl"
-
-                                act = 38
-                        case 57:
-                                // line 291 "scan_tokens.rl"
-
+//line scan_tokens.rl:301
                                 act = 39
-                        case 58:
-                                // line 269 "scan_tokens.rl"
-
+                        case 56:
+//line scan_tokens.rl:280
                                 te = p + 1
                                 {
                                         token(TokenComment)
                                 }
-                        case 59:
-                                // line 270 "scan_tokens.rl"
-
+                        case 57:
+//line scan_tokens.rl:281
                                 te = p + 1
                                 {
                                         token(TokenNewline)
                                 }
-                        case 60:
-                                // line 272 "scan_tokens.rl"
-
+                        case 58:
+//line scan_tokens.rl:283
                                 te = p + 1
                                 {
                                         token(TokenEqualOp)
                                 }
-                        case 61:
-                                // line 273 "scan_tokens.rl"
-
+                        case 59:
+//line scan_tokens.rl:284
                                 te = p + 1
                                 {
                                         token(TokenNotEqual)
                                 }
-                        case 62:
-                                // line 274 "scan_tokens.rl"
-
+                        case 60:
+//line scan_tokens.rl:285
                                 te = p + 1
                                 {
                                         token(TokenGreaterThanEq)
                                 }
-                        case 63:
-                                // line 275 "scan_tokens.rl"
-
+                        case 61:
+//line scan_tokens.rl:286
                                 te = p + 1
                                 {
                                         token(TokenLessThanEq)
                                 }
-                        case 64:
-                                // line 276 "scan_tokens.rl"
-
+                        case 62:
+//line scan_tokens.rl:287
                                 te = p + 1
                                 {
                                         token(TokenAnd)
                                 }
-                        case 65:
-                                // line 277 "scan_tokens.rl"
-
+                        case 63:
+//line scan_tokens.rl:288
                                 te = p + 1
                                 {
                                         token(TokenOr)
                                 }
-                        case 66:
-                                // line 278 "scan_tokens.rl"
-
+                        case 64:
+//line scan_tokens.rl:289
                                 te = p + 1
                                 {
                                         token(TokenEllipsis)
                                 }
-                        case 67:
-                                // line 279 "scan_tokens.rl"
-
+                        case 65:
+//line scan_tokens.rl:290
                                 te = p + 1
                                 {
                                         token(TokenFatArrow)
                                 }
-                        case 68:
-                                // line 280 "scan_tokens.rl"
-
+                        case 66:
+//line scan_tokens.rl:291
                                 te = p + 1
                                 {
                                         selfToken()
                                 }
-                        case 69:
-                                // line 175 "scan_tokens.rl"
-
+                        case 67:
+//line scan_tokens.rl:180
                                 te = p + 1
                                 {
                                         token(TokenOBrace)
                                         braces++
                                 }
-                        case 70:
-                                // line 180 "scan_tokens.rl"
-
+                        case 68:
+//line scan_tokens.rl:185
                                 te = p + 1
                                 {
                                         if len(retBraces) > 0 && retBraces[len(retBraces)-1] == braces {
@@ -5167,9 +5023,8 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 braces--
                                         }
                                 }
-                        case 71:
-                                // line 192 "scan_tokens.rl"
-
+                        case 69:
+//line scan_tokens.rl:197
                                 te = p + 1
                                 {
                                         // Only consume from the retBraces stack and return if we are at
@@ -5197,9 +5052,8 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 braces--
                                         }
                                 }
-                        case 72:
-                                // line 74 "scan_tokens.rl"
-
+                        case 70:
+//line scan_tokens.rl:79
                                 te = p + 1
                                 {
                                         token(TokenOQuote)
@@ -5207,13 +5061,12 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1515
+                                                cs = 1509
                                                 goto _again
                                         }
                                 }
-                        case 73:
-                                // line 84 "scan_tokens.rl"
-
+                        case 71:
+//line scan_tokens.rl:89
                                 te = p + 1
                                 {
                                         token(TokenOHeredoc)
@@ -5238,138 +5091,109 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                                                 stack = append(stack, 0)
                                                 stack[top] = cs
                                                 top++
-                                                cs = 1541
+                                                cs = 1523
                                                 goto _again
                                         }
                                 }
-                        case 74:
-                                // line 290 "scan_tokens.rl"
-
+                        case 72:
+//line scan_tokens.rl:301
                                 te = p + 1
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 75:
-                                // line 291 "scan_tokens.rl"
-
+                        case 73:
+//line scan_tokens.rl:302
                                 te = p + 1
                                 {
                                         token(TokenInvalid)
                                 }
-                        case 76:
-                                // line 265 "scan_tokens.rl"
-
+                        case 74:
+//line scan_tokens.rl:276
                                 te = p
                                 p--
 
-                        case 77:
-                                // line 266 "scan_tokens.rl"
-
+                        case 75:
+//line scan_tokens.rl:277
                                 te = p
                                 p--
                                 {
                                         token(TokenNumberLit)
                                 }
-                        case 78:
-                                // line 267 "scan_tokens.rl"
-
+                        case 76:
+//line scan_tokens.rl:278
                                 te = p
                                 p--
                                 {
                                         token(TokenIdent)
                                 }
-                        case 79:
-                                // line 269 "scan_tokens.rl"
-
+                        case 77:
+//line scan_tokens.rl:280
                                 te = p
                                 p--
                                 {
                                         token(TokenComment)
                                 }
-                        case 80:
-                                // line 280 "scan_tokens.rl"
-
+                        case 78:
+//line scan_tokens.rl:291
                                 te = p
                                 p--
                                 {
                                         selfToken()
                                 }
-                        case 81:
-                                // line 290 "scan_tokens.rl"
-
+                        case 79:
+//line scan_tokens.rl:301
                                 te = p
                                 p--
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 82:
-                                // line 291 "scan_tokens.rl"
-
+                        case 80:
+//line scan_tokens.rl:302
                                 te = p
                                 p--
                                 {
                                         token(TokenInvalid)
                                 }
-                        case 83:
-                                // line 266 "scan_tokens.rl"
-
+                        case 81:
+//line scan_tokens.rl:277
                                 p = (te) - 1
                                 {
                                         token(TokenNumberLit)
                                 }
-                        case 84:
-                                // line 267 "scan_tokens.rl"
-
+                        case 82:
+//line scan_tokens.rl:278
                                 p = (te) - 1
                                 {
                                         token(TokenIdent)
                                 }
-                        case 85:
-                                // line 280 "scan_tokens.rl"
-
+                        case 83:
+//line scan_tokens.rl:291
                                 p = (te) - 1
                                 {
                                         selfToken()
                                 }
-                        case 86:
-                                // line 290 "scan_tokens.rl"
-
+                        case 84:
+//line scan_tokens.rl:301
                                 p = (te) - 1
                                 {
                                         token(TokenBadUTF8)
                                 }
-                        case 87:
-                                // line 1 "NONE"
-
+                        case 85:
+//line NONE:1
                                 switch act {
-                                case 21:
-                                        {
-                                                p = (te) - 1
-                                                token(TokenIdent)
-                                        }
                                 case 22:
                                         {
                                                 p = (te) - 1
-                                                token(TokenComment)
-                                        }
-                                case 32:
-                                        {
-                                                p = (te) - 1
-                                                selfToken()
-                                        }
-                                case 38:
-                                        {
-                                                p = (te) - 1
-                                                token(TokenBadUTF8)
+                                                token(TokenIdent)
                                         }
                                 case 39:
                                         {
                                                 p = (te) - 1
-                                                token(TokenInvalid)
+                                                token(TokenBadUTF8)
                                         }
                                 }
 
-                                // line 5232 "scan_tokens.go"
+//line scan_tokens.go:5055
                         }
                 }
 
@@ -5380,17 +5204,15 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                 for ; _nacts > 0; _nacts-- {
                         _acts++
                         switch _hcltok_actions[_acts-1] {
-                        case 4:
-                                // line 1 "NONE"
-
+                        case 1:
+//line NONE:1
                                 ts = 0
 
-                        case 5:
-                                // line 1 "NONE"
-
+                        case 2:
+//line NONE:1
                                 act = 0
 
-                                // line 5252 "scan_tokens.go"
+//line scan_tokens.go:5073
                         }
                 }
 
@@ -5416,7 +5238,7 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
                 }
         }
 
-        // line 352 "scan_tokens.rl"
+//line scan_tokens.rl:363
 
         // If we fall out here without being in a final state then we've
         // encountered something that the scanner can't match, which we'll
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.rl b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.rl
index 83ef65b..4443dc4 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.rl
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.rl
@@ -9,17 +9,22 @@ import (
 
 // This file is generated from scan_tokens.rl. DO NOT EDIT.
 %%{
-  # (except you are actually in scan_tokens.rl here, so edit away!)
+  # (except when you are actually in scan_tokens.rl here, so edit away!)
 
   machine hcltok;
   write data;
 }%%
 
 func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []Token {
+    stripData := stripUTF8BOM(data)
+    start.Byte += len(data) - len(stripData)
+    data = stripData
+
     f := &tokenAccum{
-        Filename: filename,
-        Bytes:    data,
-        Pos:      start,
+        Filename:  filename,
+        Bytes:     data,
+        Pos:       start,
+        StartByte: start.Byte,
     }
 
     %%{
@@ -39,7 +44,7 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
         Ident = (ID_Start | '_') (ID_Continue | '-')*;
 
         # Symbols that just represent themselves are handled as a single rule.
-        SelfToken = "[" | "]" | "(" | ")" | "." | "," | "*" | "/" | "%" | "+" | "-" | "=" | "<" | ">" | "!" | "?" | ":" | "\n" | "&" | "|" | "~" | "^" | ";" | "`";
+        SelfToken = "[" | "]" | "(" | ")" | "." | "," | "*" | "/" | "%" | "+" | "-" | "=" | "<" | ">" | "!" | "?" | ":" | "\n" | "&" | "|" | "~" | "^" | ";" | "`" | "'";
 
         EqualOp = "==";
         NotEqual = "!=";
@@ -58,9 +63,17 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
         BeginHeredocTmpl = '<<' ('-')? Ident Newline;
 
         Comment = (
-            ("#" (any - EndOfLine)* EndOfLine) |
-            ("//" (any - EndOfLine)* EndOfLine) |
-            ("/*" any* "*/")
+            # The :>> operator in these is a "finish-guarded concatenation",
+            # which terminates the sequence on its left when it completes
+            # the sequence on its right.
+            # In the single-line comment cases this is allowing us to make
+            # the trailing EndOfLine optional while still having the overall
+            # pattern terminate. In the multi-line case it ensures that
+            # the first comment in the file ends at the first */, rather than
+            # gobbling up all of the "any*" until the _final_ */ in the file.
+            ("#" (any - EndOfLine)* :>> EndOfLine?) |
+            ("//" (any - EndOfLine)* :>> EndOfLine?) |
+            ("/*" any* :>> "*/")
         );
 
         # Note: hclwrite assumes that only ASCII spaces appear between tokens,
@@ -213,29 +226,35 @@ func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []To
         TemplateInterp = "${" ("~")?;
         TemplateControl = "%{" ("~")?;
         EndStringTmpl = '"';
-        StringLiteralChars = (AnyUTF8 - ("\r"|"\n"));
+        NewlineChars = ("\r"|"\n");
+        NewlineCharsSeq = NewlineChars+;
+        StringLiteralChars = (AnyUTF8 - NewlineChars);
+        TemplateIgnoredNonBrace = (^'{' %{ fhold; });
+        TemplateNotInterp = '$' (TemplateIgnoredNonBrace | TemplateInterp);
+        TemplateNotControl = '%' (TemplateIgnoredNonBrace | TemplateControl);
+        QuotedStringLiteralWithEsc = ('\\' StringLiteralChars) | (StringLiteralChars - ("$" | '%' | '"' | "\\"));
         TemplateStringLiteral = (
-            ('$' ^'{' %{ fhold; }) |
-            ('%' ^'{' %{ fhold; }) |
-            ('\\' StringLiteralChars) |
-            (StringLiteralChars - ("$" | '%' | '"'))
-        )+;
+            (TemplateNotInterp) |
+            (TemplateNotControl) |
+            (QuotedStringLiteralWithEsc)+
+        );
         HeredocStringLiteral = (
-            ('$' ^'{' %{ fhold; }) |
-            ('%' ^'{' %{ fhold; }) |
-            (StringLiteralChars - ("$" | '%'))
-        )*;
+            (TemplateNotInterp) |
+            (TemplateNotControl) |
+            (StringLiteralChars - ("$" | '%'))*
+        );
         BareStringLiteral = (
-            ('$' ^'{') |
-            ('%' ^'{') |
-            (StringLiteralChars - ("$" | '%'))
-        )* Newline?;
+            (TemplateNotInterp) |
+            (TemplateNotControl) |
+            (StringLiteralChars - ("$" | '%'))*
+        ) Newline?;
 
         stringTemplate := |*
             TemplateInterp        => beginTemplateInterp;
             TemplateControl       => beginTemplateControl;
             EndStringTmpl         => endStringTemplate;
             TemplateStringLiteral => { token(TokenQuotedLit); };
+            NewlineCharsSeq       => { token(TokenQuotedNewline); };
             AnyUTF8               => { token(TokenInvalid); };
             BrokenUTF8            => { token(TokenBadUTF8); };
         *|;
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/spec.md b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/spec.md
index 49b9a3e..091c1c2 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/spec.md
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/spec.md
@@ -4,18 +4,18 @@ This is the specification of the syntax and semantics of the native syntax
 for HCL. HCL is a system for defining configuration languages for applications.
 The HCL information model is designed to support multiple concrete syntaxes
 for configuration, but this native syntax is considered the primary format
-and is optimized for human authoring and maintenence, as opposed to machine
+and is optimized for human authoring and maintenance, as opposed to machine
 generation of configuration.
 
 The language consists of three integrated sub-languages:
 
-* The _structural_ language defines the overall heirarchical configuration
+- The _structural_ language defines the overall hierarchical configuration
   structure, and is a serialization of HCL bodies, blocks and attributes.
 
-* The _expression_ language is used to express attribute values, either as
+- The _expression_ language is used to express attribute values, either as
   literals or as derivations of other values.
 
-* The _template_ language is used to compose values together into strings,
+- The _template_ language is used to compose values together into strings,
   as one of several types of expression in the expression language.
 
 In normal use these three sub-languages are used together within configuration
@@ -30,19 +30,19 @@ Within this specification a semi-formal notation is used to illustrate the
 details of syntax. This notation is intended for human consumption rather
 than machine consumption, with the following conventions:
 
-* A naked name starting with an uppercase letter is a global production,
+- A naked name starting with an uppercase letter is a global production,
   common to all of the syntax specifications in this document.
-* A naked name starting with a lowercase letter is a local production,
+- A naked name starting with a lowercase letter is a local production,
   meaningful only within the specification where it is defined.
-* Double and single quotes (`"` and `'`) are used to mark literal character
+- Double and single quotes (`"` and `'`) are used to mark literal character
   sequences, which may be either punctuation markers or keywords.
-* The default operator for combining items, which has no punctuation,
+- The default operator for combining items, which has no punctuation,
   is concatenation.
-* The symbol `|` indicates that any one of its left and right operands may
+- The symbol `|` indicates that any one of its left and right operands may
   be present.
-* The `*` symbol indicates zero or more repetitions of the item to its left.
-* The `?` symbol indicates zero or one of the item to its left.
-* Parentheses (`(` and `)`) are used to group items together to apply
+- The `*` symbol indicates zero or more repetitions of the item to its left.
+- The `?` symbol indicates zero or one of the item to its left.
+- Parentheses (`(` and `)`) are used to group items together to apply
   the `|`, `*` and `?` operators to them collectively.
 
 The grammar notation does not fully describe the language. The prose may
@@ -77,11 +77,11 @@ are not valid within HCL native syntax.
 
 Comments serve as program documentation and come in two forms:
 
-* _Line comments_ start with either the `//` or `#` sequences and end with
+- _Line comments_ start with either the `//` or `#` sequences and end with
   the next newline sequence. A line comments is considered equivalent to a
   newline sequence.
 
-* _Inline comments_ start with the `/*` sequence and end with the `*/`
+- _Inline comments_ start with the `/*` sequence and end with the `*/`
   sequence, and may have any characters within except the ending sequence.
   An inline comments is considered equivalent to a whitespace sequence.
 
@@ -91,7 +91,7 @@ template literals except inside an interpolation sequence or template directive.
 ### Identifiers
 
 Identifiers name entities such as blocks, attributes and expression variables.
-Identifiers are interpreted as per [UAX #31][UAX31] Section 2. Specifically,
+Identifiers are interpreted as per [UAX #31][uax31] Section 2. Specifically,
 their syntax is defined in terms of the `ID_Start` and `ID_Continue`
 character properties as follows:
 
@@ -109,7 +109,7 @@ that is not part of the unicode `ID_Continue` definition. This is to allow
 attribute names and block type names to contain dashes, although underscores
 as word separators are considered the idiomatic usage.
 
-[UAX31]: http://unicode.org/reports/tr31/ "Unicode Identifier and Pattern Syntax"
+[uax31]: http://unicode.org/reports/tr31/ "Unicode Identifier and Pattern Syntax"
 
 ### Keywords
 
@@ -150,18 +150,19 @@ expmark    = ('e' | 'E') ("+" | "-")?;
 The structural language consists of syntax representing the following
 constructs:
 
-* _Attributes_, which assign a value to a specified name.
-* _Blocks_, which create a child body annotated by a type and optional labels.
-* _Body Content_, which consists of a collection of attributes and blocks.
+- _Attributes_, which assign a value to a specified name.
+- _Blocks_, which create a child body annotated by a type and optional labels.
+- _Body Content_, which consists of a collection of attributes and blocks.
 
 These constructs correspond to the similarly-named concepts in the
 language-agnostic HCL information model.
 
 ```ebnf
-ConfigFile = Body;
-Body       = (Attribute | Block)*;
-Attribute  = Identifier "=" Expression Newline;
-Block      = Identifier (StringLit|Identifier)* "{" Newline Body "}" Newline;
+ConfigFile   = Body;
+Body         = (Attribute | Block | OneLineBlock)*;
+Attribute    = Identifier "=" Expression Newline;
+Block        = Identifier (StringLit|Identifier)* "{" Newline Body "}" Newline;
+OneLineBlock = Identifier (StringLit|Identifier)* "{" (Identifier "=" Expression)? "}" Newline;
 ```
 
 ### Configuration Files
@@ -186,7 +187,7 @@ for later evaluation by the calling application.
 ### Blocks
 
 A _block_ creates a child body that is annotated with a block _type_ and
-zero or more block _labels_. Blocks create a structural heirachy which can be
+zero or more block _labels_. Blocks create a structural hierachy which can be
 interpreted by the calling application.
 
 Block labels can either be quoted literal strings or naked identifiers.
@@ -252,9 +253,9 @@ LiteralValue = (
 );
 ```
 
-* Numeric literals represent values of type _number_.
-* The `true` and `false` keywords represent values of type _bool_.
-* The `null` keyword represents a null value of the dynamic pseudo-type.
+- Numeric literals represent values of type _number_.
+- The `true` and `false` keywords represent values of type _bool_.
+- The `null` keyword represents a null value of the dynamic pseudo-type.
 
 String literals are not directly available in the expression sub-language, but
 are available via the template sub-language, which can in turn be incorporated
@@ -285,8 +286,8 @@ When specifying an object element, an identifier is interpreted as a literal
 attribute name as opposed to a variable reference. To populate an item key
 from a variable, use parentheses to disambiguate:
 
-* `{foo = "baz"}` is interpreted as an attribute literally named `foo`.
-* `{(foo) = "baz"}` is interpreted as an attribute whose name is taken
+- `{foo = "baz"}` is interpreted as an attribute literally named `foo`.
+- `{(foo) = "baz"}` is interpreted as an attribute whose name is taken
   from the variable named `foo`.
 
 Between the open and closing delimiters of these sequences, newline sequences
@@ -296,14 +297,14 @@ There is a syntax ambiguity between _for expressions_ and collection values
 whose first element is a reference to a variable named `for`. The
 _for expression_ interpretation has priority, so to produce a tuple whose
 first element is the value of a variable named `for`, or an object with a
-key named `for`, use paretheses to disambiguate:
+key named `for`, use parentheses to disambiguate:
 
-* `[for, foo, baz]` is a syntax error.
-* `[(for), foo, baz]` is a tuple whose first element is the value of variable
+- `[for, foo, baz]` is a syntax error.
+- `[(for), foo, baz]` is a tuple whose first element is the value of variable
   `for`.
-* `{for: 1, baz: 2}` is a syntax error.
-* `{(for): 1, baz: 2}` is an object with an attribute literally named `for`.
-* `{baz: 2, for: 1}` is equivalent to the previous example, and resolves the
+- `{for: 1, baz: 2}` is a syntax error.
+- `{(for): 1, baz: 2}` is an object with an attribute literally named `for`.
+- `{baz: 2, for: 1}` is equivalent to the previous example, and resolves the
   ambiguity by reordering.
 
 ### Template Expressions
@@ -311,9 +312,9 @@ key named `for`, use paretheses to disambiguate:
 A _template expression_ embeds a program written in the template sub-language
 as an expression. Template expressions come in two forms:
 
-* A _quoted_ template expression is delimited by quote characters (`"`) and
+- A _quoted_ template expression is delimited by quote characters (`"`) and
   defines a template as a single-line expression with escape characters.
-* A _heredoc_ template expression is introduced by a `<<` sequence and
+- A _heredoc_ template expression is introduced by a `<<` sequence and
   defines a template via a multi-line sequence terminated by a user-chosen
   delimiter.
 
@@ -321,7 +322,7 @@ In both cases the template interpolation and directive syntax is available for
 use within the delimiters, and any text outside of these special sequences is
 interpreted as a literal string.
 
-In _quoted_ template expressions any literal string sequences within the 
+In _quoted_ template expressions any literal string sequences within the
 template behave in a special way: literal newline sequences are not permitted
 and instead _escape sequences_ can be included, starting with the
 backslash `\`:
@@ -457,14 +458,14 @@ are provided, the first is the key and the second is the value.
 Tuple, object, list, map, and set types are iterable. The type of collection
 used defines how the key and value variables are populated:
 
-* For tuple and list types, the _key_ is the zero-based index into the
+- For tuple and list types, the _key_ is the zero-based index into the
   sequence for each element, and the _value_ is the element value. The
   elements are visited in index order.
-* For object and map types, the _key_ is the string attribute name or element
+- For object and map types, the _key_ is the string attribute name or element
   key, and the _value_ is the attribute or element value. The elements are
   visited in the order defined by a lexicographic sort of the attribute names
   or keys.
-* For set types, the _key_ and _value_ are both the element value. The elements
+- For set types, the _key_ and _value_ are both the element value. The elements
   are visited in an undefined but consistent order.
 
 The expression after the colon and (in the case of object `for`) the expression
@@ -482,16 +483,16 @@ object.
 In the case of object `for`, it is an error if two input elements produce
 the same result from the attribute name expression, since duplicate
 attributes are not possible. If the ellipsis symbol (`...`) appears
-immediately after the value experssion, this activates the grouping mode in
+immediately after the value expression, this activates the grouping mode in
 which each value in the resulting object is a _tuple_ of all of the values
 that were produced against each distinct key.
 
-* `[for v in ["a", "b"]: v]` returns `["a", "b"]`.
-* `[for i, v in ["a", "b"]: i]` returns `[0, 1]`.
-* `{for i, v in ["a", "b"]: v => i}` returns `{a = 0, b = 1}`.
-* `{for i, v in ["a", "a", "b"]: k => v}` produces an error, because attribute
+- `[for v in ["a", "b"]: v]` returns `["a", "b"]`.
+- `[for i, v in ["a", "b"]: i]` returns `[0, 1]`.
+- `{for i, v in ["a", "b"]: v => i}` returns `{a = 0, b = 1}`.
+- `{for i, v in ["a", "a", "b"]: k => v}` produces an error, because attribute
   `a` is defined twice.
-* `{for i, v in ["a", "a", "b"]: v => i...}` returns `{a = [0, 1], b = [2]}`.
+- `{for i, v in ["a", "a", "b"]: v => i...}` returns `{a = [0, 1], b = [2]}`.
 
 If the `if` keyword is used after the element expression(s), it applies an
 additional predicate that can be used to conditionally filter elements from
@@ -501,7 +502,7 @@ element expression(s). It must evaluate to a boolean value; if `true`, the
 element will be evaluated as normal, while if `false` the element will be
 skipped.
 
-* `[for i, v in ["a", "b", "c"]: v if i < 2]` returns `["a", "b"]`.
+- `[for i, v in ["a", "b", "c"]: v if i < 2]` returns `["a", "b"]`.
 
 If the collection value, element expression(s) or condition expression return
 unknown values that are otherwise type-valid, the result is a value of the
@@ -566,10 +567,10 @@ elements in a tuple, list, or set value.
 
 There are two kinds of "splat" operator:
 
-* The _attribute-only_ splat operator supports only attribute lookups into
+- The _attribute-only_ splat operator supports only attribute lookups into
   the elements from a list, but supports an arbitrary number of them.
 
-* The _full_ splat operator additionally supports indexing into the elements
+- The _full_ splat operator additionally supports indexing into the elements
   from a list, and allows any combination of attribute access and index
   operations.
 
@@ -582,9 +583,9 @@ fullSplat = "[" "*" "]" (GetAttr | Index)*;
 The splat operators can be thought of as shorthands for common operations that
 could otherwise be performed using _for expressions_:
 
-* `tuple.*.foo.bar[0]` is approximately equivalent to
+- `tuple.*.foo.bar[0]` is approximately equivalent to
   `[for v in tuple: v.foo.bar][0]`.
-* `tuple[*].foo.bar[0]` is approximately equivalent to
+- `tuple[*].foo.bar[0]` is approximately equivalent to
   `[for v in tuple: v.foo.bar[0]]`
 
 Note the difference in how the trailing index operator is interpreted in
@@ -596,13 +597,15 @@ _for expressions_ shown above: if a splat operator is applied to a value that
 is _not_ of tuple, list, or set type, the value is coerced automatically into
 a single-value list of the value type:
 
-* `any_object.*.id` is equivalent to `[any_object.id]`, assuming that `any_object`
+- `any_object.*.id` is equivalent to `[any_object.id]`, assuming that `any_object`
   is a single object.
-* `any_number.*` is equivalent to `[any_number]`, assuming that `any_number`
+- `any_number.*` is equivalent to `[any_number]`, assuming that `any_number`
   is a single number.
 
-If the left operand of a splat operator is an unknown value of any type, the
-result is a value of the dynamic pseudo-type.
+If applied to a null value that is not tuple, list, or set, the result is always
+an empty tuple, which allows conveniently converting a possibly-null scalar
+value into a tuple of zero or one elements. It is illegal to apply a splat
+operator to a null value of tuple, list, or set type.
 
 ### Operations
 
@@ -683,7 +686,7 @@ Arithmetic operations are considered to be performed in an arbitrary-precision
 number space.
 
 If either operand of an arithmetic operator is an unknown number or a value
-of the dynamic pseudo-type, the result is an unknown number. 
+of the dynamic pseudo-type, the result is an unknown number.
 
 ### Logic Operators
 
@@ -708,7 +711,7 @@ the outcome of a boolean expression.
 Conditional = Expression "?" Expression ":" Expression;
 ```
 
-The first expression is the _predicate_, which is  evaluated and must produce
+The first expression is the _predicate_, which is evaluated and must produce
 a boolean result. If the predicate value is `true`, the result of the second
 expression is the result of the conditional. If the predicate value is
 `false`, the result of the third expression is the result of the conditional.
@@ -769,15 +772,15 @@ sequence is escaped as `%%{`.
 
 When the template sub-language is embedded in the expression language via
 _template expressions_, additional constraints and transforms are applied to
-template literalsas described in the definition of template expressions.
+template literals as described in the definition of template expressions.
 
 The value of a template literal can be modified by _strip markers_ in any
 interpolations or directives that are adjacent to it. A strip marker is
 a tilde (`~`) placed immediately after the opening `{` or before the closing
 `}` of a template sequence:
 
-* `hello ${~ "world" }` produces `"helloworld"`.
-* `%{ if true ~} hello %{~ endif }` produces `"hello"`.
+- `hello ${~ "world" }` produces `"helloworld"`.
+- `%{ if true ~} hello %{~ endif }` produces `"hello"`.
 
 When a strip marker is present, any spaces adjacent to it in the corresponding
 string literal (if any) are removed before producing the final value. Space
@@ -786,7 +789,7 @@ characters are interpreted as per Unicode's definition.
 Stripping is done at syntax level rather than value level. Values returned
 by interpolations or directives are not subject to stripping:
 
-* `${"hello" ~}${" world"}` produces `"hello world"`, and not `"helloworld"`,
+- `${"hello" ~}${" world"}` produces `"hello world"`, and not `"helloworld"`,
   because the space is not in a template literal directly adjacent to the
   strip marker.
 
@@ -824,9 +827,9 @@ TemplateIf = (
 The evaluation of the `if` directive is equivalent to the conditional
 expression, with the following exceptions:
 
-* The two sub-templates always produce strings, and thus the result value is
+- The two sub-templates always produce strings, and thus the result value is
   also always a string.
-* The `else` clause may be omitted, in which case the conditional's third
+- The `else` clause may be omitted, in which case the conditional's third
   expression result is implied to be the empty string.
 
 ### Template For Directive
@@ -846,9 +849,9 @@ TemplateFor = (
 The evaluation of the `for` directive is equivalent to the _for expression_
 when producing a tuple, with the following exceptions:
 
-* The sub-template always produces a string.
-* There is no equivalent of the "if" clause on the for expression.
-* The elements of the resulting tuple are all converted to strings and
+- The sub-template always produces a string.
+- There is no equivalent of the "if" clause on the for expression.
+- The elements of the resulting tuple are all converted to strings and
   concatenated to produce a flat string result.
 
 ### Template Interpolation Unwrapping
@@ -864,13 +867,13 @@ template or expression syntax. Unwrapping allows arbitrary expressions to be
 used to populate attributes when strings in such languages are interpreted
 as templates.
 
-* `${true}` produces the boolean value `true`
-* `${"${true}"}` produces the boolean value `true`, because both the inner
+- `${true}` produces the boolean value `true`
+- `${"${true}"}` produces the boolean value `true`, because both the inner
   and outer interpolations are subject to unwrapping.
-* `hello ${true}` produces the string `"hello true"`
-* `${""}${true}` produces the string `"true"` because there are two
+- `hello ${true}` produces the string `"hello true"`
+- `${""}${true}` produces the string `"true"` because there are two
   interpolation sequences, even though one produces an empty result.
-* `%{ for v in [true] }${v}%{ endif }` produces the string `true` because
+- `%{ for v in [true] }${v}%{ endif }` produces the string `true` because
   the presence of the `for` directive circumvents the unwrapping even though
   the final result is a single value.
 
@@ -903,7 +906,7 @@ key/value pairs given are returned as the static pairs, with no further
 interpretation.
 
 The usual requirement that an attribute name be interpretable as a string
-does not apply to this static analyis, allowing callers to provide map-like
+does not apply to this static analysis, allowing callers to provide map-like
 constructs with different key types by building on the map syntax.
 
 ### Static Call
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/structure.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/structure.go
index d69f65b..476025d 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/structure.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/structure.go
@@ -9,6 +9,10 @@ import (
 
 // AsHCLBlock returns the block data expressed as a *hcl.Block.
 func (b *Block) AsHCLBlock() *hcl.Block {
+        if b == nil {
+                return nil
+        }
+
         lastHeaderRange := b.TypeRange
         if len(b.LabelRanges) > 0 {
                 lastHeaderRange = b.LabelRanges[len(b.LabelRanges)-1]
@@ -43,8 +47,8 @@ type Body struct {
 var assertBodyImplBody hcl.Body = &Body{}
 
 func (b *Body) walkChildNodes(w internalWalkFunc) {
-        b.Attributes = w(b.Attributes).(Attributes)
-        b.Blocks = w(b.Blocks).(Blocks)
+        w(b.Attributes)
+        w(b.Blocks)
 }
 
 func (b *Body) Range() hcl.Range {
@@ -82,8 +86,8 @@ func (b *Body) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostic
 
                         diags = append(diags, &hcl.Diagnostic{
                                 Severity: hcl.DiagError,
-                                Summary:  "Unsupported attribute",
-                                Detail:   fmt.Sprintf("An attribute named %q is not expected here.%s", name, suggestion),
+                                Summary:  "Unsupported argument",
+                                Detail:   fmt.Sprintf("An argument named %q is not expected here.%s", name, suggestion),
                                 Subject:  &attr.NameRange,
                         })
                 }
@@ -103,7 +107,7 @@ func (b *Body) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostic
                                 // Is there an attribute of the same name?
                                 for _, attrS := range schema.Attributes {
                                         if attrS.Name == blockTy {
-                                                suggestion = fmt.Sprintf(" Did you mean to define attribute %q?", blockTy)
+                                                suggestion = fmt.Sprintf(" Did you mean to define argument %q? If so, use the equals sign to assign it a value.", blockTy)
                                                 break
                                         }
                                 }
@@ -147,8 +151,8 @@ func (b *Body) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Bod
                         if attrS.Required {
                                 diags = append(diags, &hcl.Diagnostic{
                                         Severity: hcl.DiagError,
-                                        Summary:  "Missing required attribute",
-                                        Detail:   fmt.Sprintf("The attribute %q is required, but no definition was found.", attrS.Name),
+                                        Summary:  "Missing required argument",
+                                        Detail:   fmt.Sprintf("The argument %q is required, but no definition was found.", attrS.Name),
                                         Subject:  b.MissingItemRange().Ptr(),
                                 })
                         }
@@ -251,9 +255,9 @@ func (b *Body) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
                 example := b.Blocks[0]
                 diags = append(diags, &hcl.Diagnostic{
                         Severity: hcl.DiagError,
-                        Summary:  fmt.Sprintf("Unexpected %s block", example.Type),
+                        Summary:  fmt.Sprintf("Unexpected %q block", example.Type),
                         Detail:   "Blocks are not allowed here.",
-                        Context:  &example.TypeRange,
+                        Subject:  &example.TypeRange,
                 })
                 // we will continue processing anyway, and return the attributes
                 // we are able to find so that certain analyses can still be done
@@ -275,15 +279,19 @@ func (b *Body) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
 }
 
 func (b *Body) MissingItemRange() hcl.Range {
-        return b.EndRange
+        return hcl.Range{
+                Filename: b.SrcRange.Filename,
+                Start:    b.SrcRange.Start,
+                End:      b.SrcRange.Start,
+        }
 }
 
 // Attributes is the collection of attribute definitions within a body.
 type Attributes map[string]*Attribute
 
 func (a Attributes) walkChildNodes(w internalWalkFunc) {
-        for k, attr := range a {
-                a[k] = w(attr).(*Attribute)
+        for _, attr := range a {
+                w(attr)
         }
 }
 
@@ -317,7 +325,7 @@ type Attribute struct {
 }
 
 func (a *Attribute) walkChildNodes(w internalWalkFunc) {
-        a.Expr = w(a.Expr).(Expression)
+        w(a.Expr)
 }
 
 func (a *Attribute) Range() hcl.Range {
@@ -326,6 +334,9 @@ func (a *Attribute) Range() hcl.Range {
 
 // AsHCLAttribute returns the block data expressed as a *hcl.Attribute.
 func (a *Attribute) AsHCLAttribute() *hcl.Attribute {
+        if a == nil {
+                return nil
+        }
         return &hcl.Attribute{
                 Name: a.Name,
                 Expr: a.Expr,
@@ -339,8 +350,8 @@ func (a *Attribute) AsHCLAttribute() *hcl.Attribute {
 type Blocks []*Block
 
 func (bs Blocks) walkChildNodes(w internalWalkFunc) {
-        for i, block := range bs {
-                bs[i] = w(block).(*Block)
+        for _, block := range bs {
+                w(block)
         }
 }
 
@@ -371,9 +382,13 @@ type Block struct {
 }
 
 func (b *Block) walkChildNodes(w internalWalkFunc) {
-        b.Body = w(b.Body).(*Body)
+        w(b.Body)
 }
 
 func (b *Block) Range() hcl.Range {
         return hcl.RangeBetween(b.TypeRange, b.CloseBraceRange)
 }
+
+func (b *Block) DefRange() hcl.Range {
+        return hcl.RangeBetween(b.TypeRange, b.OpenBraceRange)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/structure_at_pos.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/structure_at_pos.go
new file mode 100644
index 0000000..d8f023b
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/structure_at_pos.go
@@ -0,0 +1,118 @@
+package hclsyntax
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// -----------------------------------------------------------------------------
+// The methods in this file are all optional extension methods that serve to
+// implement the methods of the same name on *hcl.File when its root body
+// is provided by this package.
+// -----------------------------------------------------------------------------
+
+// BlocksAtPos implements the method of the same name for an *hcl.File that
+// is backed by a *Body.
+func (b *Body) BlocksAtPos(pos hcl.Pos) []*hcl.Block {
+        list, _ := b.blocksAtPos(pos, true)
+        return list
+}
+
+// InnermostBlockAtPos implements the method of the same name for an *hcl.File
+// that is backed by a *Body.
+func (b *Body) InnermostBlockAtPos(pos hcl.Pos) *hcl.Block {
+        _, innermost := b.blocksAtPos(pos, false)
+        return innermost.AsHCLBlock()
+}
+
+// OutermostBlockAtPos implements the method of the same name for an *hcl.File
+// that is backed by a *Body.
+func (b *Body) OutermostBlockAtPos(pos hcl.Pos) *hcl.Block {
+        return b.outermostBlockAtPos(pos).AsHCLBlock()
+}
+
+// blocksAtPos is the internal engine of both BlocksAtPos and
+// InnermostBlockAtPos, which both need to do the same logic but return a
+// differently-shaped result.
+//
+// list is nil if makeList is false, avoiding an allocation. Innermost is
+// always set, and if the returned list is non-nil it will always match the
+// final element from that list.
+func (b *Body) blocksAtPos(pos hcl.Pos, makeList bool) (list []*hcl.Block, innermost *Block) {
+        current := b
+
+Blocks:
+        for current != nil {
+                for _, block := range current.Blocks {
+                        wholeRange := hcl.RangeBetween(block.TypeRange, block.CloseBraceRange)
+                        if wholeRange.ContainsPos(pos) {
+                                innermost = block
+                                if makeList {
+                                        list = append(list, innermost.AsHCLBlock())
+                                }
+                                current = block.Body
+                                continue Blocks
+                        }
+                }
+
+                // If we fall out here then none of the current body's nested blocks
+                // contain the position we are looking for, and so we're done.
+                break
+        }
+
+        return
+}
+
+// outermostBlockAtPos is the internal version of OutermostBlockAtPos that
+// returns a hclsyntax.Block rather than an hcl.Block, allowing for further
+// analysis if necessary.
+func (b *Body) outermostBlockAtPos(pos hcl.Pos) *Block {
+        // This is similar to blocksAtPos, but simpler because we know it only
+        // ever needs to search the first level of nested blocks.
+
+        for _, block := range b.Blocks {
+                wholeRange := hcl.RangeBetween(block.TypeRange, block.CloseBraceRange)
+                if wholeRange.ContainsPos(pos) {
+                        return block
+                }
+        }
+
+        return nil
+}
+
+// AttributeAtPos implements the method of the same name for an *hcl.File
+// that is backed by a *Body.
+func (b *Body) AttributeAtPos(pos hcl.Pos) *hcl.Attribute {
+        return b.attributeAtPos(pos).AsHCLAttribute()
+}
+
+// attributeAtPos is the internal version of AttributeAtPos that returns a
+// hclsyntax.Block rather than an hcl.Block, allowing for further analysis if
+// necessary.
+func (b *Body) attributeAtPos(pos hcl.Pos) *Attribute {
+        searchBody := b
+        _, block := b.blocksAtPos(pos, false)
+        if block != nil {
+                searchBody = block.Body
+        }
+
+        for _, attr := range searchBody.Attributes {
+                if attr.SrcRange.ContainsPos(pos) {
+                        return attr
+                }
+        }
+
+        return nil
+}
+
+// OutermostExprAtPos implements the method of the same name for an *hcl.File
+// that is backed by a *Body.
+func (b *Body) OutermostExprAtPos(pos hcl.Pos) hcl.Expression {
+        attr := b.attributeAtPos(pos)
+        if attr == nil {
+                return nil
+        }
+        if !attr.Expr.Range().ContainsPos(pos) {
+                return nil
+        }
+        return attr.Expr
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token.go
index bcaa15f..3d898fd 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token.go
@@ -1,6 +1,7 @@
 package hclsyntax
 
 import (
+        "bytes"
         "fmt"
 
         "github.com/apparentlymart/go-textseg/textseg"
@@ -84,16 +85,18 @@ const (
         // things that might work in other languages they are familiar with, or
         // simply make incorrect assumptions about the HCL language.
 
-        TokenBitwiseAnd TokenType = '&'
-        TokenBitwiseOr  TokenType = '|'
-        TokenBitwiseNot TokenType = '~'
-        TokenBitwiseXor TokenType = '^'
-        TokenStarStar   TokenType = '➚'
-        TokenBacktick   TokenType = '`'
-        TokenSemicolon  TokenType = ';'
-        TokenTabs       TokenType = '␉'
-        TokenInvalid    TokenType = '�'
-        TokenBadUTF8    TokenType = '💩'
+        TokenBitwiseAnd    TokenType = '&'
+        TokenBitwiseOr     TokenType = '|'
+        TokenBitwiseNot    TokenType = '~'
+        TokenBitwiseXor    TokenType = '^'
+        TokenStarStar      TokenType = '➚'
+        TokenApostrophe    TokenType = '\''
+        TokenBacktick      TokenType = '`'
+        TokenSemicolon     TokenType = ';'
+        TokenTabs          TokenType = '␉'
+        TokenInvalid       TokenType = '�'
+        TokenBadUTF8       TokenType = '💩'
+        TokenQuotedNewline TokenType = '␤'
 
         // TokenNil is a placeholder for when a token is required but none is
         // available, e.g. when reporting errors. The scanner will never produce
@@ -114,10 +117,11 @@ const (
 )
 
 type tokenAccum struct {
-        Filename string
-        Bytes    []byte
-        Pos      hcl.Pos
-        Tokens   []Token
+        Filename  string
+        Bytes     []byte
+        Pos       hcl.Pos
+        Tokens    []Token
+        StartByte int
 }
 
 func (f *tokenAccum) emitToken(ty TokenType, startOfs, endOfs int) {
@@ -125,11 +129,11 @@ func (f *tokenAccum) emitToken(ty TokenType, startOfs, endOfs int) {
         // the start pos to get our end pos.
 
         start := f.Pos
-        start.Column += startOfs - f.Pos.Byte // Safe because only ASCII spaces can be in the offset
-        start.Byte = startOfs
+        start.Column += startOfs + f.StartByte - f.Pos.Byte // Safe because only ASCII spaces can be in the offset
+        start.Byte = startOfs + f.StartByte
 
         end := start
-        end.Byte = endOfs
+        end.Byte = endOfs + f.StartByte
         b := f.Bytes[startOfs:endOfs]
         for len(b) > 0 {
                 advance, seq, _ := textseg.ScanGraphemeClusters(b, true)
@@ -160,6 +164,13 @@ type heredocInProgress struct {
         StartOfLine bool
 }
 
+func tokenOpensFlushHeredoc(tok Token) bool {
+        if tok.Type != TokenOHeredoc {
+                return false
+        }
+        return bytes.HasPrefix(tok.Bytes, []byte{'<', '<', '-'})
+}
+
 // checkInvalidTokens does a simple pass across the given tokens and generates
 // diagnostics for tokens that should _never_ appear in HCL source. This
 // is intended to avoid the need for the parser to have special support
@@ -174,11 +185,15 @@ func checkInvalidTokens(tokens Tokens) hcl.Diagnostics {
         toldBitwise := 0
         toldExponent := 0
         toldBacktick := 0
+        toldApostrophe := 0
         toldSemicolon := 0
         toldTabs := 0
         toldBadUTF8 := 0
 
         for _, tok := range tokens {
+                // copy token so it's safe to point to it
+                tok := tok
+
                 switch tok.Type {
                 case TokenBitwiseAnd, TokenBitwiseOr, TokenBitwiseXor, TokenBitwiseNot:
                         if toldBitwise < 4 {
@@ -214,22 +229,36 @@ func checkInvalidTokens(tokens Tokens) hcl.Diagnostics {
                 case TokenBacktick:
                         // Only report for alternating (even) backticks, so we won't report both start and ends of the same
                         // backtick-quoted string.
-                        if toldExponent < 4 && (toldExponent%2) == 0 {
+                        if (toldBacktick % 2) == 0 {
                                 diags = append(diags, &hcl.Diagnostic{
                                         Severity: hcl.DiagError,
                                         Summary:  "Invalid character",
                                         Detail:   "The \"`\" character is not valid. To create a multi-line string, use the \"heredoc\" syntax, like \"<<EOT\".",
                                         Subject:  &tok.Range,
                                 })
-
+                        }
+                        if toldBacktick <= 2 {
                                 toldBacktick++
                         }
+                case TokenApostrophe:
+                        if (toldApostrophe % 2) == 0 {
+                                newDiag := &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid character",
+                                        Detail:   "Single quotes are not valid. Use double quotes (\") to enclose strings.",
+                                        Subject:  &tok.Range,
+                                }
+                                diags = append(diags, newDiag)
+                        }
+                        if toldApostrophe <= 2 {
+                                toldApostrophe++
+                        }
                 case TokenSemicolon:
                         if toldSemicolon < 1 {
                                 diags = append(diags, &hcl.Diagnostic{
                                         Severity: hcl.DiagError,
                                         Summary:  "Invalid character",
-                                        Detail:   "The \";\" character is not valid. Use newlines to separate attributes and blocks, and commas to separate items in collection values.",
+                                        Detail:   "The \";\" character is not valid. Use newlines to separate arguments and blocks, and commas to separate items in collection values.",
                                         Subject:  &tok.Range,
                                 })
 
@@ -257,6 +286,13 @@ func checkInvalidTokens(tokens Tokens) hcl.Diagnostics {
 
                                 toldBadUTF8++
                         }
+                case TokenQuotedNewline:
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid multi-line string",
+                                Detail:   "Quoted strings may not be split over multiple lines. To produce a multi-line string, either use the \\n escape to represent a newline character or use the \"heredoc\" multi-line template syntax.",
+                                Subject:  &tok.Range,
+                        })
                 case TokenInvalid:
                         diags = append(diags, &hcl.Diagnostic{
                                 Severity: hcl.DiagError,
@@ -264,9 +300,21 @@ func checkInvalidTokens(tokens Tokens) hcl.Diagnostics {
                                 Detail:   "This character is not used within the language.",
                                 Subject:  &tok.Range,
                         })
-
-                        toldTabs++
                 }
         }
         return diags
 }
+
+var utf8BOM = []byte{0xef, 0xbb, 0xbf}
+
+// stripUTF8BOM checks whether the given buffer begins with a UTF-8 byte order
+// mark (0xEF 0xBB 0xBF) and, if so, returns a truncated slice with the same
+// backing array but with the BOM skipped.
+//
+// If there is no BOM present, the given slice is returned verbatim.
+func stripUTF8BOM(src []byte) []byte {
+        if bytes.HasPrefix(src, utf8BOM) {
+                return src[3:]
+        }
+        return src
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token_type_string.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token_type_string.go
index 93de7ee..c23c4f0 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token_type_string.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token_type_string.go
@@ -4,7 +4,67 @@ package hclsyntax
 
 import "strconv"
 
-const _TokenType_name = "TokenNilTokenNewlineTokenBangTokenPercentTokenBitwiseAndTokenOParenTokenCParenTokenStarTokenPlusTokenCommaTokenMinusTokenDotTokenSlashTokenColonTokenSemicolonTokenLessThanTokenEqualTokenGreaterThanTokenQuestionTokenCommentTokenOHeredocTokenIdentTokenNumberLitTokenQuotedLitTokenStringLitTokenOBrackTokenCBrackTokenBitwiseXorTokenBacktickTokenCHeredocTokenOBraceTokenBitwiseOrTokenCBraceTokenBitwiseNotTokenOQuoteTokenCQuoteTokenTemplateControlTokenEllipsisTokenFatArrowTokenTemplateSeqEndTokenAndTokenOrTokenTemplateInterpTokenEqualOpTokenNotEqualTokenLessThanEqTokenGreaterThanEqTokenEOFTokenTabsTokenStarStarTokenInvalidTokenBadUTF8"
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[TokenOBrace-123]
+        _ = x[TokenCBrace-125]
+        _ = x[TokenOBrack-91]
+        _ = x[TokenCBrack-93]
+        _ = x[TokenOParen-40]
+        _ = x[TokenCParen-41]
+        _ = x[TokenOQuote-171]
+        _ = x[TokenCQuote-187]
+        _ = x[TokenOHeredoc-72]
+        _ = x[TokenCHeredoc-104]
+        _ = x[TokenStar-42]
+        _ = x[TokenSlash-47]
+        _ = x[TokenPlus-43]
+        _ = x[TokenMinus-45]
+        _ = x[TokenPercent-37]
+        _ = x[TokenEqual-61]
+        _ = x[TokenEqualOp-8788]
+        _ = x[TokenNotEqual-8800]
+        _ = x[TokenLessThan-60]
+        _ = x[TokenLessThanEq-8804]
+        _ = x[TokenGreaterThan-62]
+        _ = x[TokenGreaterThanEq-8805]
+        _ = x[TokenAnd-8743]
+        _ = x[TokenOr-8744]
+        _ = x[TokenBang-33]
+        _ = x[TokenDot-46]
+        _ = x[TokenComma-44]
+        _ = x[TokenEllipsis-8230]
+        _ = x[TokenFatArrow-8658]
+        _ = x[TokenQuestion-63]
+        _ = x[TokenColon-58]
+        _ = x[TokenTemplateInterp-8747]
+        _ = x[TokenTemplateControl-955]
+        _ = x[TokenTemplateSeqEnd-8718]
+        _ = x[TokenQuotedLit-81]
+        _ = x[TokenStringLit-83]
+        _ = x[TokenNumberLit-78]
+        _ = x[TokenIdent-73]
+        _ = x[TokenComment-67]
+        _ = x[TokenNewline-10]
+        _ = x[TokenEOF-9220]
+        _ = x[TokenBitwiseAnd-38]
+        _ = x[TokenBitwiseOr-124]
+        _ = x[TokenBitwiseNot-126]
+        _ = x[TokenBitwiseXor-94]
+        _ = x[TokenStarStar-10138]
+        _ = x[TokenApostrophe-39]
+        _ = x[TokenBacktick-96]
+        _ = x[TokenSemicolon-59]
+        _ = x[TokenTabs-9225]
+        _ = x[TokenInvalid-65533]
+        _ = x[TokenBadUTF8-128169]
+        _ = x[TokenQuotedNewline-9252]
+        _ = x[TokenNil-0]
+}
+
+const _TokenType_name = "TokenNilTokenNewlineTokenBangTokenPercentTokenBitwiseAndTokenApostropheTokenOParenTokenCParenTokenStarTokenPlusTokenCommaTokenMinusTokenDotTokenSlashTokenColonTokenSemicolonTokenLessThanTokenEqualTokenGreaterThanTokenQuestionTokenCommentTokenOHeredocTokenIdentTokenNumberLitTokenQuotedLitTokenStringLitTokenOBrackTokenCBrackTokenBitwiseXorTokenBacktickTokenCHeredocTokenOBraceTokenBitwiseOrTokenCBraceTokenBitwiseNotTokenOQuoteTokenCQuoteTokenTemplateControlTokenEllipsisTokenFatArrowTokenTemplateSeqEndTokenAndTokenOrTokenTemplateInterpTokenEqualOpTokenNotEqualTokenLessThanEqTokenGreaterThanEqTokenEOFTokenTabsTokenQuotedNewlineTokenStarStarTokenInvalidTokenBadUTF8"
 
 var _TokenType_map = map[TokenType]string{
         0:      _TokenType_name[0:8],
@@ -12,53 +72,55 @@ var _TokenType_map = map[TokenType]string{
         33:     _TokenType_name[20:29],
         37:     _TokenType_name[29:41],
         38:     _TokenType_name[41:56],
-        40:     _TokenType_name[56:67],
-        41:     _TokenType_name[67:78],
-        42:     _TokenType_name[78:87],
-        43:     _TokenType_name[87:96],
-        44:     _TokenType_name[96:106],
-        45:     _TokenType_name[106:116],
-        46:     _TokenType_name[116:124],
-        47:     _TokenType_name[124:134],
-        58:     _TokenType_name[134:144],
-        59:     _TokenType_name[144:158],
-        60:     _TokenType_name[158:171],
-        61:     _TokenType_name[171:181],
-        62:     _TokenType_name[181:197],
-        63:     _TokenType_name[197:210],
-        67:     _TokenType_name[210:222],
-        72:     _TokenType_name[222:235],
-        73:     _TokenType_name[235:245],
-        78:     _TokenType_name[245:259],
-        81:     _TokenType_name[259:273],
-        83:     _TokenType_name[273:287],
-        91:     _TokenType_name[287:298],
-        93:     _TokenType_name[298:309],
-        94:     _TokenType_name[309:324],
-        96:     _TokenType_name[324:337],
-        104:    _TokenType_name[337:350],
-        123:    _TokenType_name[350:361],
-        124:    _TokenType_name[361:375],
-        125:    _TokenType_name[375:386],
-        126:    _TokenType_name[386:401],
-        171:    _TokenType_name[401:412],
-        187:    _TokenType_name[412:423],
-        955:    _TokenType_name[423:443],
-        8230:   _TokenType_name[443:456],
-        8658:   _TokenType_name[456:469],
-        8718:   _TokenType_name[469:488],
-        8743:   _TokenType_name[488:496],
-        8744:   _TokenType_name[496:503],
-        8747:   _TokenType_name[503:522],
-        8788:   _TokenType_name[522:534],
-        8800:   _TokenType_name[534:547],
-        8804:   _TokenType_name[547:562],
-        8805:   _TokenType_name[562:580],
-        9220:   _TokenType_name[580:588],
-        9225:   _TokenType_name[588:597],
-        10138:  _TokenType_name[597:610],
-        65533:  _TokenType_name[610:622],
-        128169: _TokenType_name[622:634],
+        39:     _TokenType_name[56:71],
+        40:     _TokenType_name[71:82],
+        41:     _TokenType_name[82:93],
+        42:     _TokenType_name[93:102],
+        43:     _TokenType_name[102:111],
+        44:     _TokenType_name[111:121],
+        45:     _TokenType_name[121:131],
+        46:     _TokenType_name[131:139],
+        47:     _TokenType_name[139:149],
+        58:     _TokenType_name[149:159],
+        59:     _TokenType_name[159:173],
+        60:     _TokenType_name[173:186],
+        61:     _TokenType_name[186:196],
+        62:     _TokenType_name[196:212],
+        63:     _TokenType_name[212:225],
+        67:     _TokenType_name[225:237],
+        72:     _TokenType_name[237:250],
+        73:     _TokenType_name[250:260],
+        78:     _TokenType_name[260:274],
+        81:     _TokenType_name[274:288],
+        83:     _TokenType_name[288:302],
+        91:     _TokenType_name[302:313],
+        93:     _TokenType_name[313:324],
+        94:     _TokenType_name[324:339],
+        96:     _TokenType_name[339:352],
+        104:    _TokenType_name[352:365],
+        123:    _TokenType_name[365:376],
+        124:    _TokenType_name[376:390],
+        125:    _TokenType_name[390:401],
+        126:    _TokenType_name[401:416],
+        171:    _TokenType_name[416:427],
+        187:    _TokenType_name[427:438],
+        955:    _TokenType_name[438:458],
+        8230:   _TokenType_name[458:471],
+        8658:   _TokenType_name[471:484],
+        8718:   _TokenType_name[484:503],
+        8743:   _TokenType_name[503:511],
+        8744:   _TokenType_name[511:518],
+        8747:   _TokenType_name[518:537],
+        8788:   _TokenType_name[537:549],
+        8800:   _TokenType_name[549:562],
+        8804:   _TokenType_name[562:577],
+        8805:   _TokenType_name[577:595],
+        9220:   _TokenType_name[595:603],
+        9225:   _TokenType_name[603:612],
+        9252:   _TokenType_name[612:630],
+        10138:  _TokenType_name[630:643],
+        65533:  _TokenType_name[643:655],
+        128169: _TokenType_name[655:667],
 }
 
 func (i TokenType) String() string {
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/variables.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/variables.go
index eeee1a5..91f417f 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/variables.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/variables.go
@@ -72,15 +72,15 @@ func (w *variablesWalker) Exit(n Node) hcl.Diagnostics {
 // that the child scope struct wraps.
 type ChildScope struct {
         LocalNames map[string]struct{}
-        Expr       *Expression // pointer because it can be replaced on walk
+        Expr       Expression
 }
 
 func (e ChildScope) walkChildNodes(w internalWalkFunc) {
-        *(e.Expr) = w(*(e.Expr)).(Expression)
+        w(e.Expr)
 }
 
 // Range returns the range of the expression that the ChildScope is
 // encapsulating. It isn't really very useful to call Range on a ChildScope.
 func (e ChildScope) Range() hcl.Range {
-        return (*e.Expr).Range()
+        return e.Expr.Range()
 }
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/walk.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/walk.go
index 3405d26..90f81c9 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/walk.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/walk.go
@@ -15,9 +15,8 @@ type VisitFunc func(node Node) hcl.Diagnostics
 // and returned as a single set.
 func VisitAll(node Node, f VisitFunc) hcl.Diagnostics {
         diags := f(node)
-        node.walkChildNodes(func(node Node) Node {
+        node.walkChildNodes(func(node Node) {
                 diags = append(diags, VisitAll(node, f)...)
-                return node
         })
         return diags
 }
@@ -33,45 +32,10 @@ type Walker interface {
 // Enter and Exit functions.
 func Walk(node Node, w Walker) hcl.Diagnostics {
         diags := w.Enter(node)
-        node.walkChildNodes(func(node Node) Node {
+        node.walkChildNodes(func(node Node) {
                 diags = append(diags, Walk(node, w)...)
-                return node
         })
+        moreDiags := w.Exit(node)
+        diags = append(diags, moreDiags...)
         return diags
 }
-
-// Transformer is an interface used with Transform
-type Transformer interface {
-        // Transform accepts a node and returns a replacement node along with
-        // a flag for whether to also visit child nodes. If the flag is false,
-        // none of the child nodes will be visited and the TransformExit method
-        // will not be called for the node.
-        //
-        // It is acceptable and appropriate for Transform to return the same node
-        // it was given, for situations where no transform is needed.
-        Transform(node Node) (Node, bool, hcl.Diagnostics)
-
-        // TransformExit signals the end of transformations of child nodes of the
-        // given node. If Transform returned a new node, the given node is the
-        // node that was returned, rather than the node that was originally
-        // encountered.
-        TransformExit(node Node) hcl.Diagnostics
-}
-
-// Transform allows for in-place transformations of an AST starting with a
-// particular node. The provider Transformer implementation drives the
-// transformation process. The return value is the node that replaced the
-// given top-level node.
-func Transform(node Node, t Transformer) (Node, hcl.Diagnostics) {
-        newNode, descend, diags := t.Transform(node)
-        if !descend {
-                return newNode, diags
-        }
-        node.walkChildNodes(func(node Node) Node {
-                newNode, newDiags := Transform(node, t)
-                diags = append(diags, newDiags...)
-                return newNode
-        })
-        diags = append(diags, t.TransformExit(newNode)...)
-        return newNode, diags
-}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/json/parser.go b/vendor/github.com/hashicorp/hcl2/hcl/json/parser.go
index 246fd1c..d368ea8 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/json/parser.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/json/parser.go
@@ -3,9 +3,9 @@ package json
 import (
         "encoding/json"
         "fmt"
-        "math/big"
 
         "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
 )
 
 func parseFileContent(buf []byte, filename string) (node, hcl.Diagnostics) {
@@ -55,7 +55,7 @@ func parseValue(p *peeker) (node, hcl.Diagnostics) {
                 return wrapInvalid(nil, hcl.Diagnostics{
                         {
                                 Severity: hcl.DiagError,
-                                Summary:  "Missing attribute value",
+                                Summary:  "Missing JSON value",
                                 Detail:   "A JSON value must start with a brace, a bracket, a number, a string, or a keyword.",
                                 Subject:  &tok.Range,
                         },
@@ -144,8 +144,8 @@ Token:
                 if !ok {
                         return nil, diags.Append(&hcl.Diagnostic{
                                 Severity: hcl.DiagError,
-                                Summary:  "Invalid object attribute name",
-                                Detail:   "A JSON object attribute name must be a string",
+                                Summary:  "Invalid object property name",
+                                Detail:   "A JSON object property name must be a string",
                                 Subject:  keyNode.StartRange().Ptr(),
                         })
                 }
@@ -171,7 +171,7 @@ Token:
                                 // Possible confusion with native HCL syntax.
                                 return nil, diags.Append(&hcl.Diagnostic{
                                         Severity: hcl.DiagError,
-                                        Summary:  "Missing attribute value colon",
+                                        Summary:  "Missing property value colon",
                                         Detail:   "JSON uses a colon as its name/value delimiter, not an equals sign.",
                                         Subject:  &colon.Range,
                                 })
@@ -179,8 +179,8 @@ Token:
 
                         return nil, diags.Append(&hcl.Diagnostic{
                                 Severity: hcl.DiagError,
-                                Summary:  "Missing attribute value colon",
-                                Detail:   "A colon must appear between an object attribute's name and its value.",
+                                Summary:  "Missing property value colon",
+                                Detail:   "A colon must appear between an object property's name and its value.",
                                 Subject:  &colon.Range,
                         })
                 }
@@ -205,7 +205,7 @@ Token:
                                 return nil, diags.Append(&hcl.Diagnostic{
                                         Severity: hcl.DiagError,
                                         Summary:  "Trailing comma in object",
-                                        Detail:   "JSON does not permit a trailing comma after the final attribute in an object.",
+                                        Detail:   "JSON does not permit a trailing comma after the final property in an object.",
                                         Subject:  &comma.Range,
                                 })
                         }
@@ -234,7 +234,7 @@ Token:
                         return nil, diags.Append(&hcl.Diagnostic{
                                 Severity: hcl.DiagError,
                                 Summary:  "Missing attribute seperator comma",
-                                Detail:   "A comma must appear between each attribute declaration in an object.",
+                                Detail:   "A comma must appear between each property definition in an object.",
                                 Subject:  p.Peek().Range.Ptr(),
                         })
                 }
@@ -301,7 +301,7 @@ Token:
                                 return nil, diags.Append(&hcl.Diagnostic{
                                         Severity: hcl.DiagError,
                                         Summary:  "Trailing comma in array",
-                                        Detail:   "JSON does not permit a trailing comma after the final attribute in an array.",
+                                        Detail:   "JSON does not permit a trailing comma after the final value in an array.",
                                         Subject:  &comma.Range,
                                 })
                         }
@@ -370,10 +370,15 @@ func parseNumber(p *peeker) (node, hcl.Diagnostics) {
                 }
         }
 
-        f, _, err := big.ParseFloat(string(num), 10, 512, big.ToNearestEven)
+        // We want to guarantee that we parse numbers the same way as cty (and thus
+        // native syntax HCL) would here, so we'll use the cty parser even though
+        // in most other cases we don't actually introduce cty concepts until
+        // decoding time. We'll unwrap the parsed float immediately afterwards, so
+        // the cty value is just a temporary helper.
+        nv, err := cty.ParseNumberVal(string(num))
         if err != nil {
                 // Should never happen if above passed, since JSON numbers are a subset
-                // of what big.Float can parse...
+                // of what cty can parse...
                 return nil, hcl.Diagnostics{
                         {
                                 Severity: hcl.DiagError,
@@ -385,7 +390,7 @@ func parseNumber(p *peeker) (node, hcl.Diagnostics) {
         }
 
         return &numberVal{
-                Value:    f,
+                Value:    nv.AsBigFloat(),
                 SrcRange: tok.Range,
         }, nil
 }
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/json/scanner.go b/vendor/github.com/hashicorp/hcl2/hcl/json/scanner.go
index 0a8378b..da72884 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/json/scanner.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/json/scanner.go
@@ -153,7 +153,7 @@ func byteCanStartKeyword(b byte) bool {
         // in the parser, where we can generate better diagnostics.
         // So e.g. we want to be able to say:
         //   unrecognized keyword "True". Did you mean "true"?
-        case b >= 'a' || b <= 'z' || b >= 'A' || b <= 'Z':
+        case isAlphabetical(b):
                 return true
         default:
                 return false
@@ -167,7 +167,7 @@ Byte:
         for i = 0; i < len(buf); i++ {
                 b := buf[i]
                 switch {
-                case (b >= 'a' && b <= 'z') || (b >= 'A' && b <= 'Z') || b == '_':
+                case isAlphabetical(b) || b == '_':
                         p.Pos.Byte++
                         p.Pos.Column++
                 default:
@@ -291,3 +291,7 @@ func posRange(start, end pos) hcl.Range {
 func (t token) GoString() string {
         return fmt.Sprintf("json.token{json.%s, []byte(%q), %#v}", t.Type, t.Bytes, t.Range)
 }
+
+func isAlphabetical(b byte) bool {
+        return (b >= 'a' && b <= 'z') || (b >= 'A' && b <= 'Z')
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/json/spec.md b/vendor/github.com/hashicorp/hcl2/hcl/json/spec.md
index 9b33c7f..dac5729 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/json/spec.md
+++ b/vendor/github.com/hashicorp/hcl2/hcl/json/spec.md
@@ -5,7 +5,7 @@ for defining configuration languages for applications. The HCL information
 model is designed to support multiple concrete syntaxes for configuration,
 and this JSON-based format complements [the native syntax](../hclsyntax/spec.md)
 by being easy to machine-generate, whereas the native syntax is oriented
-towards human authoring and maintenence.
+towards human authoring and maintenance
 
 This syntax is defined in terms of JSON as defined in
 [RFC7159](https://tools.ietf.org/html/rfc7159). As such it inherits the JSON
@@ -18,11 +18,11 @@ _Parsing_ such JSON has some additional constraints not beyond what is normally
 supported by JSON parsers, so a specialized parser may be required that
 is able to:
 
-* Preserve the relative ordering of properties defined in an object.
-* Preserve multiple definitions of the same property name.
-* Preserve numeric values to the precision required by the number type
+- Preserve the relative ordering of properties defined in an object.
+- Preserve multiple definitions of the same property name.
+- Preserve numeric values to the precision required by the number type
   in [the HCL syntax-agnostic information model](../spec.md).
-* Retain source location information for parsed tokens/constructs in order
+- Retain source location information for parsed tokens/constructs in order
   to produce good error messages.
 
 ## Structural Elements
@@ -118,6 +118,7 @@ type:
   ]
 }
 ```
+
 ```json
 {
   "foo": []
@@ -147,7 +148,7 @@ the following examples:
     "boz": {
       "baz": {
         "child_attr": "baz"
-      },
+      }
     }
   }
 }
@@ -189,7 +190,7 @@ the following examples:
         "boz": {
           "child_attr": "baz"
         }
-      },
+      }
     },
     {
       "bar": {
@@ -280,9 +281,9 @@ When interpreted as an expression, a JSON array represents a value of a HCL
 tuple type.
 
 Each element of the JSON array represents an element of the HCL tuple type.
-The tuple type is constructed by enumerationg the JSON array elements, creating
+The tuple type is constructed by enumerating the JSON array elements, creating
 for each an element whose type is the result of recursively applying the
-expression mapping rules. Correspondance is preserved between the array element
+expression mapping rules. Correspondence is preserved between the array element
 indices and the tuple element indices.
 
 An instance of the constructed tuple type is then created, whose values are
@@ -325,7 +326,7 @@ HCL null value of the dynamic pseudo-type.
 
 ### Strings
 
-When intepreted as an expression, a JSON string may be interpreted in one of
+When interpreted as an expression, a JSON string may be interpreted in one of
 two ways depending on the evaluation mode.
 
 If evaluating in literal-only mode (as defined by the syntax-agnostic
@@ -402,4 +403,3 @@ to that expression.
 
 If the original expression is not a string or its contents cannot be parsed
 as a native syntax expression then static call analysis is not supported.
-
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/json/structure.go b/vendor/github.com/hashicorp/hcl2/hcl/json/structure.go
index 28dcf52..bdc0e98 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/json/structure.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/json/structure.go
@@ -64,7 +64,7 @@ func (b *body) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostic
                         diags = append(diags, &hcl.Diagnostic{
                                 Severity: hcl.DiagError,
                                 Summary:  "Extraneous JSON object property",
-                                Detail:   fmt.Sprintf("No attribute or block type is named %q.%s", k, suggestion),
+                                Detail:   fmt.Sprintf("No argument or block type is named %q.%s", k, suggestion),
                                 Subject:  &attr.NameRange,
                                 Context:  attr.Range().Ptr(),
                         })
@@ -114,8 +114,8 @@ func (b *body) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Bod
                         if existing, exists := content.Attributes[attrName]; exists {
                                 diags = append(diags, &hcl.Diagnostic{
                                         Severity: hcl.DiagError,
-                                        Summary:  "Duplicate attribute definition",
-                                        Detail:   fmt.Sprintf("The attribute %q was already defined at %s.", attrName, existing.Range),
+                                        Summary:  "Duplicate argument",
+                                        Detail:   fmt.Sprintf("The argument %q was already set at %s.", attrName, existing.Range),
                                         Subject:  &jsonAttr.NameRange,
                                         Context:  jsonAttr.Range().Ptr(),
                                 })
@@ -149,8 +149,8 @@ func (b *body) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Bod
                 if _, defined := content.Attributes[attrS.Name]; !defined {
                         diags = append(diags, &hcl.Diagnostic{
                                 Severity: hcl.DiagError,
-                                Summary:  "Missing required attribute",
-                                Detail:   fmt.Sprintf("The attribute %q is required, but no definition was found.", attrS.Name),
+                                Summary:  "Missing required argument",
+                                Detail:   fmt.Sprintf("The argument %q is required, but no definition was found.", attrS.Name),
                                 Subject:  b.MissingItemRange().Ptr(),
                         })
                 }
@@ -175,7 +175,7 @@ func (b *body) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
                 diags = append(diags, &hcl.Diagnostic{
                         Severity: hcl.DiagError,
                         Summary:  "Incorrect JSON value type",
-                        Detail:   "A JSON object is required here, defining the attributes for this block.",
+                        Detail:   "A JSON object is required here, setting the arguments for this block.",
                         Subject:  b.val.StartRange().Ptr(),
                 })
                 return attrs, diags
@@ -197,7 +197,7 @@ func (b *body) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
                         diags = append(diags, &hcl.Diagnostic{
                                 Severity: hcl.DiagError,
                                 Summary:  "Duplicate attribute definition",
-                                Detail:   fmt.Sprintf("The attribute %q was already defined at %s.", name, existing.Range),
+                                Detail:   fmt.Sprintf("The argument %q was already set at %s.", name, existing.Range),
                                 Subject:  &jsonAttr.NameRange,
                         })
                         continue
@@ -266,6 +266,9 @@ func (b *body) unpackBlock(v node, typeName string, typeRange *hcl.Range, labels
         copy(labelR, labelRanges)
 
         switch tv := v.(type) {
+        case *nullVal:
+                // There is no block content, e.g the value is null.
+                return
         case *objectVal:
                 // Single instance of the block
                 *blocks = append(*blocks, &hcl.Block{
@@ -324,6 +327,8 @@ func (b *body) collectDeepAttrs(v node, labelName *string) ([]*objectAttr, hcl.D
         var attrs []*objectAttr
 
         switch tv := v.(type) {
+        case *nullVal:
+                // If a value is null, then we don't return any attributes or return an error.
 
         case *objectVal:
                 attrs = append(attrs, tv.Attrs...)
@@ -345,7 +350,7 @@ func (b *body) collectDeepAttrs(v node, labelName *string) ([]*objectAttr, hcl.D
                                         diags = append(diags, &hcl.Diagnostic{
                                                 Severity: hcl.DiagError,
                                                 Summary:  "Incorrect JSON value type",
-                                                Detail:   "A JSON object is required here, to define attributes and child blocks.",
+                                                Detail:   "A JSON object is required here, to define arguments and child blocks.",
                                                 Subject:  ev.StartRange().Ptr(),
                                         })
                                 }
@@ -364,7 +369,7 @@ func (b *body) collectDeepAttrs(v node, labelName *string) ([]*objectAttr, hcl.D
                         diags = append(diags, &hcl.Diagnostic{
                                 Severity: hcl.DiagError,
                                 Summary:  "Incorrect JSON value type",
-                                Detail:   "Either a JSON object or JSON array of objects is required here, to define attributes and child blocks.",
+                                Detail:   "Either a JSON object or JSON array of objects is required here, to define arguments and child blocks.",
                                 Subject:  v.StartRange().Ptr(),
                         })
                 }
@@ -424,7 +429,7 @@ func (e *expression) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                 known := true
                 for _, jsonAttr := range v.Attrs {
                         // In this one context we allow keys to contain interpolation
-                        // experessions too, assuming we're evaluating in interpolation
+                        // expressions too, assuming we're evaluating in interpolation
                         // mode. This achieves parity with the native syntax where
                         // object expressions can have dynamic keys, while block contents
                         // may not.
@@ -432,7 +437,8 @@ func (e *expression) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                                 Value:    jsonAttr.Name,
                                 SrcRange: jsonAttr.NameRange,
                         }}).Value(ctx)
-                        val, valDiags := (&expression{src: jsonAttr.Value}).Value(ctx)
+                        valExpr := &expression{src: jsonAttr.Value}
+                        val, valDiags := valExpr.Value(ctx)
                         diags = append(diags, nameDiags...)
                         diags = append(diags, valDiags...)
 
@@ -440,19 +446,23 @@ func (e *expression) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                         name, err = convert.Convert(name, cty.String)
                         if err != nil {
                                 diags = append(diags, &hcl.Diagnostic{
-                                        Severity: hcl.DiagError,
-                                        Summary:  "Invalid object key expression",
-                                        Detail:   fmt.Sprintf("Cannot use this expression as an object key: %s.", err),
-                                        Subject:  &jsonAttr.NameRange,
+                                        Severity:    hcl.DiagError,
+                                        Summary:     "Invalid object key expression",
+                                        Detail:      fmt.Sprintf("Cannot use this expression as an object key: %s.", err),
+                                        Subject:     &jsonAttr.NameRange,
+                                        Expression:  valExpr,
+                                        EvalContext: ctx,
                                 })
                                 continue
                         }
                         if name.IsNull() {
                                 diags = append(diags, &hcl.Diagnostic{
-                                        Severity: hcl.DiagError,
-                                        Summary:  "Invalid object key expression",
-                                        Detail:   "Cannot use null value as an object key.",
-                                        Subject:  &jsonAttr.NameRange,
+                                        Severity:    hcl.DiagError,
+                                        Summary:     "Invalid object key expression",
+                                        Detail:      "Cannot use null value as an object key.",
+                                        Subject:     &jsonAttr.NameRange,
+                                        Expression:  valExpr,
+                                        EvalContext: ctx,
                                 })
                                 continue
                         }
@@ -471,10 +481,12 @@ func (e *expression) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                         nameStr := name.AsString()
                         if _, defined := attrs[nameStr]; defined {
                                 diags = append(diags, &hcl.Diagnostic{
-                                        Severity: hcl.DiagError,
-                                        Summary:  "Duplicate object attribute",
-                                        Detail:   fmt.Sprintf("An attribute named %q was already defined at %s.", nameStr, attrRanges[nameStr]),
-                                        Subject:  &jsonAttr.NameRange,
+                                        Severity:    hcl.DiagError,
+                                        Summary:     "Duplicate object attribute",
+                                        Detail:      fmt.Sprintf("An attribute named %q was already defined at %s.", nameStr, attrRanges[nameStr]),
+                                        Subject:     &jsonAttr.NameRange,
+                                        Expression:  e,
+                                        EvalContext: ctx,
                                 })
                                 continue
                         }
@@ -487,6 +499,8 @@ func (e *expression) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
                         return cty.DynamicVal, diags
                 }
                 return cty.ObjectVal(attrs), diags
+        case *nullVal:
+                return cty.NullVal(cty.DynamicPseudoType), nil
         default:
                 // Default to DynamicVal so that ASTs containing invalid nodes can
                 // still be partially-evaluated.
@@ -526,6 +540,11 @@ func (e *expression) Variables() []hcl.Traversal {
                 }
         case *objectVal:
                 for _, jsonAttr := range v.Attrs {
+                        keyExpr := &stringVal{ // we're going to treat key as an expression in this context
+                                Value:    jsonAttr.Name,
+                                SrcRange: jsonAttr.NameRange,
+                        }
+                        vars = append(vars, (&expression{src: keyExpr}).Variables()...)
                         vars = append(vars, (&expression{src: jsonAttr.Value}).Variables()...)
                 }
         }
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/merged.go b/vendor/github.com/hashicorp/hcl2/hcl/merged.go
index ca2b728..96e62a5 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/merged.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/merged.go
@@ -109,9 +109,9 @@ func (mb mergedBodies) JustAttributes() (Attributes, Diagnostics) {
                                 if existing := attrs[name]; existing != nil {
                                         diags = diags.Append(&Diagnostic{
                                                 Severity: DiagError,
-                                                Summary:  "Duplicate attribute",
+                                                Summary:  "Duplicate argument",
                                                 Detail: fmt.Sprintf(
-                                                        "Attribute %q was already assigned at %s",
+                                                        "Argument %q was already set at %s",
                                                         name, existing.NameRange.String(),
                                                 ),
                                                 Subject: &attr.NameRange,
@@ -171,7 +171,7 @@ func (mb mergedBodies) mergedContent(schema *BodySchema, partial bool) (*BodyCon
                 }
 
                 if thisLeftovers != nil {
-                        mergedLeftovers = append(mergedLeftovers)
+                        mergedLeftovers = append(mergedLeftovers, thisLeftovers)
                 }
                 if len(thisDiags) != 0 {
                         diags = append(diags, thisDiags...)
@@ -182,9 +182,9 @@ func (mb mergedBodies) mergedContent(schema *BodySchema, partial bool) (*BodyCon
                                 if existing := content.Attributes[name]; existing != nil {
                                         diags = diags.Append(&Diagnostic{
                                                 Severity: DiagError,
-                                                Summary:  "Duplicate attribute",
+                                                Summary:  "Duplicate argument",
                                                 Detail: fmt.Sprintf(
-                                                        "Attribute %q was already assigned at %s",
+                                                        "Argument %q was already set at %s",
                                                         name, existing.NameRange.String(),
                                                 ),
                                                 Subject: &attr.NameRange,
@@ -212,9 +212,9 @@ func (mb mergedBodies) mergedContent(schema *BodySchema, partial bool) (*BodyCon
                         // use of required attributes on merged bodies.
                         diags = diags.Append(&Diagnostic{
                                 Severity: DiagError,
-                                Summary:  "Missing required attribute",
+                                Summary:  "Missing required argument",
                                 Detail: fmt.Sprintf(
-                                        "The attribute %q is required, but was not assigned.",
+                                        "The argument %q is required, but was not set.",
                                         attrS.Name,
                                 ),
                         })
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/ops.go b/vendor/github.com/hashicorp/hcl2/hcl/ops.go
index f4e30b0..5d2910c 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/ops.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/ops.go
@@ -2,6 +2,7 @@ package hcl
 
 import (
         "fmt"
+        "math/big"
 
         "github.com/zclconf/go-cty/cty"
         "github.com/zclconf/go-cty/cty/convert"
@@ -84,6 +85,27 @@ func Index(collection, key cty.Value, srcRange *Range) (cty.Value, Diagnostics)
                         }
                 }
                 if has.False() {
+                        // We have a more specialized error message for the situation of
+                        // using a fractional number to index into a sequence, because
+                        // that will tend to happen if the user is trying to use division
+                        // to calculate an index and not realizing that HCL does float
+                        // division rather than integer division.
+                        if (ty.IsListType() || ty.IsTupleType()) && key.Type().Equals(cty.Number) {
+                                if key.IsKnown() && !key.IsNull() {
+                                        bf := key.AsBigFloat()
+                                        if _, acc := bf.Int(nil); acc != big.Exact {
+                                                return cty.DynamicVal, Diagnostics{
+                                                        {
+                                                                Severity: DiagError,
+                                                                Summary:  "Invalid index",
+                                                                Detail:   fmt.Sprintf("The given key does not identify an element in this collection value: indexing a sequence requires a whole number, but the given index (%g) has a fractional part.", bf),
+                                                                Subject:  srcRange,
+                                                        },
+                                                }
+                                        }
+                                }
+                        }
+
                         return cty.DynamicVal, Diagnostics{
                                 {
                                         Severity: DiagError,
@@ -145,3 +167,122 @@ func Index(collection, key cty.Value, srcRange *Range) (cty.Value, Diagnostics)
         }
 
 }
+
+// GetAttr is a helper function that performs the same operation as the
+// attribute access in the HCL expression language. That is, the result is the
+// same as it would be for obj.attr in a configuration expression.
+//
+// This is exported so that applications can access attributes in a manner
+// consistent with how the language does it, including handling of null and
+// unknown values, etc.
+//
+// Diagnostics are produced if the given combination of values is not valid.
+// Therefore a pointer to a source range must be provided to use in diagnostics,
+// though nil can be provided if the calling application is going to
+// ignore the subject of the returned diagnostics anyway.
+func GetAttr(obj cty.Value, attrName string, srcRange *Range) (cty.Value, Diagnostics) {
+        if obj.IsNull() {
+                return cty.DynamicVal, Diagnostics{
+                        {
+                                Severity: DiagError,
+                                Summary:  "Attempt to get attribute from null value",
+                                Detail:   "This value is null, so it does not have any attributes.",
+                                Subject:  srcRange,
+                        },
+                }
+        }
+
+        ty := obj.Type()
+        switch {
+        case ty.IsObjectType():
+                if !ty.HasAttribute(attrName) {
+                        return cty.DynamicVal, Diagnostics{
+                                {
+                                        Severity: DiagError,
+                                        Summary:  "Unsupported attribute",
+                                        Detail:   fmt.Sprintf("This object does not have an attribute named %q.", attrName),
+                                        Subject:  srcRange,
+                                },
+                        }
+                }
+
+                if !obj.IsKnown() {
+                        return cty.UnknownVal(ty.AttributeType(attrName)), nil
+                }
+
+                return obj.GetAttr(attrName), nil
+        case ty.IsMapType():
+                if !obj.IsKnown() {
+                        return cty.UnknownVal(ty.ElementType()), nil
+                }
+
+                idx := cty.StringVal(attrName)
+                if obj.HasIndex(idx).False() {
+                        return cty.DynamicVal, Diagnostics{
+                                {
+                                        Severity: DiagError,
+                                        Summary:  "Missing map element",
+                                        Detail:   fmt.Sprintf("This map does not have an element with the key %q.", attrName),
+                                        Subject:  srcRange,
+                                },
+                        }
+                }
+
+                return obj.Index(idx), nil
+        case ty == cty.DynamicPseudoType:
+                return cty.DynamicVal, nil
+        default:
+                return cty.DynamicVal, Diagnostics{
+                        {
+                                Severity: DiagError,
+                                Summary:  "Unsupported attribute",
+                                Detail:   "This value does not have any attributes.",
+                                Subject:  srcRange,
+                        },
+                }
+        }
+
+}
+
+// ApplyPath is a helper function that applies a cty.Path to a value using the
+// indexing and attribute access operations from HCL.
+//
+// This is similar to calling the path's own Apply method, but ApplyPath uses
+// the more relaxed typing rules that apply to these operations in HCL, rather
+// than cty's relatively-strict rules. ApplyPath is implemented in terms of
+// Index and GetAttr, and so it has the same behavior for individual steps
+// but will stop and return any errors returned by intermediate steps.
+//
+// Diagnostics are produced if the given path cannot be applied to the given
+// value. Therefore a pointer to a source range must be provided to use in
+// diagnostics, though nil can be provided if the calling application is going
+// to ignore the subject of the returned diagnostics anyway.
+func ApplyPath(val cty.Value, path cty.Path, srcRange *Range) (cty.Value, Diagnostics) {
+        var diags Diagnostics
+
+        for _, step := range path {
+                var stepDiags Diagnostics
+                switch ts := step.(type) {
+                case cty.IndexStep:
+                        val, stepDiags = Index(val, ts.Key, srcRange)
+                case cty.GetAttrStep:
+                        val, stepDiags = GetAttr(val, ts.Name, srcRange)
+                default:
+                        // Should never happen because the above are all of the step types.
+                        diags = diags.Append(&Diagnostic{
+                                Severity: DiagError,
+                                Summary:  "Invalid path step",
+                                Detail:   fmt.Sprintf("Go type %T is not a valid path step. This is a bug in this program.", step),
+                                Subject:  srcRange,
+                        })
+                        return cty.DynamicVal, diags
+                }
+
+                diags = append(diags, stepDiags...)
+                if stepDiags.HasErrors() {
+                        return cty.DynamicVal, diags
+                }
+        }
+
+        return val, diags
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/pos.go b/vendor/github.com/hashicorp/hcl2/hcl/pos.go
index 1a4b329..06db8bf 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/pos.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/pos.go
@@ -31,6 +31,9 @@ type Pos struct {
         Byte int
 }
 
+// InitialPos is a suitable position to use to mark the start of a file.
+var InitialPos = Pos{Byte: 0, Line: 1, Column: 1}
+
 // Range represents a span of characters between two positions in a source
 // file.
 //
@@ -94,6 +97,16 @@ func RangeOver(a, b Range) Range {
         }
 }
 
+// ContainsPos returns true if and only if the given position is contained within
+// the receiving range.
+//
+// In the unlikely case that the line/column information disagree with the byte
+// offset information in the given position or receiving range, the byte
+// offsets are given priority.
+func (r Range) ContainsPos(pos Pos) bool {
+        return r.ContainsOffset(pos.Byte)
+}
+
 // ContainsOffset returns true if and only if the given byte offset is within
 // the receiving Range.
 func (r Range) ContainsOffset(offset int) bool {
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/pos_scanner.go b/vendor/github.com/hashicorp/hcl2/hcl/pos_scanner.go
index 7c8f2df..17c0d7c 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/pos_scanner.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/pos_scanner.go
@@ -29,8 +29,8 @@ type RangeScanner struct {
         err error  // error from last scan, if any
 }
 
-// Create a new RangeScanner for the given buffer, producing ranges for the
-// given filename.
+// NewRangeScanner creates a new RangeScanner for the given buffer, producing
+// ranges for the given filename.
 //
 // Since ranges have grapheme-cluster granularity rather than byte granularity,
 // the scanner will produce incorrect results if the given SplitFunc creates
@@ -39,15 +39,19 @@ type RangeScanner struct {
 // around individual UTF-8 sequences, which will split any multi-sequence
 // grapheme clusters.
 func NewRangeScanner(b []byte, filename string, cb bufio.SplitFunc) *RangeScanner {
+        return NewRangeScannerFragment(b, filename, InitialPos, cb)
+}
+
+// NewRangeScannerFragment is like NewRangeScanner but the ranges it produces
+// will be offset by the given starting position, which is appropriate for
+// sub-slices of a file, whereas NewRangeScanner assumes it is scanning an
+// entire file.
+func NewRangeScannerFragment(b []byte, filename string, start Pos, cb bufio.SplitFunc) *RangeScanner {
         return &RangeScanner{
                 filename: filename,
                 b:        b,
                 cb:       cb,
-                pos: Pos{
-                        Byte:   0,
-                        Line:   1,
-                        Column: 1,
-                },
+                pos:      start,
         }
 }
 
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/spec.md b/vendor/github.com/hashicorp/hcl2/hcl/spec.md
index 58257bf..8bbaff8 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/spec.md
+++ b/vendor/github.com/hashicorp/hcl2/hcl/spec.md
@@ -29,7 +29,7 @@ which are discussed in detail in a later section.
 A _block_ is a nested structure that has a _type name_, zero or more string
 _labels_ (e.g. identifiers), and a nested body.
 
-Together the structural elements create a heirarchical data structure, with
+Together the structural elements create a hierarchical data structure, with
 attributes intended to represent the direct properties of a particular object
 in the calling application, and blocks intended to represent child objects
 of a particular object.
@@ -57,10 +57,10 @@ access to the specific attributes and blocks requested.
 A _body schema_ consists of a list of _attribute schemata_ and
 _block header schemata_:
 
-* An _attribute schema_ provides the name of an attribute and whether its
+- An _attribute schema_ provides the name of an attribute and whether its
   presence is required.
 
-* A _block header schema_ provides a block type name and the semantic names
+- A _block header schema_ provides a block type name and the semantic names
   assigned to each of the labels of that block type, if any.
 
 Within a schema, it is an error to request the same attribute name twice or
@@ -72,11 +72,11 @@ a block whose type name is identical to the attribute name.
 The result of applying a body schema to a body is _body content_, which
 consists of an _attribute map_ and a _block sequence_:
 
-* The _attribute map_ is a map data structure whose keys are attribute names
+- The _attribute map_ is a map data structure whose keys are attribute names
   and whose values are _expressions_ that represent the corresponding attribute
   values.
 
-* The _block sequence_ is an ordered sequence of blocks, with each specifying
+- The _block sequence_ is an ordered sequence of blocks, with each specifying
   a block _type name_, the sequence of _labels_ specified for the block,
   and the body object (not body _content_) representing the block's own body.
 
@@ -132,13 +132,13 @@ the schema has been processed.
 
 Specifically:
 
-* Any attribute whose name is specified in the schema is returned in body
+- Any attribute whose name is specified in the schema is returned in body
   content and elided from the new body.
 
-* Any block whose type is specified in the schema is returned in body content
+- Any block whose type is specified in the schema is returned in body content
   and elided from the new body.
 
-* Any attribute or block _not_ meeting the above conditions is placed into
+- Any attribute or block _not_ meeting the above conditions is placed into
   the new body, unmodified.
 
 The new body can then be recursively processed using any of the body
@@ -168,20 +168,20 @@ In order to obtain a concrete value, each expression must be _evaluated_.
 Evaluation is performed in terms of an evaluation context, which
 consists of the following:
 
-* An _evaluation mode_, which is defined below.
-* A _variable scope_, which provides a set of named variables for use in
+- An _evaluation mode_, which is defined below.
+- A _variable scope_, which provides a set of named variables for use in
   expressions.
-* A _function table_, which provides a set of named functions for use in
+- A _function table_, which provides a set of named functions for use in
   expressions.
 
 The _evaluation mode_ allows for two different interpretations of an
 expression:
 
-* In _literal-only mode_, variables and functions are not available and it
+- In _literal-only mode_, variables and functions are not available and it
   is assumed that the calling application's intent is to treat the attribute
   value as a literal.
 
-* In _full expression mode_, variables and functions are defined and it is
+- In _full expression mode_, variables and functions are defined and it is
   assumed that the calling application wishes to provide a full expression
   language for definition of the attribute value.
 
@@ -235,15 +235,15 @@ for interpretation into any suitable number representation. An implementation
 may in practice implement numbers with limited precision so long as the
 following constraints are met:
 
-* Integers are represented with at least 256 bits.
-* Non-integer numbers are represented as floating point values with a
+- Integers are represented with at least 256 bits.
+- Non-integer numbers are represented as floating point values with a
   mantissa of at least 256 bits and a signed binary exponent of at least
   16 bits.
-* An error is produced if an integer value given in source cannot be
+- An error is produced if an integer value given in source cannot be
   represented precisely.
-* An error is produced if a non-integer value cannot be represented due to
+- An error is produced if a non-integer value cannot be represented due to
   overflow.
-* A non-integer number is rounded to the nearest possible value when a
+- A non-integer number is rounded to the nearest possible value when a
   value is of too high a precision to be represented.
 
 The _number_ type also requires representation of both positive and negative
@@ -265,11 +265,11 @@ _Structural types_ are types that are constructed by combining other types.
 Each distinct combination of other types is itself a distinct type. There
 are two structural type _kinds_:
 
-* _Object types_ are constructed of a set of named attributes, each of which
+- _Object types_ are constructed of a set of named attributes, each of which
   has a type. Attribute names are always strings. (_Object_ attributes are a
   distinct idea from _body_ attributes, though calling applications
   may choose to blur the distinction by use of common naming schemes.)
-* _Tuple tupes_ are constructed of a sequence of elements, each of which
+- _Tuple types_ are constructed of a sequence of elements, each of which
   has a type.
 
 Values of structural types are compared for equality in terms of their
@@ -284,9 +284,9 @@ have attributes or elements with identical types.
 _Collection types_ are types that combine together an arbitrary number of
 values of some other single type. There are three collection type _kinds_:
 
-* _List types_ represent ordered sequences of values of their element type.
-* _Map types_ represent values of their element type accessed via string keys.
-* _Set types_ represent unordered sets of distinct values of their element type.
+- _List types_ represent ordered sequences of values of their element type.
+- _Map types_ represent values of their element type accessed via string keys.
+- _Set types_ represent unordered sets of distinct values of their element type.
 
 For each of these kinds and each distinct element type there is a distinct
 collection type. For example, "list of string" is a distinct type from
@@ -301,10 +301,10 @@ the same element type.
 
 ### Null values
 
-Each type has a null value. The null value of a type represents the absense
+Each type has a null value. The null value of a type represents the absence
 of a value, but with type information retained to allow for type checking.
 
-Null values are used primarily to represent the conditional absense of a
+Null values are used primarily to represent the conditional absence of a
 body attribute. In a syntax with a conditional operator, one of the result
 values of that conditional may be null to indicate that the attribute should be
 considered not present in that case.
@@ -376,9 +376,9 @@ a type has a non-commutative _matches_ relationship with a _type specification_.
 A type specification is, in practice, just a different interpretation of a
 type such that:
 
-* Any type _matches_ any type that it is identical to.
+- Any type _matches_ any type that it is identical to.
 
-* Any type _matches_ the dynamic pseudo-type.
+- Any type _matches_ the dynamic pseudo-type.
 
 For example, given a type specification "list of dynamic pseudo-type", the
 concrete types "list of string" and "list of map" match, but the
@@ -397,51 +397,51 @@ applications to provide functions that are interoperable with all syntaxes.
 
 A _function_ is defined from the following elements:
 
-* Zero or more _positional parameters_, each with a name used for documentation,
+- Zero or more _positional parameters_, each with a name used for documentation,
   a type specification for expected argument values, and a flag for whether
   each of null values, unknown values, and values of the dynamic pseudo-type
   are accepted.
 
-* Zero or one _variadic parameters_, with the same structure as the _positional_
+- Zero or one _variadic parameters_, with the same structure as the _positional_
   parameters, which if present collects any additional arguments provided at
   the function call site.
 
-* A _result type definition_, which specifies the value type returned for each
+- A _result type definition_, which specifies the value type returned for each
   valid sequence of argument values.
 
-* A _result value definition_, which specifies the value returned for each
+- A _result value definition_, which specifies the value returned for each
   valid sequence of argument values.
 
 A _function call_, regardless of source syntax, consists of a sequence of
 argument values. The argument values are each mapped to a corresponding
 parameter as follows:
 
-* For each of the function's positional parameters in sequence, take the next
+- For each of the function's positional parameters in sequence, take the next
   argument. If there are no more arguments, the call is erroneous.
 
-* If the function has a variadic parameter, take all remaining arguments that
+- If the function has a variadic parameter, take all remaining arguments that
   where not yet assigned to a positional parameter and collect them into
   a sequence of variadic arguments that each correspond to the variadic
   parameter.
 
-* If the function has _no_ variadic parameter, it is an error if any arguments
+- If the function has _no_ variadic parameter, it is an error if any arguments
   remain after taking one argument for each positional parameter.
 
 After mapping each argument to a parameter, semantic checking proceeds
 for each argument:
 
-* If the argument value corresponding to a parameter does not match the
+- If the argument value corresponding to a parameter does not match the
   parameter's type specification, the call is erroneous.
 
-* If the argument value corresponding to a parameter is null and the parameter
+- If the argument value corresponding to a parameter is null and the parameter
   is not specified as accepting nulls, the call is erroneous.
 
-* If the argument value corresponding to a parameter is the dynamic value
+- If the argument value corresponding to a parameter is the dynamic value
   and the parameter is not specified as accepting values of the dynamic
   pseudo-type, the call is valid but its _result type_ is forced to be the
   dynamic pseudo type.
 
-* If neither of the above conditions holds for any argument, the call is
+- If neither of the above conditions holds for any argument, the call is
   valid and the function's value type definition is used to determine the
   call's _result type_. A function _may_ vary its result type depending on
   the argument _values_ as well as the argument _types_; for example, a
@@ -450,15 +450,15 @@ for each argument:
 
 If semantic checking succeeds without error, the call is _executed_:
 
-* For each argument, if its value is unknown and its corresponding parameter
+- For each argument, if its value is unknown and its corresponding parameter
   is not specified as accepting unknowns, the _result value_ is forced to be an
   unknown value of the result type.
 
-* If the previous condition does not apply, the function's result value
+- If the previous condition does not apply, the function's result value
   definition is used to determine the call's _result value_.
 
 The result of a function call expression is either an error, if one of the
-erroenous conditions above applies, or the _result value_.
+erroneous conditions above applies, or the _result value_.
 
 ## Type Conversions and Unification
 
@@ -505,7 +505,7 @@ Bidirectional conversions are available between the string and number types,
 and between the string and boolean types.
 
 The bool value true corresponds to the string containing the characters "true",
-while the bool value false corresponds to teh string containing the characters
+while the bool value false corresponds to the string containing the characters
 "false". Conversion from bool to string is safe, while the converse is
 unsafe. The strings "1" and "0" are alternative string representations
 of true and false respectively. It is an error to convert a string other than
@@ -631,20 +631,20 @@ diagnostics if they are applied to inappropriate expressions.
 
 The following are the required static analysis functions:
 
-* **Static List**: Require list/tuple construction syntax to be used and
+- **Static List**: Require list/tuple construction syntax to be used and
   return a list of expressions for each of the elements given.
 
-* **Static Map**: Require map/object construction syntax to be used and
+- **Static Map**: Require map/object construction syntax to be used and
   return a list of key/value pairs -- both expressions -- for each of
   the elements given. The usual constraint that a map key must be a string
   must not apply to this analysis, thus allowing applications to interpret
   arbitrary keys as they see fit.
 
-* **Static Call**: Require function call syntax to be used and return an
+- **Static Call**: Require function call syntax to be used and return an
   object describing the called function name and a list of expressions
   representing each of the call arguments.
 
-* **Static Traversal**: Require a reference to a symbol in the variable
+- **Static Traversal**: Require a reference to a symbol in the variable
   scope and return a description of the path from the root scope to the
   accessed attribute or index.
 
@@ -670,18 +670,18 @@ with the goals of this specification.
 The language-agnosticism of this specification assumes that certain behaviors
 are implemented separately for each syntax:
 
-* Matching of a body schema with the physical elements of a body in the
-  source language, to determine correspondance between physical constructs
+- Matching of a body schema with the physical elements of a body in the
+  source language, to determine correspondence between physical constructs
   and schema elements.
 
-* Implementing the _dynamic attributes_ body processing mode by either
+- Implementing the _dynamic attributes_ body processing mode by either
   interpreting all physical constructs as attributes or producing an error
   if non-attribute constructs are present.
 
-* Providing an evaluation function for all possible expressions that produces
+- Providing an evaluation function for all possible expressions that produces
   a value given an evaluation context.
 
-* Providing the static analysis functionality described above in a manner that
+- Providing the static analysis functionality described above in a manner that
   makes sense within the convention of the syntax.
 
 The suggested implementation strategy is to use an implementation language's
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/structure_at_pos.go b/vendor/github.com/hashicorp/hcl2/hcl/structure_at_pos.go
new file mode 100644
index 0000000..8521814
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/structure_at_pos.go
@@ -0,0 +1,117 @@
+package hcl
+
+// -----------------------------------------------------------------------------
+// The methods in this file all have the general pattern of making a best-effort
+// to find one or more constructs that contain a given source position.
+//
+// These all operate by delegating to an optional method of the same name and
+// signature on the file's root body, allowing each syntax to potentially
+// provide its own implementations of these. For syntaxes that don't implement
+// them, the result is always nil.
+// -----------------------------------------------------------------------------
+
+// BlocksAtPos attempts to find all of the blocks that contain the given
+// position, ordered so that the outermost block is first and the innermost
+// block is last. This is a best-effort method that may not be able to produce
+// a complete result for all positions or for all HCL syntaxes.
+//
+// If the returned slice is non-empty, the first element is guaranteed to
+// represent the same block as would be the result of OutermostBlockAtPos and
+// the last element the result of InnermostBlockAtPos. However, the
+// implementation may return two different objects describing the same block,
+// so comparison by pointer identity is not possible.
+//
+// The result is nil if no blocks at all contain the given position.
+func (f *File) BlocksAtPos(pos Pos) []*Block {
+        // The root body of the file must implement this interface in order
+        // to support BlocksAtPos.
+        type Interface interface {
+                BlocksAtPos(pos Pos) []*Block
+        }
+
+        impl, ok := f.Body.(Interface)
+        if !ok {
+                return nil
+        }
+        return impl.BlocksAtPos(pos)
+}
+
+// OutermostBlockAtPos attempts to find a top-level block in the receiving file
+// that contains the given position. This is a best-effort method that may not
+// be able to produce a result for all positions or for all HCL syntaxes.
+//
+// The result is nil if no single block could be selected for any reason.
+func (f *File) OutermostBlockAtPos(pos Pos) *Block {
+        // The root body of the file must implement this interface in order
+        // to support OutermostBlockAtPos.
+        type Interface interface {
+                OutermostBlockAtPos(pos Pos) *Block
+        }
+
+        impl, ok := f.Body.(Interface)
+        if !ok {
+                return nil
+        }
+        return impl.OutermostBlockAtPos(pos)
+}
+
+// InnermostBlockAtPos attempts to find the most deeply-nested block in the
+// receiving file that contains the given position. This is a best-effort
+// method that may not be able to produce a result for all positions or for
+// all HCL syntaxes.
+//
+// The result is nil if no single block could be selected for any reason.
+func (f *File) InnermostBlockAtPos(pos Pos) *Block {
+        // The root body of the file must implement this interface in order
+        // to support InnermostBlockAtPos.
+        type Interface interface {
+                InnermostBlockAtPos(pos Pos) *Block
+        }
+
+        impl, ok := f.Body.(Interface)
+        if !ok {
+                return nil
+        }
+        return impl.InnermostBlockAtPos(pos)
+}
+
+// OutermostExprAtPos attempts to find an expression in the receiving file
+// that contains the given position. This is a best-effort method that may not
+// be able to produce a result for all positions or for all HCL syntaxes.
+//
+// Since expressions are often nested inside one another, this method returns
+// the outermost "root" expression that is not contained by any other.
+//
+// The result is nil if no single expression could be selected for any reason.
+func (f *File) OutermostExprAtPos(pos Pos) Expression {
+        // The root body of the file must implement this interface in order
+        // to support OutermostExprAtPos.
+        type Interface interface {
+                OutermostExprAtPos(pos Pos) Expression
+        }
+
+        impl, ok := f.Body.(Interface)
+        if !ok {
+                return nil
+        }
+        return impl.OutermostExprAtPos(pos)
+}
+
+// AttributeAtPos attempts to find an attribute definition in the receiving
+// file that contains the given position. This is a best-effort method that may
+// not be able to produce a result for all positions or for all HCL syntaxes.
+//
+// The result is nil if no single attribute could be selected for any reason.
+func (f *File) AttributeAtPos(pos Pos) *Attribute {
+        // The root body of the file must implement this interface in order
+        // to support OutermostExprAtPos.
+        type Interface interface {
+                AttributeAtPos(pos Pos) *Attribute
+        }
+
+        impl, ok := f.Body.(Interface)
+        if !ok {
+                return nil
+        }
+        return impl.AttributeAtPos(pos)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/traversal.go b/vendor/github.com/hashicorp/hcl2/hcl/traversal.go
index 24f4c91..d710197 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/traversal.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/traversal.go
@@ -255,66 +255,7 @@ type TraverseAttr struct {
 }
 
 func (tn TraverseAttr) TraversalStep(val cty.Value) (cty.Value, Diagnostics) {
-        if val.IsNull() {
-                return cty.DynamicVal, Diagnostics{
-                        {
-                                Severity: DiagError,
-                                Summary:  "Attempt to get attribute from null value",
-                                Detail:   "This value is null, so it does not have any attributes.",
-                                Subject:  &tn.SrcRange,
-                        },
-                }
-        }
-
-        ty := val.Type()
-        switch {
-        case ty.IsObjectType():
-                if !ty.HasAttribute(tn.Name) {
-                        return cty.DynamicVal, Diagnostics{
-                                {
-                                        Severity: DiagError,
-                                        Summary:  "Unsupported attribute",
-                                        Detail:   fmt.Sprintf("This object does not have an attribute named %q.", tn.Name),
-                                        Subject:  &tn.SrcRange,
-                                },
-                        }
-                }
-
-                if !val.IsKnown() {
-                        return cty.UnknownVal(ty.AttributeType(tn.Name)), nil
-                }
-
-                return val.GetAttr(tn.Name), nil
-        case ty.IsMapType():
-                if !val.IsKnown() {
-                        return cty.UnknownVal(ty.ElementType()), nil
-                }
-
-                idx := cty.StringVal(tn.Name)
-                if val.HasIndex(idx).False() {
-                        return cty.DynamicVal, Diagnostics{
-                                {
-                                        Severity: DiagError,
-                                        Summary:  "Missing map element",
-                                        Detail:   fmt.Sprintf("This map does not have an element with the key %q.", tn.Name),
-                                        Subject:  &tn.SrcRange,
-                                },
-                        }
-                }
-
-                return val.Index(idx), nil
-        case ty == cty.DynamicPseudoType:
-                return cty.DynamicVal, nil
-        default:
-                return cty.DynamicVal, Diagnostics{
-                        {
-                                Severity: DiagError,
-                                Summary:  "Unsupported attribute",
-                                Detail:   "This value does not have any attributes.",
-                                Subject:  &tn.SrcRange,
-                        },
-                }
-        }
+        return GetAttr(val, tn.Name, &tn.SrcRange)
 }
 
 func (tn TraverseAttr) SourceRange() Range {
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/traversal_for_expr.go b/vendor/github.com/hashicorp/hcl2/hcl/traversal_for_expr.go
index 5f52946..d4a565a 100644
--- a/vendor/github.com/hashicorp/hcl2/hcl/traversal_for_expr.go
+++ b/vendor/github.com/hashicorp/hcl2/hcl/traversal_for_expr.go
@@ -52,11 +52,14 @@ func AbsTraversalForExpr(expr Expression) (Traversal, Diagnostics) {
 func RelTraversalForExpr(expr Expression) (Traversal, Diagnostics) {
         traversal, diags := AbsTraversalForExpr(expr)
         if len(traversal) > 0 {
+                ret := make(Traversal, len(traversal))
+                copy(ret, traversal)
                 root := traversal[0].(TraverseRoot)
-                traversal[0] = TraverseAttr{
+                ret[0] = TraverseAttr{
                         Name:     root.Name,
                         SrcRange: root.SrcRange,
                 }
+                return ret, diags
         }
         return traversal, diags
 }
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/public.go b/vendor/github.com/hashicorp/hcl2/hcldec/public.go
index 5d1f10a..3c80363 100644
--- a/vendor/github.com/hashicorp/hcl2/hcldec/public.go
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/public.go
@@ -65,7 +65,10 @@ func ChildBlockTypes(spec Spec) map[string]Spec {
         visit = func(s Spec) {
                 if bs, ok := s.(blockSpec); ok {
                         for _, blockS := range bs.blockHeaderSchemata() {
-                                ret[blockS.Type] = bs.nestedSpec()
+                                nested := bs.nestedSpec()
+                                if nested != nil { // nil can be returned to dynamically opt out of this interface
+                                        ret[blockS.Type] = nested
+                                }
                         }
                 }
 
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/spec.go b/vendor/github.com/hashicorp/hcl2/hcldec/spec.go
index 25cafcd..f9da7f6 100644
--- a/vendor/github.com/hashicorp/hcl2/hcldec/spec.go
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/spec.go
@@ -3,6 +3,7 @@ package hcldec
 import (
         "bytes"
         "fmt"
+        "sort"
 
         "github.com/hashicorp/hcl2/hcl"
         "github.com/zclconf/go-cty/cty"
@@ -477,6 +478,44 @@ func (s *BlockListSpec) decode(content *hcl.BodyContent, blockLabels []blockLabe
         if len(elems) == 0 {
                 ret = cty.ListValEmpty(s.Nested.impliedType())
         } else {
+                // Since our target is a list, all of the decoded elements must have the
+                // same type or cty.ListVal will panic below. Different types can arise
+                // if there is an attribute spec of type cty.DynamicPseudoType in the
+                // nested spec; all given values must be convertable to a single type
+                // in order for the result to be considered valid.
+                etys := make([]cty.Type, len(elems))
+                for i, v := range elems {
+                        etys[i] = v.Type()
+                }
+                ety, convs := convert.UnifyUnsafe(etys)
+                if ety == cty.NilType {
+                        // FIXME: This is a pretty terrible error message.
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Unconsistent argument types in %s blocks", s.TypeName),
+                                Detail:   "Corresponding attributes in all blocks of this type must be the same.",
+                                Subject:  &sourceRanges[0],
+                        })
+                        return cty.DynamicVal, diags
+                }
+                for i, v := range elems {
+                        if convs[i] != nil {
+                                newV, err := convs[i](v)
+                                if err != nil {
+                                        // FIXME: This is a pretty terrible error message.
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  fmt.Sprintf("Unconsistent argument types in %s blocks", s.TypeName),
+                                                Detail:   fmt.Sprintf("Block with index %d has inconsistent argument types: %s.", i, err),
+                                                Subject:  &sourceRanges[i],
+                                        })
+                                        // Bail early here so we won't panic below in cty.ListVal
+                                        return cty.DynamicVal, diags
+                                }
+                                elems[i] = newV
+                        }
+                }
+
                 ret = cty.ListVal(elems)
         }
 
@@ -508,6 +547,127 @@ func (s *BlockListSpec) sourceRange(content *hcl.BodyContent, blockLabels []bloc
         return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested)
 }
 
+// A BlockTupleSpec is a Spec that produces a cty tuple of the results of
+// decoding all of the nested blocks of a given type, using a nested spec.
+//
+// This is similar to BlockListSpec, but it permits the nested blocks to have
+// different result types in situations where cty.DynamicPseudoType attributes
+// are present.
+type BlockTupleSpec struct {
+        TypeName string
+        Nested   Spec
+        MinItems int
+        MaxItems int
+}
+
+func (s *BlockTupleSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node ("Nested" does not use the same body)
+}
+
+// blockSpec implementation
+func (s *BlockTupleSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema {
+        return []hcl.BlockHeaderSchema{
+                {
+                        Type:       s.TypeName,
+                        LabelNames: findLabelSpecs(s.Nested),
+                },
+        }
+}
+
+// blockSpec implementation
+func (s *BlockTupleSpec) nestedSpec() Spec {
+        return s.Nested
+}
+
+// specNeedingVariables implementation
+func (s *BlockTupleSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal {
+        var ret []hcl.Traversal
+
+        for _, childBlock := range content.Blocks {
+                if childBlock.Type != s.TypeName {
+                        continue
+                }
+
+                ret = append(ret, Variables(childBlock.Body, s.Nested)...)
+        }
+
+        return ret
+}
+
+func (s *BlockTupleSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        if s.Nested == nil {
+                panic("BlockListSpec with no Nested Spec")
+        }
+
+        var elems []cty.Value
+        var sourceRanges []hcl.Range
+        for _, childBlock := range content.Blocks {
+                if childBlock.Type != s.TypeName {
+                        continue
+                }
+
+                val, _, childDiags := decode(childBlock.Body, labelsForBlock(childBlock), ctx, s.Nested, false)
+                diags = append(diags, childDiags...)
+                elems = append(elems, val)
+                sourceRanges = append(sourceRanges, sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested))
+        }
+
+        if len(elems) < s.MinItems {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  fmt.Sprintf("Insufficient %s blocks", s.TypeName),
+                        Detail:   fmt.Sprintf("At least %d %q blocks are required.", s.MinItems, s.TypeName),
+                        Subject:  &content.MissingItemRange,
+                })
+        } else if s.MaxItems > 0 && len(elems) > s.MaxItems {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  fmt.Sprintf("Too many %s blocks", s.TypeName),
+                        Detail:   fmt.Sprintf("No more than %d %q blocks are allowed", s.MaxItems, s.TypeName),
+                        Subject:  &sourceRanges[s.MaxItems],
+                })
+        }
+
+        var ret cty.Value
+
+        if len(elems) == 0 {
+                ret = cty.EmptyTupleVal
+        } else {
+                ret = cty.TupleVal(elems)
+        }
+
+        return ret, diags
+}
+
+func (s *BlockTupleSpec) impliedType() cty.Type {
+        // We can't predict our type, because we don't know how many blocks
+        // there will be until we decode.
+        return cty.DynamicPseudoType
+}
+
+func (s *BlockTupleSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // We return the source range of the _first_ block of the given type,
+        // since they are not guaranteed to form a contiguous range.
+
+        var childBlock *hcl.Block
+        for _, candidate := range content.Blocks {
+                if candidate.Type != s.TypeName {
+                        continue
+                }
+
+                childBlock = candidate
+                break
+        }
+
+        if childBlock == nil {
+                return content.MissingItemRange
+        }
+
+        return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested)
+}
+
 // A BlockSetSpec is a Spec that produces a cty set of the results of
 // decoding all of the nested blocks of a given type, using a nested spec.
 type BlockSetSpec struct {
@@ -592,6 +752,44 @@ func (s *BlockSetSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel
         if len(elems) == 0 {
                 ret = cty.SetValEmpty(s.Nested.impliedType())
         } else {
+                // Since our target is a set, all of the decoded elements must have the
+                // same type or cty.SetVal will panic below. Different types can arise
+                // if there is an attribute spec of type cty.DynamicPseudoType in the
+                // nested spec; all given values must be convertable to a single type
+                // in order for the result to be considered valid.
+                etys := make([]cty.Type, len(elems))
+                for i, v := range elems {
+                        etys[i] = v.Type()
+                }
+                ety, convs := convert.UnifyUnsafe(etys)
+                if ety == cty.NilType {
+                        // FIXME: This is a pretty terrible error message.
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Unconsistent argument types in %s blocks", s.TypeName),
+                                Detail:   "Corresponding attributes in all blocks of this type must be the same.",
+                                Subject:  &sourceRanges[0],
+                        })
+                        return cty.DynamicVal, diags
+                }
+                for i, v := range elems {
+                        if convs[i] != nil {
+                                newV, err := convs[i](v)
+                                if err != nil {
+                                        // FIXME: This is a pretty terrible error message.
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  fmt.Sprintf("Unconsistent argument types in %s blocks", s.TypeName),
+                                                Detail:   fmt.Sprintf("Block with index %d has inconsistent argument types: %s.", i, err),
+                                                Subject:  &sourceRanges[i],
+                                        })
+                                        // Bail early here so we won't panic below in cty.ListVal
+                                        return cty.DynamicVal, diags
+                                }
+                                elems[i] = newV
+                        }
+                }
+
                 ret = cty.SetVal(elems)
         }
 
@@ -672,7 +870,10 @@ func (s *BlockMapSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel
         var diags hcl.Diagnostics
 
         if s.Nested == nil {
-                panic("BlockSetSpec with no Nested Spec")
+                panic("BlockMapSpec with no Nested Spec")
+        }
+        if ImpliedType(s).HasDynamicTypes() {
+                panic("cty.DynamicPseudoType attributes may not be used inside a BlockMapSpec")
         }
 
         elems := map[string]interface{}{}
@@ -765,6 +966,307 @@ func (s *BlockMapSpec) sourceRange(content *hcl.BodyContent, blockLabels []block
         return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested)
 }
 
+// A BlockObjectSpec is a Spec that produces a cty object of the results of
+// decoding all of the nested blocks of a given type, using a nested spec.
+//
+// One level of object structure is created for each of the given label names.
+// There must be at least one given label name.
+//
+// This is similar to BlockMapSpec, but it permits the nested blocks to have
+// different result types in situations where cty.DynamicPseudoType attributes
+// are present.
+type BlockObjectSpec struct {
+        TypeName   string
+        LabelNames []string
+        Nested     Spec
+}
+
+func (s *BlockObjectSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node ("Nested" does not use the same body)
+}
+
+// blockSpec implementation
+func (s *BlockObjectSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema {
+        return []hcl.BlockHeaderSchema{
+                {
+                        Type:       s.TypeName,
+                        LabelNames: append(s.LabelNames, findLabelSpecs(s.Nested)...),
+                },
+        }
+}
+
+// blockSpec implementation
+func (s *BlockObjectSpec) nestedSpec() Spec {
+        return s.Nested
+}
+
+// specNeedingVariables implementation
+func (s *BlockObjectSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal {
+        var ret []hcl.Traversal
+
+        for _, childBlock := range content.Blocks {
+                if childBlock.Type != s.TypeName {
+                        continue
+                }
+
+                ret = append(ret, Variables(childBlock.Body, s.Nested)...)
+        }
+
+        return ret
+}
+
+func (s *BlockObjectSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        if s.Nested == nil {
+                panic("BlockObjectSpec with no Nested Spec")
+        }
+
+        elems := map[string]interface{}{}
+        for _, childBlock := range content.Blocks {
+                if childBlock.Type != s.TypeName {
+                        continue
+                }
+
+                childLabels := labelsForBlock(childBlock)
+                val, _, childDiags := decode(childBlock.Body, childLabels[len(s.LabelNames):], ctx, s.Nested, false)
+                targetMap := elems
+                for _, key := range childBlock.Labels[:len(s.LabelNames)-1] {
+                        if _, exists := targetMap[key]; !exists {
+                                targetMap[key] = make(map[string]interface{})
+                        }
+                        targetMap = targetMap[key].(map[string]interface{})
+                }
+
+                diags = append(diags, childDiags...)
+
+                key := childBlock.Labels[len(s.LabelNames)-1]
+                if _, exists := targetMap[key]; exists {
+                        labelsBuf := bytes.Buffer{}
+                        for _, label := range childBlock.Labels {
+                                fmt.Fprintf(&labelsBuf, " %q", label)
+                        }
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Duplicate %s block", s.TypeName),
+                                Detail: fmt.Sprintf(
+                                        "A block for %s%s was already defined. The %s labels must be unique.",
+                                        s.TypeName, labelsBuf.String(), s.TypeName,
+                                ),
+                                Subject: &childBlock.DefRange,
+                        })
+                        continue
+                }
+
+                targetMap[key] = val
+        }
+
+        if len(elems) == 0 {
+                return cty.EmptyObjectVal, diags
+        }
+
+        var ctyObj func(map[string]interface{}, int) cty.Value
+        ctyObj = func(raw map[string]interface{}, depth int) cty.Value {
+                vals := make(map[string]cty.Value, len(raw))
+                if depth == 1 {
+                        for k, v := range raw {
+                                vals[k] = v.(cty.Value)
+                        }
+                } else {
+                        for k, v := range raw {
+                                vals[k] = ctyObj(v.(map[string]interface{}), depth-1)
+                        }
+                }
+                return cty.ObjectVal(vals)
+        }
+
+        return ctyObj(elems, len(s.LabelNames)), diags
+}
+
+func (s *BlockObjectSpec) impliedType() cty.Type {
+        // We can't predict our type, since we don't know how many blocks are
+        // present and what labels they have until we decode.
+        return cty.DynamicPseudoType
+}
+
+func (s *BlockObjectSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // We return the source range of the _first_ block of the given type,
+        // since they are not guaranteed to form a contiguous range.
+
+        var childBlock *hcl.Block
+        for _, candidate := range content.Blocks {
+                if candidate.Type != s.TypeName {
+                        continue
+                }
+
+                childBlock = candidate
+                break
+        }
+
+        if childBlock == nil {
+                return content.MissingItemRange
+        }
+
+        return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested)
+}
+
+// A BlockAttrsSpec is a Spec that interprets a single block as if it were
+// a map of some element type. That is, each attribute within the block
+// becomes a key in the resulting map and the attribute's value becomes the
+// element value, after conversion to the given element type. The resulting
+// value is a cty.Map of the given element type.
+//
+// This spec imposes a validation constraint that there be exactly one block
+// of the given type name and that this block may contain only attributes. The
+// block does not accept any labels.
+//
+// This is an alternative to an AttrSpec of a map type for situations where
+// block syntax is desired. Note that block syntax does not permit dynamic
+// keys, construction of the result via a "for" expression, etc. In most cases
+// an AttrSpec is preferred if the desired result is a map whose keys are
+// chosen by the user rather than by schema.
+type BlockAttrsSpec struct {
+        TypeName    string
+        ElementType cty.Type
+        Required    bool
+}
+
+func (s *BlockAttrsSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node
+}
+
+// blockSpec implementation
+func (s *BlockAttrsSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema {
+        return []hcl.BlockHeaderSchema{
+                {
+                        Type:       s.TypeName,
+                        LabelNames: nil,
+                },
+        }
+}
+
+// blockSpec implementation
+func (s *BlockAttrsSpec) nestedSpec() Spec {
+        // This is an odd case: we aren't actually going to apply a nested spec
+        // in this case, since we're going to interpret the body directly as
+        // attributes, but we need to return something non-nil so that the
+        // decoder will recognize this as a block spec. We won't actually be
+        // using this for anything at decode time.
+        return noopSpec{}
+}
+
+// specNeedingVariables implementation
+func (s *BlockAttrsSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal {
+
+        block, _ := s.findBlock(content)
+        if block == nil {
+                return nil
+        }
+
+        var vars []hcl.Traversal
+
+        attrs, diags := block.Body.JustAttributes()
+        if diags.HasErrors() {
+                return nil
+        }
+
+        for _, attr := range attrs {
+                vars = append(vars, attr.Expr.Variables()...)
+        }
+
+        // We'll return the variables references in source order so that any
+        // error messages that result are also in source order.
+        sort.Slice(vars, func(i, j int) bool {
+                return vars[i].SourceRange().Start.Byte < vars[j].SourceRange().Start.Byte
+        })
+
+        return vars
+}
+
+func (s *BlockAttrsSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        block, other := s.findBlock(content)
+        if block == nil {
+                if s.Required {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Missing %s block", s.TypeName),
+                                Detail: fmt.Sprintf(
+                                        "A block of type %q is required here.", s.TypeName,
+                                ),
+                                Subject: &content.MissingItemRange,
+                        })
+                }
+                return cty.NullVal(cty.Map(s.ElementType)), diags
+        }
+        if other != nil {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  fmt.Sprintf("Duplicate %s block", s.TypeName),
+                        Detail: fmt.Sprintf(
+                                "Only one block of type %q is allowed. Previous definition was at %s.",
+                                s.TypeName, block.DefRange.String(),
+                        ),
+                        Subject: &other.DefRange,
+                })
+        }
+
+        attrs, attrDiags := block.Body.JustAttributes()
+        diags = append(diags, attrDiags...)
+
+        if len(attrs) == 0 {
+                return cty.MapValEmpty(s.ElementType), diags
+        }
+
+        vals := make(map[string]cty.Value, len(attrs))
+        for name, attr := range attrs {
+                attrVal, attrDiags := attr.Expr.Value(ctx)
+                diags = append(diags, attrDiags...)
+
+                attrVal, err := convert.Convert(attrVal, s.ElementType)
+                if err != nil {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid attribute value",
+                                Detail:   fmt.Sprintf("Invalid value for attribute of %q block: %s.", s.TypeName, err),
+                                Subject:  attr.Expr.Range().Ptr(),
+                        })
+                        attrVal = cty.UnknownVal(s.ElementType)
+                }
+
+                vals[name] = attrVal
+        }
+
+        return cty.MapVal(vals), diags
+}
+
+func (s *BlockAttrsSpec) impliedType() cty.Type {
+        return cty.Map(s.ElementType)
+}
+
+func (s *BlockAttrsSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        block, _ := s.findBlock(content)
+        if block == nil {
+                return content.MissingItemRange
+        }
+        return block.DefRange
+}
+
+func (s *BlockAttrsSpec) findBlock(content *hcl.BodyContent) (block *hcl.Block, other *hcl.Block) {
+        for _, candidate := range content.Blocks {
+                if candidate.Type != s.TypeName {
+                        continue
+                }
+                if block != nil {
+                        return block, candidate
+                }
+                block = candidate
+        }
+
+        return block, nil
+}
+
 // A BlockLabelSpec is a Spec that returns a cty.String representing the
 // label of the block its given body belongs to, if indeed its given body
 // belongs to a block. It is a programming error to use this in a non-block
@@ -848,6 +1350,16 @@ func findLabelSpecs(spec Spec) []string {
 //
 // The two specifications must have the same implied result type for correct
 // operation. If not, the result is undefined.
+//
+// Any requirements imposed by the "Default" spec apply even if "Primary" does
+// not return null. For example, if the "Default" spec is for a required
+// attribute then that attribute is always required, regardless of the result
+// of the "Primary" spec.
+//
+// The "Default" spec must not describe a nested block, since otherwise the
+// result of ChildBlockTypes would not be decidable without evaluation. If
+// the default spec _does_ describe a nested block then the result is
+// undefined.
 type DefaultSpec struct {
         Primary Spec
         Default Spec
@@ -872,6 +1384,38 @@ func (s *DefaultSpec) impliedType() cty.Type {
         return s.Primary.impliedType()
 }
 
+// attrSpec implementation
+func (s *DefaultSpec) attrSchemata() []hcl.AttributeSchema {
+        // We must pass through the union of both of our nested specs so that
+        // we'll have both values available in the result.
+        var ret []hcl.AttributeSchema
+        if as, ok := s.Primary.(attrSpec); ok {
+                ret = append(ret, as.attrSchemata()...)
+        }
+        if as, ok := s.Default.(attrSpec); ok {
+                ret = append(ret, as.attrSchemata()...)
+        }
+        return ret
+}
+
+// blockSpec implementation
+func (s *DefaultSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema {
+        // Only the primary spec may describe a block, since otherwise
+        // our nestedSpec method below can't know which to return.
+        if bs, ok := s.Primary.(blockSpec); ok {
+                return bs.blockHeaderSchemata()
+        }
+        return nil
+}
+
+// blockSpec implementation
+func (s *DefaultSpec) nestedSpec() Spec {
+        if bs, ok := s.Primary.(blockSpec); ok {
+                return bs.nestedSpec()
+        }
+        return nil
+}
+
 func (s *DefaultSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
         // We can't tell from here which of the two specs will ultimately be used
         // in our result, so we'll just assume the first. This is usually the right
@@ -996,3 +1540,28 @@ func (s *TransformFuncSpec) sourceRange(content *hcl.BodyContent, blockLabels []
         // not super-accurate, because there's nothing better to return.
         return s.Wrapped.sourceRange(content, blockLabels)
 }
+
+// noopSpec is a placeholder spec that does nothing, used in situations where
+// a non-nil placeholder spec is required. It is not exported because there is
+// no reason to use it directly; it is always an implementation detail only.
+type noopSpec struct {
+}
+
+func (s noopSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        return cty.NullVal(cty.DynamicPseudoType), nil
+}
+
+func (s noopSpec) impliedType() cty.Type {
+        return cty.DynamicPseudoType
+}
+
+func (s noopSpec) visitSameBodyChildren(cb visitFunc) {
+        // nothing to do
+}
+
+func (s noopSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // No useful range for a noopSpec, and nobody should be calling this anyway.
+        return hcl.Range{
+                Filename: "noopSpec",
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/variables.go b/vendor/github.com/hashicorp/hcl2/hcldec/variables.go
index 427b0d0..7662516 100644
--- a/vendor/github.com/hashicorp/hcl2/hcldec/variables.go
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/variables.go
@@ -15,20 +15,22 @@ import (
 // be incomplete, but that's assumed to be okay because the eventual call
 // to Decode will produce error diagnostics anyway.
 func Variables(body hcl.Body, spec Spec) []hcl.Traversal {
+        var vars []hcl.Traversal
         schema := ImpliedSchema(spec)
-
         content, _, _ := body.PartialContent(schema)
 
-        var vars []hcl.Traversal
-
         if vs, ok := spec.(specNeedingVariables); ok {
                 vars = append(vars, vs.variablesNeeded(content)...)
         }
-        spec.visitSameBodyChildren(func(s Spec) {
+
+        var visitFn visitFunc
+        visitFn = func(s Spec) {
                 if vs, ok := s.(specNeedingVariables); ok {
                         vars = append(vars, vs.variablesNeeded(content)...)
                 }
-        })
+                s.visitSameBodyChildren(visitFn)
+        }
+        spec.visitSameBodyChildren(visitFn)
 
         return vars
 }
diff --git a/vendor/github.com/hashicorp/hcl2/hcled/doc.go b/vendor/github.com/hashicorp/hcl2/hcled/doc.go
new file mode 100644
index 0000000..1a80144
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcled/doc.go
@@ -0,0 +1,4 @@
+// Package hcled provides functionality intended to help an application
+// that embeds HCL to deliver relevant information to a text editor or IDE
+// for navigating around and analyzing configuration files.
+package hcled
diff --git a/vendor/github.com/hashicorp/hcl2/hcled/navigation.go b/vendor/github.com/hashicorp/hcl2/hcled/navigation.go
new file mode 100644
index 0000000..5d10cd8
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcled/navigation.go
@@ -0,0 +1,34 @@
+package hcled
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+type contextStringer interface {
+        ContextString(offset int) string
+}
+
+// ContextString returns a string describing the context of the given byte
+// offset, if available. An empty string is returned if no such information
+// is available, or otherwise the returned string is in a form that depends
+// on the language used to write the referenced file.
+func ContextString(file *hcl.File, offset int) string {
+        if cser, ok := file.Nav.(contextStringer); ok {
+                return cser.ContextString(offset)
+        }
+        return ""
+}
+
+type contextDefRanger interface {
+        ContextDefRange(offset int) hcl.Range
+}
+
+func ContextDefRange(file *hcl.File, offset int) hcl.Range {
+        if cser, ok := file.Nav.(contextDefRanger); ok {
+                defRange := cser.ContextDefRange(offset)
+                if !defRange.Empty() {
+                        return defRange
+                }
+        }
+        return file.Body.MissingItemRange()
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/ast.go b/vendor/github.com/hashicorp/hcl2/hclwrite/ast.go
new file mode 100644
index 0000000..0904165
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/ast.go
@@ -0,0 +1,121 @@
+package hclwrite
+
+import (
+        "bytes"
+        "io"
+)
+
+type File struct {
+        inTree
+
+        srcBytes []byte
+        body     *node
+}
+
+// NewEmptyFile constructs a new file with no content, ready to be mutated
+// by other calls that append to its body.
+func NewEmptyFile() *File {
+        f := &File{
+                inTree: newInTree(),
+        }
+        body := newBody()
+        f.body = f.children.Append(body)
+        return f
+}
+
+// Body returns the root body of the file, which contains the top-level
+// attributes and blocks.
+func (f *File) Body() *Body {
+        return f.body.content.(*Body)
+}
+
+// WriteTo writes the tokens underlying the receiving file to the given writer.
+//
+// The tokens first have a simple formatting pass applied that adjusts only
+// the spaces between them.
+func (f *File) WriteTo(wr io.Writer) (int64, error) {
+        tokens := f.inTree.children.BuildTokens(nil)
+        format(tokens)
+        return tokens.WriteTo(wr)
+}
+
+// Bytes returns a buffer containing the source code resulting from the
+// tokens underlying the receiving file. If any updates have been made via
+// the AST API, these will be reflected in the result.
+func (f *File) Bytes() []byte {
+        buf := &bytes.Buffer{}
+        f.WriteTo(buf)
+        return buf.Bytes()
+}
+
+type comments struct {
+        leafNode
+
+        parent *node
+        tokens Tokens
+}
+
+func newComments(tokens Tokens) *comments {
+        return &comments{
+                tokens: tokens,
+        }
+}
+
+func (c *comments) BuildTokens(to Tokens) Tokens {
+        return c.tokens.BuildTokens(to)
+}
+
+type identifier struct {
+        leafNode
+
+        parent *node
+        token  *Token
+}
+
+func newIdentifier(token *Token) *identifier {
+        return &identifier{
+                token: token,
+        }
+}
+
+func (i *identifier) BuildTokens(to Tokens) Tokens {
+        return append(to, i.token)
+}
+
+func (i *identifier) hasName(name string) bool {
+        return name == string(i.token.Bytes)
+}
+
+type number struct {
+        leafNode
+
+        parent *node
+        token  *Token
+}
+
+func newNumber(token *Token) *number {
+        return &number{
+                token: token,
+        }
+}
+
+func (n *number) BuildTokens(to Tokens) Tokens {
+        return append(to, n.token)
+}
+
+type quoted struct {
+        leafNode
+
+        parent *node
+        tokens Tokens
+}
+
+func newQuoted(tokens Tokens) *quoted {
+        return &quoted{
+                tokens: tokens,
+        }
+}
+
+func (q *quoted) BuildTokens(to Tokens) Tokens {
+        return q.tokens.BuildTokens(to)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/ast_attribute.go b/vendor/github.com/hashicorp/hcl2/hclwrite/ast_attribute.go
new file mode 100644
index 0000000..975fa74
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/ast_attribute.go
@@ -0,0 +1,48 @@
+package hclwrite
+
+import (
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+)
+
+type Attribute struct {
+        inTree
+
+        leadComments *node
+        name         *node
+        expr         *node
+        lineComments *node
+}
+
+func newAttribute() *Attribute {
+        return &Attribute{
+                inTree: newInTree(),
+        }
+}
+
+func (a *Attribute) init(name string, expr *Expression) {
+        expr.assertUnattached()
+
+        nameTok := newIdentToken(name)
+        nameObj := newIdentifier(nameTok)
+        a.leadComments = a.children.Append(newComments(nil))
+        a.name = a.children.Append(nameObj)
+        a.children.AppendUnstructuredTokens(Tokens{
+                {
+                        Type:  hclsyntax.TokenEqual,
+                        Bytes: []byte{'='},
+                },
+        })
+        a.expr = a.children.Append(expr)
+        a.expr.list = a.children
+        a.lineComments = a.children.Append(newComments(nil))
+        a.children.AppendUnstructuredTokens(Tokens{
+                {
+                        Type:  hclsyntax.TokenNewline,
+                        Bytes: []byte{'\n'},
+                },
+        })
+}
+
+func (a *Attribute) Expr() *Expression {
+        return a.expr.content.(*Expression)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/ast_block.go b/vendor/github.com/hashicorp/hcl2/hclwrite/ast_block.go
new file mode 100644
index 0000000..d5fd32b
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/ast_block.go
@@ -0,0 +1,74 @@
+package hclwrite
+
+import (
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+)
+
+type Block struct {
+        inTree
+
+        leadComments *node
+        typeName     *node
+        labels       nodeSet
+        open         *node
+        body         *node
+        close        *node
+}
+
+func newBlock() *Block {
+        return &Block{
+                inTree: newInTree(),
+                labels: newNodeSet(),
+        }
+}
+
+// NewBlock constructs a new, empty block with the given type name and labels.
+func NewBlock(typeName string, labels []string) *Block {
+        block := newBlock()
+        block.init(typeName, labels)
+        return block
+}
+
+func (b *Block) init(typeName string, labels []string) {
+        nameTok := newIdentToken(typeName)
+        nameObj := newIdentifier(nameTok)
+        b.leadComments = b.children.Append(newComments(nil))
+        b.typeName = b.children.Append(nameObj)
+        for _, label := range labels {
+                labelToks := TokensForValue(cty.StringVal(label))
+                labelObj := newQuoted(labelToks)
+                labelNode := b.children.Append(labelObj)
+                b.labels.Add(labelNode)
+        }
+        b.open = b.children.AppendUnstructuredTokens(Tokens{
+                {
+                        Type:  hclsyntax.TokenOBrace,
+                        Bytes: []byte{'{'},
+                },
+                {
+                        Type:  hclsyntax.TokenNewline,
+                        Bytes: []byte{'\n'},
+                },
+        })
+        body := newBody() // initially totally empty; caller can append to it subsequently
+        b.body = b.children.Append(body)
+        b.close = b.children.AppendUnstructuredTokens(Tokens{
+                {
+                        Type:  hclsyntax.TokenCBrace,
+                        Bytes: []byte{'}'},
+                },
+                {
+                        Type:  hclsyntax.TokenNewline,
+                        Bytes: []byte{'\n'},
+                },
+        })
+}
+
+// Body returns the body that represents the content of the receiving block.
+//
+// Appending to or otherwise modifying this body will make changes to the
+// tokens that are generated between the blocks open and close braces.
+func (b *Block) Body() *Body {
+        return b.body.content.(*Body)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/ast_body.go b/vendor/github.com/hashicorp/hcl2/hclwrite/ast_body.go
new file mode 100644
index 0000000..cf69fee
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/ast_body.go
@@ -0,0 +1,153 @@
+package hclwrite
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+)
+
+type Body struct {
+        inTree
+
+        items nodeSet
+}
+
+func newBody() *Body {
+        return &Body{
+                inTree: newInTree(),
+                items:  newNodeSet(),
+        }
+}
+
+func (b *Body) appendItem(c nodeContent) *node {
+        nn := b.children.Append(c)
+        b.items.Add(nn)
+        return nn
+}
+
+func (b *Body) appendItemNode(nn *node) *node {
+        nn.assertUnattached()
+        b.children.AppendNode(nn)
+        b.items.Add(nn)
+        return nn
+}
+
+// Clear removes all of the items from the body, making it empty.
+func (b *Body) Clear() {
+        b.children.Clear()
+}
+
+func (b *Body) AppendUnstructuredTokens(ts Tokens) {
+        b.inTree.children.Append(ts)
+}
+
+// Attributes returns a new map of all of the attributes in the body, with
+// the attribute names as the keys.
+func (b *Body) Attributes() map[string]*Attribute {
+        ret := make(map[string]*Attribute)
+        for n := range b.items {
+                if attr, isAttr := n.content.(*Attribute); isAttr {
+                        nameObj := attr.name.content.(*identifier)
+                        name := string(nameObj.token.Bytes)
+                        ret[name] = attr
+                }
+        }
+        return ret
+}
+
+// Blocks returns a new slice of all the blocks in the body.
+func (b *Body) Blocks() []*Block {
+        ret := make([]*Block, 0, len(b.items))
+        for n := range b.items {
+                if block, isBlock := n.content.(*Block); isBlock {
+                        ret = append(ret, block)
+                }
+        }
+        return ret
+}
+
+// GetAttribute returns the attribute from the body that has the given name,
+// or returns nil if there is currently no matching attribute.
+func (b *Body) GetAttribute(name string) *Attribute {
+        for n := range b.items {
+                if attr, isAttr := n.content.(*Attribute); isAttr {
+                        nameObj := attr.name.content.(*identifier)
+                        if nameObj.hasName(name) {
+                                // We've found it!
+                                return attr
+                        }
+                }
+        }
+
+        return nil
+}
+
+// SetAttributeValue either replaces the expression of an existing attribute
+// of the given name or adds a new attribute definition to the end of the block.
+//
+// The value is given as a cty.Value, and must therefore be a literal. To set
+// a variable reference or other traversal, use SetAttributeTraversal.
+//
+// The return value is the attribute that was either modified in-place or
+// created.
+func (b *Body) SetAttributeValue(name string, val cty.Value) *Attribute {
+        attr := b.GetAttribute(name)
+        expr := NewExpressionLiteral(val)
+        if attr != nil {
+                attr.expr = attr.expr.ReplaceWith(expr)
+        } else {
+                attr := newAttribute()
+                attr.init(name, expr)
+                b.appendItem(attr)
+        }
+        return attr
+}
+
+// SetAttributeTraversal either replaces the expression of an existing attribute
+// of the given name or adds a new attribute definition to the end of the body.
+//
+// The new expression is given as a hcl.Traversal, which must be an absolute
+// traversal. To set a literal value, use SetAttributeValue.
+//
+// The return value is the attribute that was either modified in-place or
+// created.
+func (b *Body) SetAttributeTraversal(name string, traversal hcl.Traversal) *Attribute {
+        attr := b.GetAttribute(name)
+        expr := NewExpressionAbsTraversal(traversal)
+        if attr != nil {
+                attr.expr = attr.expr.ReplaceWith(expr)
+        } else {
+                attr := newAttribute()
+                attr.init(name, expr)
+                b.appendItem(attr)
+        }
+        return attr
+}
+
+// AppendBlock appends an existing block (which must not be already attached
+// to a body) to the end of the receiving body.
+func (b *Body) AppendBlock(block *Block) *Block {
+        b.appendItem(block)
+        return block
+}
+
+// AppendNewBlock appends a new nested block to the end of the receiving body
+// with the given type name and labels.
+func (b *Body) AppendNewBlock(typeName string, labels []string) *Block {
+        block := newBlock()
+        block.init(typeName, labels)
+        b.appendItem(block)
+        return block
+}
+
+// AppendNewline appends a newline token to th end of the receiving body,
+// which generally serves as a separator between different sets of body
+// contents.
+func (b *Body) AppendNewline() {
+        b.AppendUnstructuredTokens(Tokens{
+                {
+                        Type:  hclsyntax.TokenNewline,
+                        Bytes: []byte{'\n'},
+                },
+        })
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/ast_expression.go b/vendor/github.com/hashicorp/hcl2/hclwrite/ast_expression.go
new file mode 100644
index 0000000..62d89fb
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/ast_expression.go
@@ -0,0 +1,201 @@
+package hclwrite
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+)
+
+type Expression struct {
+        inTree
+
+        absTraversals nodeSet
+}
+
+func newExpression() *Expression {
+        return &Expression{
+                inTree:        newInTree(),
+                absTraversals: newNodeSet(),
+        }
+}
+
+// NewExpressionLiteral constructs an an expression that represents the given
+// literal value.
+//
+// Since an unknown value cannot be represented in source code, this function
+// will panic if the given value is unknown or contains a nested unknown value.
+// Use val.IsWhollyKnown before calling to be sure.
+//
+// HCL native syntax does not directly represent lists, maps, and sets, and
+// instead relies on the automatic conversions to those collection types from
+// either list or tuple constructor syntax. Therefore converting collection
+// values to source code and re-reading them will lose type information, and
+// the reader must provide a suitable type at decode time to recover the
+// original value.
+func NewExpressionLiteral(val cty.Value) *Expression {
+        toks := TokensForValue(val)
+        expr := newExpression()
+        expr.children.AppendUnstructuredTokens(toks)
+        return expr
+}
+
+// NewExpressionAbsTraversal constructs an expression that represents the
+// given traversal, which must be absolute or this function will panic.
+func NewExpressionAbsTraversal(traversal hcl.Traversal) *Expression {
+        if traversal.IsRelative() {
+                panic("can't construct expression from relative traversal")
+        }
+
+        physT := newTraversal()
+        rootName := traversal.RootName()
+        steps := traversal[1:]
+
+        {
+                tn := newTraverseName()
+                tn.name = tn.children.Append(newIdentifier(&Token{
+                        Type:  hclsyntax.TokenIdent,
+                        Bytes: []byte(rootName),
+                }))
+                physT.steps.Add(physT.children.Append(tn))
+        }
+
+        for _, step := range steps {
+                switch ts := step.(type) {
+                case hcl.TraverseAttr:
+                        tn := newTraverseName()
+                        tn.children.AppendUnstructuredTokens(Tokens{
+                                {
+                                        Type:  hclsyntax.TokenDot,
+                                        Bytes: []byte{'.'},
+                                },
+                        })
+                        tn.name = tn.children.Append(newIdentifier(&Token{
+                                Type:  hclsyntax.TokenIdent,
+                                Bytes: []byte(ts.Name),
+                        }))
+                        physT.steps.Add(physT.children.Append(tn))
+                case hcl.TraverseIndex:
+                        ti := newTraverseIndex()
+                        ti.children.AppendUnstructuredTokens(Tokens{
+                                {
+                                        Type:  hclsyntax.TokenOBrack,
+                                        Bytes: []byte{'['},
+                                },
+                        })
+                        indexExpr := NewExpressionLiteral(ts.Key)
+                        ti.key = ti.children.Append(indexExpr)
+                        ti.children.AppendUnstructuredTokens(Tokens{
+                                {
+                                        Type:  hclsyntax.TokenCBrack,
+                                        Bytes: []byte{']'},
+                                },
+                        })
+                        physT.steps.Add(physT.children.Append(ti))
+                }
+        }
+
+        expr := newExpression()
+        expr.absTraversals.Add(expr.children.Append(physT))
+        return expr
+}
+
+// Variables returns the absolute traversals that exist within the receiving
+// expression.
+func (e *Expression) Variables() []*Traversal {
+        nodes := e.absTraversals.List()
+        ret := make([]*Traversal, len(nodes))
+        for i, node := range nodes {
+                ret[i] = node.content.(*Traversal)
+        }
+        return ret
+}
+
+// RenameVariablePrefix examines each of the absolute traversals in the
+// receiving expression to see if they have the given sequence of names as
+// a prefix prefix. If so, they are updated in place to have the given
+// replacement names instead of that prefix.
+//
+// This can be used to implement symbol renaming. The calling application can
+// visit all relevant expressions in its input and apply the same renaming
+// to implement a global symbol rename.
+//
+// The search and replacement traversals must be the same length, or this
+// method will panic. Only attribute access operations can be matched and
+// replaced. Index steps never match the prefix.
+func (e *Expression) RenameVariablePrefix(search, replacement []string) {
+        if len(search) != len(replacement) {
+                panic(fmt.Sprintf("search and replacement length mismatch (%d and %d)", len(search), len(replacement)))
+        }
+Traversals:
+        for node := range e.absTraversals {
+                traversal := node.content.(*Traversal)
+                if len(traversal.steps) < len(search) {
+                        // If it's shorter then it can't have our prefix
+                        continue
+                }
+
+                stepNodes := traversal.steps.List()
+                for i, name := range search {
+                        step, isName := stepNodes[i].content.(*TraverseName)
+                        if !isName {
+                                continue Traversals // only name nodes can match
+                        }
+                        foundNameBytes := step.name.content.(*identifier).token.Bytes
+                        if len(foundNameBytes) != len(name) {
+                                continue Traversals
+                        }
+                        if string(foundNameBytes) != name {
+                                continue Traversals
+                        }
+                }
+
+                // If we get here then the prefix matched, so now we'll swap in
+                // the replacement strings.
+                for i, name := range replacement {
+                        step := stepNodes[i].content.(*TraverseName)
+                        token := step.name.content.(*identifier).token
+                        token.Bytes = []byte(name)
+                }
+        }
+}
+
+// Traversal represents a sequence of variable, attribute, and/or index
+// operations.
+type Traversal struct {
+        inTree
+
+        steps nodeSet
+}
+
+func newTraversal() *Traversal {
+        return &Traversal{
+                inTree: newInTree(),
+                steps:  newNodeSet(),
+        }
+}
+
+type TraverseName struct {
+        inTree
+
+        name *node
+}
+
+func newTraverseName() *TraverseName {
+        return &TraverseName{
+                inTree: newInTree(),
+        }
+}
+
+type TraverseIndex struct {
+        inTree
+
+        key *node
+}
+
+func newTraverseIndex() *TraverseIndex {
+        return &TraverseIndex{
+                inTree: newInTree(),
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/doc.go b/vendor/github.com/hashicorp/hcl2/hclwrite/doc.go
new file mode 100644
index 0000000..56d5b77
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/doc.go
@@ -0,0 +1,11 @@
+// Package hclwrite deals with the problem of generating HCL configuration
+// and of making specific surgical changes to existing HCL configurations.
+//
+// It operates at a different level of abstraction than the main HCL parser
+// and AST, since details such as the placement of comments and newlines
+// are preserved when unchanged.
+//
+// The hclwrite API follows a similar principle to XML/HTML DOM, allowing nodes
+// to be read out, created and inserted, etc. Nodes represent syntax constructs
+// rather than semantic concepts.
+package hclwrite
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/format.go b/vendor/github.com/hashicorp/hcl2/hclwrite/format.go
new file mode 100644
index 0000000..f20ae23
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/format.go
@@ -0,0 +1,492 @@
+package hclwrite
+
+import (
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+)
+
+var inKeyword = hclsyntax.Keyword([]byte{'i', 'n'})
+
+// placeholder token used when we don't have a token but we don't want
+// to pass a real "nil" and complicate things with nil pointer checks
+var nilToken = &Token{
+        Type:         hclsyntax.TokenNil,
+        Bytes:        []byte{},
+        SpacesBefore: 0,
+}
+
+// format rewrites tokens within the given sequence, in-place, to adjust the
+// whitespace around their content to achieve canonical formatting.
+func format(tokens Tokens) {
+        // Formatting is a multi-pass process. More details on the passes below,
+        // but this is the overview:
+        // - adjust the leading space on each line to create appropriate
+        //   indentation
+        // - adjust spaces between tokens in a single cell using a set of rules
+        // - adjust the leading space in the "assign" and "comment" cells on each
+        //   line to vertically align with neighboring lines.
+        // All of these steps operate in-place on the given tokens, so a caller
+        // may collect a flat sequence of all of the tokens underlying an AST
+        // and pass it here and we will then indirectly modify the AST itself.
+        // Formatting must change only whitespace. Specifically, that means
+        // changing the SpacesBefore attribute on a token while leaving the
+        // other token attributes unchanged.
+
+        lines := linesForFormat(tokens)
+        formatIndent(lines)
+        formatSpaces(lines)
+        formatCells(lines)
+}
+
+func formatIndent(lines []formatLine) {
+        // Our methodology for indents is to take the input one line at a time
+        // and count the bracketing delimiters on each line. If a line has a net
+        // increase in open brackets, we increase the indent level by one and
+        // remember how many new openers we had. If the line has a net _decrease_,
+        // we'll compare it to the most recent number of openers and decrease the
+        // dedent level by one each time we pass an indent level remembered
+        // earlier.
+        // The "indent stack" used here allows for us to recognize degenerate
+        // input where brackets are not symmetrical within lines and avoid
+        // pushing things too far left or right, creating confusion.
+
+        // We'll start our indent stack at a reasonable capacity to minimize the
+        // chance of us needing to grow it; 10 here means 10 levels of indent,
+        // which should be more than enough for reasonable HCL uses.
+        indents := make([]int, 0, 10)
+
+        inHeredoc := false
+        for i := range lines {
+                line := &lines[i]
+                if len(line.lead) == 0 {
+                        continue
+                }
+
+                if inHeredoc {
+                        for _, token := range line.lead {
+                                if token.Type == hclsyntax.TokenCHeredoc {
+                                        inHeredoc = false
+                                }
+                        }
+                        continue // don't touch indentation inside heredocs
+                }
+
+                if line.lead[0].Type == hclsyntax.TokenNewline {
+                        // Never place spaces before a newline
+                        line.lead[0].SpacesBefore = 0
+                        continue
+                }
+
+                netBrackets := 0
+                for _, token := range line.lead {
+                        netBrackets += tokenBracketChange(token)
+                        if token.Type == hclsyntax.TokenOHeredoc {
+                                inHeredoc = true
+                        }
+                }
+                for _, token := range line.assign {
+                        netBrackets += tokenBracketChange(token)
+                }
+
+                switch {
+                case netBrackets > 0:
+                        line.lead[0].SpacesBefore = 2 * len(indents)
+                        indents = append(indents, netBrackets)
+                case netBrackets < 0:
+                        closed := -netBrackets
+                        for closed > 0 && len(indents) > 0 {
+                                switch {
+
+                                case closed > indents[len(indents)-1]:
+                                        closed -= indents[len(indents)-1]
+                                        indents = indents[:len(indents)-1]
+
+                                case closed < indents[len(indents)-1]:
+                                        indents[len(indents)-1] -= closed
+                                        closed = 0
+
+                                default:
+                                        indents = indents[:len(indents)-1]
+                                        closed = 0
+                                }
+                        }
+                        line.lead[0].SpacesBefore = 2 * len(indents)
+                default:
+                        line.lead[0].SpacesBefore = 2 * len(indents)
+                }
+        }
+}
+
+func formatSpaces(lines []formatLine) {
+        for _, line := range lines {
+                for i, token := range line.lead {
+                        var before, after *Token
+                        if i > 0 {
+                                before = line.lead[i-1]
+                        } else {
+                                before = nilToken
+                        }
+                        if i < (len(line.lead) - 1) {
+                                after = line.lead[i+1]
+                        } else {
+                                after = nilToken
+                        }
+                        if spaceAfterToken(token, before, after) {
+                                after.SpacesBefore = 1
+                        } else {
+                                after.SpacesBefore = 0
+                        }
+                }
+                for i, token := range line.assign {
+                        if i == 0 {
+                                // first token in "assign" always has one space before to
+                                // separate the equals sign from what it's assigning.
+                                token.SpacesBefore = 1
+                        }
+
+                        var before, after *Token
+                        if i > 0 {
+                                before = line.assign[i-1]
+                        } else {
+                                before = nilToken
+                        }
+                        if i < (len(line.assign) - 1) {
+                                after = line.assign[i+1]
+                        } else {
+                                after = nilToken
+                        }
+                        if spaceAfterToken(token, before, after) {
+                                after.SpacesBefore = 1
+                        } else {
+                                after.SpacesBefore = 0
+                        }
+                }
+
+        }
+}
+
+func formatCells(lines []formatLine) {
+
+        chainStart := -1
+        maxColumns := 0
+
+        // We'll deal with the "assign" cell first, since moving that will
+        // also impact the "comment" cell.
+        closeAssignChain := func(i int) {
+                for _, chainLine := range lines[chainStart:i] {
+                        columns := chainLine.lead.Columns()
+                        spaces := (maxColumns - columns) + 1
+                        chainLine.assign[0].SpacesBefore = spaces
+                }
+                chainStart = -1
+                maxColumns = 0
+        }
+        for i, line := range lines {
+                if line.assign == nil {
+                        if chainStart != -1 {
+                                closeAssignChain(i)
+                        }
+                } else {
+                        if chainStart == -1 {
+                                chainStart = i
+                        }
+                        columns := line.lead.Columns()
+                        if columns > maxColumns {
+                                maxColumns = columns
+                        }
+                }
+        }
+        if chainStart != -1 {
+                closeAssignChain(len(lines))
+        }
+
+        // Now we'll deal with the comments
+        closeCommentChain := func(i int) {
+                for _, chainLine := range lines[chainStart:i] {
+                        columns := chainLine.lead.Columns() + chainLine.assign.Columns()
+                        spaces := (maxColumns - columns) + 1
+                        chainLine.comment[0].SpacesBefore = spaces
+                }
+                chainStart = -1
+                maxColumns = 0
+        }
+        for i, line := range lines {
+                if line.comment == nil {
+                        if chainStart != -1 {
+                                closeCommentChain(i)
+                        }
+                } else {
+                        if chainStart == -1 {
+                                chainStart = i
+                        }
+                        columns := line.lead.Columns() + line.assign.Columns()
+                        if columns > maxColumns {
+                                maxColumns = columns
+                        }
+                }
+        }
+        if chainStart != -1 {
+                closeCommentChain(len(lines))
+        }
+
+}
+
+// spaceAfterToken decides whether a particular subject token should have a
+// space after it when surrounded by the given before and after tokens.
+// "before" can be TokenNil, if the subject token is at the start of a sequence.
+func spaceAfterToken(subject, before, after *Token) bool {
+        switch {
+
+        case after.Type == hclsyntax.TokenNewline || after.Type == hclsyntax.TokenNil:
+                // Never add spaces before a newline
+                return false
+
+        case subject.Type == hclsyntax.TokenIdent && after.Type == hclsyntax.TokenOParen:
+                // Don't split a function name from open paren in a call
+                return false
+
+        case subject.Type == hclsyntax.TokenDot || after.Type == hclsyntax.TokenDot:
+                // Don't use spaces around attribute access dots
+                return false
+
+        case after.Type == hclsyntax.TokenComma || after.Type == hclsyntax.TokenEllipsis:
+                // No space right before a comma or ... in an argument list
+                return false
+
+        case subject.Type == hclsyntax.TokenComma:
+                // Always a space after a comma
+                return true
+
+        case subject.Type == hclsyntax.TokenQuotedLit || subject.Type == hclsyntax.TokenStringLit || subject.Type == hclsyntax.TokenOQuote || subject.Type == hclsyntax.TokenOHeredoc || after.Type == hclsyntax.TokenQuotedLit || after.Type == hclsyntax.TokenStringLit || after.Type == hclsyntax.TokenCQuote || after.Type == hclsyntax.TokenCHeredoc:
+                // No extra spaces within templates
+                return false
+
+        case inKeyword.TokenMatches(subject.asHCLSyntax()) && before.Type == hclsyntax.TokenIdent:
+                // This is a special case for inside for expressions where a user
+                // might want to use a literal tuple constructor:
+                // [for x in [foo]: x]
+                // ... in that case, we would normally produce in[foo] thinking that
+                // in is a reference, but we'll recognize it as a keyword here instead
+                // to make the result less confusing.
+                return true
+
+        case after.Type == hclsyntax.TokenOBrack && (subject.Type == hclsyntax.TokenIdent || subject.Type == hclsyntax.TokenNumberLit || tokenBracketChange(subject) < 0):
+                return false
+
+        case subject.Type == hclsyntax.TokenMinus:
+                // Since a minus can either be subtraction or negation, and the latter
+                // should _not_ have a space after it, we need to use some heuristics
+                // to decide which case this is.
+                // We guess that we have a negation if the token before doesn't look
+                // like it could be the end of an expression.
+
+                switch before.Type {
+
+                case hclsyntax.TokenNil:
+                        // Minus at the start of input must be a negation
+                        return false
+
+                case hclsyntax.TokenOParen, hclsyntax.TokenOBrace, hclsyntax.TokenOBrack, hclsyntax.TokenEqual, hclsyntax.TokenColon, hclsyntax.TokenComma, hclsyntax.TokenQuestion:
+                        // Minus immediately after an opening bracket or separator must be a negation.
+                        return false
+
+                case hclsyntax.TokenPlus, hclsyntax.TokenStar, hclsyntax.TokenSlash, hclsyntax.TokenPercent, hclsyntax.TokenMinus:
+                        // Minus immediately after another arithmetic operator must be negation.
+                        return false
+
+                case hclsyntax.TokenEqualOp, hclsyntax.TokenNotEqual, hclsyntax.TokenGreaterThan, hclsyntax.TokenGreaterThanEq, hclsyntax.TokenLessThan, hclsyntax.TokenLessThanEq:
+                        // Minus immediately after another comparison operator must be negation.
+                        return false
+
+                case hclsyntax.TokenAnd, hclsyntax.TokenOr, hclsyntax.TokenBang:
+                        // Minus immediately after logical operator doesn't make sense but probably intended as negation.
+                        return false
+
+                default:
+                        return true
+                }
+
+        case subject.Type == hclsyntax.TokenOBrace || after.Type == hclsyntax.TokenCBrace:
+                // Unlike other bracket types, braces have spaces on both sides of them,
+                // both in single-line nested blocks foo { bar = baz } and in object
+                // constructor expressions foo = { bar = baz }.
+                if subject.Type == hclsyntax.TokenOBrace && after.Type == hclsyntax.TokenCBrace {
+                        // An open brace followed by a close brace is an exception, however.
+                        // e.g. foo {} rather than foo { }
+                        return false
+                }
+                return true
+
+        // In the unlikely event that an interpolation expression is just
+        // a single object constructor, we'll put a space between the ${ and
+        // the following { to make this more obvious, and then the same
+        // thing for the two braces at the end.
+        case (subject.Type == hclsyntax.TokenTemplateInterp || subject.Type == hclsyntax.TokenTemplateControl) && after.Type == hclsyntax.TokenOBrace:
+                return true
+        case subject.Type == hclsyntax.TokenCBrace && after.Type == hclsyntax.TokenTemplateSeqEnd:
+                return true
+
+        // Don't add spaces between interpolated items
+        case subject.Type == hclsyntax.TokenTemplateSeqEnd && after.Type == hclsyntax.TokenTemplateInterp:
+                return false
+
+        case tokenBracketChange(subject) > 0:
+                // No spaces after open brackets
+                return false
+
+        case tokenBracketChange(after) < 0:
+                // No spaces before close brackets
+                return false
+
+        default:
+                // Most tokens are space-separated
+                return true
+
+        }
+}
+
+func linesForFormat(tokens Tokens) []formatLine {
+        if len(tokens) == 0 {
+                return make([]formatLine, 0)
+        }
+
+        // first we'll count our lines, so we can allocate the array for them in
+        // a single block. (We want to minimize memory pressure in this codepath,
+        // so it can be run somewhat-frequently by editor integrations.)
+        lineCount := 1 // if there are zero newlines then there is one line
+        for _, tok := range tokens {
+                if tokenIsNewline(tok) {
+                        lineCount++
+                }
+        }
+
+        // To start, we'll just put everything in the "lead" cell on each line,
+        // and then do another pass over the lines afterwards to adjust.
+        lines := make([]formatLine, lineCount)
+        li := 0
+        lineStart := 0
+        for i, tok := range tokens {
+                if tok.Type == hclsyntax.TokenEOF {
+                        // The EOF token doesn't belong to any line, and terminates the
+                        // token sequence.
+                        lines[li].lead = tokens[lineStart:i]
+                        break
+                }
+
+                if tokenIsNewline(tok) {
+                        lines[li].lead = tokens[lineStart : i+1]
+                        lineStart = i + 1
+                        li++
+                }
+        }
+
+        // If a set of tokens doesn't end in TokenEOF (e.g. because it's a
+        // fragment of tokens from the middle of a file) then we might fall
+        // out here with a line still pending.
+        if lineStart < len(tokens) {
+                lines[li].lead = tokens[lineStart:]
+                if lines[li].lead[len(lines[li].lead)-1].Type == hclsyntax.TokenEOF {
+                        lines[li].lead = lines[li].lead[:len(lines[li].lead)-1]
+                }
+        }
+
+        // Now we'll pick off any trailing comments and attribute assignments
+        // to shuffle off into the "comment" and "assign" cells.
+        inHeredoc := false
+        for i := range lines {
+                line := &lines[i]
+                if len(line.lead) == 0 {
+                        // if the line is empty then there's nothing for us to do
+                        // (this should happen only for the final line, because all other
+                        // lines would have a newline token of some kind)
+                        continue
+                }
+
+                if inHeredoc {
+                        for _, tok := range line.lead {
+                                if tok.Type == hclsyntax.TokenCHeredoc {
+                                        inHeredoc = false
+                                        break
+                                }
+                        }
+                        // Inside a heredoc everything is "lead", even if there's a
+                        // template interpolation embedded in there that might otherwise
+                        // confuse our logic below.
+                        continue
+                }
+
+                for _, tok := range line.lead {
+                        if tok.Type == hclsyntax.TokenOHeredoc {
+                                inHeredoc = true
+                                break
+                        }
+                }
+
+                if len(line.lead) > 1 && line.lead[len(line.lead)-1].Type == hclsyntax.TokenComment {
+                        line.comment = line.lead[len(line.lead)-1:]
+                        line.lead = line.lead[:len(line.lead)-1]
+                }
+
+                for i, tok := range line.lead {
+                        if i > 0 && tok.Type == hclsyntax.TokenEqual {
+                                // We only move the tokens into "assign" if the RHS seems to
+                                // be a whole expression, which we determine by counting
+                                // brackets. If there's a net positive number of brackets
+                                // then that suggests we're introducing a multi-line expression.
+                                netBrackets := 0
+                                for _, token := range line.lead[i:] {
+                                        netBrackets += tokenBracketChange(token)
+                                }
+
+                                if netBrackets == 0 {
+                                        line.assign = line.lead[i:]
+                                        line.lead = line.lead[:i]
+                                }
+                                break
+                        }
+                }
+        }
+
+        return lines
+}
+
+func tokenIsNewline(tok *Token) bool {
+        if tok.Type == hclsyntax.TokenNewline {
+                return true
+        } else if tok.Type == hclsyntax.TokenComment {
+                // Single line tokens (# and //) consume their terminating newline,
+                // so we need to treat them as newline tokens as well.
+                if len(tok.Bytes) > 0 && tok.Bytes[len(tok.Bytes)-1] == '\n' {
+                        return true
+                }
+        }
+        return false
+}
+
+func tokenBracketChange(tok *Token) int {
+        switch tok.Type {
+        case hclsyntax.TokenOBrace, hclsyntax.TokenOBrack, hclsyntax.TokenOParen, hclsyntax.TokenTemplateControl, hclsyntax.TokenTemplateInterp:
+                return 1
+        case hclsyntax.TokenCBrace, hclsyntax.TokenCBrack, hclsyntax.TokenCParen, hclsyntax.TokenTemplateSeqEnd:
+                return -1
+        default:
+                return 0
+        }
+}
+
+// formatLine represents a single line of source code for formatting purposes,
+// splitting its tokens into up to three "cells":
+//
+// lead: always present, representing everything up to one of the others
+// assign: if line contains an attribute assignment, represents the tokens
+//    starting at (and including) the equals symbol
+// comment: if line contains any non-comment tokens and ends with a
+//    single-line comment token, represents the comment.
+//
+// When formatting, the leading spaces of the first tokens in each of these
+// cells is adjusted to align vertically their occurences on consecutive
+// rows.
+type formatLine struct {
+        lead    Tokens
+        assign  Tokens
+        comment Tokens
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/generate.go b/vendor/github.com/hashicorp/hcl2/hclwrite/generate.go
new file mode 100644
index 0000000..d249cfd
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/generate.go
@@ -0,0 +1,250 @@
+package hclwrite
+
+import (
+        "fmt"
+        "unicode"
+        "unicode/utf8"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// TokensForValue returns a sequence of tokens that represents the given
+// constant value.
+//
+// This function only supports types that are used by HCL. In particular, it
+// does not support capsule types and will panic if given one.
+//
+// It is not possible to express an unknown value in source code, so this
+// function will panic if the given value is unknown or contains any unknown
+// values. A caller can call the value's IsWhollyKnown method to verify that
+// no unknown values are present before calling TokensForValue.
+func TokensForValue(val cty.Value) Tokens {
+        toks := appendTokensForValue(val, nil)
+        format(toks) // fiddle with the SpacesBefore field to get canonical spacing
+        return toks
+}
+
+// TokensForTraversal returns a sequence of tokens that represents the given
+// traversal.
+//
+// If the traversal is absolute then the result is a self-contained, valid
+// reference expression. If the traversal is relative then the returned tokens
+// could be appended to some other expression tokens to traverse into the
+// represented expression.
+func TokensForTraversal(traversal hcl.Traversal) Tokens {
+        toks := appendTokensForTraversal(traversal, nil)
+        format(toks) // fiddle with the SpacesBefore field to get canonical spacing
+        return toks
+}
+
+func appendTokensForValue(val cty.Value, toks Tokens) Tokens {
+        switch {
+
+        case !val.IsKnown():
+                panic("cannot produce tokens for unknown value")
+
+        case val.IsNull():
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenIdent,
+                        Bytes: []byte(`null`),
+                })
+
+        case val.Type() == cty.Bool:
+                var src []byte
+                if val.True() {
+                        src = []byte(`true`)
+                } else {
+                        src = []byte(`false`)
+                }
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenIdent,
+                        Bytes: src,
+                })
+
+        case val.Type() == cty.Number:
+                bf := val.AsBigFloat()
+                srcStr := bf.Text('f', -1)
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenNumberLit,
+                        Bytes: []byte(srcStr),
+                })
+
+        case val.Type() == cty.String:
+                // TODO: If it's a multi-line string ending in a newline, format
+                // it as a HEREDOC instead.
+                src := escapeQuotedStringLit(val.AsString())
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenOQuote,
+                        Bytes: []byte{'"'},
+                })
+                if len(src) > 0 {
+                        toks = append(toks, &Token{
+                                Type:  hclsyntax.TokenQuotedLit,
+                                Bytes: src,
+                        })
+                }
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenCQuote,
+                        Bytes: []byte{'"'},
+                })
+
+        case val.Type().IsListType() || val.Type().IsSetType() || val.Type().IsTupleType():
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenOBrack,
+                        Bytes: []byte{'['},
+                })
+
+                i := 0
+                for it := val.ElementIterator(); it.Next(); {
+                        if i > 0 {
+                                toks = append(toks, &Token{
+                                        Type:  hclsyntax.TokenComma,
+                                        Bytes: []byte{','},
+                                })
+                        }
+                        _, eVal := it.Element()
+                        toks = appendTokensForValue(eVal, toks)
+                        i++
+                }
+
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenCBrack,
+                        Bytes: []byte{']'},
+                })
+
+        case val.Type().IsMapType() || val.Type().IsObjectType():
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenOBrace,
+                        Bytes: []byte{'{'},
+                })
+
+                i := 0
+                for it := val.ElementIterator(); it.Next(); {
+                        if i > 0 {
+                                toks = append(toks, &Token{
+                                        Type:  hclsyntax.TokenComma,
+                                        Bytes: []byte{','},
+                                })
+                        }
+                        eKey, eVal := it.Element()
+                        if hclsyntax.ValidIdentifier(eKey.AsString()) {
+                                toks = append(toks, &Token{
+                                        Type:  hclsyntax.TokenIdent,
+                                        Bytes: []byte(eKey.AsString()),
+                                })
+                        } else {
+                                toks = appendTokensForValue(eKey, toks)
+                        }
+                        toks = append(toks, &Token{
+                                Type:  hclsyntax.TokenEqual,
+                                Bytes: []byte{'='},
+                        })
+                        toks = appendTokensForValue(eVal, toks)
+                        i++
+                }
+
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenCBrace,
+                        Bytes: []byte{'}'},
+                })
+
+        default:
+                panic(fmt.Sprintf("cannot produce tokens for %#v", val))
+        }
+
+        return toks
+}
+
+func appendTokensForTraversal(traversal hcl.Traversal, toks Tokens) Tokens {
+        for _, step := range traversal {
+                appendTokensForTraversalStep(step, toks)
+        }
+        return toks
+}
+
+func appendTokensForTraversalStep(step hcl.Traverser, toks Tokens) {
+        switch ts := step.(type) {
+        case hcl.TraverseRoot:
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenIdent,
+                        Bytes: []byte(ts.Name),
+                })
+        case hcl.TraverseAttr:
+                toks = append(
+                        toks,
+                        &Token{
+                                Type:  hclsyntax.TokenDot,
+                                Bytes: []byte{'.'},
+                        },
+                        &Token{
+                                Type:  hclsyntax.TokenIdent,
+                                Bytes: []byte(ts.Name),
+                        },
+                )
+        case hcl.TraverseIndex:
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenOBrack,
+                        Bytes: []byte{'['},
+                })
+                appendTokensForValue(ts.Key, toks)
+                toks = append(toks, &Token{
+                        Type:  hclsyntax.TokenCBrack,
+                        Bytes: []byte{']'},
+                })
+        default:
+                panic(fmt.Sprintf("unsupported traversal step type %T", step))
+        }
+}
+
+func escapeQuotedStringLit(s string) []byte {
+        if len(s) == 0 {
+                return nil
+        }
+        buf := make([]byte, 0, len(s))
+        for i, r := range s {
+                switch r {
+                case '\n':
+                        buf = append(buf, '\\', 'n')
+                case '\r':
+                        buf = append(buf, '\\', 'r')
+                case '\t':
+                        buf = append(buf, '\\', 't')
+                case '"':
+                        buf = append(buf, '\\', '"')
+                case '\\':
+                        buf = append(buf, '\\', '\\')
+                case '$', '%':
+                        buf = appendRune(buf, r)
+                        remain := s[i+1:]
+                        if len(remain) > 0 && remain[0] == '{' {
+                                // Double up our template introducer symbol to escape it.
+                                buf = appendRune(buf, r)
+                        }
+                default:
+                        if !unicode.IsPrint(r) {
+                                var fmted string
+                                if r < 65536 {
+                                        fmted = fmt.Sprintf("\\u%04x", r)
+                                } else {
+                                        fmted = fmt.Sprintf("\\U%08x", r)
+                                }
+                                buf = append(buf, fmted...)
+                        } else {
+                                buf = appendRune(buf, r)
+                        }
+                }
+        }
+        return buf
+}
+
+func appendRune(b []byte, r rune) []byte {
+        l := utf8.RuneLen(r)
+        for i := 0; i < l; i++ {
+                b = append(b, 0) // make room at the end of our buffer
+        }
+        ch := b[len(b)-l:]
+        utf8.EncodeRune(ch, r)
+        return b
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/native_node_sorter.go b/vendor/github.com/hashicorp/hcl2/hclwrite/native_node_sorter.go
new file mode 100644
index 0000000..a13c0ec
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/native_node_sorter.go
@@ -0,0 +1,23 @@
+package hclwrite
+
+import (
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+)
+
+type nativeNodeSorter struct {
+        Nodes []hclsyntax.Node
+}
+
+func (s nativeNodeSorter) Len() int {
+        return len(s.Nodes)
+}
+
+func (s nativeNodeSorter) Less(i, j int) bool {
+        rangeI := s.Nodes[i].Range()
+        rangeJ := s.Nodes[j].Range()
+        return rangeI.Start.Byte < rangeJ.Start.Byte
+}
+
+func (s nativeNodeSorter) Swap(i, j int) {
+        s.Nodes[i], s.Nodes[j] = s.Nodes[j], s.Nodes[i]
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/node.go b/vendor/github.com/hashicorp/hcl2/hclwrite/node.go
new file mode 100644
index 0000000..71fd00f
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/node.go
@@ -0,0 +1,236 @@
+package hclwrite
+
+import (
+        "fmt"
+
+        "github.com/google/go-cmp/cmp"
+)
+
+// node represents a node in the AST.
+type node struct {
+        content nodeContent
+
+        list          *nodes
+        before, after *node
+}
+
+func newNode(c nodeContent) *node {
+        return &node{
+                content: c,
+        }
+}
+
+func (n *node) Equal(other *node) bool {
+        return cmp.Equal(n.content, other.content)
+}
+
+func (n *node) BuildTokens(to Tokens) Tokens {
+        return n.content.BuildTokens(to)
+}
+
+// Detach removes the receiver from the list it currently belongs to. If the
+// node is not currently in a list, this is a no-op.
+func (n *node) Detach() {
+        if n.list == nil {
+                return
+        }
+        if n.before != nil {
+                n.before.after = n.after
+        }
+        if n.after != nil {
+                n.after.before = n.before
+        }
+        if n.list.first == n {
+                n.list.first = n.after
+        }
+        if n.list.last == n {
+                n.list.last = n.before
+        }
+        n.list = nil
+        n.before = nil
+        n.after = nil
+}
+
+// ReplaceWith removes the receiver from the list it currently belongs to and
+// inserts a new node with the given content in its place. If the node is not
+// currently in a list, this function will panic.
+//
+// The return value is the newly-constructed node, containing the given content.
+// After this function returns, the reciever is no longer attached to a list.
+func (n *node) ReplaceWith(c nodeContent) *node {
+        if n.list == nil {
+                panic("can't replace node that is not in a list")
+        }
+
+        before := n.before
+        after := n.after
+        list := n.list
+        n.before, n.after, n.list = nil, nil, nil
+
+        nn := newNode(c)
+        nn.before = before
+        nn.after = after
+        nn.list = list
+        if before != nil {
+                before.after = nn
+        }
+        if after != nil {
+                after.before = nn
+        }
+        return nn
+}
+
+func (n *node) assertUnattached() {
+        if n.list != nil {
+                panic(fmt.Sprintf("attempt to attach already-attached node %#v", n))
+        }
+}
+
+// nodeContent is the interface type implemented by all AST content types.
+type nodeContent interface {
+        walkChildNodes(w internalWalkFunc)
+        BuildTokens(to Tokens) Tokens
+}
+
+// nodes is a list of nodes.
+type nodes struct {
+        first, last *node
+}
+
+func (ns *nodes) BuildTokens(to Tokens) Tokens {
+        for n := ns.first; n != nil; n = n.after {
+                to = n.BuildTokens(to)
+        }
+        return to
+}
+
+func (ns *nodes) Clear() {
+        ns.first = nil
+        ns.last = nil
+}
+
+func (ns *nodes) Append(c nodeContent) *node {
+        n := &node{
+                content: c,
+        }
+        ns.AppendNode(n)
+        n.list = ns
+        return n
+}
+
+func (ns *nodes) AppendNode(n *node) {
+        if ns.last != nil {
+                n.before = ns.last
+                ns.last.after = n
+        }
+        n.list = ns
+        ns.last = n
+        if ns.first == nil {
+                ns.first = n
+        }
+}
+
+func (ns *nodes) AppendUnstructuredTokens(tokens Tokens) *node {
+        if len(tokens) == 0 {
+                return nil
+        }
+        n := newNode(tokens)
+        ns.AppendNode(n)
+        n.list = ns
+        return n
+}
+
+// nodeSet is an unordered set of nodes. It is used to describe a set of nodes
+// that all belong to the same list that have some role or characteristic
+// in common.
+type nodeSet map[*node]struct{}
+
+func newNodeSet() nodeSet {
+        return make(nodeSet)
+}
+
+func (ns nodeSet) Has(n *node) bool {
+        if ns == nil {
+                return false
+        }
+        _, exists := ns[n]
+        return exists
+}
+
+func (ns nodeSet) Add(n *node) {
+        ns[n] = struct{}{}
+}
+
+func (ns nodeSet) Remove(n *node) {
+        delete(ns, n)
+}
+
+func (ns nodeSet) List() []*node {
+        if len(ns) == 0 {
+                return nil
+        }
+
+        ret := make([]*node, 0, len(ns))
+
+        // Determine which list we are working with. We assume here that all of
+        // the nodes belong to the same list, since that is part of the contract
+        // for nodeSet.
+        var list *nodes
+        for n := range ns {
+                list = n.list
+                break
+        }
+
+        // We recover the order by iterating over the whole list. This is not
+        // the most efficient way to do it, but our node lists should always be
+        // small so not worth making things more complex.
+        for n := list.first; n != nil; n = n.after {
+                if ns.Has(n) {
+                        ret = append(ret, n)
+                }
+        }
+        return ret
+}
+
+type internalWalkFunc func(*node)
+
+// inTree can be embedded into a content struct that has child nodes to get
+// a standard implementation of the NodeContent interface and a record of
+// a potential parent node.
+type inTree struct {
+        parent   *node
+        children *nodes
+}
+
+func newInTree() inTree {
+        return inTree{
+                children: &nodes{},
+        }
+}
+
+func (it *inTree) assertUnattached() {
+        if it.parent != nil {
+                panic(fmt.Sprintf("node is already attached to %T", it.parent.content))
+        }
+}
+
+func (it *inTree) walkChildNodes(w internalWalkFunc) {
+        for n := it.children.first; n != nil; n = n.after {
+                w(n)
+        }
+}
+
+func (it *inTree) BuildTokens(to Tokens) Tokens {
+        for n := it.children.first; n != nil; n = n.after {
+                to = n.BuildTokens(to)
+        }
+        return to
+}
+
+// leafNode can be embedded into a content struct to give it a do-nothing
+// implementation of walkChildNodes
+type leafNode struct {
+}
+
+func (n *leafNode) walkChildNodes(w internalWalkFunc) {
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/parser.go b/vendor/github.com/hashicorp/hcl2/hclwrite/parser.go
new file mode 100644
index 0000000..1876818
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/parser.go
@@ -0,0 +1,594 @@
+package hclwrite
+
+import (
+        "fmt"
+        "sort"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Our "parser" here is actually not doing any parsing of its own. Instead,
+// it leans on the native parser in hclsyntax, and then uses the source ranges
+// from the AST to partition the raw token sequence to match the raw tokens
+// up to AST nodes.
+//
+// This strategy feels somewhat counter-intuitive, since most of the work the
+// parser does is thrown away here, but this strategy is chosen because the
+// normal parsing work done by hclsyntax is considered to be the "main case",
+// while modifying and re-printing source is more of an edge case, used only
+// in ancillary tools, and so it's good to keep all the main parsing logic
+// with the main case but keep all of the extra complexity of token wrangling
+// out of the main parser, which is already rather complex just serving the
+// use-cases it already serves.
+//
+// If the parsing step produces any errors, the returned File is nil because
+// we can't reliably extract tokens from the partial AST produced by an
+// erroneous parse.
+func parse(src []byte, filename string, start hcl.Pos) (*File, hcl.Diagnostics) {
+        file, diags := hclsyntax.ParseConfig(src, filename, start)
+        if diags.HasErrors() {
+                return nil, diags
+        }
+
+        // To do our work here, we use the "native" tokens (those from hclsyntax)
+        // to match against source ranges in the AST, but ultimately produce
+        // slices from our sequence of "writer" tokens, which contain only
+        // *relative* position information that is more appropriate for
+        // transformation/writing use-cases.
+        nativeTokens, diags := hclsyntax.LexConfig(src, filename, start)
+        if diags.HasErrors() {
+                // should never happen, since we would've caught these diags in
+                // the first call above.
+                return nil, diags
+        }
+        writerTokens := writerTokens(nativeTokens)
+
+        from := inputTokens{
+                nativeTokens: nativeTokens,
+                writerTokens: writerTokens,
+        }
+
+        before, root, after := parseBody(file.Body.(*hclsyntax.Body), from)
+        ret := &File{
+                inTree: newInTree(),
+
+                srcBytes: src,
+                body:     root,
+        }
+
+        nodes := ret.inTree.children
+        nodes.Append(before.Tokens())
+        nodes.AppendNode(root)
+        nodes.Append(after.Tokens())
+
+        return ret, diags
+}
+
+type inputTokens struct {
+        nativeTokens hclsyntax.Tokens
+        writerTokens Tokens
+}
+
+func (it inputTokens) Partition(rng hcl.Range) (before, within, after inputTokens) {
+        start, end := partitionTokens(it.nativeTokens, rng)
+        before = it.Slice(0, start)
+        within = it.Slice(start, end)
+        after = it.Slice(end, len(it.nativeTokens))
+        return
+}
+
+func (it inputTokens) PartitionType(ty hclsyntax.TokenType) (before, within, after inputTokens) {
+        for i, t := range it.writerTokens {
+                if t.Type == ty {
+                        return it.Slice(0, i), it.Slice(i, i+1), it.Slice(i+1, len(it.nativeTokens))
+                }
+        }
+        panic(fmt.Sprintf("didn't find any token of type %s", ty))
+}
+
+func (it inputTokens) PartitionTypeSingle(ty hclsyntax.TokenType) (before inputTokens, found *Token, after inputTokens) {
+        before, within, after := it.PartitionType(ty)
+        if within.Len() != 1 {
+                panic("PartitionType found more than one token")
+        }
+        return before, within.Tokens()[0], after
+}
+
+// PartitionIncludeComments is like Partition except the returned "within"
+// range includes any lead and line comments associated with the range.
+func (it inputTokens) PartitionIncludingComments(rng hcl.Range) (before, within, after inputTokens) {
+        start, end := partitionTokens(it.nativeTokens, rng)
+        start = partitionLeadCommentTokens(it.nativeTokens[:start])
+        _, afterNewline := partitionLineEndTokens(it.nativeTokens[end:])
+        end += afterNewline
+
+        before = it.Slice(0, start)
+        within = it.Slice(start, end)
+        after = it.Slice(end, len(it.nativeTokens))
+        return
+
+}
+
+// PartitionBlockItem is similar to PartitionIncludeComments but it returns
+// the comments as separate token sequences so that they can be captured into
+// AST attributes. It makes assumptions that apply only to block items, so
+// should not be used for other constructs.
+func (it inputTokens) PartitionBlockItem(rng hcl.Range) (before, leadComments, within, lineComments, newline, after inputTokens) {
+        before, within, after = it.Partition(rng)
+        before, leadComments = before.PartitionLeadComments()
+        lineComments, newline, after = after.PartitionLineEndTokens()
+        return
+}
+
+func (it inputTokens) PartitionLeadComments() (before, within inputTokens) {
+        start := partitionLeadCommentTokens(it.nativeTokens)
+        before = it.Slice(0, start)
+        within = it.Slice(start, len(it.nativeTokens))
+        return
+}
+
+func (it inputTokens) PartitionLineEndTokens() (comments, newline, after inputTokens) {
+        afterComments, afterNewline := partitionLineEndTokens(it.nativeTokens)
+        comments = it.Slice(0, afterComments)
+        newline = it.Slice(afterComments, afterNewline)
+        after = it.Slice(afterNewline, len(it.nativeTokens))
+        return
+}
+
+func (it inputTokens) Slice(start, end int) inputTokens {
+        // When we slice, we create a new slice with no additional capacity because
+        // we expect that these slices will be mutated in order to insert
+        // new code into the AST, and we want to ensure that a new underlying
+        // array gets allocated in that case, rather than writing into some
+        // following slice and corrupting it.
+        return inputTokens{
+                nativeTokens: it.nativeTokens[start:end:end],
+                writerTokens: it.writerTokens[start:end:end],
+        }
+}
+
+func (it inputTokens) Len() int {
+        return len(it.nativeTokens)
+}
+
+func (it inputTokens) Tokens() Tokens {
+        return it.writerTokens
+}
+
+func (it inputTokens) Types() []hclsyntax.TokenType {
+        ret := make([]hclsyntax.TokenType, len(it.nativeTokens))
+        for i, tok := range it.nativeTokens {
+                ret[i] = tok.Type
+        }
+        return ret
+}
+
+// parseBody locates the given body within the given input tokens and returns
+// the resulting *Body object as well as the tokens that appeared before and
+// after it.
+func parseBody(nativeBody *hclsyntax.Body, from inputTokens) (inputTokens, *node, inputTokens) {
+        before, within, after := from.PartitionIncludingComments(nativeBody.SrcRange)
+
+        // The main AST doesn't retain the original source ordering of the
+        // body items, so we need to reconstruct that ordering by inspecting
+        // their source ranges.
+        nativeItems := make([]hclsyntax.Node, 0, len(nativeBody.Attributes)+len(nativeBody.Blocks))
+        for _, nativeAttr := range nativeBody.Attributes {
+                nativeItems = append(nativeItems, nativeAttr)
+        }
+        for _, nativeBlock := range nativeBody.Blocks {
+                nativeItems = append(nativeItems, nativeBlock)
+        }
+        sort.Sort(nativeNodeSorter{nativeItems})
+
+        body := &Body{
+                inTree: newInTree(),
+                items:  newNodeSet(),
+        }
+
+        remain := within
+        for _, nativeItem := range nativeItems {
+                beforeItem, item, afterItem := parseBodyItem(nativeItem, remain)
+
+                if beforeItem.Len() > 0 {
+                        body.AppendUnstructuredTokens(beforeItem.Tokens())
+                }
+                body.appendItemNode(item)
+
+                remain = afterItem
+        }
+
+        if remain.Len() > 0 {
+                body.AppendUnstructuredTokens(remain.Tokens())
+        }
+
+        return before, newNode(body), after
+}
+
+func parseBodyItem(nativeItem hclsyntax.Node, from inputTokens) (inputTokens, *node, inputTokens) {
+        before, leadComments, within, lineComments, newline, after := from.PartitionBlockItem(nativeItem.Range())
+
+        var item *node
+
+        switch tItem := nativeItem.(type) {
+        case *hclsyntax.Attribute:
+                item = parseAttribute(tItem, within, leadComments, lineComments, newline)
+        case *hclsyntax.Block:
+                item = parseBlock(tItem, within, leadComments, lineComments, newline)
+        default:
+                // should never happen if caller is behaving
+                panic("unsupported native item type")
+        }
+
+        return before, item, after
+}
+
+func parseAttribute(nativeAttr *hclsyntax.Attribute, from, leadComments, lineComments, newline inputTokens) *node {
+        attr := &Attribute{
+                inTree: newInTree(),
+        }
+        children := attr.inTree.children
+
+        {
+                cn := newNode(newComments(leadComments.Tokens()))
+                attr.leadComments = cn
+                children.AppendNode(cn)
+        }
+
+        before, nameTokens, from := from.Partition(nativeAttr.NameRange)
+        {
+                children.AppendUnstructuredTokens(before.Tokens())
+                if nameTokens.Len() != 1 {
+                        // Should never happen with valid input
+                        panic("attribute name is not exactly one token")
+                }
+                token := nameTokens.Tokens()[0]
+                in := newNode(newIdentifier(token))
+                attr.name = in
+                children.AppendNode(in)
+        }
+
+        before, equalsTokens, from := from.Partition(nativeAttr.EqualsRange)
+        children.AppendUnstructuredTokens(before.Tokens())
+        children.AppendUnstructuredTokens(equalsTokens.Tokens())
+
+        before, exprTokens, from := from.Partition(nativeAttr.Expr.Range())
+        {
+                children.AppendUnstructuredTokens(before.Tokens())
+                exprNode := parseExpression(nativeAttr.Expr, exprTokens)
+                attr.expr = exprNode
+                children.AppendNode(exprNode)
+        }
+
+        {
+                cn := newNode(newComments(lineComments.Tokens()))
+                attr.lineComments = cn
+                children.AppendNode(cn)
+        }
+
+        children.AppendUnstructuredTokens(newline.Tokens())
+
+        // Collect any stragglers, though there shouldn't be any
+        children.AppendUnstructuredTokens(from.Tokens())
+
+        return newNode(attr)
+}
+
+func parseBlock(nativeBlock *hclsyntax.Block, from, leadComments, lineComments, newline inputTokens) *node {
+        block := &Block{
+                inTree: newInTree(),
+                labels: newNodeSet(),
+        }
+        children := block.inTree.children
+
+        {
+                cn := newNode(newComments(leadComments.Tokens()))
+                block.leadComments = cn
+                children.AppendNode(cn)
+        }
+
+        before, typeTokens, from := from.Partition(nativeBlock.TypeRange)
+        {
+                children.AppendUnstructuredTokens(before.Tokens())
+                if typeTokens.Len() != 1 {
+                        // Should never happen with valid input
+                        panic("block type name is not exactly one token")
+                }
+                token := typeTokens.Tokens()[0]
+                in := newNode(newIdentifier(token))
+                block.typeName = in
+                children.AppendNode(in)
+        }
+
+        for _, rng := range nativeBlock.LabelRanges {
+                var labelTokens inputTokens
+                before, labelTokens, from = from.Partition(rng)
+                children.AppendUnstructuredTokens(before.Tokens())
+                tokens := labelTokens.Tokens()
+                ln := newNode(newQuoted(tokens))
+                block.labels.Add(ln)
+                children.AppendNode(ln)
+        }
+
+        before, oBrace, from := from.Partition(nativeBlock.OpenBraceRange)
+        children.AppendUnstructuredTokens(before.Tokens())
+        children.AppendUnstructuredTokens(oBrace.Tokens())
+
+        // We go a bit out of order here: we go hunting for the closing brace
+        // so that we have a delimited body, but then we'll deal with the body
+        // before we actually append the closing brace and any straggling tokens
+        // that appear after it.
+        bodyTokens, cBrace, from := from.Partition(nativeBlock.CloseBraceRange)
+        before, body, after := parseBody(nativeBlock.Body, bodyTokens)
+        children.AppendUnstructuredTokens(before.Tokens())
+        block.body = body
+        children.AppendNode(body)
+        children.AppendUnstructuredTokens(after.Tokens())
+
+        children.AppendUnstructuredTokens(cBrace.Tokens())
+
+        // stragglers
+        children.AppendUnstructuredTokens(from.Tokens())
+        if lineComments.Len() > 0 {
+                // blocks don't actually have line comments, so we'll just treat
+                // them as extra stragglers
+                children.AppendUnstructuredTokens(lineComments.Tokens())
+        }
+        children.AppendUnstructuredTokens(newline.Tokens())
+
+        return newNode(block)
+}
+
+func parseExpression(nativeExpr hclsyntax.Expression, from inputTokens) *node {
+        expr := newExpression()
+        children := expr.inTree.children
+
+        nativeVars := nativeExpr.Variables()
+
+        for _, nativeTraversal := range nativeVars {
+                before, traversal, after := parseTraversal(nativeTraversal, from)
+                children.AppendUnstructuredTokens(before.Tokens())
+                children.AppendNode(traversal)
+                expr.absTraversals.Add(traversal)
+                from = after
+        }
+        // Attach any stragglers that don't belong to a traversal to the expression
+        // itself. In an expression with no traversals at all, this is just the
+        // entirety of "from".
+        children.AppendUnstructuredTokens(from.Tokens())
+
+        return newNode(expr)
+}
+
+func parseTraversal(nativeTraversal hcl.Traversal, from inputTokens) (before inputTokens, n *node, after inputTokens) {
+        traversal := newTraversal()
+        children := traversal.inTree.children
+        before, from, after = from.Partition(nativeTraversal.SourceRange())
+
+        stepAfter := from
+        for _, nativeStep := range nativeTraversal {
+                before, step, after := parseTraversalStep(nativeStep, stepAfter)
+                children.AppendUnstructuredTokens(before.Tokens())
+                children.AppendNode(step)
+                traversal.steps.Add(step)
+                stepAfter = after
+        }
+
+        return before, newNode(traversal), after
+}
+
+func parseTraversalStep(nativeStep hcl.Traverser, from inputTokens) (before inputTokens, n *node, after inputTokens) {
+        var children *nodes
+        switch tNativeStep := nativeStep.(type) {
+
+        case hcl.TraverseRoot, hcl.TraverseAttr:
+                step := newTraverseName()
+                children = step.inTree.children
+                before, from, after = from.Partition(nativeStep.SourceRange())
+                inBefore, token, inAfter := from.PartitionTypeSingle(hclsyntax.TokenIdent)
+                name := newIdentifier(token)
+                children.AppendUnstructuredTokens(inBefore.Tokens())
+                step.name = children.Append(name)
+                children.AppendUnstructuredTokens(inAfter.Tokens())
+                return before, newNode(step), after
+
+        case hcl.TraverseIndex:
+                step := newTraverseIndex()
+                children = step.inTree.children
+                before, from, after = from.Partition(nativeStep.SourceRange())
+
+                var inBefore, oBrack, keyTokens, cBrack inputTokens
+                inBefore, oBrack, from = from.PartitionType(hclsyntax.TokenOBrack)
+                children.AppendUnstructuredTokens(inBefore.Tokens())
+                children.AppendUnstructuredTokens(oBrack.Tokens())
+                keyTokens, cBrack, from = from.PartitionType(hclsyntax.TokenCBrack)
+
+                keyVal := tNativeStep.Key
+                switch keyVal.Type() {
+                case cty.String:
+                        key := newQuoted(keyTokens.Tokens())
+                        step.key = children.Append(key)
+                case cty.Number:
+                        valBefore, valToken, valAfter := keyTokens.PartitionTypeSingle(hclsyntax.TokenNumberLit)
+                        children.AppendUnstructuredTokens(valBefore.Tokens())
+                        key := newNumber(valToken)
+                        step.key = children.Append(key)
+                        children.AppendUnstructuredTokens(valAfter.Tokens())
+                }
+
+                children.AppendUnstructuredTokens(cBrack.Tokens())
+                children.AppendUnstructuredTokens(from.Tokens())
+
+                return before, newNode(step), after
+        default:
+                panic(fmt.Sprintf("unsupported traversal step type %T", nativeStep))
+        }
+
+}
+
+// writerTokens takes a sequence of tokens as produced by the main hclsyntax
+// package and transforms it into an equivalent sequence of tokens using
+// this package's own token model.
+//
+// The resulting list contains the same number of tokens and uses the same
+// indices as the input, allowing the two sets of tokens to be correlated
+// by index.
+func writerTokens(nativeTokens hclsyntax.Tokens) Tokens {
+        // Ultimately we want a slice of token _pointers_, but since we can
+        // predict how much memory we're going to devote to tokens we'll allocate
+        // it all as a single flat buffer and thus give the GC less work to do.
+        tokBuf := make([]Token, len(nativeTokens))
+        var lastByteOffset int
+        for i, mainToken := range nativeTokens {
+                // Create a copy of the bytes so that we can mutate without
+                // corrupting the original token stream.
+                bytes := make([]byte, len(mainToken.Bytes))
+                copy(bytes, mainToken.Bytes)
+
+                tokBuf[i] = Token{
+                        Type:  mainToken.Type,
+                        Bytes: bytes,
+
+                        // We assume here that spaces are always ASCII spaces, since
+                        // that's what the scanner also assumes, and thus the number
+                        // of bytes skipped is also the number of space characters.
+                        SpacesBefore: mainToken.Range.Start.Byte - lastByteOffset,
+                }
+
+                lastByteOffset = mainToken.Range.End.Byte
+        }
+
+        // Now make a slice of pointers into the previous slice.
+        ret := make(Tokens, len(tokBuf))
+        for i := range ret {
+                ret[i] = &tokBuf[i]
+        }
+
+        return ret
+}
+
+// partitionTokens takes a sequence of tokens and a hcl.Range and returns
+// two indices within the token sequence that correspond with the range
+// boundaries, such that the slice operator could be used to produce
+// three token sequences for before, within, and after respectively:
+//
+//     start, end := partitionTokens(toks, rng)
+//     before := toks[:start]
+//     within := toks[start:end]
+//     after := toks[end:]
+//
+// This works best when the range is aligned with token boundaries (e.g.
+// because it was produced in terms of the scanner's result) but if that isn't
+// true then it will make a best effort that may produce strange results at
+// the boundaries.
+//
+// Native hclsyntax tokens are used here, because they contain the necessary
+// absolute position information. However, since writerTokens produces a
+// correlatable sequence of writer tokens, the resulting indices can be
+// used also to index into its result, allowing the partitioning of writer
+// tokens to be driven by the partitioning of native tokens.
+//
+// The tokens are assumed to be in source order and non-overlapping, which
+// will be true if the token sequence from the scanner is used directly.
+func partitionTokens(toks hclsyntax.Tokens, rng hcl.Range) (start, end int) {
+        // We us a linear search here because we assume tha in most cases our
+        // target range is close to the beginning of the sequence, and the seqences
+        // are generally small for most reasonable files anyway.
+        for i := 0; ; i++ {
+                if i >= len(toks) {
+                        // No tokens for the given range at all!
+                        return len(toks), len(toks)
+                }
+
+                if toks[i].Range.Start.Byte >= rng.Start.Byte {
+                        start = i
+                        break
+                }
+        }
+
+        for i := start; ; i++ {
+                if i >= len(toks) {
+                        // The range "hangs off" the end of the token sequence
+                        return start, len(toks)
+                }
+
+                if toks[i].Range.Start.Byte >= rng.End.Byte {
+                        end = i // end marker is exclusive
+                        break
+                }
+        }
+
+        return start, end
+}
+
+// partitionLeadCommentTokens takes a sequence of tokens that is assumed
+// to immediately precede a construct that can have lead comment tokens,
+// and returns the index into that sequence where the lead comments begin.
+//
+// Lead comments are defined as whole lines containing only comment tokens
+// with no blank lines between. If no such lines are found, the returned
+// index will be len(toks).
+func partitionLeadCommentTokens(toks hclsyntax.Tokens) int {
+        // single-line comments (which is what we're interested in here)
+        // consume their trailing newline, so we can just walk backwards
+        // until we stop seeing comment tokens.
+        for i := len(toks) - 1; i >= 0; i-- {
+                if toks[i].Type != hclsyntax.TokenComment {
+                        return i + 1
+                }
+        }
+        return 0
+}
+
+// partitionLineEndTokens takes a sequence of tokens that is assumed
+// to immediately follow a construct that can have a line comment, and
+// returns first the index where any line comments end and then second
+// the index immediately after the trailing newline.
+//
+// Line comments are defined as comments that appear immediately after
+// a construct on the same line where its significant tokens ended.
+//
+// Since single-line comment tokens (# and //) include the newline that
+// terminates them, in the presence of these the two returned indices
+// will be the same since the comment itself serves as the line end.
+func partitionLineEndTokens(toks hclsyntax.Tokens) (afterComment, afterNewline int) {
+        for i := 0; i < len(toks); i++ {
+                tok := toks[i]
+                if tok.Type != hclsyntax.TokenComment {
+                        switch tok.Type {
+                        case hclsyntax.TokenNewline:
+                                return i, i + 1
+                        case hclsyntax.TokenEOF:
+                                // Although this is valid, we mustn't include the EOF
+                                // itself as our "newline" or else strange things will
+                                // happen when we try to append new items.
+                                return i, i
+                        default:
+                                // If we have well-formed input here then nothing else should be
+                                // possible. This path should never happen, because we only try
+                                // to extract tokens from the sequence if the parser succeeded,
+                                // and it should catch this problem itself.
+                                panic("malformed line trailers: expected only comments and newlines")
+                        }
+                }
+
+                if len(tok.Bytes) > 0 && tok.Bytes[len(tok.Bytes)-1] == '\n' {
+                        // Newline at the end of a single-line comment serves both as
+                        // the end of comments *and* the end of the line.
+                        return i + 1, i + 1
+                }
+        }
+        return len(toks), len(toks)
+}
+
+// lexConfig uses the hclsyntax scanner to get a token stream and then
+// rewrites it into this package's token model.
+//
+// Any errors produced during scanning are ignored, so the results of this
+// function should be used with care.
+func lexConfig(src []byte) Tokens {
+        mainTokens, _ := hclsyntax.LexConfig(src, "", hcl.Pos{Byte: 0, Line: 1, Column: 1})
+        return writerTokens(mainTokens)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/public.go b/vendor/github.com/hashicorp/hcl2/hclwrite/public.go
new file mode 100644
index 0000000..4d5ce2a
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/public.go
@@ -0,0 +1,44 @@
+package hclwrite
+
+import (
+        "bytes"
+
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// NewFile creates a new file object that is empty and ready to have constructs
+// added t it.
+func NewFile() *File {
+        body := &Body{
+                inTree: newInTree(),
+                items:  newNodeSet(),
+        }
+        file := &File{
+                inTree: newInTree(),
+        }
+        file.body = file.inTree.children.Append(body)
+        return file
+}
+
+// ParseConfig interprets the given source bytes into a *hclwrite.File. The
+// resulting AST can be used to perform surgical edits on the source code
+// before turning it back into bytes again.
+func ParseConfig(src []byte, filename string, start hcl.Pos) (*File, hcl.Diagnostics) {
+        return parse(src, filename, start)
+}
+
+// Format takes source code and performs simple whitespace changes to transform
+// it to a canonical layout style.
+//
+// Format skips constructing an AST and works directly with tokens, so it
+// is less expensive than formatting via the AST for situations where no other
+// changes will be made. It also ignores syntax errors and can thus be applied
+// to partial source code, although the result in that case may not be
+// desirable.
+func Format(src []byte) []byte {
+        tokens := lexConfig(src)
+        format(tokens)
+        buf := &bytes.Buffer{}
+        tokens.WriteTo(buf)
+        return buf.Bytes()
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclwrite/tokens.go b/vendor/github.com/hashicorp/hcl2/hclwrite/tokens.go
new file mode 100644
index 0000000..d87f818
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclwrite/tokens.go
@@ -0,0 +1,122 @@
+package hclwrite
+
+import (
+        "bytes"
+        "io"
+
+        "github.com/apparentlymart/go-textseg/textseg"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+)
+
+// Token is a single sequence of bytes annotated with a type. It is similar
+// in purpose to hclsyntax.Token, but discards the source position information
+// since that is not useful in code generation.
+type Token struct {
+        Type  hclsyntax.TokenType
+        Bytes []byte
+
+        // We record the number of spaces before each token so that we can
+        // reproduce the exact layout of the original file when we're making
+        // surgical changes in-place. When _new_ code is created it will always
+        // be in the canonical style, but we preserve layout of existing code.
+        SpacesBefore int
+}
+
+// asHCLSyntax returns the receiver expressed as an incomplete hclsyntax.Token.
+// A complete token is not possible since we don't have source location
+// information here, and so this method is unexported so we can be sure it will
+// only be used for internal purposes where we know the range isn't important.
+//
+// This is primarily intended to allow us to re-use certain functionality from
+// hclsyntax rather than re-implementing it against our own token type here.
+func (t *Token) asHCLSyntax() hclsyntax.Token {
+        return hclsyntax.Token{
+                Type:  t.Type,
+                Bytes: t.Bytes,
+                Range: hcl.Range{
+                        Filename: "<invalid>",
+                },
+        }
+}
+
+// Tokens is a flat list of tokens.
+type Tokens []*Token
+
+func (ts Tokens) Bytes() []byte {
+        buf := &bytes.Buffer{}
+        ts.WriteTo(buf)
+        return buf.Bytes()
+}
+
+func (ts Tokens) testValue() string {
+        return string(ts.Bytes())
+}
+
+// Columns returns the number of columns (grapheme clusters) the token sequence
+// occupies. The result is not meaningful if there are newline or single-line
+// comment tokens in the sequence.
+func (ts Tokens) Columns() int {
+        ret := 0
+        for _, token := range ts {
+                ret += token.SpacesBefore // spaces are always worth one column each
+                ct, _ := textseg.TokenCount(token.Bytes, textseg.ScanGraphemeClusters)
+                ret += ct
+        }
+        return ret
+}
+
+// WriteTo takes an io.Writer and writes the bytes for each token to it,
+// along with the spacing that separates each token. In other words, this
+// allows serializing the tokens to a file or other such byte stream.
+func (ts Tokens) WriteTo(wr io.Writer) (int64, error) {
+        // We know we're going to be writing a lot of small chunks of repeated
+        // space characters, so we'll prepare a buffer of these that we can
+        // easily pass to wr.Write without any further allocation.
+        spaces := make([]byte, 40)
+        for i := range spaces {
+                spaces[i] = ' '
+        }
+
+        var n int64
+        var err error
+        for _, token := range ts {
+                if err != nil {
+                        return n, err
+                }
+
+                for spacesBefore := token.SpacesBefore; spacesBefore > 0; spacesBefore -= len(spaces) {
+                        thisChunk := spacesBefore
+                        if thisChunk > len(spaces) {
+                                thisChunk = len(spaces)
+                        }
+                        var thisN int
+                        thisN, err = wr.Write(spaces[:thisChunk])
+                        n += int64(thisN)
+                        if err != nil {
+                                return n, err
+                        }
+                }
+
+                var thisN int
+                thisN, err = wr.Write(token.Bytes)
+                n += int64(thisN)
+        }
+
+        return n, err
+}
+
+func (ts Tokens) walkChildNodes(w internalWalkFunc) {
+        // Unstructured tokens have no child nodes
+}
+
+func (ts Tokens) BuildTokens(to Tokens) Tokens {
+        return append(to, ts...)
+}
+
+func newIdentToken(name string) *Token {
+        return &Token{
+                Type:  hclsyntax.TokenIdent,
+                Bytes: []byte(name),
+        }
+}
diff --git a/vendor/github.com/hashicorp/hil/convert.go b/vendor/github.com/hashicorp/hil/convert.go
index f2024d0..184e029 100644
--- a/vendor/github.com/hashicorp/hil/convert.go
+++ b/vendor/github.com/hashicorp/hil/convert.go
@@ -47,8 +47,23 @@ func hilMapstructureWeakDecode(m interface{}, rawVal interface{}) error {
 }
 
 func InterfaceToVariable(input interface{}) (ast.Variable, error) {
-        if inputVariable, ok := input.(ast.Variable); ok {
-                return inputVariable, nil
+        if iv, ok := input.(ast.Variable); ok {
+                return iv, nil
+        }
+
+        // This is just to maintain backward compatibility
+        // after https://github.com/mitchellh/mapstructure/pull/98
+        if v, ok := input.([]ast.Variable); ok {
+                return ast.Variable{
+                        Type:  ast.TypeList,
+                        Value: v,
+                }, nil
+        }
+        if v, ok := input.(map[string]ast.Variable); ok {
+                return ast.Variable{
+                        Type:  ast.TypeMap,
+                        Value: v,
+                }, nil
         }
 
         var stringVal string
diff --git a/vendor/github.com/hashicorp/hil/go.mod b/vendor/github.com/hashicorp/hil/go.mod
new file mode 100644
index 0000000..45719a6
--- /dev/null
+++ b/vendor/github.com/hashicorp/hil/go.mod
@@ -0,0 +1,6 @@
+module github.com/hashicorp/hil
+
+require (
+        github.com/mitchellh/mapstructure v1.1.2
+        github.com/mitchellh/reflectwalk v1.0.0
+)
diff --git a/vendor/github.com/hashicorp/hil/go.sum b/vendor/github.com/hashicorp/hil/go.sum
new file mode 100644
index 0000000..83639b6
--- /dev/null
+++ b/vendor/github.com/hashicorp/hil/go.sum
@@ -0,0 +1,4 @@
+github.com/mitchellh/mapstructure v1.1.2 h1:fmNYVwqnSfB9mZU6OS2O6GsXM+wcskZDuKQzvN1EDeE=
+github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/mitchellh/reflectwalk v1.0.0 h1:9D+8oIskB4VJBN5SFlmc27fSlIBZaov1Wpk/IfikLNY=
+github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
diff --git a/vendor/github.com/hashicorp/logutils/go.mod b/vendor/github.com/hashicorp/logutils/go.mod
new file mode 100644
index 0000000..ba38a45
--- /dev/null
+++ b/vendor/github.com/hashicorp/logutils/go.mod
@@ -0,0 +1 @@
+module github.com/hashicorp/logutils
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/LICENSE b/vendor/github.com/hashicorp/terraform-config-inspect/LICENSE
new file mode 100644
index 0000000..82b4de9
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/LICENSE
@@ -0,0 +1,353 @@
+Mozilla Public License, version 2.0
+
+1. Definitions
+
+1.1. “Contributor”
+
+     means each individual or legal entity that creates, contributes to the
+     creation of, or owns Covered Software.
+
+1.2. “Contributor Version”
+
+     means the combination of the Contributions of others (if any) used by a
+     Contributor and that particular Contributor’s Contribution.
+
+1.3. “Contribution”
+
+     means Covered Software of a particular Contributor.
+
+1.4. “Covered Software”
+
+     means Source Code Form to which the initial Contributor has attached the
+     notice in Exhibit A, the Executable Form of such Source Code Form, and
+     Modifications of such Source Code Form, in each case including portions
+     thereof.
+
+1.5. “Incompatible With Secondary Licenses”
+     means
+
+     a. that the initial Contributor has attached the notice described in
+        Exhibit B to the Covered Software; or
+
+     b. that the Covered Software was made available under the terms of version
+        1.1 or earlier of the License, but not also under the terms of a
+        Secondary License.
+
+1.6. “Executable Form”
+
+     means any form of the work other than Source Code Form.
+
+1.7. “Larger Work”
+
+     means a work that combines Covered Software with other material, in a separate
+     file or files, that is not Covered Software.
+
+1.8. “License”
+
+     means this document.
+
+1.9. “Licensable”
+
+     means having the right to grant, to the maximum extent possible, whether at the
+     time of the initial grant or subsequently, any and all of the rights conveyed by
+     this License.
+
+1.10. “Modifications”
+
+     means any of the following:
+
+     a. any file in Source Code Form that results from an addition to, deletion
+        from, or modification of the contents of Covered Software; or
+
+     b. any new file in Source Code Form that contains any Covered Software.
+
+1.11. “Patent Claims” of a Contributor
+
+      means any patent claim(s), including without limitation, method, process,
+      and apparatus claims, in any patent Licensable by such Contributor that
+      would be infringed, but for the grant of the License, by the making,
+      using, selling, offering for sale, having made, import, or transfer of
+      either its Contributions or its Contributor Version.
+
+1.12. “Secondary License”
+
+      means either the GNU General Public License, Version 2.0, the GNU Lesser
+      General Public License, Version 2.1, the GNU Affero General Public
+      License, Version 3.0, or any later versions of those licenses.
+
+1.13. “Source Code Form”
+
+      means the form of the work preferred for making modifications.
+
+1.14. “You” (or “Your”)
+
+      means an individual or a legal entity exercising rights under this
+      License. For legal entities, “You” includes any entity that controls, is
+      controlled by, or is under common control with You. For purposes of this
+      definition, “control” means (a) the power, direct or indirect, to cause
+      the direction or management of such entity, whether by contract or
+      otherwise, or (b) ownership of more than fifty percent (50%) of the
+      outstanding shares or beneficial ownership of such entity.
+
+
+2. License Grants and Conditions
+
+2.1. Grants
+
+     Each Contributor hereby grants You a world-wide, royalty-free,
+     non-exclusive license:
+
+     a. under intellectual property rights (other than patent or trademark)
+        Licensable by such Contributor to use, reproduce, make available,
+        modify, display, perform, distribute, and otherwise exploit its
+        Contributions, either on an unmodified basis, with Modifications, or as
+        part of a Larger Work; and
+
+     b. under Patent Claims of such Contributor to make, use, sell, offer for
+        sale, have made, import, and otherwise transfer either its Contributions
+        or its Contributor Version.
+
+2.2. Effective Date
+
+     The licenses granted in Section 2.1 with respect to any Contribution become
+     effective for each Contribution on the date the Contributor first distributes
+     such Contribution.
+
+2.3. Limitations on Grant Scope
+
+     The licenses granted in this Section 2 are the only rights granted under this
+     License. No additional rights or licenses will be implied from the distribution
+     or licensing of Covered Software under this License. Notwithstanding Section
+     2.1(b) above, no patent license is granted by a Contributor:
+
+     a. for any code that a Contributor has removed from Covered Software; or
+
+     b. for infringements caused by: (i) Your and any other third party’s
+        modifications of Covered Software, or (ii) the combination of its
+        Contributions with other software (except as part of its Contributor
+        Version); or
+
+     c. under Patent Claims infringed by Covered Software in the absence of its
+        Contributions.
+
+     This License does not grant any rights in the trademarks, service marks, or
+     logos of any Contributor (except as may be necessary to comply with the
+     notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+     No Contributor makes additional grants as a result of Your choice to
+     distribute the Covered Software under a subsequent version of this License
+     (see Section 10.2) or under the terms of a Secondary License (if permitted
+     under the terms of Section 3.3).
+
+2.5. Representation
+
+     Each Contributor represents that the Contributor believes its Contributions
+     are its original creation(s) or it has sufficient rights to grant the
+     rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+     This License is not intended to limit any rights You have under applicable
+     copyright doctrines of fair use, fair dealing, or other equivalents.
+
+2.7. Conditions
+
+     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
+     Section 2.1.
+
+
+3. Responsibilities
+
+3.1. Distribution of Source Form
+
+     All distribution of Covered Software in Source Code Form, including any
+     Modifications that You create or to which You contribute, must be under the
+     terms of this License. You must inform recipients that the Source Code Form
+     of the Covered Software is governed by the terms of this License, and how
+     they can obtain a copy of this License. You may not attempt to alter or
+     restrict the recipients’ rights in the Source Code Form.
+
+3.2. Distribution of Executable Form
+
+     If You distribute Covered Software in Executable Form then:
+
+     a. such Covered Software must also be made available in Source Code Form,
+        as described in Section 3.1, and You must inform recipients of the
+        Executable Form how they can obtain a copy of such Source Code Form by
+        reasonable means in a timely manner, at a charge no more than the cost
+        of distribution to the recipient; and
+
+     b. You may distribute such Executable Form under the terms of this License,
+        or sublicense it under different terms, provided that the license for
+        the Executable Form does not attempt to limit or alter the recipients’
+        rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+     You may create and distribute a Larger Work under terms of Your choice,
+     provided that You also comply with the requirements of this License for the
+     Covered Software. If the Larger Work is a combination of Covered Software
+     with a work governed by one or more Secondary Licenses, and the Covered
+     Software is not Incompatible With Secondary Licenses, this License permits
+     You to additionally distribute such Covered Software under the terms of
+     such Secondary License(s), so that the recipient of the Larger Work may, at
+     their option, further distribute the Covered Software under the terms of
+     either this License or such Secondary License(s).
+
+3.4. Notices
+
+     You may not remove or alter the substance of any license notices (including
+     copyright notices, patent notices, disclaimers of warranty, or limitations
+     of liability) contained within the Source Code Form of the Covered
+     Software, except that You may alter any license notices to the extent
+     required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+     You may choose to offer, and to charge a fee for, warranty, support,
+     indemnity or liability obligations to one or more recipients of Covered
+     Software. However, You may do so only on Your own behalf, and not on behalf
+     of any Contributor. You must make it absolutely clear that any such
+     warranty, support, indemnity, or liability obligation is offered by You
+     alone, and You hereby agree to indemnify every Contributor for any
+     liability incurred by such Contributor as a result of warranty, support,
+     indemnity or liability terms You offer. You may include additional
+     disclaimers of warranty and limitations of liability specific to any
+     jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+
+   If it is impossible for You to comply with any of the terms of this License
+   with respect to some or all of the Covered Software due to statute, judicial
+   order, or regulation then You must: (a) comply with the terms of this License
+   to the maximum extent possible; and (b) describe the limitations and the code
+   they affect. Such description must be placed in a text file included with all
+   distributions of the Covered Software under this License. Except to the
+   extent prohibited by statute or regulation, such description must be
+   sufficiently detailed for a recipient of ordinary skill to be able to
+   understand it.
+
+5. Termination
+
+5.1. The rights granted under this License will terminate automatically if You
+     fail to comply with any of its terms. However, if You become compliant,
+     then the rights granted under this License from a particular Contributor
+     are reinstated (a) provisionally, unless and until such Contributor
+     explicitly and finally terminates Your grants, and (b) on an ongoing basis,
+     if such Contributor fails to notify You of the non-compliance by some
+     reasonable means prior to 60 days after You have come back into compliance.
+     Moreover, Your grants from a particular Contributor are reinstated on an
+     ongoing basis if such Contributor notifies You of the non-compliance by
+     some reasonable means, this is the first time You have received notice of
+     non-compliance with this License from such Contributor, and You become
+     compliant prior to 30 days after Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+     infringement claim (excluding declaratory judgment actions, counter-claims,
+     and cross-claims) alleging that a Contributor Version directly or
+     indirectly infringes any patent, then the rights granted to You by any and
+     all Contributors for the Covered Software under Section 2.1 of this License
+     shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
+     license agreements (excluding distributors and resellers) which have been
+     validly granted by You or Your distributors under this License prior to
+     termination shall survive termination.
+
+6. Disclaimer of Warranty
+
+   Covered Software is provided under this License on an “as is” basis, without
+   warranty of any kind, either expressed, implied, or statutory, including,
+   without limitation, warranties that the Covered Software is free of defects,
+   merchantable, fit for a particular purpose or non-infringing. The entire
+   risk as to the quality and performance of the Covered Software is with You.
+   Should any Covered Software prove defective in any respect, You (not any
+   Contributor) assume the cost of any necessary servicing, repair, or
+   correction. This disclaimer of warranty constitutes an essential part of this
+   License. No use of  any Covered Software is authorized under this License
+   except under this disclaimer.
+
+7. Limitation of Liability
+
+   Under no circumstances and under no legal theory, whether tort (including
+   negligence), contract, or otherwise, shall any Contributor, or anyone who
+   distributes Covered Software as permitted above, be liable to You for any
+   direct, indirect, special, incidental, or consequential damages of any
+   character including, without limitation, damages for lost profits, loss of
+   goodwill, work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses, even if such party shall have been
+   informed of the possibility of such damages. This limitation of liability
+   shall not apply to liability for death or personal injury resulting from such
+   party’s negligence to the extent applicable law prohibits such limitation.
+   Some jurisdictions do not allow the exclusion or limitation of incidental or
+   consequential damages, so this exclusion and limitation may not apply to You.
+
+8. Litigation
+
+   Any litigation relating to this License may be brought only in the courts of
+   a jurisdiction where the defendant maintains its principal place of business
+   and such litigation shall be governed by laws of that jurisdiction, without
+   reference to its conflict-of-law provisions. Nothing in this Section shall
+   prevent a party’s ability to bring cross-claims or counter-claims.
+
+9. Miscellaneous
+
+   This License represents the complete agreement concerning the subject matter
+   hereof. If any provision of this License is held to be unenforceable, such
+   provision shall be reformed only to the extent necessary to make it
+   enforceable. Any law or regulation which provides that the language of a
+   contract shall be construed against the drafter shall not be used to construe
+   this License against a Contributor.
+
+
+10. Versions of the License
+
+10.1. New Versions
+
+      Mozilla Foundation is the license steward. Except as provided in Section
+      10.3, no one other than the license steward has the right to modify or
+      publish new versions of this License. Each version will be given a
+      distinguishing version number.
+
+10.2. Effect of New Versions
+
+      You may distribute the Covered Software under the terms of the version of
+      the License under which You originally received the Covered Software, or
+      under the terms of any subsequent version published by the license
+      steward.
+
+10.3. Modified Versions
+
+      If you create software not governed by this License, and you want to
+      create a new license for such software, you may create and use a modified
+      version of this License if you rename the license and remove any
+      references to the name of the license steward (except to note that such
+      modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary Licenses
+      If You choose to distribute Source Code Form that is Incompatible With
+      Secondary Licenses under the terms of this version of the License, the
+      notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+
+      This Source Code Form is subject to the
+      terms of the Mozilla Public License, v.
+      2.0. If a copy of the MPL was not
+      distributed with this file, You can
+      obtain one at
+      http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular file, then
+You may include the notice in a location (such as a LICENSE file in a relevant
+directory) where a recipient would be likely to look for such a notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - “Incompatible With Secondary Licenses” Notice
+
+      This Source Code Form is “Incompatible
+      With Secondary Licenses”, as defined by
+      the Mozilla Public License, v. 2.0.
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/diagnostic.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/diagnostic.go
new file mode 100644
index 0000000..8d04ad4
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/diagnostic.go
@@ -0,0 +1,138 @@
+package tfconfig
+
+import (
+        "fmt"
+
+        legacyhclparser "github.com/hashicorp/hcl/hcl/parser"
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// Diagnostic describes a problem (error or warning) encountered during
+// configuration loading.
+type Diagnostic struct {
+        Severity DiagSeverity `json:"severity"`
+        Summary  string       `json:"summary"`
+        Detail   string       `json:"detail,omitempty"`
+
+        // Pos is not populated for all diagnostics, but when populated should
+        // indicate a particular line that the described problem relates to.
+        Pos *SourcePos `json:"pos,omitempty"`
+}
+
+// Diagnostics represents a sequence of diagnostics. This is the type that
+// should be returned from a function that might generate diagnostics.
+type Diagnostics []Diagnostic
+
+// HasErrors returns true if there is at least one Diagnostic of severity
+// DiagError in the receiever.
+//
+// If a function returns a Diagnostics without errors then the result can
+// be assumed to be complete within the "best effort" constraints of this
+// library. If errors are present then the caller may wish to employ more
+// caution in relying on the result.
+func (diags Diagnostics) HasErrors() bool {
+        for _, diag := range diags {
+                if diag.Severity == DiagError {
+                        return true
+                }
+        }
+        return false
+}
+
+func (diags Diagnostics) Error() string {
+        switch len(diags) {
+        case 0:
+                return "no problems"
+        case 1:
+                return fmt.Sprintf("%s: %s", diags[0].Summary, diags[0].Detail)
+        default:
+                return fmt.Sprintf("%s: %s (and %d other messages)", diags[0].Summary, diags[0].Detail, len(diags)-1)
+        }
+}
+
+// Err returns an error representing the receiver if the receiver HasErrors, or
+// nil otherwise.
+//
+// The returned error can be type-asserted back to a Diagnostics if needed.
+func (diags Diagnostics) Err() error {
+        if diags.HasErrors() {
+                return diags
+        }
+        return nil
+}
+
+// DiagSeverity describes the severity of a Diagnostic.
+type DiagSeverity rune
+
+// DiagError indicates a problem that prevented proper processing of the
+// configuration. In the precense of DiagError diagnostics the result is
+// likely to be incomplete.
+const DiagError DiagSeverity = 'E'
+
+// DiagWarning indicates a problem that the user may wish to consider but
+// that did not prevent proper processing of the configuration.
+const DiagWarning DiagSeverity = 'W'
+
+// MarshalJSON is an implementation of encoding/json.Marshaler
+func (s DiagSeverity) MarshalJSON() ([]byte, error) {
+        switch s {
+        case DiagError:
+                return []byte(`"error"`), nil
+        case DiagWarning:
+                return []byte(`"warning"`), nil
+        default:
+                return []byte(`"invalid"`), nil
+        }
+}
+
+func diagnosticsHCL(diags hcl.Diagnostics) Diagnostics {
+        if len(diags) == 0 {
+                return nil
+        }
+        ret := make(Diagnostics, len(diags))
+        for i, diag := range diags {
+                ret[i] = Diagnostic{
+                        Summary: diag.Summary,
+                        Detail:  diag.Detail,
+                }
+                switch diag.Severity {
+                case hcl.DiagError:
+                        ret[i].Severity = DiagError
+                case hcl.DiagWarning:
+                        ret[i].Severity = DiagWarning
+                }
+                if diag.Subject != nil {
+                        pos := sourcePosHCL(*diag.Subject)
+                        ret[i].Pos = &pos
+                }
+        }
+        return ret
+}
+
+func diagnosticsError(err error) Diagnostics {
+        if err == nil {
+                return nil
+        }
+
+        if posErr, ok := err.(*legacyhclparser.PosError); ok {
+                pos := sourcePosLegacyHCL(posErr.Pos, "")
+                return Diagnostics{
+                        Diagnostic{
+                                Severity: DiagError,
+                                Summary:  posErr.Err.Error(),
+                                Pos:      &pos,
+                        },
+                }
+        }
+
+        return Diagnostics{
+                Diagnostic{
+                        Severity: DiagError,
+                        Summary:  err.Error(),
+                },
+        }
+}
+
+func diagnosticsErrorf(format string, args ...interface{}) Diagnostics {
+        return diagnosticsError(fmt.Errorf(format, args...))
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/doc.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/doc.go
new file mode 100644
index 0000000..1604a6e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/doc.go
@@ -0,0 +1,21 @@
+// Package tfconfig is a helper library that does careful, shallow parsing of
+// Terraform modules to provide access to high-level metadata while
+// remaining broadly compatible with configurations targeting various
+// different Terraform versions.
+//
+// This packge focuses on describing top-level objects only, and in particular
+// does not attempt any sort of processing that would require access to plugins.
+// Currently it allows callers to extract high-level information about
+// variables, outputs, resource blocks, provider dependencies, and Terraform
+// Core dependencies.
+//
+// This package only works at the level of single modules. A full configuration
+// is a tree of potentially several modules, some of which may be references
+// to remote packages. There are some basic helpers for traversing calls to
+// modules at relative local paths, however.
+//
+// This package employs a "best effort" parsing strategy, producing as complete
+// a result as possible even though the input may not be entirely valid. The
+// intended use-case is high-level analysis and indexing of externally-facing
+// module characteristics, as opposed to validating or even applying the module.
+package tfconfig
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/load.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/load.go
new file mode 100644
index 0000000..2d13fe1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/load.go
@@ -0,0 +1,130 @@
+package tfconfig
+
+import (
+        "fmt"
+        "io/ioutil"
+        "path/filepath"
+        "strings"
+
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// LoadModule reads the directory at the given path and attempts to interpret
+// it as a Terraform module.
+func LoadModule(dir string) (*Module, Diagnostics) {
+
+        // For broad compatibility here we actually have two separate loader
+        // codepaths. The main one uses the new HCL parser and API and is intended
+        // for configurations from Terraform 0.12 onwards (though will work for
+        // many older configurations too), but we'll also fall back on one that
+        // uses the _old_ HCL implementation so we can deal with some edge-cases
+        // that are not valid in new HCL.
+
+        module, diags := loadModule(dir)
+        if diags.HasErrors() {
+                // Try using the legacy HCL parser and see if we fare better.
+                legacyModule, legacyDiags := loadModuleLegacyHCL(dir)
+                if !legacyDiags.HasErrors() {
+                        legacyModule.init(legacyDiags)
+                        return legacyModule, legacyDiags
+                }
+        }
+
+        module.init(diags)
+        return module, diags
+}
+
+// IsModuleDir checks if the given path contains terraform configuration files.
+// This allows the caller to decide how to handle directories that do not have tf files.
+func IsModuleDir(dir string) bool {
+        primaryPaths, _ := dirFiles(dir)
+        if len(primaryPaths) == 0 {
+                return false
+        }
+        return true
+}
+
+func (m *Module) init(diags Diagnostics) {
+        // Fill in any additional provider requirements that are implied by
+        // resource configurations, to avoid the caller from needing to apply
+        // this logic itself. Implied requirements don't have version constraints,
+        // but we'll make sure the requirement value is still non-nil in this
+        // case so callers can easily recognize it.
+        for _, r := range m.ManagedResources {
+                if _, exists := m.RequiredProviders[r.Provider.Name]; !exists {
+                        m.RequiredProviders[r.Provider.Name] = []string{}
+                }
+        }
+        for _, r := range m.DataResources {
+                if _, exists := m.RequiredProviders[r.Provider.Name]; !exists {
+                        m.RequiredProviders[r.Provider.Name] = []string{}
+                }
+        }
+
+        // We redundantly also reference the diagnostics from inside the module
+        // object, primarily so that we can easily included in JSON-serialized
+        // versions of the module object.
+        m.Diagnostics = diags
+}
+
+func dirFiles(dir string) (primary []string, diags hcl.Diagnostics) {
+        infos, err := ioutil.ReadDir(dir)
+        if err != nil {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Failed to read module directory",
+                        Detail:   fmt.Sprintf("Module directory %s does not exist or cannot be read.", dir),
+                })
+                return
+        }
+
+        var override []string
+        for _, info := range infos {
+                if info.IsDir() {
+                        // We only care about files
+                        continue
+                }
+
+                name := info.Name()
+                ext := fileExt(name)
+                if ext == "" || isIgnoredFile(name) {
+                        continue
+                }
+
+                baseName := name[:len(name)-len(ext)] // strip extension
+                isOverride := baseName == "override" || strings.HasSuffix(baseName, "_override")
+
+                fullPath := filepath.Join(dir, name)
+                if isOverride {
+                        override = append(override, fullPath)
+                } else {
+                        primary = append(primary, fullPath)
+                }
+        }
+
+        // We are assuming that any _override files will be logically named,
+        // and processing the files in alphabetical order. Primaries first, then overrides.
+        primary = append(primary, override...)
+
+        return
+}
+
+// fileExt returns the Terraform configuration extension of the given
+// path, or a blank string if it is not a recognized extension.
+func fileExt(path string) string {
+        if strings.HasSuffix(path, ".tf") {
+                return ".tf"
+        } else if strings.HasSuffix(path, ".tf.json") {
+                return ".tf.json"
+        } else {
+                return ""
+        }
+}
+
+// isIgnoredFile returns true if the given filename (which must not have a
+// directory path ahead of it) should be ignored as e.g. an editor swap file.
+func isIgnoredFile(name string) bool {
+        return strings.HasPrefix(name, ".") || // Unix-like hidden files
+                strings.HasSuffix(name, "~") || // vim
+                strings.HasPrefix(name, "#") && strings.HasSuffix(name, "#") // emacs
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/load_hcl.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/load_hcl.go
new file mode 100644
index 0000000..72b5d4a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/load_hcl.go
@@ -0,0 +1,322 @@
+package tfconfig
+
+import (
+        "encoding/json"
+        "fmt"
+        "strings"
+
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+
+        "github.com/hashicorp/hcl2/gohcl"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hclparse"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+)
+
+func loadModule(dir string) (*Module, Diagnostics) {
+        mod := newModule(dir)
+        primaryPaths, diags := dirFiles(dir)
+
+        parser := hclparse.NewParser()
+
+        for _, filename := range primaryPaths {
+                var file *hcl.File
+                var fileDiags hcl.Diagnostics
+                if strings.HasSuffix(filename, ".json") {
+                        file, fileDiags = parser.ParseJSONFile(filename)
+                } else {
+                        file, fileDiags = parser.ParseHCLFile(filename)
+                }
+                diags = append(diags, fileDiags...)
+                if file == nil {
+                        continue
+                }
+
+                content, _, contentDiags := file.Body.PartialContent(rootSchema)
+                diags = append(diags, contentDiags...)
+
+                for _, block := range content.Blocks {
+                        switch block.Type {
+
+                        case "terraform":
+                                content, _, contentDiags := block.Body.PartialContent(terraformBlockSchema)
+                                diags = append(diags, contentDiags...)
+
+                                if attr, defined := content.Attributes["required_version"]; defined {
+                                        var version string
+                                        valDiags := gohcl.DecodeExpression(attr.Expr, nil, &version)
+                                        diags = append(diags, valDiags...)
+                                        if !valDiags.HasErrors() {
+                                                mod.RequiredCore = append(mod.RequiredCore, version)
+                                        }
+                                }
+
+                                for _, block := range content.Blocks {
+                                        // Our schema only allows required_providers here, so we
+                                        // assume that we'll only get that block type.
+                                        attrs, attrDiags := block.Body.JustAttributes()
+                                        diags = append(diags, attrDiags...)
+
+                                        for name, attr := range attrs {
+                                                var version string
+                                                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &version)
+                                                diags = append(diags, valDiags...)
+                                                if !valDiags.HasErrors() {
+                                                        mod.RequiredProviders[name] = append(mod.RequiredProviders[name], version)
+                                                }
+                                        }
+                                }
+
+                        case "variable":
+                                content, _, contentDiags := block.Body.PartialContent(variableSchema)
+                                diags = append(diags, contentDiags...)
+
+                                name := block.Labels[0]
+                                v := &Variable{
+                                        Name: name,
+                                        Pos:  sourcePosHCL(block.DefRange),
+                                }
+
+                                mod.Variables[name] = v
+
+                                if attr, defined := content.Attributes["type"]; defined {
+                                        // We handle this particular attribute in a somewhat-tricky way:
+                                        // since Terraform may evolve its type expression syntax in
+                                        // future versions, we don't want to be overly-strict in how
+                                        // we handle it here, and so we'll instead just take the raw
+                                        // source provided by the user, using the source location
+                                        // information in the expression object.
+                                        //
+                                        // However, older versions of Terraform expected the type
+                                        // to be a string containing a keyword, so we'll need to
+                                        // handle that as a special case first for backward compatibility.
+
+                                        var typeExpr string
+
+                                        var typeExprAsStr string
+                                        valDiags := gohcl.DecodeExpression(attr.Expr, nil, &typeExprAsStr)
+                                        if !valDiags.HasErrors() {
+                                                typeExpr = typeExprAsStr
+                                        } else {
+
+                                                rng := attr.Expr.Range()
+                                                sourceFilename := rng.Filename
+                                                source, exists := parser.Sources()[sourceFilename]
+                                                if exists {
+                                                        typeExpr = string(rng.SliceBytes(source))
+                                                } else {
+                                                        // This should never happen, so we'll just warn about it and leave the type unspecified.
+                                                        diags = append(diags, &hcl.Diagnostic{
+                                                                Severity: hcl.DiagError,
+                                                                Summary:  "Source code not available",
+                                                                Detail:   fmt.Sprintf("Source code is not available for the file %q, which declares the variable %q.", sourceFilename, name),
+                                                                Subject:  &block.DefRange,
+                                                        })
+                                                        typeExpr = ""
+                                                }
+
+                                        }
+
+                                        v.Type = typeExpr
+                                }
+
+                                if attr, defined := content.Attributes["description"]; defined {
+                                        var description string
+                                        valDiags := gohcl.DecodeExpression(attr.Expr, nil, &description)
+                                        diags = append(diags, valDiags...)
+                                        v.Description = description
+                                }
+
+                                if attr, defined := content.Attributes["default"]; defined {
+                                        // To avoid the caller needing to deal with cty here, we'll
+                                        // use its JSON encoding to convert into an
+                                        // approximately-equivalent plain Go interface{} value
+                                        // to return.
+                                        val, valDiags := attr.Expr.Value(nil)
+                                        diags = append(diags, valDiags...)
+                                        if val.IsWhollyKnown() { // should only be false if there are errors in the input
+                                                valJSON, err := ctyjson.Marshal(val, val.Type())
+                                                if err != nil {
+                                                        // Should never happen, since all possible known
+                                                        // values have a JSON mapping.
+                                                        panic(fmt.Errorf("failed to serialize default value as JSON: %s", err))
+                                                }
+                                                var def interface{}
+                                                err = json.Unmarshal(valJSON, &def)
+                                                if err != nil {
+                                                        // Again should never happen, because valJSON is
+                                                        // guaranteed valid by ctyjson.Marshal.
+                                                        panic(fmt.Errorf("failed to re-parse default value from JSON: %s", err))
+                                                }
+                                                v.Default = def
+                                        }
+                                }
+
+                        case "output":
+
+                                content, _, contentDiags := block.Body.PartialContent(outputSchema)
+                                diags = append(diags, contentDiags...)
+
+                                name := block.Labels[0]
+                                o := &Output{
+                                        Name: name,
+                                        Pos:  sourcePosHCL(block.DefRange),
+                                }
+
+                                mod.Outputs[name] = o
+
+                                if attr, defined := content.Attributes["description"]; defined {
+                                        var description string
+                                        valDiags := gohcl.DecodeExpression(attr.Expr, nil, &description)
+                                        diags = append(diags, valDiags...)
+                                        o.Description = description
+                                }
+
+                        case "provider":
+
+                                content, _, contentDiags := block.Body.PartialContent(providerConfigSchema)
+                                diags = append(diags, contentDiags...)
+
+                                name := block.Labels[0]
+
+                                if attr, defined := content.Attributes["version"]; defined {
+                                        var version string
+                                        valDiags := gohcl.DecodeExpression(attr.Expr, nil, &version)
+                                        diags = append(diags, valDiags...)
+                                        if !valDiags.HasErrors() {
+                                                mod.RequiredProviders[name] = append(mod.RequiredProviders[name], version)
+                                        }
+                                }
+
+                                // Even if there wasn't an explicit version required, we still
+                                // need an entry in our map to signal the unversioned dependency.
+                                if _, exists := mod.RequiredProviders[name]; !exists {
+                                        mod.RequiredProviders[name] = []string{}
+                                }
+
+                        case "resource", "data":
+
+                                content, _, contentDiags := block.Body.PartialContent(resourceSchema)
+                                diags = append(diags, contentDiags...)
+
+                                typeName := block.Labels[0]
+                                name := block.Labels[1]
+
+                                r := &Resource{
+                                        Type: typeName,
+                                        Name: name,
+                                        Pos:  sourcePosHCL(block.DefRange),
+                                }
+
+                                var resourcesMap map[string]*Resource
+
+                                switch block.Type {
+                                case "resource":
+                                        r.Mode = ManagedResourceMode
+                                        resourcesMap = mod.ManagedResources
+                                case "data":
+                                        r.Mode = DataResourceMode
+                                        resourcesMap = mod.DataResources
+                                }
+
+                                key := r.MapKey()
+
+                                resourcesMap[key] = r
+
+                                if attr, defined := content.Attributes["provider"]; defined {
+                                        // New style here is to provide this as a naked traversal
+                                        // expression, but we also support quoted references for
+                                        // older configurations that predated this convention.
+                                        traversal, travDiags := hcl.AbsTraversalForExpr(attr.Expr)
+                                        if travDiags.HasErrors() {
+                                                traversal = nil // in case we got any partial results
+
+                                                // Fall back on trying to parse as a string
+                                                var travStr string
+                                                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &travStr)
+                                                if !valDiags.HasErrors() {
+                                                        var strDiags hcl.Diagnostics
+                                                        traversal, strDiags = hclsyntax.ParseTraversalAbs([]byte(travStr), "", hcl.Pos{})
+                                                        if strDiags.HasErrors() {
+                                                                traversal = nil
+                                                        }
+                                                }
+                                        }
+
+                                        // If we get out here with a nil traversal then we didn't
+                                        // succeed in processing the input.
+                                        if len(traversal) > 0 {
+                                                providerName := traversal.RootName()
+                                                alias := ""
+                                                if len(traversal) > 1 {
+                                                        if getAttr, ok := traversal[1].(hcl.TraverseAttr); ok {
+                                                                alias = getAttr.Name
+                                                        }
+                                                }
+                                                r.Provider = ProviderRef{
+                                                        Name:  providerName,
+                                                        Alias: alias,
+                                                }
+                                        } else {
+                                                diags = append(diags, &hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Invalid provider reference",
+                                                        Detail:   "Provider argument requires a provider name followed by an optional alias, like \"aws.foo\".",
+                                                        Subject:  attr.Expr.Range().Ptr(),
+                                                })
+                                        }
+                                } else {
+                                        // If provider _isn't_ set then we'll infer it from the
+                                        // resource type.
+                                        r.Provider = ProviderRef{
+                                                Name: resourceTypeDefaultProviderName(r.Type),
+                                        }
+                                }
+
+                        case "module":
+
+                                content, _, contentDiags := block.Body.PartialContent(moduleCallSchema)
+                                diags = append(diags, contentDiags...)
+
+                                name := block.Labels[0]
+                                mc := &ModuleCall{
+                                        Name: block.Labels[0],
+                                        Pos:  sourcePosHCL(block.DefRange),
+                                }
+
+                                // check if this is overriding an existing module
+                                var origSource string
+                                if origMod, exists := mod.ModuleCalls[name]; exists {
+                                        origSource = origMod.Source
+                                }
+
+                                mod.ModuleCalls[name] = mc
+
+                                if attr, defined := content.Attributes["source"]; defined {
+                                        var source string
+                                        valDiags := gohcl.DecodeExpression(attr.Expr, nil, &source)
+                                        diags = append(diags, valDiags...)
+                                        mc.Source = source
+                                }
+
+                                if mc.Source == "" {
+                                        mc.Source = origSource
+                                }
+
+                                if attr, defined := content.Attributes["version"]; defined {
+                                        var version string
+                                        valDiags := gohcl.DecodeExpression(attr.Expr, nil, &version)
+                                        diags = append(diags, valDiags...)
+                                        mc.Version = version
+                                }
+
+                        default:
+                                // Should never happen because our cases above should be
+                                // exhaustive for our schema.
+                                panic(fmt.Errorf("unhandled block type %q", block.Type))
+                        }
+                }
+        }
+
+        return mod, diagnosticsHCL(diags)
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/load_legacy.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/load_legacy.go
new file mode 100644
index 0000000..86ffdf1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/load_legacy.go
@@ -0,0 +1,325 @@
+package tfconfig
+
+import (
+        "io/ioutil"
+        "strings"
+
+        legacyhcl "github.com/hashicorp/hcl"
+        legacyast "github.com/hashicorp/hcl/hcl/ast"
+)
+
+func loadModuleLegacyHCL(dir string) (*Module, Diagnostics) {
+        // This implementation is intentionally more quick-and-dirty than the
+        // main loader. In particular, it doesn't bother to keep careful track
+        // of multiple error messages because we always fall back on returning
+        // the main parser's error message if our fallback parsing produces
+        // an error, and thus the errors here are not seen by the end-caller.
+        mod := newModule(dir)
+
+        primaryPaths, diags := dirFiles(dir)
+        if diags.HasErrors() {
+                return mod, diagnosticsHCL(diags)
+        }
+
+        for _, filename := range primaryPaths {
+                src, err := ioutil.ReadFile(filename)
+                if err != nil {
+                        return mod, diagnosticsErrorf("Error reading %s: %s", filename, err)
+                }
+
+                hclRoot, err := legacyhcl.Parse(string(src))
+                if err != nil {
+                        return mod, diagnosticsErrorf("Error parsing %s: %s", filename, err)
+                }
+
+                list, ok := hclRoot.Node.(*legacyast.ObjectList)
+                if !ok {
+                        return mod, diagnosticsErrorf("Error parsing %s: no root object", filename)
+                }
+
+                for _, item := range list.Filter("terraform").Items {
+                        if len(item.Keys) > 0 {
+                                item = &legacyast.ObjectItem{
+                                        Val: &legacyast.ObjectType{
+                                                List: &legacyast.ObjectList{
+                                                        Items: []*legacyast.ObjectItem{item},
+                                                },
+                                        },
+                                }
+                        }
+
+                        type TerraformBlock struct {
+                                RequiredVersion string `hcl:"required_version"`
+                        }
+                        var block TerraformBlock
+                        err = legacyhcl.DecodeObject(&block, item.Val)
+                        if err != nil {
+                                return nil, diagnosticsErrorf("terraform block: %s", err)
+                        }
+
+                        if block.RequiredVersion != "" {
+                                mod.RequiredCore = append(mod.RequiredCore, block.RequiredVersion)
+                        }
+                }
+
+                if vars := list.Filter("variable"); len(vars.Items) > 0 {
+                        vars = vars.Children()
+                        type VariableBlock struct {
+                                Type        string `hcl:"type"`
+                                Default     interface{}
+                                Description string
+                                Fields      []string `hcl:",decodedFields"`
+                        }
+
+                        for _, item := range vars.Items {
+                                unwrapLegacyHCLObjectKeysFromJSON(item, 1)
+
+                                if len(item.Keys) != 1 {
+                                        return nil, diagnosticsErrorf("variable block at %s has no label", item.Pos())
+                                }
+
+                                name := item.Keys[0].Token.Value().(string)
+
+                                var block VariableBlock
+                                err := legacyhcl.DecodeObject(&block, item.Val)
+                                if err != nil {
+                                        return nil, diagnosticsErrorf("invalid variable block at %s: %s", item.Pos(), err)
+                                }
+
+                                // Clean up legacy HCL decoding ambiguity by unwrapping list of maps
+                                if ms, ok := block.Default.([]map[string]interface{}); ok {
+                                        def := make(map[string]interface{})
+                                        for _, m := range ms {
+                                                for k, v := range m {
+                                                        def[k] = v
+                                                }
+                                        }
+                                        block.Default = def
+                                }
+
+                                v := &Variable{
+                                        Name:        name,
+                                        Type:        block.Type,
+                                        Description: block.Description,
+                                        Default:     block.Default,
+                                        Pos:         sourcePosLegacyHCL(item.Pos(), filename),
+                                }
+                                if _, exists := mod.Variables[name]; exists {
+                                        return nil, diagnosticsErrorf("duplicate variable block for %q", name)
+                                }
+                                mod.Variables[name] = v
+
+                        }
+                }
+
+                if outputs := list.Filter("output"); len(outputs.Items) > 0 {
+                        outputs = outputs.Children()
+                        type OutputBlock struct {
+                                Description string
+                        }
+
+                        for _, item := range outputs.Items {
+                                unwrapLegacyHCLObjectKeysFromJSON(item, 1)
+
+                                if len(item.Keys) != 1 {
+                                        return nil, diagnosticsErrorf("output block at %s has no label", item.Pos())
+                                }
+
+                                name := item.Keys[0].Token.Value().(string)
+
+                                var block OutputBlock
+                                err := legacyhcl.DecodeObject(&block, item.Val)
+                                if err != nil {
+                                        return nil, diagnosticsErrorf("invalid output block at %s: %s", item.Pos(), err)
+                                }
+
+                                o := &Output{
+                                        Name:        name,
+                                        Description: block.Description,
+                                        Pos:         sourcePosLegacyHCL(item.Pos(), filename),
+                                }
+                                if _, exists := mod.Outputs[name]; exists {
+                                        return nil, diagnosticsErrorf("duplicate output block for %q", name)
+                                }
+                                mod.Outputs[name] = o
+                        }
+                }
+
+                for _, blockType := range []string{"resource", "data"} {
+                        if resources := list.Filter(blockType); len(resources.Items) > 0 {
+                                resources = resources.Children()
+                                type ResourceBlock struct {
+                                        Provider string
+                                }
+
+                                for _, item := range resources.Items {
+                                        unwrapLegacyHCLObjectKeysFromJSON(item, 2)
+
+                                        if len(item.Keys) != 2 {
+                                                return nil, diagnosticsErrorf("resource block at %s has wrong label count", item.Pos())
+                                        }
+
+                                        typeName := item.Keys[0].Token.Value().(string)
+                                        name := item.Keys[1].Token.Value().(string)
+                                        var mode ResourceMode
+                                        var rMap map[string]*Resource
+                                        switch blockType {
+                                        case "resource":
+                                                mode = ManagedResourceMode
+                                                rMap = mod.ManagedResources
+                                        case "data":
+                                                mode = DataResourceMode
+                                                rMap = mod.DataResources
+                                        }
+
+                                        var block ResourceBlock
+                                        err := legacyhcl.DecodeObject(&block, item.Val)
+                                        if err != nil {
+                                                return nil, diagnosticsErrorf("invalid resource block at %s: %s", item.Pos(), err)
+                                        }
+
+                                        var providerName, providerAlias string
+                                        if dotPos := strings.IndexByte(block.Provider, '.'); dotPos != -1 {
+                                                providerName = block.Provider[:dotPos]
+                                                providerAlias = block.Provider[dotPos+1:]
+                                        } else {
+                                                providerName = block.Provider
+                                        }
+                                        if providerName == "" {
+                                                providerName = resourceTypeDefaultProviderName(typeName)
+                                        }
+
+                                        r := &Resource{
+                                                Mode: mode,
+                                                Type: typeName,
+                                                Name: name,
+                                                Provider: ProviderRef{
+                                                        Name:  providerName,
+                                                        Alias: providerAlias,
+                                                },
+                                                Pos: sourcePosLegacyHCL(item.Pos(), filename),
+                                        }
+                                        key := r.MapKey()
+                                        if _, exists := rMap[key]; exists {
+                                                return nil, diagnosticsErrorf("duplicate resource block for %q", key)
+                                        }
+                                        rMap[key] = r
+                                }
+                        }
+
+                }
+
+                if moduleCalls := list.Filter("module"); len(moduleCalls.Items) > 0 {
+                        moduleCalls = moduleCalls.Children()
+                        type ModuleBlock struct {
+                                Source  string
+                                Version string
+                        }
+
+                        for _, item := range moduleCalls.Items {
+                                unwrapLegacyHCLObjectKeysFromJSON(item, 1)
+
+                                if len(item.Keys) != 1 {
+                                        return nil, diagnosticsErrorf("module block at %s has no label", item.Pos())
+                                }
+
+                                name := item.Keys[0].Token.Value().(string)
+
+                                var block ModuleBlock
+                                err := legacyhcl.DecodeObject(&block, item.Val)
+                                if err != nil {
+                                        return nil, diagnosticsErrorf("module block at %s: %s", item.Pos(), err)
+                                }
+
+                                mc := &ModuleCall{
+                                        Name:    name,
+                                        Source:  block.Source,
+                                        Version: block.Version,
+                                        Pos:     sourcePosLegacyHCL(item.Pos(), filename),
+                                }
+                                // it's possible this module call is from an override file
+                                if origMod, exists := mod.ModuleCalls[name]; exists {
+                                        if mc.Source == "" {
+                                                mc.Source = origMod.Source
+                                        }
+                                }
+                                mod.ModuleCalls[name] = mc
+                        }
+                }
+
+                if providerConfigs := list.Filter("provider"); len(providerConfigs.Items) > 0 {
+                        providerConfigs = providerConfigs.Children()
+                        type ProviderBlock struct {
+                                Version string
+                        }
+
+                        for _, item := range providerConfigs.Items {
+                                unwrapLegacyHCLObjectKeysFromJSON(item, 1)
+
+                                if len(item.Keys) != 1 {
+                                        return nil, diagnosticsErrorf("provider block at %s has no label", item.Pos())
+                                }
+
+                                name := item.Keys[0].Token.Value().(string)
+
+                                var block ProviderBlock
+                                err := legacyhcl.DecodeObject(&block, item.Val)
+                                if err != nil {
+                                        return nil, diagnosticsErrorf("invalid provider block at %s: %s", item.Pos(), err)
+                                }
+
+                                if block.Version != "" {
+                                        mod.RequiredProviders[name] = append(mod.RequiredProviders[name], block.Version)
+                                }
+
+                                // Even if there wasn't an explicit version required, we still
+                                // need an entry in our map to signal the unversioned dependency.
+                                if _, exists := mod.RequiredProviders[name]; !exists {
+                                        mod.RequiredProviders[name] = []string{}
+                                }
+
+                        }
+                }
+        }
+
+        return mod, nil
+}
+
+// unwrapLegacyHCLObjectKeysFromJSON cleans up an edge case that can occur when
+// parsing JSON as input: if we're parsing JSON then directly nested
+// items will show up as additional "keys".
+//
+// For objects that expect a fixed number of keys, this breaks the
+// decoding process. This function unwraps the object into what it would've
+// looked like if it came directly from HCL by specifying the number of keys
+// you expect.
+//
+// Example:
+//
+// { "foo": { "baz": {} } }
+//
+// Will show up with Keys being: []string{"foo", "baz"}
+// when we really just want the first two. This function will fix this.
+func unwrapLegacyHCLObjectKeysFromJSON(item *legacyast.ObjectItem, depth int) {
+        if len(item.Keys) > depth && item.Keys[0].Token.JSON {
+                for len(item.Keys) > depth {
+                        // Pop off the last key
+                        n := len(item.Keys)
+                        key := item.Keys[n-1]
+                        item.Keys[n-1] = nil
+                        item.Keys = item.Keys[:n-1]
+
+                        // Wrap our value in a list
+                        item.Val = &legacyast.ObjectType{
+                                List: &legacyast.ObjectList{
+                                        Items: []*legacyast.ObjectItem{
+                                                &legacyast.ObjectItem{
+                                                        Keys: []*legacyast.ObjectKey{key},
+                                                        Val:  item.Val,
+                                                },
+                                        },
+                                },
+                        }
+                }
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/module.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/module.go
new file mode 100644
index 0000000..65ddb23
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/module.go
@@ -0,0 +1,35 @@
+package tfconfig
+
+// Module is the top-level type representing a parsed and processed Terraform
+// module.
+type Module struct {
+        // Path is the local filesystem directory where the module was loaded from.
+        Path string `json:"path"`
+
+        Variables map[string]*Variable `json:"variables"`
+        Outputs   map[string]*Output   `json:"outputs"`
+
+        RequiredCore      []string            `json:"required_core,omitempty"`
+        RequiredProviders map[string][]string `json:"required_providers"`
+
+        ManagedResources map[string]*Resource   `json:"managed_resources"`
+        DataResources    map[string]*Resource   `json:"data_resources"`
+        ModuleCalls      map[string]*ModuleCall `json:"module_calls"`
+
+        // Diagnostics records any errors and warnings that were detected during
+        // loading, primarily for inclusion in serialized forms of the module
+        // since this slice is also returned as a second argument from LoadModule.
+        Diagnostics Diagnostics `json:"diagnostics,omitempty"`
+}
+
+func newModule(path string) *Module {
+        return &Module{
+                Path:              path,
+                Variables:         make(map[string]*Variable),
+                Outputs:           make(map[string]*Output),
+                RequiredProviders: make(map[string][]string),
+                ManagedResources:  make(map[string]*Resource),
+                DataResources:     make(map[string]*Resource),
+                ModuleCalls:       make(map[string]*ModuleCall),
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/module_call.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/module_call.go
new file mode 100644
index 0000000..5e1e05a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/module_call.go
@@ -0,0 +1,11 @@
+package tfconfig
+
+// ModuleCall represents a "module" block within a module. That is, a
+// declaration of a child module from inside its parent.
+type ModuleCall struct {
+        Name    string `json:"name"`
+        Source  string `json:"source"`
+        Version string `json:"version,omitempty"`
+
+        Pos SourcePos `json:"pos"`
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/output.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/output.go
new file mode 100644
index 0000000..890b25e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/output.go
@@ -0,0 +1,9 @@
+package tfconfig
+
+// Output represents a single output from a Terraform module.
+type Output struct {
+        Name        string `json:"name"`
+        Description string `json:"description,omitempty"`
+
+        Pos SourcePos `json:"pos"`
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/provider_ref.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/provider_ref.go
new file mode 100644
index 0000000..d924837
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/provider_ref.go
@@ -0,0 +1,9 @@
+package tfconfig
+
+// ProviderRef is a reference to a provider configuration within a module.
+// It represents the contents of a "provider" argument in a resource, or
+// a value in the "providers" map for a module call.
+type ProviderRef struct {
+        Name  string `json:"name"`
+        Alias string `json:"alias,omitempty"` // Empty if the default provider configuration is referenced
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/resource.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/resource.go
new file mode 100644
index 0000000..401c8fc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/resource.go
@@ -0,0 +1,64 @@
+package tfconfig
+
+import (
+        "fmt"
+        "strconv"
+        "strings"
+)
+
+// Resource represents a single "resource" or "data" block within a module.
+type Resource struct {
+        Mode ResourceMode `json:"mode"`
+        Type string       `json:"type"`
+        Name string       `json:"name"`
+
+        Provider ProviderRef `json:"provider"`
+
+        Pos SourcePos `json:"pos"`
+}
+
+// MapKey returns a string that can be used to uniquely identify the receiver
+// in a map[string]*Resource.
+func (r *Resource) MapKey() string {
+        switch r.Mode {
+        case ManagedResourceMode:
+                return fmt.Sprintf("%s.%s", r.Type, r.Name)
+        case DataResourceMode:
+                return fmt.Sprintf("data.%s.%s", r.Type, r.Name)
+        default:
+                // should never happen
+                return fmt.Sprintf("[invalid_mode!].%s.%s", r.Type, r.Name)
+        }
+}
+
+// ResourceMode represents the "mode" of a resource, which is used to
+// distinguish between managed resources ("resource" blocks in config) and
+// data resources ("data" blocks in config).
+type ResourceMode rune
+
+const InvalidResourceMode ResourceMode = 0
+const ManagedResourceMode ResourceMode = 'M'
+const DataResourceMode ResourceMode = 'D'
+
+func (m ResourceMode) String() string {
+        switch m {
+        case ManagedResourceMode:
+                return "managed"
+        case DataResourceMode:
+                return "data"
+        default:
+                return ""
+        }
+}
+
+// MarshalJSON implements encoding/json.Marshaler.
+func (m ResourceMode) MarshalJSON() ([]byte, error) {
+        return []byte(strconv.Quote(m.String())), nil
+}
+
+func resourceTypeDefaultProviderName(typeName string) string {
+        if underPos := strings.IndexByte(typeName, '_'); underPos != -1 {
+                return typeName[:underPos]
+        }
+        return typeName
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/schema.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/schema.go
new file mode 100644
index 0000000..3af742f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/schema.go
@@ -0,0 +1,106 @@
+package tfconfig
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+var rootSchema = &hcl.BodySchema{
+        Blocks: []hcl.BlockHeaderSchema{
+                {
+                        Type:       "terraform",
+                        LabelNames: nil,
+                },
+                {
+                        Type:       "variable",
+                        LabelNames: []string{"name"},
+                },
+                {
+                        Type:       "output",
+                        LabelNames: []string{"name"},
+                },
+                {
+                        Type:       "provider",
+                        LabelNames: []string{"name"},
+                },
+                {
+                        Type:       "resource",
+                        LabelNames: []string{"type", "name"},
+                },
+                {
+                        Type:       "data",
+                        LabelNames: []string{"type", "name"},
+                },
+                {
+                        Type:       "module",
+                        LabelNames: []string{"name"},
+                },
+        },
+}
+
+var terraformBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "required_version",
+                },
+        },
+        Blocks: []hcl.BlockHeaderSchema{
+                {
+                        Type: "required_providers",
+                },
+        },
+}
+
+var providerConfigSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "version",
+                },
+                {
+                        Name: "alias",
+                },
+        },
+}
+
+var variableSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "type",
+                },
+                {
+                        Name: "description",
+                },
+                {
+                        Name: "default",
+                },
+        },
+}
+
+var outputSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "description",
+                },
+        },
+}
+
+var moduleCallSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "source",
+                },
+                {
+                        Name: "version",
+                },
+                {
+                        Name: "providers",
+                },
+        },
+}
+
+var resourceSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "provider",
+                },
+        },
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/source_pos.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/source_pos.go
new file mode 100644
index 0000000..883914e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/source_pos.go
@@ -0,0 +1,50 @@
+package tfconfig
+
+import (
+        legacyhcltoken "github.com/hashicorp/hcl/hcl/token"
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// SourcePos is a pointer to a particular location in a source file.
+//
+// This type is embedded into other structs to allow callers to locate the
+// definition of each described module element. The SourcePos of an element
+// is usually the first line of its definition, although the definition can
+// be a little "fuzzy" with JSON-based config files.
+type SourcePos struct {
+        Filename string `json:"filename"`
+        Line     int    `json:"line"`
+}
+
+func sourcePos(filename string, line int) SourcePos {
+        return SourcePos{
+                Filename: filename,
+                Line:     line,
+        }
+}
+
+func sourcePosHCL(rng hcl.Range) SourcePos {
+        // We intentionally throw away the column information here because
+        // current and legacy HCL both disagree on the definition of a column
+        // and so a line-only reference is the best granularity we can do
+        // such that the result is consistent between both parsers.
+        return SourcePos{
+                Filename: rng.Filename,
+                Line:     rng.Start.Line,
+        }
+}
+
+func sourcePosLegacyHCL(pos legacyhcltoken.Pos, filename string) SourcePos {
+        useFilename := pos.Filename
+        // We'll try to use the filename given in legacy HCL position, but
+        // in practice there's no way to actually get this populated via
+        // the HCL API so it's usually empty except in some specialized
+        // situations, such as positions in error objects.
+        if useFilename == "" {
+                useFilename = filename
+        }
+        return SourcePos{
+                Filename: useFilename,
+                Line:     pos.Line,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/variable.go b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/variable.go
new file mode 100644
index 0000000..0f73fc9
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform-config-inspect/tfconfig/variable.go
@@ -0,0 +1,16 @@
+package tfconfig
+
+// Variable represents a single variable from a Terraform module.
+type Variable struct {
+        Name        string `json:"name"`
+        Type        string `json:"type,omitempty"`
+        Description string `json:"description,omitempty"`
+
+        // Default is an approximate representation of the default value in
+        // the native Go type system. The conversion from the value given in
+        // configuration may be slightly lossy. Only values that can be
+        // serialized by json.Marshal will be included here.
+        Default interface{} `json:"default,omitempty"`
+
+        Pos SourcePos `json:"pos"`
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/count_attr.go b/vendor/github.com/hashicorp/terraform/addrs/count_attr.go
new file mode 100644
index 0000000..90a5faf
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/count_attr.go
@@ -0,0 +1,12 @@
+package addrs
+
+// CountAttr is the address of an attribute of the "count" object in
+// the interpolation scope, like "count.index".
+type CountAttr struct {
+        referenceable
+        Name string
+}
+
+func (ca CountAttr) String() string {
+        return "count." + ca.Name
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/doc.go b/vendor/github.com/hashicorp/terraform/addrs/doc.go
new file mode 100644
index 0000000..4609331
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/doc.go
@@ -0,0 +1,17 @@
+// Package addrs contains types that represent "addresses", which are
+// references to specific objects within a Terraform configuration or
+// state.
+//
+// All addresses have string representations based on HCL traversal syntax
+// which should be used in the user-interface, and also in-memory
+// representations that can be used internally.
+//
+// For object types that exist within Terraform modules a pair of types is
+// used. The "local" part of the address is represented by a type, and then
+// an absolute path to that object in the context of its module is represented
+// by a type of the same name with an "Abs" prefix added, for "absolute".
+//
+// All types within this package should be treated as immutable, even if this
+// is not enforced by the Go compiler. It is always an implementation error
+// to modify an address object in-place after it is initially constructed.
+package addrs
diff --git a/vendor/github.com/hashicorp/terraform/addrs/input_variable.go b/vendor/github.com/hashicorp/terraform/addrs/input_variable.go
new file mode 100644
index 0000000..d2c046c
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/input_variable.go
@@ -0,0 +1,41 @@
+package addrs
+
+import (
+        "fmt"
+)
+
+// InputVariable is the address of an input variable.
+type InputVariable struct {
+        referenceable
+        Name string
+}
+
+func (v InputVariable) String() string {
+        return "var." + v.Name
+}
+
+// AbsInputVariableInstance is the address of an input variable within a
+// particular module instance.
+type AbsInputVariableInstance struct {
+        Module   ModuleInstance
+        Variable InputVariable
+}
+
+// InputVariable returns the absolute address of the input variable of the
+// given name inside the receiving module instance.
+func (m ModuleInstance) InputVariable(name string) AbsInputVariableInstance {
+        return AbsInputVariableInstance{
+                Module: m,
+                Variable: InputVariable{
+                        Name: name,
+                },
+        }
+}
+
+func (v AbsInputVariableInstance) String() string {
+        if len(v.Module) == 0 {
+                return v.String()
+        }
+
+        return fmt.Sprintf("%s.%s", v.Module.String(), v.Variable.String())
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/instance_key.go b/vendor/github.com/hashicorp/terraform/addrs/instance_key.go
new file mode 100644
index 0000000..cef8b27
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/instance_key.go
@@ -0,0 +1,123 @@
+package addrs
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+// InstanceKey represents the key of an instance within an object that
+// contains multiple instances due to using "count" or "for_each" arguments
+// in configuration.
+//
+// IntKey and StringKey are the two implementations of this type. No other
+// implementations are allowed. The single instance of an object that _isn't_
+// using "count" or "for_each" is represented by NoKey, which is a nil
+// InstanceKey.
+type InstanceKey interface {
+        instanceKeySigil()
+        String() string
+}
+
+// ParseInstanceKey returns the instance key corresponding to the given value,
+// which must be known and non-null.
+//
+// If an unknown or null value is provided then this function will panic. This
+// function is intended to deal with the values that would naturally be found
+// in a hcl.TraverseIndex, which (when parsed from source, at least) can never
+// contain unknown or null values.
+func ParseInstanceKey(key cty.Value) (InstanceKey, error) {
+        switch key.Type() {
+        case cty.String:
+                return StringKey(key.AsString()), nil
+        case cty.Number:
+                var idx int
+                err := gocty.FromCtyValue(key, &idx)
+                return IntKey(idx), err
+        default:
+                return NoKey, fmt.Errorf("either a string or an integer is required")
+        }
+}
+
+// NoKey represents the absense of an InstanceKey, for the single instance
+// of a configuration object that does not use "count" or "for_each" at all.
+var NoKey InstanceKey
+
+// IntKey is the InstanceKey representation representing integer indices, as
+// used when the "count" argument is specified or if for_each is used with
+// a sequence type.
+type IntKey int
+
+func (k IntKey) instanceKeySigil() {
+}
+
+func (k IntKey) String() string {
+        return fmt.Sprintf("[%d]", int(k))
+}
+
+// StringKey is the InstanceKey representation representing string indices, as
+// used when the "for_each" argument is specified with a map or object type.
+type StringKey string
+
+func (k StringKey) instanceKeySigil() {
+}
+
+func (k StringKey) String() string {
+        // FIXME: This isn't _quite_ right because Go's quoted string syntax is
+        // slightly different than HCL's, but we'll accept it for now.
+        return fmt.Sprintf("[%q]", string(k))
+}
+
+// InstanceKeyLess returns true if the first given instance key i should sort
+// before the second key j, and false otherwise.
+func InstanceKeyLess(i, j InstanceKey) bool {
+        iTy := instanceKeyType(i)
+        jTy := instanceKeyType(j)
+
+        switch {
+        case i == j:
+                return false
+        case i == NoKey:
+                return true
+        case j == NoKey:
+                return false
+        case iTy != jTy:
+                // The ordering here is arbitrary except that we want NoKeyType
+                // to sort before the others, so we'll just use the enum values
+                // of InstanceKeyType here (where NoKey is zero, sorting before
+                // any other).
+                return uint32(iTy) < uint32(jTy)
+        case iTy == IntKeyType:
+                return int(i.(IntKey)) < int(j.(IntKey))
+        case iTy == StringKeyType:
+                return string(i.(StringKey)) < string(j.(StringKey))
+        default:
+                // Shouldn't be possible to get down here in practice, since the
+                // above is exhaustive.
+                return false
+        }
+}
+
+func instanceKeyType(k InstanceKey) InstanceKeyType {
+        if _, ok := k.(StringKey); ok {
+                return StringKeyType
+        }
+        if _, ok := k.(IntKey); ok {
+                return IntKeyType
+        }
+        return NoKeyType
+}
+
+// InstanceKeyType represents the different types of instance key that are
+// supported. Usually it is sufficient to simply type-assert an InstanceKey
+// value to either IntKey or StringKey, but this type and its values can be
+// used to represent the types themselves, rather than specific values
+// of those types.
+type InstanceKeyType rune
+
+const (
+        NoKeyType     InstanceKeyType = 0
+        IntKeyType    InstanceKeyType = 'I'
+        StringKeyType InstanceKeyType = 'S'
+)
diff --git a/vendor/github.com/hashicorp/terraform/addrs/local_value.go b/vendor/github.com/hashicorp/terraform/addrs/local_value.go
new file mode 100644
index 0000000..61a07b9
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/local_value.go
@@ -0,0 +1,48 @@
+package addrs
+
+import (
+        "fmt"
+)
+
+// LocalValue is the address of a local value.
+type LocalValue struct {
+        referenceable
+        Name string
+}
+
+func (v LocalValue) String() string {
+        return "local." + v.Name
+}
+
+// Absolute converts the receiver into an absolute address within the given
+// module instance.
+func (v LocalValue) Absolute(m ModuleInstance) AbsLocalValue {
+        return AbsLocalValue{
+                Module:     m,
+                LocalValue: v,
+        }
+}
+
+// AbsLocalValue is the absolute address of a local value within a module instance.
+type AbsLocalValue struct {
+        Module     ModuleInstance
+        LocalValue LocalValue
+}
+
+// LocalValue returns the absolute address of a local value of the given
+// name within the receiving module instance.
+func (m ModuleInstance) LocalValue(name string) AbsLocalValue {
+        return AbsLocalValue{
+                Module: m,
+                LocalValue: LocalValue{
+                        Name: name,
+                },
+        }
+}
+
+func (v AbsLocalValue) String() string {
+        if len(v.Module) == 0 {
+                return v.LocalValue.String()
+        }
+        return fmt.Sprintf("%s.%s", v.Module.String(), v.LocalValue.String())
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/module.go b/vendor/github.com/hashicorp/terraform/addrs/module.go
new file mode 100644
index 0000000..6420c63
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/module.go
@@ -0,0 +1,75 @@
+package addrs
+
+import (
+        "strings"
+)
+
+// Module is an address for a module call within configuration. This is
+// the static counterpart of ModuleInstance, representing a traversal through
+// the static module call tree in configuration and does not take into account
+// the potentially-multiple instances of a module that might be created by
+// "count" and "for_each" arguments within those calls.
+//
+// This type should be used only in very specialized cases when working with
+// the static module call tree. Type ModuleInstance is appropriate in more cases.
+//
+// Although Module is a slice, it should be treated as immutable after creation.
+type Module []string
+
+// RootModule is the module address representing the root of the static module
+// call tree, which is also the zero value of Module.
+//
+// Note that this is not the root of the dynamic module tree, which is instead
+// represented by RootModuleInstance.
+var RootModule Module
+
+// IsRoot returns true if the receiver is the address of the root module,
+// or false otherwise.
+func (m Module) IsRoot() bool {
+        return len(m) == 0
+}
+
+func (m Module) String() string {
+        if len(m) == 0 {
+                return ""
+        }
+        return strings.Join([]string(m), ".")
+}
+
+// Child returns the address of a child call in the receiver, identified by the
+// given name.
+func (m Module) Child(name string) Module {
+        ret := make(Module, 0, len(m)+1)
+        ret = append(ret, m...)
+        return append(ret, name)
+}
+
+// Parent returns the address of the parent module of the receiver, or the
+// receiver itself if there is no parent (if it's the root module address).
+func (m Module) Parent() Module {
+        if len(m) == 0 {
+                return m
+        }
+        return m[:len(m)-1]
+}
+
+// Call returns the module call address that corresponds to the given module
+// instance, along with the address of the module that contains it.
+//
+// There is no call for the root module, so this method will panic if called
+// on the root module address.
+//
+// In practice, this just turns the last element of the receiver into a
+// ModuleCall and then returns a slice of the receiever that excludes that
+// last part. This is just a convenience for situations where a call address
+// is required, such as when dealing with *Reference and Referencable values.
+func (m Module) Call() (Module, ModuleCall) {
+        if len(m) == 0 {
+                panic("cannot produce ModuleCall for root module")
+        }
+
+        caller, callName := m[:len(m)-1], m[len(m)-1]
+        return caller, ModuleCall{
+                Name: callName,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/module_call.go b/vendor/github.com/hashicorp/terraform/addrs/module_call.go
new file mode 100644
index 0000000..09596cc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/module_call.go
@@ -0,0 +1,81 @@
+package addrs
+
+import (
+        "fmt"
+)
+
+// ModuleCall is the address of a call from the current module to a child
+// module.
+//
+// There is no "Abs" version of ModuleCall because an absolute module path
+// is represented by ModuleInstance.
+type ModuleCall struct {
+        referenceable
+        Name string
+}
+
+func (c ModuleCall) String() string {
+        return "module." + c.Name
+}
+
+// Instance returns the address of an instance of the receiver identified by
+// the given key.
+func (c ModuleCall) Instance(key InstanceKey) ModuleCallInstance {
+        return ModuleCallInstance{
+                Call: c,
+                Key:  key,
+        }
+}
+
+// ModuleCallInstance is the address of one instance of a module created from
+// a module call, which might create multiple instances using "count" or
+// "for_each" arguments.
+type ModuleCallInstance struct {
+        referenceable
+        Call ModuleCall
+        Key  InstanceKey
+}
+
+func (c ModuleCallInstance) String() string {
+        if c.Key == NoKey {
+                return c.Call.String()
+        }
+        return fmt.Sprintf("module.%s%s", c.Call.Name, c.Key)
+}
+
+// ModuleInstance returns the address of the module instance that corresponds
+// to the receiving call instance when resolved in the given calling module.
+// In other words, it returns the child module instance that the receving
+// call instance creates.
+func (c ModuleCallInstance) ModuleInstance(caller ModuleInstance) ModuleInstance {
+        return caller.Child(c.Call.Name, c.Key)
+}
+
+// Output returns the address of an output of the receiver identified by its
+// name.
+func (c ModuleCallInstance) Output(name string) ModuleCallOutput {
+        return ModuleCallOutput{
+                Call: c,
+                Name: name,
+        }
+}
+
+// ModuleCallOutput is the address of a particular named output produced by
+// an instance of a module call.
+type ModuleCallOutput struct {
+        referenceable
+        Call ModuleCallInstance
+        Name string
+}
+
+func (co ModuleCallOutput) String() string {
+        return fmt.Sprintf("%s.%s", co.Call.String(), co.Name)
+}
+
+// AbsOutputValue returns the absolute output value address that corresponds
+// to the receving module call output address, once resolved in the given
+// calling module.
+func (co ModuleCallOutput) AbsOutputValue(caller ModuleInstance) AbsOutputValue {
+        moduleAddr := co.Call.ModuleInstance(caller)
+        return moduleAddr.OutputValue(co.Name)
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/module_instance.go b/vendor/github.com/hashicorp/terraform/addrs/module_instance.go
new file mode 100644
index 0000000..67e73e5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/module_instance.go
@@ -0,0 +1,415 @@
+package addrs
+
+import (
+        "bytes"
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/gocty"
+
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// ModuleInstance is an address for a particular module instance within the
+// dynamic module tree. This is an extension of the static traversals
+// represented by type Module that deals with the possibility of a single
+// module call producing multiple instances via the "count" and "for_each"
+// arguments.
+//
+// Although ModuleInstance is a slice, it should be treated as immutable after
+// creation.
+type ModuleInstance []ModuleInstanceStep
+
+var (
+        _ Targetable = ModuleInstance(nil)
+)
+
+func ParseModuleInstance(traversal hcl.Traversal) (ModuleInstance, tfdiags.Diagnostics) {
+        mi, remain, diags := parseModuleInstancePrefix(traversal)
+        if len(remain) != 0 {
+                if len(remain) == len(traversal) {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid module instance address",
+                                Detail:   "A module instance address must begin with \"module.\".",
+                                Subject:  remain.SourceRange().Ptr(),
+                        })
+                } else {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid module instance address",
+                                Detail:   "The module instance address is followed by additional invalid content.",
+                                Subject:  remain.SourceRange().Ptr(),
+                        })
+                }
+        }
+        return mi, diags
+}
+
+// ParseModuleInstanceStr is a helper wrapper around ParseModuleInstance
+// that takes a string and parses it with the HCL native syntax traversal parser
+// before interpreting it.
+//
+// This should be used only in specialized situations since it will cause the
+// created references to not have any meaningful source location information.
+// If a reference string is coming from a source that should be identified in
+// error messages then the caller should instead parse it directly using a
+// suitable function from the HCL API and pass the traversal itself to
+// ParseProviderConfigCompact.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// then the returned address is invalid.
+func ParseModuleInstanceStr(str string) (ModuleInstance, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return nil, diags
+        }
+
+        addr, addrDiags := ParseModuleInstance(traversal)
+        diags = diags.Append(addrDiags)
+        return addr, diags
+}
+
+func parseModuleInstancePrefix(traversal hcl.Traversal) (ModuleInstance, hcl.Traversal, tfdiags.Diagnostics) {
+        remain := traversal
+        var mi ModuleInstance
+        var diags tfdiags.Diagnostics
+
+        for len(remain) > 0 {
+                var next string
+                switch tt := remain[0].(type) {
+                case hcl.TraverseRoot:
+                        next = tt.Name
+                case hcl.TraverseAttr:
+                        next = tt.Name
+                default:
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid address operator",
+                                Detail:   "Module address prefix must be followed by dot and then a name.",
+                                Subject:  remain[0].SourceRange().Ptr(),
+                        })
+                        break
+                }
+
+                if next != "module" {
+                        break
+                }
+
+                kwRange := remain[0].SourceRange()
+                remain = remain[1:]
+                // If we have the prefix "module" then we should be followed by an
+                // module call name, as an attribute, and then optionally an index step
+                // giving the instance key.
+                if len(remain) == 0 {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid address operator",
+                                Detail:   "Prefix \"module.\" must be followed by a module name.",
+                                Subject:  &kwRange,
+                        })
+                        break
+                }
+
+                var moduleName string
+                switch tt := remain[0].(type) {
+                case hcl.TraverseAttr:
+                        moduleName = tt.Name
+                default:
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid address operator",
+                                Detail:   "Prefix \"module.\" must be followed by a module name.",
+                                Subject:  remain[0].SourceRange().Ptr(),
+                        })
+                        break
+                }
+                remain = remain[1:]
+                step := ModuleInstanceStep{
+                        Name: moduleName,
+                }
+
+                if len(remain) > 0 {
+                        if idx, ok := remain[0].(hcl.TraverseIndex); ok {
+                                remain = remain[1:]
+
+                                switch idx.Key.Type() {
+                                case cty.String:
+                                        step.InstanceKey = StringKey(idx.Key.AsString())
+                                case cty.Number:
+                                        var idxInt int
+                                        err := gocty.FromCtyValue(idx.Key, &idxInt)
+                                        if err == nil {
+                                                step.InstanceKey = IntKey(idxInt)
+                                        } else {
+                                                diags = diags.Append(&hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Invalid address operator",
+                                                        Detail:   fmt.Sprintf("Invalid module index: %s.", err),
+                                                        Subject:  idx.SourceRange().Ptr(),
+                                                })
+                                        }
+                                default:
+                                        // Should never happen, because no other types are allowed in traversal indices.
+                                        diags = diags.Append(&hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Invalid address operator",
+                                                Detail:   "Invalid module key: must be either a string or an integer.",
+                                                Subject:  idx.SourceRange().Ptr(),
+                                        })
+                                }
+                        }
+                }
+
+                mi = append(mi, step)
+        }
+
+        var retRemain hcl.Traversal
+        if len(remain) > 0 {
+                retRemain = make(hcl.Traversal, len(remain))
+                copy(retRemain, remain)
+                // The first element here might be either a TraverseRoot or a
+                // TraverseAttr, depending on whether we had a module address on the
+                // front. To make life easier for callers, we'll normalize to always
+                // start with a TraverseRoot.
+                if tt, ok := retRemain[0].(hcl.TraverseAttr); ok {
+                        retRemain[0] = hcl.TraverseRoot{
+                                Name:     tt.Name,
+                                SrcRange: tt.SrcRange,
+                        }
+                }
+        }
+
+        return mi, retRemain, diags
+}
+
+// UnkeyedInstanceShim is a shim method for converting a Module address to the
+// equivalent ModuleInstance address that assumes that no modules have
+// keyed instances.
+//
+// This is a temporary allowance for the fact that Terraform does not presently
+// support "count" and "for_each" on modules, and thus graph building code that
+// derives graph nodes from configuration must just assume unkeyed modules
+// in order to construct the graph. At a later time when "count" and "for_each"
+// support is added for modules, all callers of this method will need to be
+// reworked to allow for keyed module instances.
+func (m Module) UnkeyedInstanceShim() ModuleInstance {
+        path := make(ModuleInstance, len(m))
+        for i, name := range m {
+                path[i] = ModuleInstanceStep{Name: name}
+        }
+        return path
+}
+
+// ModuleInstanceStep is a single traversal step through the dynamic module
+// tree. It is used only as part of ModuleInstance.
+type ModuleInstanceStep struct {
+        Name        string
+        InstanceKey InstanceKey
+}
+
+// RootModuleInstance is the module instance address representing the root
+// module, which is also the zero value of ModuleInstance.
+var RootModuleInstance ModuleInstance
+
+// IsRoot returns true if the receiver is the address of the root module instance,
+// or false otherwise.
+func (m ModuleInstance) IsRoot() bool {
+        return len(m) == 0
+}
+
+// Child returns the address of a child module instance of the receiver,
+// identified by the given name and key.
+func (m ModuleInstance) Child(name string, key InstanceKey) ModuleInstance {
+        ret := make(ModuleInstance, 0, len(m)+1)
+        ret = append(ret, m...)
+        return append(ret, ModuleInstanceStep{
+                Name:        name,
+                InstanceKey: key,
+        })
+}
+
+// Parent returns the address of the parent module instance of the receiver, or
+// the receiver itself if there is no parent (if it's the root module address).
+func (m ModuleInstance) Parent() ModuleInstance {
+        if len(m) == 0 {
+                return m
+        }
+        return m[:len(m)-1]
+}
+
+// String returns a string representation of the receiver, in the format used
+// within e.g. user-provided resource addresses.
+//
+// The address of the root module has the empty string as its representation.
+func (m ModuleInstance) String() string {
+        var buf bytes.Buffer
+        sep := ""
+        for _, step := range m {
+                buf.WriteString(sep)
+                buf.WriteString("module.")
+                buf.WriteString(step.Name)
+                if step.InstanceKey != NoKey {
+                        buf.WriteString(step.InstanceKey.String())
+                }
+                sep = "."
+        }
+        return buf.String()
+}
+
+// Equal returns true if the receiver and the given other value
+// contains the exact same parts.
+func (m ModuleInstance) Equal(o ModuleInstance) bool {
+        return m.String() == o.String()
+}
+
+// Less returns true if the receiver should sort before the given other value
+// in a sorted list of addresses.
+func (m ModuleInstance) Less(o ModuleInstance) bool {
+        if len(m) != len(o) {
+                // Shorter path sorts first.
+                return len(m) < len(o)
+        }
+
+        for i := range m {
+                mS, oS := m[i], o[i]
+                switch {
+                case mS.Name != oS.Name:
+                        return mS.Name < oS.Name
+                case mS.InstanceKey != oS.InstanceKey:
+                        return InstanceKeyLess(mS.InstanceKey, oS.InstanceKey)
+                }
+        }
+
+        return false
+}
+
+// Ancestors returns a slice containing the receiver and all of its ancestor
+// module instances, all the way up to (and including) the root module.
+// The result is ordered by depth, with the root module always first.
+//
+// Since the result always includes the root module, a caller may choose to
+// ignore it by slicing the result with [1:].
+func (m ModuleInstance) Ancestors() []ModuleInstance {
+        ret := make([]ModuleInstance, 0, len(m)+1)
+        for i := 0; i <= len(m); i++ {
+                ret = append(ret, m[:i])
+        }
+        return ret
+}
+
+// IsAncestor returns true if the receiver is an ancestor of the given
+// other value.
+func (m ModuleInstance) IsAncestor(o ModuleInstance) bool {
+        // Longer or equal sized paths means the receiver cannot
+        // be an ancestor of the given module insatnce.
+        if len(m) >= len(o) {
+                return false
+        }
+
+        for i, ms := range m {
+                if ms.Name != o[i].Name {
+                        return false
+                }
+                if ms.InstanceKey != NoKey && ms.InstanceKey != o[i].InstanceKey {
+                        return false
+                }
+        }
+
+        return true
+}
+
+// Call returns the module call address that corresponds to the given module
+// instance, along with the address of the module instance that contains it.
+//
+// There is no call for the root module, so this method will panic if called
+// on the root module address.
+//
+// A single module call can produce potentially many module instances, so the
+// result discards any instance key that might be present on the last step
+// of the instance. To retain this, use CallInstance instead.
+//
+// In practice, this just turns the last element of the receiver into a
+// ModuleCall and then returns a slice of the receiever that excludes that
+// last part. This is just a convenience for situations where a call address
+// is required, such as when dealing with *Reference and Referencable values.
+func (m ModuleInstance) Call() (ModuleInstance, ModuleCall) {
+        if len(m) == 0 {
+                panic("cannot produce ModuleCall for root module")
+        }
+
+        inst, lastStep := m[:len(m)-1], m[len(m)-1]
+        return inst, ModuleCall{
+                Name: lastStep.Name,
+        }
+}
+
+// CallInstance returns the module call instance address that corresponds to
+// the given module instance, along with the address of the module instance
+// that contains it.
+//
+// There is no call for the root module, so this method will panic if called
+// on the root module address.
+//
+// In practice, this just turns the last element of the receiver into a
+// ModuleCallInstance and then returns a slice of the receiever that excludes
+// that last part. This is just a convenience for situations where a call\
+// address is required, such as when dealing with *Reference and Referencable
+// values.
+func (m ModuleInstance) CallInstance() (ModuleInstance, ModuleCallInstance) {
+        if len(m) == 0 {
+                panic("cannot produce ModuleCallInstance for root module")
+        }
+
+        inst, lastStep := m[:len(m)-1], m[len(m)-1]
+        return inst, ModuleCallInstance{
+                Call: ModuleCall{
+                        Name: lastStep.Name,
+                },
+                Key: lastStep.InstanceKey,
+        }
+}
+
+// TargetContains implements Targetable by returning true if the given other
+// address either matches the receiver, is a sub-module-instance of the
+// receiver, or is a targetable absolute address within a module that
+// is contained within the reciever.
+func (m ModuleInstance) TargetContains(other Targetable) bool {
+        switch to := other.(type) {
+
+        case ModuleInstance:
+                if len(to) < len(m) {
+                        // Can't be contained if the path is shorter
+                        return false
+                }
+                // Other is contained if its steps match for the length of our own path.
+                for i, ourStep := range m {
+                        otherStep := to[i]
+                        if ourStep != otherStep {
+                                return false
+                        }
+                }
+                // If we fall out here then the prefixed matched, so it's contained.
+                return true
+
+        case AbsResource:
+                return m.TargetContains(to.Module)
+
+        case AbsResourceInstance:
+                return m.TargetContains(to.Module)
+
+        default:
+                return false
+        }
+}
+
+func (m ModuleInstance) targetableSigil() {
+        // ModuleInstance is targetable
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/output_value.go b/vendor/github.com/hashicorp/terraform/addrs/output_value.go
new file mode 100644
index 0000000..bcd923a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/output_value.go
@@ -0,0 +1,75 @@
+package addrs
+
+import (
+        "fmt"
+)
+
+// OutputValue is the address of an output value, in the context of the module
+// that is defining it.
+//
+// This is related to but separate from ModuleCallOutput, which represents
+// a module output from the perspective of its parent module. Since output
+// values cannot be represented from the module where they are defined,
+// OutputValue is not Referenceable, while ModuleCallOutput is.
+type OutputValue struct {
+        Name string
+}
+
+func (v OutputValue) String() string {
+        return "output." + v.Name
+}
+
+// Absolute converts the receiver into an absolute address within the given
+// module instance.
+func (v OutputValue) Absolute(m ModuleInstance) AbsOutputValue {
+        return AbsOutputValue{
+                Module:      m,
+                OutputValue: v,
+        }
+}
+
+// AbsOutputValue is the absolute address of an output value within a module instance.
+//
+// This represents an output globally within the namespace of a particular
+// configuration. It is related to but separate from ModuleCallOutput, which
+// represents a module output from the perspective of its parent module.
+type AbsOutputValue struct {
+        Module      ModuleInstance
+        OutputValue OutputValue
+}
+
+// OutputValue returns the absolute address of an output value of the given
+// name within the receiving module instance.
+func (m ModuleInstance) OutputValue(name string) AbsOutputValue {
+        return AbsOutputValue{
+                Module: m,
+                OutputValue: OutputValue{
+                        Name: name,
+                },
+        }
+}
+
+func (v AbsOutputValue) String() string {
+        if v.Module.IsRoot() {
+                return v.OutputValue.String()
+        }
+        return fmt.Sprintf("%s.%s", v.Module.String(), v.OutputValue.String())
+}
+
+// ModuleCallOutput converts an AbsModuleOutput into a ModuleCallOutput,
+// returning also the module instance that the ModuleCallOutput is relative
+// to.
+//
+// The root module does not have a call, and so this method cannot be used
+// with outputs in the root module, and will panic in that case.
+func (v AbsOutputValue) ModuleCallOutput() (ModuleInstance, ModuleCallOutput) {
+        if v.Module.IsRoot() {
+                panic("ReferenceFromCall used with root module output")
+        }
+
+        caller, call := v.Module.CallInstance()
+        return caller, ModuleCallOutput{
+                Call: call,
+                Name: v.OutputValue.Name,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/parse_ref.go b/vendor/github.com/hashicorp/terraform/addrs/parse_ref.go
new file mode 100644
index 0000000..84fe8a0
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/parse_ref.go
@@ -0,0 +1,338 @@
+package addrs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// Reference describes a reference to an address with source location
+// information.
+type Reference struct {
+        Subject     Referenceable
+        SourceRange tfdiags.SourceRange
+        Remaining   hcl.Traversal
+}
+
+// ParseRef attempts to extract a referencable address from the prefix of the
+// given traversal, which must be an absolute traversal or this function
+// will panic.
+//
+// If no error diagnostics are returned, the returned reference includes the
+// address that was extracted, the source range it was extracted from, and any
+// remaining relative traversal that was not consumed as part of the
+// reference.
+//
+// If error diagnostics are returned then the Reference value is invalid and
+// must not be used.
+func ParseRef(traversal hcl.Traversal) (*Reference, tfdiags.Diagnostics) {
+        ref, diags := parseRef(traversal)
+
+        // Normalize a little to make life easier for callers.
+        if ref != nil {
+                if len(ref.Remaining) == 0 {
+                        ref.Remaining = nil
+                }
+        }
+
+        return ref, diags
+}
+
+// ParseRefStr is a helper wrapper around ParseRef that takes a string
+// and parses it with the HCL native syntax traversal parser before
+// interpreting it.
+//
+// This should be used only in specialized situations since it will cause the
+// created references to not have any meaningful source location information.
+// If a reference string is coming from a source that should be identified in
+// error messages then the caller should instead parse it directly using a
+// suitable function from the HCL API and pass the traversal itself to
+// ParseRef.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// the returned reference may be nil or incomplete.
+func ParseRefStr(str string) (*Reference, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return nil, diags
+        }
+
+        ref, targetDiags := ParseRef(traversal)
+        diags = diags.Append(targetDiags)
+        return ref, diags
+}
+
+func parseRef(traversal hcl.Traversal) (*Reference, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        root := traversal.RootName()
+        rootRange := traversal[0].SourceRange()
+
+        switch root {
+
+        case "count":
+                name, rng, remain, diags := parseSingleAttrRef(traversal)
+                return &Reference{
+                        Subject:     CountAttr{Name: name},
+                        SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                        Remaining:   remain,
+                }, diags
+
+        case "data":
+                if len(traversal) < 3 {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid reference",
+                                Detail:   `The "data" object must be followed by two attribute names: the data source type and the resource name.`,
+                                Subject:  traversal.SourceRange().Ptr(),
+                        })
+                        return nil, diags
+                }
+                remain := traversal[1:] // trim off "data" so we can use our shared resource reference parser
+                return parseResourceRef(DataResourceMode, rootRange, remain)
+
+        case "local":
+                name, rng, remain, diags := parseSingleAttrRef(traversal)
+                return &Reference{
+                        Subject:     LocalValue{Name: name},
+                        SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                        Remaining:   remain,
+                }, diags
+
+        case "module":
+                callName, callRange, remain, diags := parseSingleAttrRef(traversal)
+                if diags.HasErrors() {
+                        return nil, diags
+                }
+
+                // A traversal starting with "module" can either be a reference to
+                // an entire module instance or to a single output from a module
+                // instance, depending on what we find after this introducer.
+
+                callInstance := ModuleCallInstance{
+                        Call: ModuleCall{
+                                Name: callName,
+                        },
+                        Key: NoKey,
+                }
+
+                if len(remain) == 0 {
+                        // Reference to an entire module instance. Might alternatively
+                        // be a reference to a collection of instances of a particular
+                        // module, but the caller will need to deal with that ambiguity
+                        // since we don't have enough context here.
+                        return &Reference{
+                                Subject:     callInstance,
+                                SourceRange: tfdiags.SourceRangeFromHCL(callRange),
+                                Remaining:   remain,
+                        }, diags
+                }
+
+                if idxTrav, ok := remain[0].(hcl.TraverseIndex); ok {
+                        var err error
+                        callInstance.Key, err = ParseInstanceKey(idxTrav.Key)
+                        if err != nil {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid index key",
+                                        Detail:   fmt.Sprintf("Invalid index for module instance: %s.", err),
+                                        Subject:  &idxTrav.SrcRange,
+                                })
+                                return nil, diags
+                        }
+                        remain = remain[1:]
+
+                        if len(remain) == 0 {
+                                // Also a reference to an entire module instance, but we have a key
+                                // now.
+                                return &Reference{
+                                        Subject:     callInstance,
+                                        SourceRange: tfdiags.SourceRangeFromHCL(hcl.RangeBetween(callRange, idxTrav.SrcRange)),
+                                        Remaining:   remain,
+                                }, diags
+                        }
+                }
+
+                if attrTrav, ok := remain[0].(hcl.TraverseAttr); ok {
+                        remain = remain[1:]
+                        return &Reference{
+                                Subject: ModuleCallOutput{
+                                        Name: attrTrav.Name,
+                                        Call: callInstance,
+                                },
+                                SourceRange: tfdiags.SourceRangeFromHCL(hcl.RangeBetween(callRange, attrTrav.SrcRange)),
+                                Remaining:   remain,
+                        }, diags
+                }
+
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid reference",
+                        Detail:   "Module instance objects do not support this operation.",
+                        Subject:  remain[0].SourceRange().Ptr(),
+                })
+                return nil, diags
+
+        case "path":
+                name, rng, remain, diags := parseSingleAttrRef(traversal)
+                return &Reference{
+                        Subject:     PathAttr{Name: name},
+                        SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                        Remaining:   remain,
+                }, diags
+
+        case "self":
+                return &Reference{
+                        Subject:     Self,
+                        SourceRange: tfdiags.SourceRangeFromHCL(rootRange),
+                        Remaining:   traversal[1:],
+                }, diags
+
+        case "terraform":
+                name, rng, remain, diags := parseSingleAttrRef(traversal)
+                return &Reference{
+                        Subject:     TerraformAttr{Name: name},
+                        SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                        Remaining:   remain,
+                }, diags
+
+        case "var":
+                name, rng, remain, diags := parseSingleAttrRef(traversal)
+                return &Reference{
+                        Subject:     InputVariable{Name: name},
+                        SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                        Remaining:   remain,
+                }, diags
+
+        default:
+                return parseResourceRef(ManagedResourceMode, rootRange, traversal)
+        }
+}
+
+func parseResourceRef(mode ResourceMode, startRange hcl.Range, traversal hcl.Traversal) (*Reference, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        if len(traversal) < 2 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid reference",
+                        Detail:   `A reference to a resource type must be followed by at least one attribute access, specifying the resource name.`,
+                        Subject:  hcl.RangeBetween(traversal[0].SourceRange(), traversal[len(traversal)-1].SourceRange()).Ptr(),
+                })
+                return nil, diags
+        }
+
+        var typeName, name string
+        switch tt := traversal[0].(type) { // Could be either root or attr, depending on our resource mode
+        case hcl.TraverseRoot:
+                typeName = tt.Name
+        case hcl.TraverseAttr:
+                typeName = tt.Name
+        default:
+                // If it isn't a TraverseRoot then it must be a "data" reference.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid reference",
+                        Detail:   `The "data" object does not support this operation.`,
+                        Subject:  traversal[0].SourceRange().Ptr(),
+                })
+                return nil, diags
+        }
+
+        attrTrav, ok := traversal[1].(hcl.TraverseAttr)
+        if !ok {
+                var what string
+                switch mode {
+                case DataResourceMode:
+                        what = "data source"
+                default:
+                        what = "resource type"
+                }
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid reference",
+                        Detail:   fmt.Sprintf(`A reference to a %s must be followed by at least one attribute access, specifying the resource name.`, what),
+                        Subject:  traversal[1].SourceRange().Ptr(),
+                })
+                return nil, diags
+        }
+        name = attrTrav.Name
+        rng := hcl.RangeBetween(startRange, attrTrav.SrcRange)
+        remain := traversal[2:]
+
+        resourceAddr := Resource{
+                Mode: mode,
+                Type: typeName,
+                Name: name,
+        }
+        resourceInstAddr := ResourceInstance{
+                Resource: resourceAddr,
+                Key:      NoKey,
+        }
+
+        if len(remain) == 0 {
+                // This might actually be a reference to the collection of all instances
+                // of the resource, but we don't have enough context here to decide
+                // so we'll let the caller resolve that ambiguity.
+                return &Reference{
+                        Subject:     resourceInstAddr,
+                        SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                }, diags
+        }
+
+        if idxTrav, ok := remain[0].(hcl.TraverseIndex); ok {
+                var err error
+                resourceInstAddr.Key, err = ParseInstanceKey(idxTrav.Key)
+                if err != nil {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid index key",
+                                Detail:   fmt.Sprintf("Invalid index for resource instance: %s.", err),
+                                Subject:  &idxTrav.SrcRange,
+                        })
+                        return nil, diags
+                }
+                remain = remain[1:]
+                rng = hcl.RangeBetween(rng, idxTrav.SrcRange)
+        }
+
+        return &Reference{
+                Subject:     resourceInstAddr,
+                SourceRange: tfdiags.SourceRangeFromHCL(rng),
+                Remaining:   remain,
+        }, diags
+}
+
+func parseSingleAttrRef(traversal hcl.Traversal) (string, hcl.Range, hcl.Traversal, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        root := traversal.RootName()
+        rootRange := traversal[0].SourceRange()
+
+        if len(traversal) < 2 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid reference",
+                        Detail:   fmt.Sprintf("The %q object cannot be accessed directly. Instead, access one of its attributes.", root),
+                        Subject:  &rootRange,
+                })
+                return "", hcl.Range{}, nil, diags
+        }
+        if attrTrav, ok := traversal[1].(hcl.TraverseAttr); ok {
+                return attrTrav.Name, hcl.RangeBetween(rootRange, attrTrav.SrcRange), traversal[2:], diags
+        }
+        diags = diags.Append(&hcl.Diagnostic{
+                Severity: hcl.DiagError,
+                Summary:  "Invalid reference",
+                Detail:   fmt.Sprintf("The %q object does not support this operation.", root),
+                Subject:  traversal[1].SourceRange().Ptr(),
+        })
+        return "", hcl.Range{}, nil, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/parse_target.go b/vendor/github.com/hashicorp/terraform/addrs/parse_target.go
new file mode 100644
index 0000000..057443a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/parse_target.go
@@ -0,0 +1,318 @@
+package addrs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// Target describes a targeted address with source location information.
+type Target struct {
+        Subject     Targetable
+        SourceRange tfdiags.SourceRange
+}
+
+// ParseTarget attempts to interpret the given traversal as a targetable
+// address. The given traversal must be absolute, or this function will
+// panic.
+//
+// If no error diagnostics are returned, the returned target includes the
+// address that was extracted and the source range it was extracted from.
+//
+// If error diagnostics are returned then the Target value is invalid and
+// must not be used.
+func ParseTarget(traversal hcl.Traversal) (*Target, tfdiags.Diagnostics) {
+        path, remain, diags := parseModuleInstancePrefix(traversal)
+        if diags.HasErrors() {
+                return nil, diags
+        }
+
+        rng := tfdiags.SourceRangeFromHCL(traversal.SourceRange())
+
+        if len(remain) == 0 {
+                return &Target{
+                        Subject:     path,
+                        SourceRange: rng,
+                }, diags
+        }
+
+        mode := ManagedResourceMode
+        if remain.RootName() == "data" {
+                mode = DataResourceMode
+                remain = remain[1:]
+        }
+
+        if len(remain) < 2 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "Resource specification must include a resource type and name.",
+                        Subject:  remain.SourceRange().Ptr(),
+                })
+                return nil, diags
+        }
+
+        var typeName, name string
+        switch tt := remain[0].(type) {
+        case hcl.TraverseRoot:
+                typeName = tt.Name
+        case hcl.TraverseAttr:
+                typeName = tt.Name
+        default:
+                switch mode {
+                case ManagedResourceMode:
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid address",
+                                Detail:   "A resource type name is required.",
+                                Subject:  remain[0].SourceRange().Ptr(),
+                        })
+                case DataResourceMode:
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid address",
+                                Detail:   "A data source name is required.",
+                                Subject:  remain[0].SourceRange().Ptr(),
+                        })
+                default:
+                        panic("unknown mode")
+                }
+                return nil, diags
+        }
+
+        switch tt := remain[1].(type) {
+        case hcl.TraverseAttr:
+                name = tt.Name
+        default:
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "A resource name is required.",
+                        Subject:  remain[1].SourceRange().Ptr(),
+                })
+                return nil, diags
+        }
+
+        var subject Targetable
+        remain = remain[2:]
+        switch len(remain) {
+        case 0:
+                subject = path.Resource(mode, typeName, name)
+        case 1:
+                if tt, ok := remain[0].(hcl.TraverseIndex); ok {
+                        key, err := ParseInstanceKey(tt.Key)
+                        if err != nil {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid address",
+                                        Detail:   fmt.Sprintf("Invalid resource instance key: %s.", err),
+                                        Subject:  remain[0].SourceRange().Ptr(),
+                                })
+                                return nil, diags
+                        }
+
+                        subject = path.ResourceInstance(mode, typeName, name, key)
+                } else {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid address",
+                                Detail:   "Resource instance key must be given in square brackets.",
+                                Subject:  remain[0].SourceRange().Ptr(),
+                        })
+                        return nil, diags
+                }
+        default:
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "Unexpected extra operators after address.",
+                        Subject:  remain[1].SourceRange().Ptr(),
+                })
+                return nil, diags
+        }
+
+        return &Target{
+                Subject:     subject,
+                SourceRange: rng,
+        }, diags
+}
+
+// ParseTargetStr is a helper wrapper around ParseTarget that takes a string
+// and parses it with the HCL native syntax traversal parser before
+// interpreting it.
+//
+// This should be used only in specialized situations since it will cause the
+// created references to not have any meaningful source location information.
+// If a target string is coming from a source that should be identified in
+// error messages then the caller should instead parse it directly using a
+// suitable function from the HCL API and pass the traversal itself to
+// ParseTarget.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// the returned target may be nil or incomplete.
+func ParseTargetStr(str string) (*Target, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return nil, diags
+        }
+
+        target, targetDiags := ParseTarget(traversal)
+        diags = diags.Append(targetDiags)
+        return target, diags
+}
+
+// ParseAbsResource attempts to interpret the given traversal as an absolute
+// resource address, using the same syntax as expected by ParseTarget.
+//
+// If no error diagnostics are returned, the returned target includes the
+// address that was extracted and the source range it was extracted from.
+//
+// If error diagnostics are returned then the AbsResource value is invalid and
+// must not be used.
+func ParseAbsResource(traversal hcl.Traversal) (AbsResource, tfdiags.Diagnostics) {
+        addr, diags := ParseTarget(traversal)
+        if diags.HasErrors() {
+                return AbsResource{}, diags
+        }
+
+        switch tt := addr.Subject.(type) {
+
+        case AbsResource:
+                return tt, diags
+
+        case AbsResourceInstance: // Catch likely user error with specialized message
+                // Assume that the last element of the traversal must be the index,
+                // since that's required for a valid resource instance address.
+                indexStep := traversal[len(traversal)-1]
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "A resource address is required. This instance key identifies a specific resource instance, which is not expected here.",
+                        Subject:  indexStep.SourceRange().Ptr(),
+                })
+                return AbsResource{}, diags
+
+        case ModuleInstance: // Catch likely user error with specialized message
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "A resource address is required here. The module path must be followed by a resource specification.",
+                        Subject:  traversal.SourceRange().Ptr(),
+                })
+                return AbsResource{}, diags
+
+        default: // Generic message for other address types
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "A resource address is required here.",
+                        Subject:  traversal.SourceRange().Ptr(),
+                })
+                return AbsResource{}, diags
+
+        }
+}
+
+// ParseAbsResourceStr is a helper wrapper around ParseAbsResource that takes a
+// string and parses it with the HCL native syntax traversal parser before
+// interpreting it.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// the returned address may be incomplete.
+//
+// Since this function has no context about the source of the given string,
+// any returned diagnostics will not have meaningful source location
+// information.
+func ParseAbsResourceStr(str string) (AbsResource, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return AbsResource{}, diags
+        }
+
+        addr, addrDiags := ParseAbsResource(traversal)
+        diags = diags.Append(addrDiags)
+        return addr, diags
+}
+
+// ParseAbsResourceInstance attempts to interpret the given traversal as an
+// absolute resource instance address, using the same syntax as expected by
+// ParseTarget.
+//
+// If no error diagnostics are returned, the returned target includes the
+// address that was extracted and the source range it was extracted from.
+//
+// If error diagnostics are returned then the AbsResource value is invalid and
+// must not be used.
+func ParseAbsResourceInstance(traversal hcl.Traversal) (AbsResourceInstance, tfdiags.Diagnostics) {
+        addr, diags := ParseTarget(traversal)
+        if diags.HasErrors() {
+                return AbsResourceInstance{}, diags
+        }
+
+        switch tt := addr.Subject.(type) {
+
+        case AbsResource:
+                return tt.Instance(NoKey), diags
+
+        case AbsResourceInstance:
+                return tt, diags
+
+        case ModuleInstance: // Catch likely user error with specialized message
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "A resource instance address is required here. The module path must be followed by a resource instance specification.",
+                        Subject:  traversal.SourceRange().Ptr(),
+                })
+                return AbsResourceInstance{}, diags
+
+        default: // Generic message for other address types
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid address",
+                        Detail:   "A resource address is required here.",
+                        Subject:  traversal.SourceRange().Ptr(),
+                })
+                return AbsResourceInstance{}, diags
+
+        }
+}
+
+// ParseAbsResourceInstanceStr is a helper wrapper around
+// ParseAbsResourceInstance that takes a string and parses it with the HCL
+// native syntax traversal parser before interpreting it.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// the returned address may be incomplete.
+//
+// Since this function has no context about the source of the given string,
+// any returned diagnostics will not have meaningful source location
+// information.
+func ParseAbsResourceInstanceStr(str string) (AbsResourceInstance, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return AbsResourceInstance{}, diags
+        }
+
+        addr, addrDiags := ParseAbsResourceInstance(traversal)
+        diags = diags.Append(addrDiags)
+        return addr, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/path_attr.go b/vendor/github.com/hashicorp/terraform/addrs/path_attr.go
new file mode 100644
index 0000000..cfc13f4
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/path_attr.go
@@ -0,0 +1,12 @@
+package addrs
+
+// PathAttr is the address of an attribute of the "path" object in
+// the interpolation scope, like "path.module".
+type PathAttr struct {
+        referenceable
+        Name string
+}
+
+func (pa PathAttr) String() string {
+        return "path." + pa.Name
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/provider_config.go b/vendor/github.com/hashicorp/terraform/addrs/provider_config.go
new file mode 100644
index 0000000..340dd19
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/provider_config.go
@@ -0,0 +1,297 @@
+package addrs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/tfdiags"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+)
+
+// ProviderConfig is the address of a provider configuration.
+type ProviderConfig struct {
+        Type string
+
+        // If not empty, Alias identifies which non-default (aliased) provider
+        // configuration this address refers to.
+        Alias string
+}
+
+// NewDefaultProviderConfig returns the address of the default (un-aliased)
+// configuration for the provider with the given type name.
+func NewDefaultProviderConfig(typeName string) ProviderConfig {
+        return ProviderConfig{
+                Type: typeName,
+        }
+}
+
+// ParseProviderConfigCompact parses the given absolute traversal as a relative
+// provider address in compact form. The following are examples of traversals
+// that can be successfully parsed as compact relative provider configuration
+// addresses:
+//
+//     aws
+//     aws.foo
+//
+// This function will panic if given a relative traversal.
+//
+// If the returned diagnostics contains errors then the result value is invalid
+// and must not be used.
+func ParseProviderConfigCompact(traversal hcl.Traversal) (ProviderConfig, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        ret := ProviderConfig{
+                Type: traversal.RootName(),
+        }
+
+        if len(traversal) < 2 {
+                // Just a type name, then.
+                return ret, diags
+        }
+
+        aliasStep := traversal[1]
+        switch ts := aliasStep.(type) {
+        case hcl.TraverseAttr:
+                ret.Alias = ts.Name
+                return ret, diags
+        default:
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid provider configuration address",
+                        Detail:   "The provider type name must either stand alone or be followed by an alias name separated with a dot.",
+                        Subject:  aliasStep.SourceRange().Ptr(),
+                })
+        }
+
+        if len(traversal) > 2 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid provider configuration address",
+                        Detail:   "Extraneous extra operators after provider configuration address.",
+                        Subject:  traversal[2:].SourceRange().Ptr(),
+                })
+        }
+
+        return ret, diags
+}
+
+// ParseProviderConfigCompactStr is a helper wrapper around ParseProviderConfigCompact
+// that takes a string and parses it with the HCL native syntax traversal parser
+// before interpreting it.
+//
+// This should be used only in specialized situations since it will cause the
+// created references to not have any meaningful source location information.
+// If a reference string is coming from a source that should be identified in
+// error messages then the caller should instead parse it directly using a
+// suitable function from the HCL API and pass the traversal itself to
+// ParseProviderConfigCompact.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// then the returned address is invalid.
+func ParseProviderConfigCompactStr(str string) (ProviderConfig, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return ProviderConfig{}, diags
+        }
+
+        addr, addrDiags := ParseProviderConfigCompact(traversal)
+        diags = diags.Append(addrDiags)
+        return addr, diags
+}
+
+// Absolute returns an AbsProviderConfig from the receiver and the given module
+// instance address.
+func (pc ProviderConfig) Absolute(module ModuleInstance) AbsProviderConfig {
+        return AbsProviderConfig{
+                Module:         module,
+                ProviderConfig: pc,
+        }
+}
+
+func (pc ProviderConfig) String() string {
+        if pc.Type == "" {
+                // Should never happen; always indicates a bug
+                return "provider.<invalid>"
+        }
+
+        if pc.Alias != "" {
+                return fmt.Sprintf("provider.%s.%s", pc.Type, pc.Alias)
+        }
+
+        return "provider." + pc.Type
+}
+
+// StringCompact is an alternative to String that returns the form that can
+// be parsed by ParseProviderConfigCompact, without the "provider." prefix.
+func (pc ProviderConfig) StringCompact() string {
+        if pc.Alias != "" {
+                return fmt.Sprintf("%s.%s", pc.Type, pc.Alias)
+        }
+        return pc.Type
+}
+
+// AbsProviderConfig is the absolute address of a provider configuration
+// within a particular module instance.
+type AbsProviderConfig struct {
+        Module         ModuleInstance
+        ProviderConfig ProviderConfig
+}
+
+// ParseAbsProviderConfig parses the given traversal as an absolute provider
+// address. The following are examples of traversals that can be successfully
+// parsed as absolute provider configuration addresses:
+//
+//     provider.aws
+//     provider.aws.foo
+//     module.bar.provider.aws
+//     module.bar.module.baz.provider.aws.foo
+//     module.foo[1].provider.aws.foo
+//
+// This type of address is used, for example, to record the relationships
+// between resources and provider configurations in the state structure.
+// This type of address is not generally used in the UI, except in error
+// messages that refer to provider configurations.
+func ParseAbsProviderConfig(traversal hcl.Traversal) (AbsProviderConfig, tfdiags.Diagnostics) {
+        modInst, remain, diags := parseModuleInstancePrefix(traversal)
+        ret := AbsProviderConfig{
+                Module: modInst,
+        }
+        if len(remain) < 2 || remain.RootName() != "provider" {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid provider configuration address",
+                        Detail:   "Provider address must begin with \"provider.\", followed by a provider type name.",
+                        Subject:  remain.SourceRange().Ptr(),
+                })
+                return ret, diags
+        }
+        if len(remain) > 3 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid provider configuration address",
+                        Detail:   "Extraneous operators after provider configuration alias.",
+                        Subject:  hcl.Traversal(remain[3:]).SourceRange().Ptr(),
+                })
+                return ret, diags
+        }
+
+        if tt, ok := remain[1].(hcl.TraverseAttr); ok {
+                ret.ProviderConfig.Type = tt.Name
+        } else {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid provider configuration address",
+                        Detail:   "The prefix \"provider.\" must be followed by a provider type name.",
+                        Subject:  remain[1].SourceRange().Ptr(),
+                })
+                return ret, diags
+        }
+
+        if len(remain) == 3 {
+                if tt, ok := remain[2].(hcl.TraverseAttr); ok {
+                        ret.ProviderConfig.Alias = tt.Name
+                } else {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid provider configuration address",
+                                Detail:   "Provider type name must be followed by a configuration alias name.",
+                                Subject:  remain[2].SourceRange().Ptr(),
+                        })
+                        return ret, diags
+                }
+        }
+
+        return ret, diags
+}
+
+// ParseAbsProviderConfigStr is a helper wrapper around ParseAbsProviderConfig
+// that takes a string and parses it with the HCL native syntax traversal parser
+// before interpreting it.
+//
+// This should be used only in specialized situations since it will cause the
+// created references to not have any meaningful source location information.
+// If a reference string is coming from a source that should be identified in
+// error messages then the caller should instead parse it directly using a
+// suitable function from the HCL API and pass the traversal itself to
+// ParseAbsProviderConfig.
+//
+// Error diagnostics are returned if either the parsing fails or the analysis
+// of the traversal fails. There is no way for the caller to distinguish the
+// two kinds of diagnostics programmatically. If error diagnostics are returned
+// the returned address is invalid.
+func ParseAbsProviderConfigStr(str string) (AbsProviderConfig, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        traversal, parseDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(parseDiags)
+        if parseDiags.HasErrors() {
+                return AbsProviderConfig{}, diags
+        }
+
+        addr, addrDiags := ParseAbsProviderConfig(traversal)
+        diags = diags.Append(addrDiags)
+        return addr, diags
+}
+
+// ProviderConfigDefault returns the address of the default provider config
+// of the given type inside the recieving module instance.
+func (m ModuleInstance) ProviderConfigDefault(name string) AbsProviderConfig {
+        return AbsProviderConfig{
+                Module: m,
+                ProviderConfig: ProviderConfig{
+                        Type: name,
+                },
+        }
+}
+
+// ProviderConfigAliased returns the address of an aliased provider config
+// of with given type and alias inside the recieving module instance.
+func (m ModuleInstance) ProviderConfigAliased(name, alias string) AbsProviderConfig {
+        return AbsProviderConfig{
+                Module: m,
+                ProviderConfig: ProviderConfig{
+                        Type:  name,
+                        Alias: alias,
+                },
+        }
+}
+
+// Inherited returns an address that the receiving configuration address might
+// inherit from in a parent module. The second bool return value indicates if
+// such inheritance is possible, and thus whether the returned address is valid.
+//
+// Inheritance is possible only for default (un-aliased) providers in modules
+// other than the root module. Even if a valid address is returned, inheritence
+// may not be performed for other reasons, such as if the calling module
+// provided explicit provider configurations within the call for this module.
+// The ProviderTransformer graph transform in the main terraform module has
+// the authoritative logic for provider inheritance, and this method is here
+// mainly just for its benefit.
+func (pc AbsProviderConfig) Inherited() (AbsProviderConfig, bool) {
+        // Can't inherit if we're already in the root.
+        if len(pc.Module) == 0 {
+                return AbsProviderConfig{}, false
+        }
+
+        // Can't inherit if we have an alias.
+        if pc.ProviderConfig.Alias != "" {
+                return AbsProviderConfig{}, false
+        }
+
+        // Otherwise, we might inherit from a configuration with the same
+        // provider name in the parent module instance.
+        parentMod := pc.Module.Parent()
+        return pc.ProviderConfig.Absolute(parentMod), true
+}
+
+func (pc AbsProviderConfig) String() string {
+        if len(pc.Module) == 0 {
+                return pc.ProviderConfig.String()
+        }
+        return fmt.Sprintf("%s.%s", pc.Module.String(), pc.ProviderConfig.String())
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/referenceable.go b/vendor/github.com/hashicorp/terraform/addrs/referenceable.go
new file mode 100644
index 0000000..211083a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/referenceable.go
@@ -0,0 +1,20 @@
+package addrs
+
+// Referenceable is an interface implemented by all address types that can
+// appear as references in configuration language expressions.
+type Referenceable interface {
+        // All implementations of this interface must be covered by the type switch
+        // in lang.Scope.buildEvalContext.
+        referenceableSigil()
+
+        // String produces a string representation of the address that could be
+        // parsed as a HCL traversal and passed to ParseRef to produce an identical
+        // result.
+        String() string
+}
+
+type referenceable struct {
+}
+
+func (r referenceable) referenceableSigil() {
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/resource.go b/vendor/github.com/hashicorp/terraform/addrs/resource.go
new file mode 100644
index 0000000..2866770
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/resource.go
@@ -0,0 +1,270 @@
+package addrs
+
+import (
+        "fmt"
+        "strings"
+)
+
+// Resource is an address for a resource block within configuration, which
+// contains potentially-multiple resource instances if that configuration
+// block uses "count" or "for_each".
+type Resource struct {
+        referenceable
+        Mode ResourceMode
+        Type string
+        Name string
+}
+
+func (r Resource) String() string {
+        switch r.Mode {
+        case ManagedResourceMode:
+                return fmt.Sprintf("%s.%s", r.Type, r.Name)
+        case DataResourceMode:
+                return fmt.Sprintf("data.%s.%s", r.Type, r.Name)
+        default:
+                // Should never happen, but we'll return a string here rather than
+                // crashing just in case it does.
+                return fmt.Sprintf("<invalid>.%s.%s", r.Type, r.Name)
+        }
+}
+
+func (r Resource) Equal(o Resource) bool {
+        return r.String() == o.String()
+}
+
+// Instance produces the address for a specific instance of the receiver
+// that is idenfied by the given key.
+func (r Resource) Instance(key InstanceKey) ResourceInstance {
+        return ResourceInstance{
+                Resource: r,
+                Key:      key,
+        }
+}
+
+// Absolute returns an AbsResource from the receiver and the given module
+// instance address.
+func (r Resource) Absolute(module ModuleInstance) AbsResource {
+        return AbsResource{
+                Module:   module,
+                Resource: r,
+        }
+}
+
+// DefaultProviderConfig returns the address of the provider configuration
+// that should be used for the resource identified by the reciever if it
+// does not have a provider configuration address explicitly set in
+// configuration.
+//
+// This method is not able to verify that such a configuration exists, nor
+// represent the behavior of automatically inheriting certain provider
+// configurations from parent modules. It just does a static analysis of the
+// receiving address and returns an address to start from, relative to the
+// same module that contains the resource.
+func (r Resource) DefaultProviderConfig() ProviderConfig {
+        typeName := r.Type
+        if under := strings.Index(typeName, "_"); under != -1 {
+                typeName = typeName[:under]
+        }
+        return ProviderConfig{
+                Type: typeName,
+        }
+}
+
+// ResourceInstance is an address for a specific instance of a resource.
+// When a resource is defined in configuration with "count" or "for_each" it
+// produces zero or more instances, which can be addressed using this type.
+type ResourceInstance struct {
+        referenceable
+        Resource Resource
+        Key      InstanceKey
+}
+
+func (r ResourceInstance) ContainingResource() Resource {
+        return r.Resource
+}
+
+func (r ResourceInstance) String() string {
+        if r.Key == NoKey {
+                return r.Resource.String()
+        }
+        return r.Resource.String() + r.Key.String()
+}
+
+func (r ResourceInstance) Equal(o ResourceInstance) bool {
+        return r.String() == o.String()
+}
+
+// Absolute returns an AbsResourceInstance from the receiver and the given module
+// instance address.
+func (r ResourceInstance) Absolute(module ModuleInstance) AbsResourceInstance {
+        return AbsResourceInstance{
+                Module:   module,
+                Resource: r,
+        }
+}
+
+// AbsResource is an absolute address for a resource under a given module path.
+type AbsResource struct {
+        targetable
+        Module   ModuleInstance
+        Resource Resource
+}
+
+// Resource returns the address of a particular resource within the receiver.
+func (m ModuleInstance) Resource(mode ResourceMode, typeName string, name string) AbsResource {
+        return AbsResource{
+                Module: m,
+                Resource: Resource{
+                        Mode: mode,
+                        Type: typeName,
+                        Name: name,
+                },
+        }
+}
+
+// Instance produces the address for a specific instance of the receiver
+// that is idenfied by the given key.
+func (r AbsResource) Instance(key InstanceKey) AbsResourceInstance {
+        return AbsResourceInstance{
+                Module:   r.Module,
+                Resource: r.Resource.Instance(key),
+        }
+}
+
+// TargetContains implements Targetable by returning true if the given other
+// address is either equal to the receiver or is an instance of the
+// receiver.
+func (r AbsResource) TargetContains(other Targetable) bool {
+        switch to := other.(type) {
+
+        case AbsResource:
+                // We'll use our stringification as a cheat-ish way to test for equality.
+                return to.String() == r.String()
+
+        case AbsResourceInstance:
+                return r.TargetContains(to.ContainingResource())
+
+        default:
+                return false
+
+        }
+}
+
+func (r AbsResource) String() string {
+        if len(r.Module) == 0 {
+                return r.Resource.String()
+        }
+        return fmt.Sprintf("%s.%s", r.Module.String(), r.Resource.String())
+}
+
+func (r AbsResource) Equal(o AbsResource) bool {
+        return r.String() == o.String()
+}
+
+// AbsResourceInstance is an absolute address for a resource instance under a
+// given module path.
+type AbsResourceInstance struct {
+        targetable
+        Module   ModuleInstance
+        Resource ResourceInstance
+}
+
+// ResourceInstance returns the address of a particular resource instance within the receiver.
+func (m ModuleInstance) ResourceInstance(mode ResourceMode, typeName string, name string, key InstanceKey) AbsResourceInstance {
+        return AbsResourceInstance{
+                Module: m,
+                Resource: ResourceInstance{
+                        Resource: Resource{
+                                Mode: mode,
+                                Type: typeName,
+                                Name: name,
+                        },
+                        Key: key,
+                },
+        }
+}
+
+// ContainingResource returns the address of the resource that contains the
+// receving resource instance. In other words, it discards the key portion
+// of the address to produce an AbsResource value.
+func (r AbsResourceInstance) ContainingResource() AbsResource {
+        return AbsResource{
+                Module:   r.Module,
+                Resource: r.Resource.ContainingResource(),
+        }
+}
+
+// TargetContains implements Targetable by returning true if the given other
+// address is equal to the receiver.
+func (r AbsResourceInstance) TargetContains(other Targetable) bool {
+        switch to := other.(type) {
+
+        case AbsResourceInstance:
+                // We'll use our stringification as a cheat-ish way to test for equality.
+                return to.String() == r.String()
+
+        default:
+                return false
+
+        }
+}
+
+func (r AbsResourceInstance) String() string {
+        if len(r.Module) == 0 {
+                return r.Resource.String()
+        }
+        return fmt.Sprintf("%s.%s", r.Module.String(), r.Resource.String())
+}
+
+func (r AbsResourceInstance) Equal(o AbsResourceInstance) bool {
+        return r.String() == o.String()
+}
+
+// Less returns true if the receiver should sort before the given other value
+// in a sorted list of addresses.
+func (r AbsResourceInstance) Less(o AbsResourceInstance) bool {
+        switch {
+
+        case len(r.Module) != len(o.Module):
+                return len(r.Module) < len(o.Module)
+
+        case r.Module.String() != o.Module.String():
+                return r.Module.Less(o.Module)
+
+        case r.Resource.Resource.Mode != o.Resource.Resource.Mode:
+                return r.Resource.Resource.Mode == DataResourceMode
+
+        case r.Resource.Resource.Type != o.Resource.Resource.Type:
+                return r.Resource.Resource.Type < o.Resource.Resource.Type
+
+        case r.Resource.Resource.Name != o.Resource.Resource.Name:
+                return r.Resource.Resource.Name < o.Resource.Resource.Name
+
+        case r.Resource.Key != o.Resource.Key:
+                return InstanceKeyLess(r.Resource.Key, o.Resource.Key)
+
+        default:
+                return false
+
+        }
+}
+
+// ResourceMode defines which lifecycle applies to a given resource. Each
+// resource lifecycle has a slightly different address format.
+type ResourceMode rune
+
+//go:generate stringer -type ResourceMode
+
+const (
+        // InvalidResourceMode is the zero value of ResourceMode and is not
+        // a valid resource mode.
+        InvalidResourceMode ResourceMode = 0
+
+        // ManagedResourceMode indicates a managed resource, as defined by
+        // "resource" blocks in configuration.
+        ManagedResourceMode ResourceMode = 'M'
+
+        // DataResourceMode indicates a data resource, as defined by
+        // "data" blocks in configuration.
+        DataResourceMode ResourceMode = 'D'
+)
diff --git a/vendor/github.com/hashicorp/terraform/addrs/resource_phase.go b/vendor/github.com/hashicorp/terraform/addrs/resource_phase.go
new file mode 100644
index 0000000..9bdbdc4
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/resource_phase.go
@@ -0,0 +1,105 @@
+package addrs
+
+import "fmt"
+
+// ResourceInstancePhase is a special kind of reference used only internally
+// during graph building to represent resource instances that are in a
+// non-primary state.
+//
+// Graph nodes can declare themselves referenceable via an instance phase
+// or can declare that they reference an instance phase in order to accomodate
+// secondary graph nodes dealing with, for example, destroy actions.
+//
+// This special reference type cannot be accessed directly by end-users, and
+// should never be shown in the UI.
+type ResourceInstancePhase struct {
+        referenceable
+        ResourceInstance ResourceInstance
+        Phase            ResourceInstancePhaseType
+}
+
+var _ Referenceable = ResourceInstancePhase{}
+
+// Phase returns a special "phase address" for the receving instance. See the
+// documentation of ResourceInstancePhase for the limited situations where this
+// is intended to be used.
+func (r ResourceInstance) Phase(rpt ResourceInstancePhaseType) ResourceInstancePhase {
+        return ResourceInstancePhase{
+                ResourceInstance: r,
+                Phase:            rpt,
+        }
+}
+
+// ContainingResource returns an address for the same phase of the resource
+// that this instance belongs to.
+func (rp ResourceInstancePhase) ContainingResource() ResourcePhase {
+        return rp.ResourceInstance.Resource.Phase(rp.Phase)
+}
+
+func (rp ResourceInstancePhase) String() string {
+        // We use a different separator here than usual to ensure that we'll
+        // never conflict with any non-phased resource instance string. This
+        // is intentionally something that would fail parsing with ParseRef,
+        // because this special address type should never be exposed in the UI.
+        return fmt.Sprintf("%s#%s", rp.ResourceInstance, rp.Phase)
+}
+
+// ResourceInstancePhaseType is an enumeration used with ResourceInstancePhase.
+type ResourceInstancePhaseType string
+
+const (
+        // ResourceInstancePhaseDestroy represents the "destroy" phase of a
+        // resource instance.
+        ResourceInstancePhaseDestroy ResourceInstancePhaseType = "destroy"
+
+        // ResourceInstancePhaseDestroyCBD is similar to ResourceInstancePhaseDestroy
+        // but is used for resources that have "create_before_destroy" set, thus
+        // requiring a different dependency ordering.
+        ResourceInstancePhaseDestroyCBD ResourceInstancePhaseType = "destroy-cbd"
+)
+
+func (rpt ResourceInstancePhaseType) String() string {
+        return string(rpt)
+}
+
+// ResourcePhase is a special kind of reference used only internally
+// during graph building to represent resources that are in a
+// non-primary state.
+//
+// Graph nodes can declare themselves referenceable via a resource phase
+// or can declare that they reference a resource phase in order to accomodate
+// secondary graph nodes dealing with, for example, destroy actions.
+//
+// Since resources (as opposed to instances) aren't actually phased, this
+// address type is used only as an approximation during initial construction
+// of the resource-oriented plan graph, under the assumption that resource
+// instances with ResourceInstancePhase addresses will be created in dynamic
+// subgraphs during the graph walk.
+//
+// This special reference type cannot be accessed directly by end-users, and
+// should never be shown in the UI.
+type ResourcePhase struct {
+        referenceable
+        Resource Resource
+        Phase    ResourceInstancePhaseType
+}
+
+var _ Referenceable = ResourcePhase{}
+
+// Phase returns a special "phase address" for the receving instance. See the
+// documentation of ResourceInstancePhase for the limited situations where this
+// is intended to be used.
+func (r Resource) Phase(rpt ResourceInstancePhaseType) ResourcePhase {
+        return ResourcePhase{
+                Resource: r,
+                Phase:    rpt,
+        }
+}
+
+func (rp ResourcePhase) String() string {
+        // We use a different separator here than usual to ensure that we'll
+        // never conflict with any non-phased resource instance string. This
+        // is intentionally something that would fail parsing with ParseRef,
+        // because this special address type should never be exposed in the UI.
+        return fmt.Sprintf("%s#%s", rp.Resource, rp.Phase)
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/resourcemode_string.go b/vendor/github.com/hashicorp/terraform/addrs/resourcemode_string.go
new file mode 100644
index 0000000..0b5c33f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/resourcemode_string.go
@@ -0,0 +1,33 @@
+// Code generated by "stringer -type ResourceMode"; DO NOT EDIT.
+
+package addrs
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[InvalidResourceMode-0]
+        _ = x[ManagedResourceMode-77]
+        _ = x[DataResourceMode-68]
+}
+
+const (
+        _ResourceMode_name_0 = "InvalidResourceMode"
+        _ResourceMode_name_1 = "DataResourceMode"
+        _ResourceMode_name_2 = "ManagedResourceMode"
+)
+
+func (i ResourceMode) String() string {
+        switch {
+        case i == 0:
+                return _ResourceMode_name_0
+        case i == 68:
+                return _ResourceMode_name_1
+        case i == 77:
+                return _ResourceMode_name_2
+        default:
+                return "ResourceMode(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/self.go b/vendor/github.com/hashicorp/terraform/addrs/self.go
new file mode 100644
index 0000000..7f24eaf
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/self.go
@@ -0,0 +1,14 @@
+package addrs
+
+// Self is the address of the special object "self" that behaves as an alias
+// for a containing object currently in scope.
+const Self selfT = 0
+
+type selfT int
+
+func (s selfT) referenceableSigil() {
+}
+
+func (s selfT) String() string {
+        return "self"
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/targetable.go b/vendor/github.com/hashicorp/terraform/addrs/targetable.go
new file mode 100644
index 0000000..16819a5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/targetable.go
@@ -0,0 +1,26 @@
+package addrs
+
+// Targetable is an interface implemented by all address types that can be
+// used as "targets" for selecting sub-graphs of a graph.
+type Targetable interface {
+        targetableSigil()
+
+        // TargetContains returns true if the receiver is considered to contain
+        // the given other address. Containment, for the purpose of targeting,
+        // means that if a container address is targeted then all of the
+        // addresses within it are also implicitly targeted.
+        //
+        // A targetable address always contains at least itself.
+        TargetContains(other Targetable) bool
+
+        // String produces a string representation of the address that could be
+        // parsed as a HCL traversal and passed to ParseTarget to produce an
+        // identical result.
+        String() string
+}
+
+type targetable struct {
+}
+
+func (r targetable) targetableSigil() {
+}
diff --git a/vendor/github.com/hashicorp/terraform/addrs/terraform_attr.go b/vendor/github.com/hashicorp/terraform/addrs/terraform_attr.go
new file mode 100644
index 0000000..a880182
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/addrs/terraform_attr.go
@@ -0,0 +1,12 @@
+package addrs
+
+// TerraformAttr is the address of an attribute of the "terraform" object in
+// the interpolation scope, like "terraform.workspace".
+type TerraformAttr struct {
+        referenceable
+        Name string
+}
+
+func (ta TerraformAttr) String() string {
+        return "terraform." + ta.Name
+}
diff --git a/vendor/github.com/hashicorp/terraform/command/format/diagnostic.go b/vendor/github.com/hashicorp/terraform/command/format/diagnostic.go
new file mode 100644
index 0000000..3dd9238
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/command/format/diagnostic.go
@@ -0,0 +1,295 @@
+package format
+
+import (
+        "bufio"
+        "bytes"
+        "fmt"
+        "sort"
+        "strings"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcled"
+        "github.com/hashicorp/hcl2/hclparse"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/mitchellh/colorstring"
+        wordwrap "github.com/mitchellh/go-wordwrap"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Diagnostic formats a single diagnostic message.
+//
+// The width argument specifies at what column the diagnostic messages will
+// be wrapped. If set to zero, messages will not be wrapped by this function
+// at all. Although the long-form text parts of the message are wrapped,
+// not all aspects of the message are guaranteed to fit within the specified
+// terminal width.
+func Diagnostic(diag tfdiags.Diagnostic, sources map[string][]byte, color *colorstring.Colorize, width int) string {
+        if diag == nil {
+                // No good reason to pass a nil diagnostic in here...
+                return ""
+        }
+
+        var buf bytes.Buffer
+
+        switch diag.Severity() {
+        case tfdiags.Error:
+                buf.WriteString(color.Color("\n[bold][red]Error: [reset]"))
+        case tfdiags.Warning:
+                buf.WriteString(color.Color("\n[bold][yellow]Warning: [reset]"))
+        default:
+                // Clear out any coloring that might be applied by Terraform's UI helper,
+                // so our result is not context-sensitive.
+                buf.WriteString(color.Color("\n[reset]"))
+        }
+
+        desc := diag.Description()
+        sourceRefs := diag.Source()
+
+        // We don't wrap the summary, since we expect it to be terse, and since
+        // this is where we put the text of a native Go error it may not always
+        // be pure text that lends itself well to word-wrapping.
+        fmt.Fprintf(&buf, color.Color("[bold]%s[reset]\n\n"), desc.Summary)
+
+        if sourceRefs.Subject != nil {
+                // We'll borrow HCL's range implementation here, because it has some
+                // handy features to help us produce a nice source code snippet.
+                highlightRange := sourceRefs.Subject.ToHCL()
+                snippetRange := highlightRange
+                if sourceRefs.Context != nil {
+                        snippetRange = sourceRefs.Context.ToHCL()
+                }
+
+                // Make sure the snippet includes the highlight. This should be true
+                // for any reasonable diagnostic, but we'll make sure.
+                snippetRange = hcl.RangeOver(snippetRange, highlightRange)
+                if snippetRange.Empty() {
+                        snippetRange.End.Byte++
+                        snippetRange.End.Column++
+                }
+                if highlightRange.Empty() {
+                        highlightRange.End.Byte++
+                        highlightRange.End.Column++
+                }
+
+                var src []byte
+                if sources != nil {
+                        src = sources[snippetRange.Filename]
+                }
+                if src == nil {
+                        // This should generally not happen, as long as sources are always
+                        // loaded through the main loader. We may load things in other
+                        // ways in weird cases, so we'll tolerate it at the expense of
+                        // a not-so-helpful error message.
+                        fmt.Fprintf(&buf, "  on %s line %d:\n  (source code not available)\n", highlightRange.Filename, highlightRange.Start.Line)
+                } else {
+                        file, offset := parseRange(src, highlightRange)
+
+                        headerRange := highlightRange
+
+                        contextStr := hcled.ContextString(file, offset-1)
+                        if contextStr != "" {
+                                contextStr = ", in " + contextStr
+                        }
+
+                        fmt.Fprintf(&buf, "  on %s line %d%s:\n", headerRange.Filename, headerRange.Start.Line, contextStr)
+
+                        // Config snippet rendering
+                        sc := hcl.NewRangeScanner(src, highlightRange.Filename, bufio.ScanLines)
+                        for sc.Scan() {
+                                lineRange := sc.Range()
+                                if !lineRange.Overlaps(snippetRange) {
+                                        continue
+                                }
+                                beforeRange, highlightedRange, afterRange := lineRange.PartitionAround(highlightRange)
+                                before := beforeRange.SliceBytes(src)
+                                highlighted := highlightedRange.SliceBytes(src)
+                                after := afterRange.SliceBytes(src)
+                                fmt.Fprintf(
+                                        &buf, color.Color("%4d: %s[underline]%s[reset]%s\n"),
+                                        lineRange.Start.Line,
+                                        before, highlighted, after,
+                                )
+                        }
+
+                }
+
+                if fromExpr := diag.FromExpr(); fromExpr != nil {
+                        // We may also be able to generate information about the dynamic
+                        // values of relevant variables at the point of evaluation, then.
+                        // This is particularly useful for expressions that get evaluated
+                        // multiple times with different values, such as blocks using
+                        // "count" and "for_each", or within "for" expressions.
+                        expr := fromExpr.Expression
+                        ctx := fromExpr.EvalContext
+                        vars := expr.Variables()
+                        stmts := make([]string, 0, len(vars))
+                        seen := make(map[string]struct{}, len(vars))
+                Traversals:
+                        for _, traversal := range vars {
+                                for len(traversal) > 1 {
+                                        val, diags := traversal.TraverseAbs(ctx)
+                                        if diags.HasErrors() {
+                                                // Skip anything that generates errors, since we probably
+                                                // already have the same error in our diagnostics set
+                                                // already.
+                                                traversal = traversal[:len(traversal)-1]
+                                                continue
+                                        }
+
+                                        traversalStr := traversalStr(traversal)
+                                        if _, exists := seen[traversalStr]; exists {
+                                                continue Traversals // don't show duplicates when the same variable is referenced multiple times
+                                        }
+                                        switch {
+                                        case !val.IsKnown():
+                                                // Can't say anything about this yet, then.
+                                                continue Traversals
+                                        case val.IsNull():
+                                                stmts = append(stmts, fmt.Sprintf(color.Color("[bold]%s[reset] is null"), traversalStr))
+                                        default:
+                                                stmts = append(stmts, fmt.Sprintf(color.Color("[bold]%s[reset] is %s"), traversalStr, compactValueStr(val)))
+                                        }
+                                        seen[traversalStr] = struct{}{}
+                                }
+                        }
+
+                        sort.Strings(stmts) // FIXME: Should maybe use a traversal-aware sort that can sort numeric indexes properly?
+
+                        if len(stmts) > 0 {
+                                fmt.Fprint(&buf, color.Color("    [dark_gray]|----------------[reset]\n"))
+                        }
+                        for _, stmt := range stmts {
+                                fmt.Fprintf(&buf, color.Color("    [dark_gray]|[reset] %s\n"), stmt)
+                        }
+                }
+
+                buf.WriteByte('\n')
+        }
+
+        if desc.Detail != "" {
+                detail := desc.Detail
+                if width != 0 {
+                        detail = wordwrap.WrapString(detail, uint(width))
+                }
+                fmt.Fprintf(&buf, "%s\n", detail)
+        }
+
+        return buf.String()
+}
+
+func parseRange(src []byte, rng hcl.Range) (*hcl.File, int) {
+        filename := rng.Filename
+        offset := rng.Start.Byte
+
+        // We need to re-parse here to get a *hcl.File we can interrogate. This
+        // is not awesome since we presumably already parsed the file earlier too,
+        // but this re-parsing is architecturally simpler than retaining all of
+        // the hcl.File objects and we only do this in the case of an error anyway
+        // so the overhead here is not a big problem.
+        parser := hclparse.NewParser()
+        var file *hcl.File
+        var diags hcl.Diagnostics
+        if strings.HasSuffix(filename, ".json") {
+                file, diags = parser.ParseJSON(src, filename)
+        } else {
+                file, diags = parser.ParseHCL(src, filename)
+        }
+        if diags.HasErrors() {
+                return file, offset
+        }
+
+        return file, offset
+}
+
+// traversalStr produces a representation of an HCL traversal that is compact,
+// resembles HCL native syntax, and is suitable for display in the UI.
+func traversalStr(traversal hcl.Traversal) string {
+        // This is a specialized subset of traversal rendering tailored to
+        // producing helpful contextual messages in diagnostics. It is not
+        // comprehensive nor intended to be used for other purposes.
+
+        var buf bytes.Buffer
+        for _, step := range traversal {
+                switch tStep := step.(type) {
+                case hcl.TraverseRoot:
+                        buf.WriteString(tStep.Name)
+                case hcl.TraverseAttr:
+                        buf.WriteByte('.')
+                        buf.WriteString(tStep.Name)
+                case hcl.TraverseIndex:
+                        buf.WriteByte('[')
+                        if keyTy := tStep.Key.Type(); keyTy.IsPrimitiveType() {
+                                buf.WriteString(compactValueStr(tStep.Key))
+                        } else {
+                                // We'll just use a placeholder for more complex values,
+                                // since otherwise our result could grow ridiculously long.
+                                buf.WriteString("...")
+                        }
+                        buf.WriteByte(']')
+                }
+        }
+        return buf.String()
+}
+
+// compactValueStr produces a compact, single-line summary of a given value
+// that is suitable for display in the UI.
+//
+// For primitives it returns a full representation, while for more complex
+// types it instead summarizes the type, size, etc to produce something
+// that is hopefully still somewhat useful but not as verbose as a rendering
+// of the entire data structure.
+func compactValueStr(val cty.Value) string {
+        // This is a specialized subset of value rendering tailored to producing
+        // helpful but concise messages in diagnostics. It is not comprehensive
+        // nor intended to be used for other purposes.
+
+        ty := val.Type()
+        switch {
+        case val.IsNull():
+                return "null"
+        case !val.IsKnown():
+                // Should never happen here because we should filter before we get
+                // in here, but we'll do something reasonable rather than panic.
+                return "(not yet known)"
+        case ty == cty.Bool:
+                if val.True() {
+                        return "true"
+                }
+                return "false"
+        case ty == cty.Number:
+                bf := val.AsBigFloat()
+                return bf.Text('g', 10)
+        case ty == cty.String:
+                // Go string syntax is not exactly the same as HCL native string syntax,
+                // but we'll accept the minor edge-cases where this is different here
+                // for now, just to get something reasonable here.
+                return fmt.Sprintf("%q", val.AsString())
+        case ty.IsCollectionType() || ty.IsTupleType():
+                l := val.LengthInt()
+                switch l {
+                case 0:
+                        return "empty " + ty.FriendlyName()
+                case 1:
+                        return ty.FriendlyName() + " with 1 element"
+                default:
+                        return fmt.Sprintf("%s with %d elements", ty.FriendlyName(), l)
+                }
+        case ty.IsObjectType():
+                atys := ty.AttributeTypes()
+                l := len(atys)
+                switch l {
+                case 0:
+                        return "object with no attributes"
+                case 1:
+                        var name string
+                        for k := range atys {
+                                name = k
+                        }
+                        return fmt.Sprintf("object with 1 attribute %q", name)
+                default:
+                        return fmt.Sprintf("object with %d attributes", l)
+                }
+        default:
+                return ty.FriendlyName()
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/command/format/diff.go b/vendor/github.com/hashicorp/terraform/command/format/diff.go
new file mode 100644
index 0000000..c726f0e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/command/format/diff.go
@@ -0,0 +1,1192 @@
+package format
+
+import (
+        "bufio"
+        "bytes"
+        "fmt"
+        "sort"
+        "strings"
+
+        "github.com/mitchellh/colorstring"
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/plans/objchange"
+        "github.com/hashicorp/terraform/states"
+)
+
+// ResourceChange returns a string representation of a change to a particular
+// resource, for inclusion in user-facing plan output.
+//
+// The resource schema must be provided along with the change so that the
+// formatted change can reflect the configuration structure for the associated
+// resource.
+//
+// If "color" is non-nil, it will be used to color the result. Otherwise,
+// no color codes will be included.
+func ResourceChange(
+        change *plans.ResourceInstanceChangeSrc,
+        tainted bool,
+        schema *configschema.Block,
+        color *colorstring.Colorize,
+) string {
+        addr := change.Addr
+        var buf bytes.Buffer
+
+        if color == nil {
+                color = &colorstring.Colorize{
+                        Colors:  colorstring.DefaultColors,
+                        Disable: true,
+                        Reset:   false,
+                }
+        }
+
+        dispAddr := addr.String()
+        if change.DeposedKey != states.NotDeposed {
+                dispAddr = fmt.Sprintf("%s (deposed object %s)", dispAddr, change.DeposedKey)
+        }
+
+        switch change.Action {
+        case plans.Create:
+                buf.WriteString(color.Color(fmt.Sprintf("[bold]  # %s[reset] will be created", dispAddr)))
+        case plans.Read:
+                buf.WriteString(color.Color(fmt.Sprintf("[bold]  # %s[reset] will be read during apply\n  # (config refers to values not yet known)", dispAddr)))
+        case plans.Update:
+                buf.WriteString(color.Color(fmt.Sprintf("[bold]  # %s[reset] will be updated in-place", dispAddr)))
+        case plans.CreateThenDelete, plans.DeleteThenCreate:
+                if tainted {
+                        buf.WriteString(color.Color(fmt.Sprintf("[bold]  # %s[reset] is tainted, so must be [bold][red]replaced", dispAddr)))
+                } else {
+                        buf.WriteString(color.Color(fmt.Sprintf("[bold]  # %s[reset] must be [bold][red]replaced", dispAddr)))
+                }
+        case plans.Delete:
+                buf.WriteString(color.Color(fmt.Sprintf("[bold]  # %s[reset] will be [bold][red]destroyed", dispAddr)))
+        default:
+                // should never happen, since the above is exhaustive
+                buf.WriteString(fmt.Sprintf("%s has an action the plan renderer doesn't support (this is a bug)", dispAddr))
+        }
+        buf.WriteString(color.Color("[reset]\n"))
+
+        switch change.Action {
+        case plans.Create:
+                buf.WriteString(color.Color("[green]  +[reset] "))
+        case plans.Read:
+                buf.WriteString(color.Color("[cyan] <=[reset] "))
+        case plans.Update:
+                buf.WriteString(color.Color("[yellow]  ~[reset] "))
+        case plans.DeleteThenCreate:
+                buf.WriteString(color.Color("[red]-[reset]/[green]+[reset] "))
+        case plans.CreateThenDelete:
+                buf.WriteString(color.Color("[green]+[reset]/[red]-[reset] "))
+        case plans.Delete:
+                buf.WriteString(color.Color("[red]  -[reset] "))
+        default:
+                buf.WriteString(color.Color("??? "))
+        }
+
+        switch addr.Resource.Resource.Mode {
+        case addrs.ManagedResourceMode:
+                buf.WriteString(fmt.Sprintf(
+                        "resource %q %q",
+                        addr.Resource.Resource.Type,
+                        addr.Resource.Resource.Name,
+                ))
+        case addrs.DataResourceMode:
+                buf.WriteString(fmt.Sprintf(
+                        "data %q %q ",
+                        addr.Resource.Resource.Type,
+                        addr.Resource.Resource.Name,
+                ))
+        default:
+                // should never happen, since the above is exhaustive
+                buf.WriteString(addr.String())
+        }
+
+        buf.WriteString(" {")
+
+        p := blockBodyDiffPrinter{
+                buf:             &buf,
+                color:           color,
+                action:          change.Action,
+                requiredReplace: change.RequiredReplace,
+        }
+
+        // Most commonly-used resources have nested blocks that result in us
+        // going at least three traversals deep while we recurse here, so we'll
+        // start with that much capacity and then grow as needed for deeper
+        // structures.
+        path := make(cty.Path, 0, 3)
+
+        changeV, err := change.Decode(schema.ImpliedType())
+        if err != nil {
+                // Should never happen in here, since we've already been through
+                // loads of layers of encode/decode of the planned changes before now.
+                panic(fmt.Sprintf("failed to decode plan for %s while rendering diff: %s", addr, err))
+        }
+
+        // We currently have an opt-out that permits the legacy SDK to return values
+        // that defy our usual conventions around handling of nesting blocks. To
+        // avoid the rendering code from needing to handle all of these, we'll
+        // normalize first.
+        // (Ideally we'd do this as part of the SDK opt-out implementation in core,
+        // but we've added it here for now to reduce risk of unexpected impacts
+        // on other code in core.)
+        changeV.Change.Before = objchange.NormalizeObjectFromLegacySDK(changeV.Change.Before, schema)
+        changeV.Change.After = objchange.NormalizeObjectFromLegacySDK(changeV.Change.After, schema)
+
+        bodyWritten := p.writeBlockBodyDiff(schema, changeV.Before, changeV.After, 6, path)
+        if bodyWritten {
+                buf.WriteString("\n")
+                buf.WriteString(strings.Repeat(" ", 4))
+        }
+        buf.WriteString("}\n")
+
+        return buf.String()
+}
+
+type blockBodyDiffPrinter struct {
+        buf             *bytes.Buffer
+        color           *colorstring.Colorize
+        action          plans.Action
+        requiredReplace cty.PathSet
+}
+
+const forcesNewResourceCaption = " [red]# forces replacement[reset]"
+
+// writeBlockBodyDiff writes attribute or block differences
+// and returns true if any differences were found and written
+func (p *blockBodyDiffPrinter) writeBlockBodyDiff(schema *configschema.Block, old, new cty.Value, indent int, path cty.Path) bool {
+        path = ctyEnsurePathCapacity(path, 1)
+
+        bodyWritten := false
+        blankBeforeBlocks := false
+        {
+                attrNames := make([]string, 0, len(schema.Attributes))
+                attrNameLen := 0
+                for name := range schema.Attributes {
+                        oldVal := ctyGetAttrMaybeNull(old, name)
+                        newVal := ctyGetAttrMaybeNull(new, name)
+                        if oldVal.IsNull() && newVal.IsNull() {
+                                // Skip attributes where both old and new values are null
+                                // (we do this early here so that we'll do our value alignment
+                                // based on the longest attribute name that has a change, rather
+                                // than the longest attribute name in the full set.)
+                                continue
+                        }
+
+                        attrNames = append(attrNames, name)
+                        if len(name) > attrNameLen {
+                                attrNameLen = len(name)
+                        }
+                }
+                sort.Strings(attrNames)
+                if len(attrNames) > 0 {
+                        blankBeforeBlocks = true
+                }
+
+                for _, name := range attrNames {
+                        attrS := schema.Attributes[name]
+                        oldVal := ctyGetAttrMaybeNull(old, name)
+                        newVal := ctyGetAttrMaybeNull(new, name)
+
+                        bodyWritten = true
+                        p.writeAttrDiff(name, attrS, oldVal, newVal, attrNameLen, indent, path)
+                }
+        }
+
+        {
+                blockTypeNames := make([]string, 0, len(schema.BlockTypes))
+                for name := range schema.BlockTypes {
+                        blockTypeNames = append(blockTypeNames, name)
+                }
+                sort.Strings(blockTypeNames)
+
+                for _, name := range blockTypeNames {
+                        blockS := schema.BlockTypes[name]
+                        oldVal := ctyGetAttrMaybeNull(old, name)
+                        newVal := ctyGetAttrMaybeNull(new, name)
+
+                        bodyWritten = true
+                        p.writeNestedBlockDiffs(name, blockS, oldVal, newVal, blankBeforeBlocks, indent, path)
+
+                        // Always include a blank for any subsequent block types.
+                        blankBeforeBlocks = true
+                }
+        }
+
+        return bodyWritten
+}
+
+func (p *blockBodyDiffPrinter) writeAttrDiff(name string, attrS *configschema.Attribute, old, new cty.Value, nameLen, indent int, path cty.Path) {
+        path = append(path, cty.GetAttrStep{Name: name})
+        p.buf.WriteString("\n")
+        p.buf.WriteString(strings.Repeat(" ", indent))
+        showJustNew := false
+        var action plans.Action
+        switch {
+        case old.IsNull():
+                action = plans.Create
+                showJustNew = true
+        case new.IsNull():
+                action = plans.Delete
+        case ctyEqualWithUnknown(old, new):
+                action = plans.NoOp
+                showJustNew = true
+        default:
+                action = plans.Update
+        }
+
+        p.writeActionSymbol(action)
+
+        p.buf.WriteString(p.color.Color("[bold]"))
+        p.buf.WriteString(name)
+        p.buf.WriteString(p.color.Color("[reset]"))
+        p.buf.WriteString(strings.Repeat(" ", nameLen-len(name)))
+        p.buf.WriteString(" = ")
+
+        if attrS.Sensitive {
+                p.buf.WriteString("(sensitive value)")
+        } else {
+                switch {
+                case showJustNew:
+                        p.writeValue(new, action, indent+2)
+                        if p.pathForcesNewResource(path) {
+                                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+                        }
+                default:
+                        // We show new even if it is null to emphasize the fact
+                        // that it is being unset, since otherwise it is easy to
+                        // misunderstand that the value is still set to the old value.
+                        p.writeValueDiff(old, new, indent+2, path)
+                }
+        }
+}
+
+func (p *blockBodyDiffPrinter) writeNestedBlockDiffs(name string, blockS *configschema.NestedBlock, old, new cty.Value, blankBefore bool, indent int, path cty.Path) {
+        path = append(path, cty.GetAttrStep{Name: name})
+        if old.IsNull() && new.IsNull() {
+                // Nothing to do if both old and new is null
+                return
+        }
+
+        // Where old/new are collections representing a nesting mode other than
+        // NestingSingle, we assume the collection value can never be unknown
+        // since we always produce the container for the nested objects, even if
+        // the objects within are computed.
+
+        switch blockS.Nesting {
+        case configschema.NestingSingle, configschema.NestingGroup:
+                var action plans.Action
+                eqV := new.Equals(old)
+                switch {
+                case old.IsNull():
+                        action = plans.Create
+                case new.IsNull():
+                        action = plans.Delete
+                case !new.IsWhollyKnown() || !old.IsWhollyKnown():
+                        // "old" should actually always be known due to our contract
+                        // that old values must never be unknown, but we'll allow it
+                        // anyway to be robust.
+                        action = plans.Update
+                case !eqV.IsKnown() || !eqV.True():
+                        action = plans.Update
+                }
+
+                if blankBefore {
+                        p.buf.WriteRune('\n')
+                }
+                p.writeNestedBlockDiff(name, nil, &blockS.Block, action, old, new, indent, path)
+        case configschema.NestingList:
+                // For the sake of handling nested blocks, we'll treat a null list
+                // the same as an empty list since the config language doesn't
+                // distinguish these anyway.
+                old = ctyNullBlockListAsEmpty(old)
+                new = ctyNullBlockListAsEmpty(new)
+
+                oldItems := ctyCollectionValues(old)
+                newItems := ctyCollectionValues(new)
+
+                // Here we intentionally preserve the index-based correspondance
+                // between old and new, rather than trying to detect insertions
+                // and removals in the list, because this more accurately reflects
+                // how Terraform Core and providers will understand the change,
+                // particularly when the nested block contains computed attributes
+                // that will themselves maintain correspondance by index.
+
+                // commonLen is number of elements that exist in both lists, which
+                // will be presented as updates (~). Any additional items in one
+                // of the lists will be presented as either creates (+) or deletes (-)
+                // depending on which list they belong to.
+                var commonLen int
+                switch {
+                case len(oldItems) < len(newItems):
+                        commonLen = len(oldItems)
+                default:
+                        commonLen = len(newItems)
+                }
+
+                if blankBefore && (len(oldItems) > 0 || len(newItems) > 0) {
+                        p.buf.WriteRune('\n')
+                }
+
+                for i := 0; i < commonLen; i++ {
+                        path := append(path, cty.IndexStep{Key: cty.NumberIntVal(int64(i))})
+                        oldItem := oldItems[i]
+                        newItem := newItems[i]
+                        action := plans.Update
+                        if oldItem.RawEquals(newItem) {
+                                action = plans.NoOp
+                        }
+                        p.writeNestedBlockDiff(name, nil, &blockS.Block, action, oldItem, newItem, indent, path)
+                }
+                for i := commonLen; i < len(oldItems); i++ {
+                        path := append(path, cty.IndexStep{Key: cty.NumberIntVal(int64(i))})
+                        oldItem := oldItems[i]
+                        newItem := cty.NullVal(oldItem.Type())
+                        p.writeNestedBlockDiff(name, nil, &blockS.Block, plans.Delete, oldItem, newItem, indent, path)
+                }
+                for i := commonLen; i < len(newItems); i++ {
+                        path := append(path, cty.IndexStep{Key: cty.NumberIntVal(int64(i))})
+                        newItem := newItems[i]
+                        oldItem := cty.NullVal(newItem.Type())
+                        p.writeNestedBlockDiff(name, nil, &blockS.Block, plans.Create, oldItem, newItem, indent, path)
+                }
+        case configschema.NestingSet:
+                // For the sake of handling nested blocks, we'll treat a null set
+                // the same as an empty set since the config language doesn't
+                // distinguish these anyway.
+                old = ctyNullBlockSetAsEmpty(old)
+                new = ctyNullBlockSetAsEmpty(new)
+
+                oldItems := ctyCollectionValues(old)
+                newItems := ctyCollectionValues(new)
+
+                if (len(oldItems) + len(newItems)) == 0 {
+                        // Nothing to do if both sets are empty
+                        return
+                }
+
+                allItems := make([]cty.Value, 0, len(oldItems)+len(newItems))
+                allItems = append(allItems, oldItems...)
+                allItems = append(allItems, newItems...)
+                all := cty.SetVal(allItems)
+
+                if blankBefore {
+                        p.buf.WriteRune('\n')
+                }
+
+                for it := all.ElementIterator(); it.Next(); {
+                        _, val := it.Element()
+                        var action plans.Action
+                        var oldValue, newValue cty.Value
+                        switch {
+                        case !val.IsKnown():
+                                action = plans.Update
+                                newValue = val
+                        case !old.HasElement(val).True():
+                                action = plans.Create
+                                oldValue = cty.NullVal(val.Type())
+                                newValue = val
+                        case !new.HasElement(val).True():
+                                action = plans.Delete
+                                oldValue = val
+                                newValue = cty.NullVal(val.Type())
+                        default:
+                                action = plans.NoOp
+                                oldValue = val
+                                newValue = val
+                        }
+                        path := append(path, cty.IndexStep{Key: val})
+                        p.writeNestedBlockDiff(name, nil, &blockS.Block, action, oldValue, newValue, indent, path)
+                }
+
+        case configschema.NestingMap:
+                // For the sake of handling nested blocks, we'll treat a null map
+                // the same as an empty map since the config language doesn't
+                // distinguish these anyway.
+                old = ctyNullBlockMapAsEmpty(old)
+                new = ctyNullBlockMapAsEmpty(new)
+
+                oldItems := old.AsValueMap()
+                newItems := new.AsValueMap()
+                if (len(oldItems) + len(newItems)) == 0 {
+                        // Nothing to do if both maps are empty
+                        return
+                }
+
+                allKeys := make(map[string]bool)
+                for k := range oldItems {
+                        allKeys[k] = true
+                }
+                for k := range newItems {
+                        allKeys[k] = true
+                }
+                allKeysOrder := make([]string, 0, len(allKeys))
+                for k := range allKeys {
+                        allKeysOrder = append(allKeysOrder, k)
+                }
+                sort.Strings(allKeysOrder)
+
+                if blankBefore {
+                        p.buf.WriteRune('\n')
+                }
+
+                for _, k := range allKeysOrder {
+                        var action plans.Action
+                        oldValue := oldItems[k]
+                        newValue := newItems[k]
+                        switch {
+                        case oldValue == cty.NilVal:
+                                oldValue = cty.NullVal(newValue.Type())
+                                action = plans.Create
+                        case newValue == cty.NilVal:
+                                newValue = cty.NullVal(oldValue.Type())
+                                action = plans.Delete
+                        case !newValue.RawEquals(oldValue):
+                                action = plans.Update
+                        default:
+                                action = plans.NoOp
+                        }
+
+                        path := append(path, cty.IndexStep{Key: cty.StringVal(k)})
+                        p.writeNestedBlockDiff(name, &k, &blockS.Block, action, oldValue, newValue, indent, path)
+                }
+        }
+}
+
+func (p *blockBodyDiffPrinter) writeNestedBlockDiff(name string, label *string, blockS *configschema.Block, action plans.Action, old, new cty.Value, indent int, path cty.Path) {
+        p.buf.WriteString("\n")
+        p.buf.WriteString(strings.Repeat(" ", indent))
+        p.writeActionSymbol(action)
+
+        if label != nil {
+                fmt.Fprintf(p.buf, "%s %q {", name, *label)
+        } else {
+                fmt.Fprintf(p.buf, "%s {", name)
+        }
+
+        if action != plans.NoOp && (p.pathForcesNewResource(path) || p.pathForcesNewResource(path[:len(path)-1])) {
+                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+        }
+
+        bodyWritten := p.writeBlockBodyDiff(blockS, old, new, indent+4, path)
+        if bodyWritten {
+                p.buf.WriteString("\n")
+                p.buf.WriteString(strings.Repeat(" ", indent+2))
+        }
+        p.buf.WriteString("}")
+}
+
+func (p *blockBodyDiffPrinter) writeValue(val cty.Value, action plans.Action, indent int) {
+        if !val.IsKnown() {
+                p.buf.WriteString("(known after apply)")
+                return
+        }
+        if val.IsNull() {
+                p.buf.WriteString(p.color.Color("[dark_gray]null[reset]"))
+                return
+        }
+
+        ty := val.Type()
+
+        switch {
+        case ty.IsPrimitiveType():
+                switch ty {
+                case cty.String:
+                        {
+                                // Special behavior for JSON strings containing array or object
+                                src := []byte(val.AsString())
+                                ty, err := ctyjson.ImpliedType(src)
+                                // check for the special case of "null", which decodes to nil,
+                                // and just allow it to be printed out directly
+                                if err == nil && !ty.IsPrimitiveType() && val.AsString() != "null" {
+                                        jv, err := ctyjson.Unmarshal(src, ty)
+                                        if err == nil {
+                                                p.buf.WriteString("jsonencode(")
+                                                if jv.LengthInt() == 0 {
+                                                        p.writeValue(jv, action, 0)
+                                                } else {
+                                                        p.buf.WriteByte('\n')
+                                                        p.buf.WriteString(strings.Repeat(" ", indent+4))
+                                                        p.writeValue(jv, action, indent+4)
+                                                        p.buf.WriteByte('\n')
+                                                        p.buf.WriteString(strings.Repeat(" ", indent))
+                                                }
+                                                p.buf.WriteByte(')')
+                                                break // don't *also* do the normal behavior below
+                                        }
+                                }
+                        }
+                        fmt.Fprintf(p.buf, "%q", val.AsString())
+                case cty.Bool:
+                        if val.True() {
+                                p.buf.WriteString("true")
+                        } else {
+                                p.buf.WriteString("false")
+                        }
+                case cty.Number:
+                        bf := val.AsBigFloat()
+                        p.buf.WriteString(bf.Text('f', -1))
+                default:
+                        // should never happen, since the above is exhaustive
+                        fmt.Fprintf(p.buf, "%#v", val)
+                }
+        case ty.IsListType() || ty.IsSetType() || ty.IsTupleType():
+                p.buf.WriteString("[")
+
+                it := val.ElementIterator()
+                for it.Next() {
+                        _, val := it.Element()
+
+                        p.buf.WriteString("\n")
+                        p.buf.WriteString(strings.Repeat(" ", indent+2))
+                        p.writeActionSymbol(action)
+                        p.writeValue(val, action, indent+4)
+                        p.buf.WriteString(",")
+                }
+
+                if val.LengthInt() > 0 {
+                        p.buf.WriteString("\n")
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                }
+                p.buf.WriteString("]")
+        case ty.IsMapType():
+                p.buf.WriteString("{")
+
+                keyLen := 0
+                for it := val.ElementIterator(); it.Next(); {
+                        key, _ := it.Element()
+                        if keyStr := key.AsString(); len(keyStr) > keyLen {
+                                keyLen = len(keyStr)
+                        }
+                }
+
+                for it := val.ElementIterator(); it.Next(); {
+                        key, val := it.Element()
+
+                        p.buf.WriteString("\n")
+                        p.buf.WriteString(strings.Repeat(" ", indent+2))
+                        p.writeActionSymbol(action)
+                        p.writeValue(key, action, indent+4)
+                        p.buf.WriteString(strings.Repeat(" ", keyLen-len(key.AsString())))
+                        p.buf.WriteString(" = ")
+                        p.writeValue(val, action, indent+4)
+                }
+
+                if val.LengthInt() > 0 {
+                        p.buf.WriteString("\n")
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                }
+                p.buf.WriteString("}")
+        case ty.IsObjectType():
+                p.buf.WriteString("{")
+
+                atys := ty.AttributeTypes()
+                attrNames := make([]string, 0, len(atys))
+                nameLen := 0
+                for attrName := range atys {
+                        attrNames = append(attrNames, attrName)
+                        if len(attrName) > nameLen {
+                                nameLen = len(attrName)
+                        }
+                }
+                sort.Strings(attrNames)
+
+                for _, attrName := range attrNames {
+                        val := val.GetAttr(attrName)
+
+                        p.buf.WriteString("\n")
+                        p.buf.WriteString(strings.Repeat(" ", indent+2))
+                        p.writeActionSymbol(action)
+                        p.buf.WriteString(attrName)
+                        p.buf.WriteString(strings.Repeat(" ", nameLen-len(attrName)))
+                        p.buf.WriteString(" = ")
+                        p.writeValue(val, action, indent+4)
+                }
+
+                if len(attrNames) > 0 {
+                        p.buf.WriteString("\n")
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                }
+                p.buf.WriteString("}")
+        }
+}
+
+func (p *blockBodyDiffPrinter) writeValueDiff(old, new cty.Value, indent int, path cty.Path) {
+        ty := old.Type()
+        typesEqual := ctyTypesEqual(ty, new.Type())
+
+        // We have some specialized diff implementations for certain complex
+        // values where it's useful to see a visualization of the diff of
+        // the nested elements rather than just showing the entire old and
+        // new values verbatim.
+        // However, these specialized implementations can apply only if both
+        // values are known and non-null.
+        if old.IsKnown() && new.IsKnown() && !old.IsNull() && !new.IsNull() && typesEqual {
+                switch {
+                case ty == cty.String:
+                        // We have special behavior for both multi-line strings in general
+                        // and for strings that can parse as JSON. For the JSON handling
+                        // to apply, both old and new must be valid JSON.
+                        // For single-line strings that don't parse as JSON we just fall
+                        // out of this switch block and do the default old -> new rendering.
+                        oldS := old.AsString()
+                        newS := new.AsString()
+
+                        {
+                                // Special behavior for JSON strings containing object or
+                                // list values.
+                                oldBytes := []byte(oldS)
+                                newBytes := []byte(newS)
+                                oldType, oldErr := ctyjson.ImpliedType(oldBytes)
+                                newType, newErr := ctyjson.ImpliedType(newBytes)
+                                if oldErr == nil && newErr == nil && !(oldType.IsPrimitiveType() && newType.IsPrimitiveType()) {
+                                        oldJV, oldErr := ctyjson.Unmarshal(oldBytes, oldType)
+                                        newJV, newErr := ctyjson.Unmarshal(newBytes, newType)
+                                        if oldErr == nil && newErr == nil {
+                                                if !oldJV.RawEquals(newJV) { // two JSON values may differ only in insignificant whitespace
+                                                        p.buf.WriteString("jsonencode(")
+                                                        p.buf.WriteByte('\n')
+                                                        p.buf.WriteString(strings.Repeat(" ", indent+2))
+                                                        p.writeActionSymbol(plans.Update)
+                                                        p.writeValueDiff(oldJV, newJV, indent+4, path)
+                                                        p.buf.WriteByte('\n')
+                                                        p.buf.WriteString(strings.Repeat(" ", indent))
+                                                        p.buf.WriteByte(')')
+                                                } else {
+                                                        // if they differ only in insigificant whitespace
+                                                        // then we'll note that but still expand out the
+                                                        // effective value.
+                                                        if p.pathForcesNewResource(path) {
+                                                                p.buf.WriteString(p.color.Color("jsonencode( [red]# whitespace changes force replacement[reset]"))
+                                                        } else {
+                                                                p.buf.WriteString(p.color.Color("jsonencode( [dim]# whitespace changes[reset]"))
+                                                        }
+                                                        p.buf.WriteByte('\n')
+                                                        p.buf.WriteString(strings.Repeat(" ", indent+4))
+                                                        p.writeValue(oldJV, plans.NoOp, indent+4)
+                                                        p.buf.WriteByte('\n')
+                                                        p.buf.WriteString(strings.Repeat(" ", indent))
+                                                        p.buf.WriteByte(')')
+                                                }
+                                                return
+                                        }
+                                }
+                        }
+
+                        if strings.Index(oldS, "\n") < 0 && strings.Index(newS, "\n") < 0 {
+                                break
+                        }
+
+                        p.buf.WriteString("<<~EOT")
+                        if p.pathForcesNewResource(path) {
+                                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+                        }
+                        p.buf.WriteString("\n")
+
+                        var oldLines, newLines []cty.Value
+                        {
+                                r := strings.NewReader(oldS)
+                                sc := bufio.NewScanner(r)
+                                for sc.Scan() {
+                                        oldLines = append(oldLines, cty.StringVal(sc.Text()))
+                                }
+                        }
+                        {
+                                r := strings.NewReader(newS)
+                                sc := bufio.NewScanner(r)
+                                for sc.Scan() {
+                                        newLines = append(newLines, cty.StringVal(sc.Text()))
+                                }
+                        }
+
+                        diffLines := ctySequenceDiff(oldLines, newLines)
+                        for _, diffLine := range diffLines {
+                                p.buf.WriteString(strings.Repeat(" ", indent+2))
+                                p.writeActionSymbol(diffLine.Action)
+
+                                switch diffLine.Action {
+                                case plans.NoOp, plans.Delete:
+                                        p.buf.WriteString(diffLine.Before.AsString())
+                                case plans.Create:
+                                        p.buf.WriteString(diffLine.After.AsString())
+                                default:
+                                        // Should never happen since the above covers all
+                                        // actions that ctySequenceDiff can return for strings
+                                        p.buf.WriteString(diffLine.After.AsString())
+
+                                }
+                                p.buf.WriteString("\n")
+                        }
+
+                        p.buf.WriteString(strings.Repeat(" ", indent)) // +4 here because there's no symbol
+                        p.buf.WriteString("EOT")
+
+                        return
+
+                case ty.IsSetType():
+                        p.buf.WriteString("[")
+                        if p.pathForcesNewResource(path) {
+                                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+                        }
+                        p.buf.WriteString("\n")
+
+                        var addedVals, removedVals, allVals []cty.Value
+                        for it := old.ElementIterator(); it.Next(); {
+                                _, val := it.Element()
+                                allVals = append(allVals, val)
+                                if new.HasElement(val).False() {
+                                        removedVals = append(removedVals, val)
+                                }
+                        }
+                        for it := new.ElementIterator(); it.Next(); {
+                                _, val := it.Element()
+                                allVals = append(allVals, val)
+                                if val.IsKnown() && old.HasElement(val).False() {
+                                        addedVals = append(addedVals, val)
+                                }
+                        }
+
+                        var all, added, removed cty.Value
+                        if len(allVals) > 0 {
+                                all = cty.SetVal(allVals)
+                        } else {
+                                all = cty.SetValEmpty(ty.ElementType())
+                        }
+                        if len(addedVals) > 0 {
+                                added = cty.SetVal(addedVals)
+                        } else {
+                                added = cty.SetValEmpty(ty.ElementType())
+                        }
+                        if len(removedVals) > 0 {
+                                removed = cty.SetVal(removedVals)
+                        } else {
+                                removed = cty.SetValEmpty(ty.ElementType())
+                        }
+
+                        for it := all.ElementIterator(); it.Next(); {
+                                _, val := it.Element()
+
+                                p.buf.WriteString(strings.Repeat(" ", indent+2))
+
+                                var action plans.Action
+                                switch {
+                                case !val.IsKnown():
+                                        action = plans.Update
+                                case added.HasElement(val).True():
+                                        action = plans.Create
+                                case removed.HasElement(val).True():
+                                        action = plans.Delete
+                                default:
+                                        action = plans.NoOp
+                                }
+
+                                p.writeActionSymbol(action)
+                                p.writeValue(val, action, indent+4)
+                                p.buf.WriteString(",\n")
+                        }
+
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                        p.buf.WriteString("]")
+                        return
+                case ty.IsListType() || ty.IsTupleType():
+                        p.buf.WriteString("[")
+                        if p.pathForcesNewResource(path) {
+                                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+                        }
+                        p.buf.WriteString("\n")
+
+                        elemDiffs := ctySequenceDiff(old.AsValueSlice(), new.AsValueSlice())
+                        for _, elemDiff := range elemDiffs {
+                                p.buf.WriteString(strings.Repeat(" ", indent+2))
+                                p.writeActionSymbol(elemDiff.Action)
+                                switch elemDiff.Action {
+                                case plans.NoOp, plans.Delete:
+                                        p.writeValue(elemDiff.Before, elemDiff.Action, indent+4)
+                                case plans.Update:
+                                        p.writeValueDiff(elemDiff.Before, elemDiff.After, indent+4, path)
+                                case plans.Create:
+                                        p.writeValue(elemDiff.After, elemDiff.Action, indent+4)
+                                default:
+                                        // Should never happen since the above covers all
+                                        // actions that ctySequenceDiff can return.
+                                        p.writeValue(elemDiff.After, elemDiff.Action, indent+4)
+                                }
+
+                                p.buf.WriteString(",\n")
+                        }
+
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                        p.buf.WriteString("]")
+                        return
+
+                case ty.IsMapType():
+                        p.buf.WriteString("{")
+                        if p.pathForcesNewResource(path) {
+                                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+                        }
+                        p.buf.WriteString("\n")
+
+                        var allKeys []string
+                        keyLen := 0
+                        for it := old.ElementIterator(); it.Next(); {
+                                k, _ := it.Element()
+                                keyStr := k.AsString()
+                                allKeys = append(allKeys, keyStr)
+                                if len(keyStr) > keyLen {
+                                        keyLen = len(keyStr)
+                                }
+                        }
+                        for it := new.ElementIterator(); it.Next(); {
+                                k, _ := it.Element()
+                                keyStr := k.AsString()
+                                allKeys = append(allKeys, keyStr)
+                                if len(keyStr) > keyLen {
+                                        keyLen = len(keyStr)
+                                }
+                        }
+
+                        sort.Strings(allKeys)
+
+                        lastK := ""
+                        for i, k := range allKeys {
+                                if i > 0 && lastK == k {
+                                        continue // skip duplicates (list is sorted)
+                                }
+                                lastK = k
+
+                                p.buf.WriteString(strings.Repeat(" ", indent+2))
+                                kV := cty.StringVal(k)
+                                var action plans.Action
+                                if old.HasIndex(kV).False() {
+                                        action = plans.Create
+                                } else if new.HasIndex(kV).False() {
+                                        action = plans.Delete
+                                } else if eqV := old.Index(kV).Equals(new.Index(kV)); eqV.IsKnown() && eqV.True() {
+                                        action = plans.NoOp
+                                } else {
+                                        action = plans.Update
+                                }
+
+                                path := append(path, cty.IndexStep{Key: kV})
+
+                                p.writeActionSymbol(action)
+                                p.writeValue(kV, action, indent+4)
+                                p.buf.WriteString(strings.Repeat(" ", keyLen-len(k)))
+                                p.buf.WriteString(" = ")
+                                switch action {
+                                case plans.Create, plans.NoOp:
+                                        v := new.Index(kV)
+                                        p.writeValue(v, action, indent+4)
+                                case plans.Delete:
+                                        oldV := old.Index(kV)
+                                        newV := cty.NullVal(oldV.Type())
+                                        p.writeValueDiff(oldV, newV, indent+4, path)
+                                default:
+                                        oldV := old.Index(kV)
+                                        newV := new.Index(kV)
+                                        p.writeValueDiff(oldV, newV, indent+4, path)
+                                }
+
+                                p.buf.WriteByte('\n')
+                        }
+
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                        p.buf.WriteString("}")
+                        return
+                case ty.IsObjectType():
+                        p.buf.WriteString("{")
+                        p.buf.WriteString("\n")
+
+                        forcesNewResource := p.pathForcesNewResource(path)
+
+                        var allKeys []string
+                        keyLen := 0
+                        for it := old.ElementIterator(); it.Next(); {
+                                k, _ := it.Element()
+                                keyStr := k.AsString()
+                                allKeys = append(allKeys, keyStr)
+                                if len(keyStr) > keyLen {
+                                        keyLen = len(keyStr)
+                                }
+                        }
+                        for it := new.ElementIterator(); it.Next(); {
+                                k, _ := it.Element()
+                                keyStr := k.AsString()
+                                allKeys = append(allKeys, keyStr)
+                                if len(keyStr) > keyLen {
+                                        keyLen = len(keyStr)
+                                }
+                        }
+
+                        sort.Strings(allKeys)
+
+                        lastK := ""
+                        for i, k := range allKeys {
+                                if i > 0 && lastK == k {
+                                        continue // skip duplicates (list is sorted)
+                                }
+                                lastK = k
+
+                                p.buf.WriteString(strings.Repeat(" ", indent+2))
+                                kV := k
+                                var action plans.Action
+                                if !old.Type().HasAttribute(kV) {
+                                        action = plans.Create
+                                } else if !new.Type().HasAttribute(kV) {
+                                        action = plans.Delete
+                                } else if eqV := old.GetAttr(kV).Equals(new.GetAttr(kV)); eqV.IsKnown() && eqV.True() {
+                                        action = plans.NoOp
+                                } else {
+                                        action = plans.Update
+                                }
+
+                                path := append(path, cty.GetAttrStep{Name: kV})
+
+                                p.writeActionSymbol(action)
+                                p.buf.WriteString(k)
+                                p.buf.WriteString(strings.Repeat(" ", keyLen-len(k)))
+                                p.buf.WriteString(" = ")
+
+                                switch action {
+                                case plans.Create, plans.NoOp:
+                                        v := new.GetAttr(kV)
+                                        p.writeValue(v, action, indent+4)
+                                case plans.Delete:
+                                        oldV := old.GetAttr(kV)
+                                        newV := cty.NullVal(oldV.Type())
+                                        p.writeValueDiff(oldV, newV, indent+4, path)
+                                default:
+                                        oldV := old.GetAttr(kV)
+                                        newV := new.GetAttr(kV)
+                                        p.writeValueDiff(oldV, newV, indent+4, path)
+                                }
+
+                                p.buf.WriteString("\n")
+                        }
+
+                        p.buf.WriteString(strings.Repeat(" ", indent))
+                        p.buf.WriteString("}")
+
+                        if forcesNewResource {
+                                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+                        }
+                        return
+                }
+        }
+
+        // In all other cases, we just show the new and old values as-is
+        p.writeValue(old, plans.Delete, indent)
+        if new.IsNull() {
+                p.buf.WriteString(p.color.Color(" [dark_gray]->[reset] "))
+        } else {
+                p.buf.WriteString(p.color.Color(" [yellow]->[reset] "))
+        }
+
+        p.writeValue(new, plans.Create, indent)
+        if p.pathForcesNewResource(path) {
+                p.buf.WriteString(p.color.Color(forcesNewResourceCaption))
+        }
+}
+
+// writeActionSymbol writes a symbol to represent the given action, followed
+// by a space.
+//
+// It only supports the actions that can be represented with a single character:
+// Create, Delete, Update and NoAction.
+func (p *blockBodyDiffPrinter) writeActionSymbol(action plans.Action) {
+        switch action {
+        case plans.Create:
+                p.buf.WriteString(p.color.Color("[green]+[reset] "))
+        case plans.Delete:
+                p.buf.WriteString(p.color.Color("[red]-[reset] "))
+        case plans.Update:
+                p.buf.WriteString(p.color.Color("[yellow]~[reset] "))
+        case plans.NoOp:
+                p.buf.WriteString("  ")
+        default:
+                // Should never happen
+                p.buf.WriteString(p.color.Color("? "))
+        }
+}
+
+func (p *blockBodyDiffPrinter) pathForcesNewResource(path cty.Path) bool {
+        if !p.action.IsReplace() {
+                // "requiredReplace" only applies when the instance is being replaced
+                return false
+        }
+        return p.requiredReplace.Has(path)
+}
+
+func ctyEmptyString(value cty.Value) bool {
+        if !value.IsNull() && value.IsKnown() {
+                valueType := value.Type()
+                if valueType == cty.String && value.AsString() == "" {
+                        return true
+                }
+        }
+        return false
+}
+
+func ctyGetAttrMaybeNull(val cty.Value, name string) cty.Value {
+        attrType := val.Type().AttributeType(name)
+
+        if val.IsNull() {
+                return cty.NullVal(attrType)
+        }
+
+        // We treat "" as null here
+        // as existing SDK doesn't support null yet.
+        // This allows us to avoid spurious diffs
+        // until we introduce null to the SDK.
+        attrValue := val.GetAttr(name)
+        if ctyEmptyString(attrValue) {
+                return cty.NullVal(attrType)
+        }
+
+        return attrValue
+}
+
+func ctyCollectionValues(val cty.Value) []cty.Value {
+        if !val.IsKnown() || val.IsNull() {
+                return nil
+        }
+
+        ret := make([]cty.Value, 0, val.LengthInt())
+        for it := val.ElementIterator(); it.Next(); {
+                _, value := it.Element()
+                ret = append(ret, value)
+        }
+        return ret
+}
+
+// ctySequenceDiff returns differences between given sequences of cty.Value(s)
+// in the form of Create, Delete, or Update actions (for objects).
+func ctySequenceDiff(old, new []cty.Value) []*plans.Change {
+        var ret []*plans.Change
+        lcs := objchange.LongestCommonSubsequence(old, new)
+        var oldI, newI, lcsI int
+        for oldI < len(old) || newI < len(new) || lcsI < len(lcs) {
+                for oldI < len(old) && (lcsI >= len(lcs) || !old[oldI].RawEquals(lcs[lcsI])) {
+                        isObjectDiff := old[oldI].Type().IsObjectType() && (newI >= len(new) || new[newI].Type().IsObjectType())
+                        if isObjectDiff && newI < len(new) {
+                                ret = append(ret, &plans.Change{
+                                        Action: plans.Update,
+                                        Before: old[oldI],
+                                        After:  new[newI],
+                                })
+                                oldI++
+                                newI++ // we also consume the next "new" in this case
+                                continue
+                        }
+
+                        ret = append(ret, &plans.Change{
+                                Action: plans.Delete,
+                                Before: old[oldI],
+                                After:  cty.NullVal(old[oldI].Type()),
+                        })
+                        oldI++
+                }
+                for newI < len(new) && (lcsI >= len(lcs) || !new[newI].RawEquals(lcs[lcsI])) {
+                        ret = append(ret, &plans.Change{
+                                Action: plans.Create,
+                                Before: cty.NullVal(new[newI].Type()),
+                                After:  new[newI],
+                        })
+                        newI++
+                }
+                if lcsI < len(lcs) {
+                        ret = append(ret, &plans.Change{
+                                Action: plans.NoOp,
+                                Before: lcs[lcsI],
+                                After:  lcs[lcsI],
+                        })
+
+                        // All of our indexes advance together now, since the line
+                        // is common to all three sequences.
+                        lcsI++
+                        oldI++
+                        newI++
+                }
+        }
+        return ret
+}
+
+func ctyEqualWithUnknown(old, new cty.Value) bool {
+        if !old.IsWhollyKnown() || !new.IsWhollyKnown() {
+                return false
+        }
+        return old.Equals(new).True()
+}
+
+// ctyTypesEqual checks equality of two types more loosely
+// by avoiding checks of object/tuple elements
+// as we render differences on element-by-element basis anyway
+func ctyTypesEqual(oldT, newT cty.Type) bool {
+        if oldT.IsObjectType() && newT.IsObjectType() {
+                return true
+        }
+        if oldT.IsTupleType() && newT.IsTupleType() {
+                return true
+        }
+        return oldT.Equals(newT)
+}
+
+func ctyEnsurePathCapacity(path cty.Path, minExtra int) cty.Path {
+        if cap(path)-len(path) >= minExtra {
+                return path
+        }
+        newCap := cap(path) * 2
+        if newCap < (len(path) + minExtra) {
+                newCap = len(path) + minExtra
+        }
+        newPath := make(cty.Path, len(path), newCap)
+        copy(newPath, path)
+        return newPath
+}
+
+// ctyNullBlockListAsEmpty either returns the given value verbatim if it is non-nil
+// or returns an empty value of a suitable type to serve as a placeholder for it.
+//
+// In particular, this function handles the special situation where a "list" is
+// actually represented as a tuple type where nested blocks contain
+// dynamically-typed values.
+func ctyNullBlockListAsEmpty(in cty.Value) cty.Value {
+        if !in.IsNull() {
+                return in
+        }
+        if ty := in.Type(); ty.IsListType() {
+                return cty.ListValEmpty(ty.ElementType())
+        }
+        return cty.EmptyTupleVal // must need a tuple, then
+}
+
+// ctyNullBlockMapAsEmpty either returns the given value verbatim if it is non-nil
+// or returns an empty value of a suitable type to serve as a placeholder for it.
+//
+// In particular, this function handles the special situation where a "map" is
+// actually represented as an object type where nested blocks contain
+// dynamically-typed values.
+func ctyNullBlockMapAsEmpty(in cty.Value) cty.Value {
+        if !in.IsNull() {
+                return in
+        }
+        if ty := in.Type(); ty.IsMapType() {
+                return cty.MapValEmpty(ty.ElementType())
+        }
+        return cty.EmptyObjectVal // must need an object, then
+}
+
+// ctyNullBlockSetAsEmpty either returns the given value verbatim if it is non-nil
+// or returns an empty value of a suitable type to serve as a placeholder for it.
+func ctyNullBlockSetAsEmpty(in cty.Value) cty.Value {
+        if !in.IsNull() {
+                return in
+        }
+        // Dynamically-typed attributes are not supported inside blocks backed by
+        // sets, so our result here is always a set.
+        return cty.SetValEmpty(in.Type().ElementType())
+}
diff --git a/vendor/github.com/hashicorp/terraform/command/format/format.go b/vendor/github.com/hashicorp/terraform/command/format/format.go
new file mode 100644
index 0000000..aa8d7de
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/command/format/format.go
@@ -0,0 +1,8 @@
+// Package format contains helpers for formatting various Terraform
+// structures for human-readabout output.
+//
+// This package is used by the official Terraform CLI in formatting any
+// output and is exported to encourage non-official frontends to mimic the
+// output formatting as much as possible so that text formats of Terraform
+// structures have a consistent look and feel.
+package format
diff --git a/vendor/github.com/hashicorp/terraform/command/format/object_id.go b/vendor/github.com/hashicorp/terraform/command/format/object_id.go
new file mode 100644
index 0000000..85ebbfe
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/command/format/object_id.go
@@ -0,0 +1,123 @@
+package format
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// ObjectValueID takes a value that is assumed to be an object representation
+// of some resource instance object and attempts to heuristically find an
+// attribute of it that is likely to be a unique identifier in the remote
+// system that it belongs to which will be useful to the user.
+//
+// If such an attribute is found, its name and string value intended for
+// display are returned. Both returned strings are empty if no such attribute
+// exists, in which case the caller should assume that the resource instance
+// address within the Terraform configuration is the best available identifier.
+//
+// This is only a best-effort sort of thing, relying on naming conventions in
+// our resource type schemas. The result is not guaranteed to be unique, but
+// should generally be suitable for display to an end-user anyway.
+//
+// This function will panic if the given value is not of an object type.
+func ObjectValueID(obj cty.Value) (k, v string) {
+        if obj.IsNull() || !obj.IsKnown() {
+                return "", ""
+        }
+
+        atys := obj.Type().AttributeTypes()
+
+        switch {
+
+        case atys["id"] == cty.String:
+                v := obj.GetAttr("id")
+                if v.IsKnown() && !v.IsNull() {
+                        return "id", v.AsString()
+                }
+
+        case atys["name"] == cty.String:
+                // "name" isn't always globally unique, but if there isn't also an
+                // "id" then it _often_ is, in practice.
+                v := obj.GetAttr("name")
+                if v.IsKnown() && !v.IsNull() {
+                        return "name", v.AsString()
+                }
+        }
+
+        return "", ""
+}
+
+// ObjectValueName takes a value that is assumed to be an object representation
+// of some resource instance object and attempts to heuristically find an
+// attribute of it that is likely to be a human-friendly name in the remote
+// system that it belongs to which will be useful to the user.
+//
+// If such an attribute is found, its name and string value intended for
+// display are returned. Both returned strings are empty if no such attribute
+// exists, in which case the caller should assume that the resource instance
+// address within the Terraform configuration is the best available identifier.
+//
+// This is only a best-effort sort of thing, relying on naming conventions in
+// our resource type schemas. The result is not guaranteed to be unique, but
+// should generally be suitable for display to an end-user anyway.
+//
+// Callers that use both ObjectValueName and ObjectValueID at the same time
+// should be prepared to get the same attribute key and value from both in
+// some cases, since there is overlap betweek the id-extraction and
+// name-extraction heuristics.
+//
+// This function will panic if the given value is not of an object type.
+func ObjectValueName(obj cty.Value) (k, v string) {
+        if obj.IsNull() || !obj.IsKnown() {
+                return "", ""
+        }
+
+        atys := obj.Type().AttributeTypes()
+
+        switch {
+
+        case atys["name"] == cty.String:
+                v := obj.GetAttr("name")
+                if v.IsKnown() && !v.IsNull() {
+                        return "name", v.AsString()
+                }
+
+        case atys["tags"].IsMapType() && atys["tags"].ElementType() == cty.String:
+                tags := obj.GetAttr("tags")
+                if tags.IsNull() || !tags.IsWhollyKnown() {
+                        break
+                }
+
+                switch {
+                case tags.HasIndex(cty.StringVal("name")).RawEquals(cty.True):
+                        v := tags.Index(cty.StringVal("name"))
+                        if v.IsKnown() && !v.IsNull() {
+                                return "tags.name", v.AsString()
+                        }
+                case tags.HasIndex(cty.StringVal("Name")).RawEquals(cty.True):
+                        // AWS-style naming convention
+                        v := tags.Index(cty.StringVal("Name"))
+                        if v.IsKnown() && !v.IsNull() {
+                                return "tags.Name", v.AsString()
+                        }
+                }
+        }
+
+        return "", ""
+}
+
+// ObjectValueIDOrName is a convenience wrapper around both ObjectValueID
+// and ObjectValueName (in that preference order) to try to extract some sort
+// of human-friendly descriptive string value for an object as additional
+// context about an object when it is being displayed in a compact way (where
+// not all of the attributes are visible.)
+//
+// Just as with the two functions it wraps, it is a best-effort and may return
+// two empty strings if no suitable attribute can be found for a given object.
+func ObjectValueIDOrName(obj cty.Value) (k, v string) {
+        k, v = ObjectValueID(obj)
+        if k != "" {
+                return
+        }
+        k, v = ObjectValueName(obj)
+        return
+}
diff --git a/vendor/github.com/hashicorp/terraform/command/format/plan.go b/vendor/github.com/hashicorp/terraform/command/format/plan.go
new file mode 100644
index 0000000..098653f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/command/format/plan.go
@@ -0,0 +1,302 @@
+package format
+
+import (
+        "bytes"
+        "fmt"
+        "log"
+        "sort"
+        "strings"
+
+        "github.com/mitchellh/colorstring"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/terraform"
+)
+
+// Plan is a representation of a plan optimized for display to
+// an end-user, as opposed to terraform.Plan which is for internal use.
+//
+// DisplayPlan excludes implementation details that may otherwise appear
+// in the main plan, such as destroy actions on data sources (which are
+// there only to clean up the state).
+type Plan struct {
+        Resources []*InstanceDiff
+}
+
+// InstanceDiff is a representation of an instance diff optimized
+// for display, in conjunction with DisplayPlan.
+type InstanceDiff struct {
+        Addr   *terraform.ResourceAddress
+        Action plans.Action
+
+        // Attributes describes changes to the attributes of the instance.
+        //
+        // For destroy diffs this is always nil.
+        Attributes []*AttributeDiff
+
+        Tainted bool
+        Deposed bool
+}
+
+// AttributeDiff is a representation of an attribute diff optimized
+// for display, in conjunction with DisplayInstanceDiff.
+type AttributeDiff struct {
+        // Path is a dot-delimited traversal through possibly many levels of list and map structure,
+        // intended for display purposes only.
+        Path string
+
+        Action plans.Action
+
+        OldValue string
+        NewValue string
+
+        NewComputed bool
+        Sensitive   bool
+        ForcesNew   bool
+}
+
+// PlanStats gives summary counts for a Plan.
+type PlanStats struct {
+        ToAdd, ToChange, ToDestroy int
+}
+
+// NewPlan produces a display-oriented Plan from a terraform.Plan.
+func NewPlan(changes *plans.Changes) *Plan {
+        log.Printf("[TRACE] NewPlan for %#v", changes)
+        ret := &Plan{}
+        if changes == nil {
+                // Nothing to do!
+                return ret
+        }
+
+        for _, rc := range changes.Resources {
+                addr := rc.Addr
+                log.Printf("[TRACE] NewPlan found %s (%s)", addr, rc.Action)
+                dataSource := addr.Resource.Resource.Mode == addrs.DataResourceMode
+
+                // We create "delete" actions for data resources so we can clean
+                // up their entries in state, but this is an implementation detail
+                // that users shouldn't see.
+                if dataSource && rc.Action == plans.Delete {
+                        continue
+                }
+
+                // For now we'll shim this to work with our old types.
+                // TODO: Update for the new plan types, ideally also switching over to
+                // a structural diff renderer instead of a flat renderer.
+                did := &InstanceDiff{
+                        Addr:   terraform.NewLegacyResourceInstanceAddress(addr),
+                        Action: rc.Action,
+                }
+
+                if rc.DeposedKey != states.NotDeposed {
+                        did.Deposed = true
+                }
+
+                // Since this is just a temporary stub implementation on the way
+                // to us replacing this with the structural diff renderer, we currently
+                // don't include any attributes here.
+                // FIXME: Implement the structural diff renderer to replace this
+                // codepath altogether.
+
+                ret.Resources = append(ret.Resources, did)
+        }
+
+        // Sort the instance diffs by their addresses for display.
+        sort.Slice(ret.Resources, func(i, j int) bool {
+                iAddr := ret.Resources[i].Addr
+                jAddr := ret.Resources[j].Addr
+                return iAddr.Less(jAddr)
+        })
+
+        return ret
+}
+
+// Format produces and returns a text representation of the receiving plan
+// intended for display in a terminal.
+//
+// If color is not nil, it is used to colorize the output.
+func (p *Plan) Format(color *colorstring.Colorize) string {
+        if p.Empty() {
+                return "This plan does nothing."
+        }
+
+        if color == nil {
+                color = &colorstring.Colorize{
+                        Colors: colorstring.DefaultColors,
+                        Reset:  false,
+                }
+        }
+
+        // Find the longest path length of all the paths that are changing,
+        // so we can align them all.
+        keyLen := 0
+        for _, r := range p.Resources {
+                for _, attr := range r.Attributes {
+                        key := attr.Path
+
+                        if len(key) > keyLen {
+                                keyLen = len(key)
+                        }
+                }
+        }
+
+        buf := new(bytes.Buffer)
+        for _, r := range p.Resources {
+                formatPlanInstanceDiff(buf, r, keyLen, color)
+        }
+
+        return strings.TrimSpace(buf.String())
+}
+
+// Stats returns statistics about the plan
+func (p *Plan) Stats() PlanStats {
+        var ret PlanStats
+        for _, r := range p.Resources {
+                switch r.Action {
+                case plans.Create:
+                        ret.ToAdd++
+                case plans.Update:
+                        ret.ToChange++
+                case plans.DeleteThenCreate, plans.CreateThenDelete:
+                        ret.ToAdd++
+                        ret.ToDestroy++
+                case plans.Delete:
+                        ret.ToDestroy++
+                }
+        }
+        return ret
+}
+
+// ActionCounts returns the number of diffs for each action type
+func (p *Plan) ActionCounts() map[plans.Action]int {
+        ret := map[plans.Action]int{}
+        for _, r := range p.Resources {
+                ret[r.Action]++
+        }
+        return ret
+}
+
+// Empty returns true if there is at least one resource diff in the receiving plan.
+func (p *Plan) Empty() bool {
+        return len(p.Resources) == 0
+}
+
+// DiffActionSymbol returns a string that, once passed through a
+// colorstring.Colorize, will produce a result that can be written
+// to a terminal to produce a symbol made of three printable
+// characters, possibly interspersed with VT100 color codes.
+func DiffActionSymbol(action plans.Action) string {
+        switch action {
+        case plans.DeleteThenCreate:
+                return "[red]-[reset]/[green]+[reset]"
+        case plans.CreateThenDelete:
+                return "[green]+[reset]/[red]-[reset]"
+        case plans.Create:
+                return "  [green]+[reset]"
+        case plans.Delete:
+                return "  [red]-[reset]"
+        case plans.Read:
+                return " [cyan]<=[reset]"
+        case plans.Update:
+                return "  [yellow]~[reset]"
+        default:
+                return "  ?"
+        }
+}
+
+// formatPlanInstanceDiff writes the text representation of the given instance diff
+// to the given buffer, using the given colorizer.
+func formatPlanInstanceDiff(buf *bytes.Buffer, r *InstanceDiff, keyLen int, colorizer *colorstring.Colorize) {
+        addrStr := r.Addr.String()
+
+        // Determine the color for the text (green for adding, yellow
+        // for change, red for delete), and symbol, and output the
+        // resource header.
+        color := "yellow"
+        symbol := DiffActionSymbol(r.Action)
+        oldValues := true
+        switch r.Action {
+        case plans.DeleteThenCreate, plans.CreateThenDelete:
+                color = "yellow"
+        case plans.Create:
+                color = "green"
+                oldValues = false
+        case plans.Delete:
+                color = "red"
+        case plans.Read:
+                color = "cyan"
+                oldValues = false
+        }
+
+        var extraStr string
+        if r.Tainted {
+                extraStr = extraStr + " (tainted)"
+        }
+        if r.Deposed {
+                extraStr = extraStr + " (deposed)"
+        }
+        if r.Action.IsReplace() {
+                extraStr = extraStr + colorizer.Color(" [red][bold](new resource required)")
+        }
+
+        buf.WriteString(
+                colorizer.Color(fmt.Sprintf(
+                        "[%s]%s [%s]%s%s\n",
+                        color, symbol, color, addrStr, extraStr,
+                )),
+        )
+
+        for _, attr := range r.Attributes {
+
+                v := attr.NewValue
+                var dispV string
+                switch {
+                case v == "" && attr.NewComputed:
+                        dispV = "<computed>"
+                case attr.Sensitive:
+                        dispV = "<sensitive>"
+                default:
+                        dispV = fmt.Sprintf("%q", v)
+                }
+
+                updateMsg := ""
+                switch {
+                case attr.ForcesNew && r.Action.IsReplace():
+                        updateMsg = colorizer.Color(" [red](forces new resource)")
+                case attr.Sensitive && oldValues:
+                        updateMsg = colorizer.Color(" [yellow](attribute changed)")
+                }
+
+                if oldValues {
+                        u := attr.OldValue
+                        var dispU string
+                        switch {
+                        case attr.Sensitive:
+                                dispU = "<sensitive>"
+                        default:
+                                dispU = fmt.Sprintf("%q", u)
+                        }
+                        buf.WriteString(fmt.Sprintf(
+                                "      %s:%s %s => %s%s\n",
+                                attr.Path,
+                                strings.Repeat(" ", keyLen-len(attr.Path)),
+                                dispU, dispV,
+                                updateMsg,
+                        ))
+                } else {
+                        buf.WriteString(fmt.Sprintf(
+                                "      %s:%s %s%s\n",
+                                attr.Path,
+                                strings.Repeat(" ", keyLen-len(attr.Path)),
+                                dispV,
+                                updateMsg,
+                        ))
+                }
+        }
+
+        // Write the reset color so we don't bleed color into later text
+        buf.WriteString(colorizer.Color("[reset]\n"))
+}
diff --git a/vendor/github.com/hashicorp/terraform/command/format/state.go b/vendor/github.com/hashicorp/terraform/command/format/state.go
new file mode 100644
index 0000000..f411ef9
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/command/format/state.go
@@ -0,0 +1,286 @@
+package format
+
+import (
+        "bytes"
+        "fmt"
+        "sort"
+        "strings"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/terraform"
+        "github.com/mitchellh/colorstring"
+)
+
+// StateOpts are the options for formatting a state.
+type StateOpts struct {
+        // State is the state to format. This is required.
+        State *states.State
+
+        // Schemas are used to decode attributes. This is required.
+        Schemas *terraform.Schemas
+
+        // Color is the colorizer. This is optional.
+        Color *colorstring.Colorize
+}
+
+// State takes a state and returns a string
+func State(opts *StateOpts) string {
+        if opts.Color == nil {
+                panic("colorize not given")
+        }
+
+        if opts.Schemas == nil {
+                panic("schemas not given")
+        }
+
+        s := opts.State
+        if len(s.Modules) == 0 {
+                return "The state file is empty. No resources are represented."
+        }
+
+        buf := bytes.NewBufferString("[reset]")
+        p := blockBodyDiffPrinter{
+                buf:    buf,
+                color:  opts.Color,
+                action: plans.NoOp,
+        }
+
+        // Format all the modules
+        for _, m := range s.Modules {
+                formatStateModule(p, m, opts.Schemas)
+        }
+
+        // Write the outputs for the root module
+        m := s.RootModule()
+
+        if m.OutputValues != nil {
+                if len(m.OutputValues) > 0 {
+                        p.buf.WriteString("Outputs:\n\n")
+                }
+
+                // Sort the outputs
+                ks := make([]string, 0, len(m.OutputValues))
+                for k := range m.OutputValues {
+                        ks = append(ks, k)
+                }
+                sort.Strings(ks)
+
+                // Output each output k/v pair
+                for _, k := range ks {
+                        v := m.OutputValues[k]
+                        p.buf.WriteString(fmt.Sprintf("%s = ", k))
+                        p.writeValue(v.Value, plans.NoOp, 0)
+                        p.buf.WriteString("\n\n")
+                }
+        }
+
+        return opts.Color.Color(strings.TrimSpace(p.buf.String()))
+
+}
+
+func formatStateModule(p blockBodyDiffPrinter, m *states.Module, schemas *terraform.Schemas) {
+        // First get the names of all the resources so we can show them
+        // in alphabetical order.
+        names := make([]string, 0, len(m.Resources))
+        for name := range m.Resources {
+                names = append(names, name)
+        }
+        sort.Strings(names)
+
+        // Go through each resource and begin building up the output.
+        for _, key := range names {
+                for k, v := range m.Resources[key].Instances {
+                        addr := m.Resources[key].Addr
+
+                        taintStr := ""
+                        if v.Current.Status == 'T' {
+                                taintStr = "(tainted)"
+                        }
+                        p.buf.WriteString(fmt.Sprintf("# %s: %s\n", addr.Absolute(m.Addr).Instance(k), taintStr))
+
+                        var schema *configschema.Block
+                        provider := m.Resources[key].ProviderConfig.ProviderConfig.StringCompact()
+                        if _, exists := schemas.Providers[provider]; !exists {
+                                // This should never happen in normal use because we should've
+                                // loaded all of the schemas and checked things prior to this
+                                // point. We can't return errors here, but since this is UI code
+                                // we will try to do _something_ reasonable.
+                                p.buf.WriteString(fmt.Sprintf("# missing schema for provider %q\n\n", provider))
+                                continue
+                        }
+
+                        switch addr.Mode {
+                        case addrs.ManagedResourceMode:
+                                schema, _ = schemas.ResourceTypeConfig(
+                                        provider,
+                                        addr.Mode,
+                                        addr.Type,
+                                )
+                                if schema == nil {
+                                        p.buf.WriteString(fmt.Sprintf(
+                                                "# missing schema for provider %q resource type %s\n\n", provider, addr.Type))
+                                        continue
+                                }
+
+                                p.buf.WriteString(fmt.Sprintf(
+                                        "resource %q %q {",
+                                        addr.Type,
+                                        addr.Name,
+                                ))
+                        case addrs.DataResourceMode:
+                                schema, _ = schemas.ResourceTypeConfig(
+                                        provider,
+                                        addr.Mode,
+                                        addr.Type,
+                                )
+                                if schema == nil {
+                                        p.buf.WriteString(fmt.Sprintf(
+                                                "# missing schema for provider %q data source %s\n\n", provider, addr.Type))
+                                        continue
+                                }
+
+                                p.buf.WriteString(fmt.Sprintf(
+                                        "data %q %q {",
+                                        addr.Type,
+                                        addr.Name,
+                                ))
+                        default:
+                                // should never happen, since the above is exhaustive
+                                p.buf.WriteString(addr.String())
+                        }
+
+                        val, err := v.Current.Decode(schema.ImpliedType())
+                        if err != nil {
+                                fmt.Println(err.Error())
+                                break
+                        }
+
+                        path := make(cty.Path, 0, 3)
+                        bodyWritten := p.writeBlockBodyDiff(schema, val.Value, val.Value, 2, path)
+                        if bodyWritten {
+                                p.buf.WriteString("\n")
+                        }
+
+                        p.buf.WriteString("}\n\n")
+                }
+        }
+        p.buf.WriteString("[reset]\n")
+}
+
+func formatNestedList(indent string, outputList []interface{}) string {
+        outputBuf := new(bytes.Buffer)
+        outputBuf.WriteString(fmt.Sprintf("%s[", indent))
+
+        lastIdx := len(outputList) - 1
+
+        for i, value := range outputList {
+                outputBuf.WriteString(fmt.Sprintf("\n%s%s%s", indent, "    ", value))
+                if i != lastIdx {
+                        outputBuf.WriteString(",")
+                }
+        }
+
+        outputBuf.WriteString(fmt.Sprintf("\n%s]", indent))
+        return strings.TrimPrefix(outputBuf.String(), "\n")
+}
+
+func formatListOutput(indent, outputName string, outputList []interface{}) string {
+        keyIndent := ""
+
+        outputBuf := new(bytes.Buffer)
+
+        if outputName != "" {
+                outputBuf.WriteString(fmt.Sprintf("%s%s = [", indent, outputName))
+                keyIndent = "    "
+        }
+
+        lastIdx := len(outputList) - 1
+
+        for i, value := range outputList {
+                switch typedValue := value.(type) {
+                case string:
+                        outputBuf.WriteString(fmt.Sprintf("\n%s%s%s", indent, keyIndent, value))
+                case []interface{}:
+                        outputBuf.WriteString(fmt.Sprintf("\n%s%s", indent,
+                                formatNestedList(indent+keyIndent, typedValue)))
+                case map[string]interface{}:
+                        outputBuf.WriteString(fmt.Sprintf("\n%s%s", indent,
+                                formatNestedMap(indent+keyIndent, typedValue)))
+                }
+
+                if lastIdx != i {
+                        outputBuf.WriteString(",")
+                }
+        }
+
+        if outputName != "" {
+                if len(outputList) > 0 {
+                        outputBuf.WriteString(fmt.Sprintf("\n%s]", indent))
+                } else {
+                        outputBuf.WriteString("]")
+                }
+        }
+
+        return strings.TrimPrefix(outputBuf.String(), "\n")
+}
+
+func formatNestedMap(indent string, outputMap map[string]interface{}) string {
+        ks := make([]string, 0, len(outputMap))
+        for k, _ := range outputMap {
+                ks = append(ks, k)
+        }
+        sort.Strings(ks)
+
+        outputBuf := new(bytes.Buffer)
+        outputBuf.WriteString(fmt.Sprintf("%s{", indent))
+
+        lastIdx := len(outputMap) - 1
+        for i, k := range ks {
+                v := outputMap[k]
+                outputBuf.WriteString(fmt.Sprintf("\n%s%s = %v", indent+"    ", k, v))
+
+                if lastIdx != i {
+                        outputBuf.WriteString(",")
+                }
+        }
+
+        outputBuf.WriteString(fmt.Sprintf("\n%s}", indent))
+
+        return strings.TrimPrefix(outputBuf.String(), "\n")
+}
+
+func formatMapOutput(indent, outputName string, outputMap map[string]interface{}) string {
+        ks := make([]string, 0, len(outputMap))
+        for k, _ := range outputMap {
+                ks = append(ks, k)
+        }
+        sort.Strings(ks)
+
+        keyIndent := ""
+
+        outputBuf := new(bytes.Buffer)
+        if outputName != "" {
+                outputBuf.WriteString(fmt.Sprintf("%s%s = {", indent, outputName))
+                keyIndent = "  "
+        }
+
+        for _, k := range ks {
+                v := outputMap[k]
+                outputBuf.WriteString(fmt.Sprintf("\n%s%s%s = %v", indent, keyIndent, k, v))
+        }
+
+        if outputName != "" {
+                if len(outputMap) > 0 {
+                        outputBuf.WriteString(fmt.Sprintf("\n%s}", indent))
+                } else {
+                        outputBuf.WriteString("}")
+                }
+        }
+
+        return strings.TrimPrefix(outputBuf.String(), "\n")
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/decoder_spec.go b/vendor/github.com/hashicorp/terraform/config/configschema/decoder_spec.go
deleted file mode 100644
index 2b1b0ca..0000000
--- a/vendor/github.com/hashicorp/terraform/config/configschema/decoder_spec.go
+++ /dev/null
@@ -1,97 +0,0 @@
-package configschema
-
-import (
-        "github.com/hashicorp/hcl2/hcldec"
-        "github.com/zclconf/go-cty/cty"
-)
-
-var mapLabelNames = []string{"key"}
-
-// DecoderSpec returns a hcldec.Spec that can be used to decode a HCL Body
-// using the facilities in the hcldec package.
-//
-// The returned specification is guaranteed to return a value of the same type
-// returned by method ImpliedType, but it may contain null or unknown values if
-// any of the block attributes are defined as optional and/or computed
-// respectively.
-func (b *Block) DecoderSpec() hcldec.Spec {
-        ret := hcldec.ObjectSpec{}
-        if b == nil {
-                return ret
-        }
-
-        for name, attrS := range b.Attributes {
-                switch {
-                case attrS.Computed && attrS.Optional:
-                        // In this special case we use an unknown value as a default
-                        // to get the intended behavior that the result is computed
-                        // unless it has been explicitly set in config.
-                        ret[name] = &hcldec.DefaultSpec{
-                                Primary: &hcldec.AttrSpec{
-                                        Name: name,
-                                        Type: attrS.Type,
-                                },
-                                Default: &hcldec.LiteralSpec{
-                                        Value: cty.UnknownVal(attrS.Type),
-                                },
-                        }
-                case attrS.Computed:
-                        ret[name] = &hcldec.LiteralSpec{
-                                Value: cty.UnknownVal(attrS.Type),
-                        }
-                default:
-                        ret[name] = &hcldec.AttrSpec{
-                                Name:     name,
-                                Type:     attrS.Type,
-                                Required: attrS.Required,
-                        }
-                }
-        }
-
-        for name, blockS := range b.BlockTypes {
-                if _, exists := ret[name]; exists {
-                        // This indicates an invalid schema, since it's not valid to
-                        // define both an attribute and a block type of the same name.
-                        // However, we don't raise this here since it's checked by
-                        // InternalValidate.
-                        continue
-                }
-
-                childSpec := blockS.Block.DecoderSpec()
-
-                switch blockS.Nesting {
-                case NestingSingle:
-                        ret[name] = &hcldec.BlockSpec{
-                                TypeName: name,
-                                Nested:   childSpec,
-                                Required: blockS.MinItems == 1 && blockS.MaxItems >= 1,
-                        }
-                case NestingList:
-                        ret[name] = &hcldec.BlockListSpec{
-                                TypeName: name,
-                                Nested:   childSpec,
-                                MinItems: blockS.MinItems,
-                                MaxItems: blockS.MaxItems,
-                        }
-                case NestingSet:
-                        ret[name] = &hcldec.BlockSetSpec{
-                                TypeName: name,
-                                Nested:   childSpec,
-                                MinItems: blockS.MinItems,
-                                MaxItems: blockS.MaxItems,
-                        }
-                case NestingMap:
-                        ret[name] = &hcldec.BlockMapSpec{
-                                TypeName:   name,
-                                Nested:     childSpec,
-                                LabelNames: mapLabelNames,
-                        }
-                default:
-                        // Invalid nesting type is just ignored. It's checked by
-                        // InternalValidate.
-                        continue
-                }
-        }
-
-        return ret
-}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/implied_type.go b/vendor/github.com/hashicorp/terraform/config/configschema/implied_type.go
deleted file mode 100644
index 67324eb..0000000
--- a/vendor/github.com/hashicorp/terraform/config/configschema/implied_type.go
+++ /dev/null
@@ -1,21 +0,0 @@
-package configschema
-
-import (
-        "github.com/hashicorp/hcl2/hcldec"
-        "github.com/zclconf/go-cty/cty"
-)
-
-// ImpliedType returns the cty.Type that would result from decoding a
-// configuration block using the receiving block schema.
-//
-// ImpliedType always returns a result, even if the given schema is
-// inconsistent. Code that creates configschema.Block objects should be
-// tested using the InternalValidate method to detect any inconsistencies
-// that would cause this method to fall back on defaults and assumptions.
-func (b *Block) ImpliedType() cty.Type {
-        if b == nil {
-                return cty.EmptyObject
-        }
-
-        return hcldec.ImpliedType(b.DecoderSpec())
-}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/nestingmode_string.go b/vendor/github.com/hashicorp/terraform/config/configschema/nestingmode_string.go
deleted file mode 100644
index 6cb9313..0000000
--- a/vendor/github.com/hashicorp/terraform/config/configschema/nestingmode_string.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// Code generated by "stringer -type=NestingMode"; DO NOT EDIT.
-
-package configschema
-
-import "strconv"
-
-const _NestingMode_name = "nestingModeInvalidNestingSingleNestingListNestingSetNestingMap"
-
-var _NestingMode_index = [...]uint8{0, 18, 31, 42, 52, 62}
-
-func (i NestingMode) String() string {
-        if i < 0 || i >= NestingMode(len(_NestingMode_index)-1) {
-                return "NestingMode(" + strconv.FormatInt(int64(i), 10) + ")"
-        }
-        return _NestingMode_name[_NestingMode_index[i]:_NestingMode_index[i+1]]
-}
diff --git a/vendor/github.com/hashicorp/terraform/config/hcl2shim/flatmap.go b/vendor/github.com/hashicorp/terraform/config/hcl2shim/flatmap.go
new file mode 100644
index 0000000..bb4228d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/hcl2shim/flatmap.go
@@ -0,0 +1,424 @@
+package hcl2shim
+
+import (
+        "fmt"
+        "strconv"
+        "strings"
+
+        "github.com/zclconf/go-cty/cty/convert"
+
+        "github.com/zclconf/go-cty/cty"
+)
+
+// FlatmapValueFromHCL2 converts a value from HCL2 (really, from the cty dynamic
+// types library that HCL2 uses) to a map compatible with what would be
+// produced by the "flatmap" package.
+//
+// The type of the given value informs the structure of the resulting map.
+// The value must be of an object type or this function will panic.
+//
+// Flatmap values can only represent maps when they are of primitive types,
+// so the given value must not have any maps of complex types or the result
+// is undefined.
+func FlatmapValueFromHCL2(v cty.Value) map[string]string {
+        if v.IsNull() {
+                return nil
+        }
+
+        if !v.Type().IsObjectType() {
+                panic(fmt.Sprintf("HCL2ValueFromFlatmap called on %#v", v.Type()))
+        }
+
+        m := make(map[string]string)
+        flatmapValueFromHCL2Map(m, "", v)
+        return m
+}
+
+func flatmapValueFromHCL2Value(m map[string]string, key string, val cty.Value) {
+        ty := val.Type()
+        switch {
+        case ty.IsPrimitiveType() || ty == cty.DynamicPseudoType:
+                flatmapValueFromHCL2Primitive(m, key, val)
+        case ty.IsObjectType() || ty.IsMapType():
+                flatmapValueFromHCL2Map(m, key+".", val)
+        case ty.IsTupleType() || ty.IsListType() || ty.IsSetType():
+                flatmapValueFromHCL2Seq(m, key+".", val)
+        default:
+                panic(fmt.Sprintf("cannot encode %s to flatmap", ty.FriendlyName()))
+        }
+}
+
+func flatmapValueFromHCL2Primitive(m map[string]string, key string, val cty.Value) {
+        if !val.IsKnown() {
+                m[key] = UnknownVariableValue
+                return
+        }
+        if val.IsNull() {
+                // Omit entirely
+                return
+        }
+
+        var err error
+        val, err = convert.Convert(val, cty.String)
+        if err != nil {
+                // Should not be possible, since all primitive types can convert to string.
+                panic(fmt.Sprintf("invalid primitive encoding to flatmap: %s", err))
+        }
+        m[key] = val.AsString()
+}
+
+func flatmapValueFromHCL2Map(m map[string]string, prefix string, val cty.Value) {
+        if val.IsNull() {
+                // Omit entirely
+                return
+        }
+        if !val.IsKnown() {
+                switch {
+                case val.Type().IsObjectType():
+                        // Whole objects can't be unknown in flatmap, so instead we'll
+                        // just write all of the attribute values out as unknown.
+                        for name, aty := range val.Type().AttributeTypes() {
+                                flatmapValueFromHCL2Value(m, prefix+name, cty.UnknownVal(aty))
+                        }
+                default:
+                        m[prefix+"%"] = UnknownVariableValue
+                }
+                return
+        }
+
+        len := 0
+        for it := val.ElementIterator(); it.Next(); {
+                ak, av := it.Element()
+                name := ak.AsString()
+                flatmapValueFromHCL2Value(m, prefix+name, av)
+                len++
+        }
+        if !val.Type().IsObjectType() { // objects don't have an explicit count included, since their attribute count is fixed
+                m[prefix+"%"] = strconv.Itoa(len)
+        }
+}
+
+func flatmapValueFromHCL2Seq(m map[string]string, prefix string, val cty.Value) {
+        if val.IsNull() {
+                // Omit entirely
+                return
+        }
+        if !val.IsKnown() {
+                m[prefix+"#"] = UnknownVariableValue
+                return
+        }
+
+        // For sets this won't actually generate exactly what helper/schema would've
+        // generated, because we don't have access to the set key function it
+        // would've used. However, in practice it doesn't actually matter what the
+        // keys are as long as they are unique, so we'll just generate sequential
+        // indexes for them as if it were a list.
+        //
+        // An important implication of this, however, is that the set ordering will
+        // not be consistent across mutations and so different keys may be assigned
+        // to the same value when round-tripping. Since this shim is intended to
+        // be short-lived and not used for round-tripping, we accept this.
+        i := 0
+        for it := val.ElementIterator(); it.Next(); {
+                _, av := it.Element()
+                key := prefix + strconv.Itoa(i)
+                flatmapValueFromHCL2Value(m, key, av)
+                i++
+        }
+        m[prefix+"#"] = strconv.Itoa(i)
+}
+
+// HCL2ValueFromFlatmap converts a map compatible with what would be produced
+// by the "flatmap" package to a HCL2 (really, the cty dynamic types library
+// that HCL2 uses) object type.
+//
+// The intended result type must be provided in order to guide how the
+// map contents are decoded. This must be an object type or this function
+// will panic.
+//
+// Flatmap values can only represent maps when they are of primitive types,
+// so the given type must not have any maps of complex types or the result
+// is undefined.
+//
+// The result may contain null values if the given map does not contain keys
+// for all of the different key paths implied by the given type.
+func HCL2ValueFromFlatmap(m map[string]string, ty cty.Type) (cty.Value, error) {
+        if m == nil {
+                return cty.NullVal(ty), nil
+        }
+        if !ty.IsObjectType() {
+                panic(fmt.Sprintf("HCL2ValueFromFlatmap called on %#v", ty))
+        }
+
+        return hcl2ValueFromFlatmapObject(m, "", ty.AttributeTypes())
+}
+
+func hcl2ValueFromFlatmapValue(m map[string]string, key string, ty cty.Type) (cty.Value, error) {
+        var val cty.Value
+        var err error
+        switch {
+        case ty.IsPrimitiveType():
+                val, err = hcl2ValueFromFlatmapPrimitive(m, key, ty)
+        case ty.IsObjectType():
+                val, err = hcl2ValueFromFlatmapObject(m, key+".", ty.AttributeTypes())
+        case ty.IsTupleType():
+                val, err = hcl2ValueFromFlatmapTuple(m, key+".", ty.TupleElementTypes())
+        case ty.IsMapType():
+                val, err = hcl2ValueFromFlatmapMap(m, key+".", ty)
+        case ty.IsListType():
+                val, err = hcl2ValueFromFlatmapList(m, key+".", ty)
+        case ty.IsSetType():
+                val, err = hcl2ValueFromFlatmapSet(m, key+".", ty)
+        default:
+                err = fmt.Errorf("cannot decode %s from flatmap", ty.FriendlyName())
+        }
+
+        if err != nil {
+                return cty.DynamicVal, err
+        }
+        return val, nil
+}
+
+func hcl2ValueFromFlatmapPrimitive(m map[string]string, key string, ty cty.Type) (cty.Value, error) {
+        rawVal, exists := m[key]
+        if !exists {
+                return cty.NullVal(ty), nil
+        }
+        if rawVal == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        var err error
+        val := cty.StringVal(rawVal)
+        val, err = convert.Convert(val, ty)
+        if err != nil {
+                // This should never happen for _valid_ input, but flatmap data might
+                // be tampered with by the user and become invalid.
+                return cty.DynamicVal, fmt.Errorf("invalid value for %q in state: %s", key, err)
+        }
+
+        return val, nil
+}
+
+func hcl2ValueFromFlatmapObject(m map[string]string, prefix string, atys map[string]cty.Type) (cty.Value, error) {
+        vals := make(map[string]cty.Value)
+        for name, aty := range atys {
+                val, err := hcl2ValueFromFlatmapValue(m, prefix+name, aty)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+                vals[name] = val
+        }
+        return cty.ObjectVal(vals), nil
+}
+
+func hcl2ValueFromFlatmapTuple(m map[string]string, prefix string, etys []cty.Type) (cty.Value, error) {
+        var vals []cty.Value
+
+        // if the container is unknown, there is no count string
+        listName := strings.TrimRight(prefix, ".")
+        if m[listName] == UnknownVariableValue {
+                return cty.UnknownVal(cty.Tuple(etys)), nil
+        }
+
+        countStr, exists := m[prefix+"#"]
+        if !exists {
+                return cty.NullVal(cty.Tuple(etys)), nil
+        }
+        if countStr == UnknownVariableValue {
+                return cty.UnknownVal(cty.Tuple(etys)), nil
+        }
+
+        count, err := strconv.Atoi(countStr)
+        if err != nil {
+                return cty.DynamicVal, fmt.Errorf("invalid count value for %q in state: %s", prefix, err)
+        }
+        if count != len(etys) {
+                return cty.DynamicVal, fmt.Errorf("wrong number of values for %q in state: got %d, but need %d", prefix, count, len(etys))
+        }
+
+        vals = make([]cty.Value, len(etys))
+        for i, ety := range etys {
+                key := prefix + strconv.Itoa(i)
+                val, err := hcl2ValueFromFlatmapValue(m, key, ety)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+                vals[i] = val
+        }
+        return cty.TupleVal(vals), nil
+}
+
+func hcl2ValueFromFlatmapMap(m map[string]string, prefix string, ty cty.Type) (cty.Value, error) {
+        vals := make(map[string]cty.Value)
+        ety := ty.ElementType()
+
+        // if the container is unknown, there is no count string
+        listName := strings.TrimRight(prefix, ".")
+        if m[listName] == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        // We actually don't really care about the "count" of a map for our
+        // purposes here, but we do need to check if it _exists_ in order to
+        // recognize the difference between null (not set at all) and empty.
+        if strCount, exists := m[prefix+"%"]; !exists {
+                return cty.NullVal(ty), nil
+        } else if strCount == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        for fullKey := range m {
+                if !strings.HasPrefix(fullKey, prefix) {
+                        continue
+                }
+
+                // The flatmap format doesn't allow us to distinguish between keys
+                // that contain periods and nested objects, so by convention a
+                // map is only ever of primitive type in flatmap, and we just assume
+                // that the remainder of the raw key (dots and all) is the key we
+                // want in the result value.
+                key := fullKey[len(prefix):]
+                if key == "%" {
+                        // Ignore the "count" key
+                        continue
+                }
+
+                val, err := hcl2ValueFromFlatmapValue(m, fullKey, ety)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+                vals[key] = val
+        }
+
+        if len(vals) == 0 {
+                return cty.MapValEmpty(ety), nil
+        }
+        return cty.MapVal(vals), nil
+}
+
+func hcl2ValueFromFlatmapList(m map[string]string, prefix string, ty cty.Type) (cty.Value, error) {
+        var vals []cty.Value
+
+        // if the container is unknown, there is no count string
+        listName := strings.TrimRight(prefix, ".")
+        if m[listName] == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        countStr, exists := m[prefix+"#"]
+        if !exists {
+                return cty.NullVal(ty), nil
+        }
+        if countStr == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        count, err := strconv.Atoi(countStr)
+        if err != nil {
+                return cty.DynamicVal, fmt.Errorf("invalid count value for %q in state: %s", prefix, err)
+        }
+
+        ety := ty.ElementType()
+        if count == 0 {
+                return cty.ListValEmpty(ety), nil
+        }
+
+        vals = make([]cty.Value, count)
+        for i := 0; i < count; i++ {
+                key := prefix + strconv.Itoa(i)
+                val, err := hcl2ValueFromFlatmapValue(m, key, ety)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+                vals[i] = val
+        }
+
+        return cty.ListVal(vals), nil
+}
+
+func hcl2ValueFromFlatmapSet(m map[string]string, prefix string, ty cty.Type) (cty.Value, error) {
+        var vals []cty.Value
+        ety := ty.ElementType()
+
+        // if the container is unknown, there is no count string
+        listName := strings.TrimRight(prefix, ".")
+        if m[listName] == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        strCount, exists := m[prefix+"#"]
+        if !exists {
+                return cty.NullVal(ty), nil
+        } else if strCount == UnknownVariableValue {
+                return cty.UnknownVal(ty), nil
+        }
+
+        // Keep track of keys we've seen, se we don't add the same set value
+        // multiple times. The cty.Set will normally de-duplicate values, but we may
+        // have unknown values that would not show as equivalent.
+        seen := map[string]bool{}
+
+        for fullKey := range m {
+                if !strings.HasPrefix(fullKey, prefix) {
+                        continue
+                }
+                subKey := fullKey[len(prefix):]
+                if subKey == "#" {
+                        // Ignore the "count" key
+                        continue
+                }
+                key := fullKey
+                if dot := strings.IndexByte(subKey, '.'); dot != -1 {
+                        key = fullKey[:dot+len(prefix)]
+                }
+
+                if seen[key] {
+                        continue
+                }
+
+                seen[key] = true
+
+                // The flatmap format doesn't allow us to distinguish between keys
+                // that contain periods and nested objects, so by convention a
+                // map is only ever of primitive type in flatmap, and we just assume
+                // that the remainder of the raw key (dots and all) is the key we
+                // want in the result value.
+
+                val, err := hcl2ValueFromFlatmapValue(m, key, ety)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+                vals = append(vals, val)
+        }
+
+        if len(vals) == 0 && strCount == "1" {
+                // An empty set wouldn't be represented in the flatmap, so this must be
+                // a single empty object since the count is actually 1.
+                // Add an appropriately typed null value to the set.
+                var val cty.Value
+                switch {
+                case ety.IsMapType():
+                        val = cty.MapValEmpty(ety)
+                case ety.IsListType():
+                        val = cty.ListValEmpty(ety)
+                case ety.IsSetType():
+                        val = cty.SetValEmpty(ety)
+                case ety.IsObjectType():
+                        // TODO: cty.ObjectValEmpty
+                        objectMap := map[string]cty.Value{}
+                        for attr, ty := range ety.AttributeTypes() {
+                                objectMap[attr] = cty.NullVal(ty)
+                        }
+                        val = cty.ObjectVal(objectMap)
+                default:
+                        val = cty.NullVal(ety)
+                }
+                vals = append(vals, val)
+
+        } else if len(vals) == 0 {
+                return cty.SetValEmpty(ety), nil
+        }
+
+        return cty.SetVal(vals), nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/hcl2shim/paths.go b/vendor/github.com/hashicorp/terraform/config/hcl2shim/paths.go
new file mode 100644
index 0000000..3403c02
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/hcl2shim/paths.go
@@ -0,0 +1,276 @@
+package hcl2shim
+
+import (
+        "fmt"
+        "reflect"
+        "strconv"
+        "strings"
+
+        "github.com/zclconf/go-cty/cty"
+)
+
+// RequiresReplace takes a list of flatmapped paths from a
+// InstanceDiff.Attributes along with the corresponding cty.Type, and returns
+// the list of the cty.Paths that are flagged as causing the resource
+// replacement (RequiresNew).
+// This will filter out redundant paths, paths that refer to flatmapped indexes
+// (e.g. "#", "%"), and will return any changes within a set as the path to the
+// set itself.
+func RequiresReplace(attrs []string, ty cty.Type) ([]cty.Path, error) {
+        var paths []cty.Path
+
+        for _, attr := range attrs {
+                p, err := requiresReplacePath(attr, ty)
+                if err != nil {
+                        return nil, err
+                }
+
+                paths = append(paths, p)
+        }
+
+        // now trim off any trailing paths that aren't GetAttrSteps, since only an
+        // attribute itself can require replacement
+        paths = trimPaths(paths)
+
+        // There may be redundant paths due to set elements or index attributes
+        // Do some ugly n^2 filtering, but these are always fairly small sets.
+        for i := 0; i < len(paths)-1; i++ {
+                for j := i + 1; j < len(paths); j++ {
+                        if reflect.DeepEqual(paths[i], paths[j]) {
+                                // swap the tail and slice it off
+                                paths[j], paths[len(paths)-1] = paths[len(paths)-1], paths[j]
+                                paths = paths[:len(paths)-1]
+                                j--
+                        }
+                }
+        }
+
+        return paths, nil
+}
+
+// trimPaths removes any trailing steps that aren't of type GetAttrSet, since
+// only an attribute itself can require replacement
+func trimPaths(paths []cty.Path) []cty.Path {
+        var trimmed []cty.Path
+        for _, path := range paths {
+                path = trimPath(path)
+                if len(path) > 0 {
+                        trimmed = append(trimmed, path)
+                }
+        }
+        return trimmed
+}
+
+func trimPath(path cty.Path) cty.Path {
+        for len(path) > 0 {
+                _, isGetAttr := path[len(path)-1].(cty.GetAttrStep)
+                if isGetAttr {
+                        break
+                }
+                path = path[:len(path)-1]
+        }
+        return path
+}
+
+// requiresReplacePath takes a key from a flatmap along with the cty.Type
+// describing the structure, and returns the cty.Path that would be used to
+// reference the nested value in the data structure.
+// This is used specifically to record the RequiresReplace attributes from a
+// ResourceInstanceDiff.
+func requiresReplacePath(k string, ty cty.Type) (cty.Path, error) {
+        if k == "" {
+                return nil, nil
+        }
+        if !ty.IsObjectType() {
+                panic(fmt.Sprintf("requires replace path on non-object type: %#v", ty))
+        }
+
+        path, err := pathFromFlatmapKeyObject(k, ty.AttributeTypes())
+        if err != nil {
+                return path, fmt.Errorf("[%s] %s", k, err)
+        }
+        return path, nil
+}
+
+func pathSplit(p string) (string, string) {
+        parts := strings.SplitN(p, ".", 2)
+        head := parts[0]
+        rest := ""
+        if len(parts) > 1 {
+                rest = parts[1]
+        }
+        return head, rest
+}
+
+func pathFromFlatmapKeyObject(key string, atys map[string]cty.Type) (cty.Path, error) {
+        k, rest := pathSplit(key)
+
+        path := cty.Path{cty.GetAttrStep{Name: k}}
+
+        ty, ok := atys[k]
+        if !ok {
+                return path, fmt.Errorf("attribute %q not found", k)
+        }
+
+        if rest == "" {
+                return path, nil
+        }
+
+        p, err := pathFromFlatmapKeyValue(rest, ty)
+        if err != nil {
+                return path, err
+        }
+
+        return append(path, p...), nil
+}
+
+func pathFromFlatmapKeyValue(key string, ty cty.Type) (cty.Path, error) {
+        var path cty.Path
+        var err error
+
+        switch {
+        case ty.IsPrimitiveType():
+                err = fmt.Errorf("invalid step %q with type %#v", key, ty)
+        case ty.IsObjectType():
+                path, err = pathFromFlatmapKeyObject(key, ty.AttributeTypes())
+        case ty.IsTupleType():
+                path, err = pathFromFlatmapKeyTuple(key, ty.TupleElementTypes())
+        case ty.IsMapType():
+                path, err = pathFromFlatmapKeyMap(key, ty)
+        case ty.IsListType():
+                path, err = pathFromFlatmapKeyList(key, ty)
+        case ty.IsSetType():
+                path, err = pathFromFlatmapKeySet(key, ty)
+        default:
+                err = fmt.Errorf("unrecognized type: %s", ty.FriendlyName())
+        }
+
+        if err != nil {
+                return path, err
+        }
+
+        return path, nil
+}
+
+func pathFromFlatmapKeyTuple(key string, etys []cty.Type) (cty.Path, error) {
+        var path cty.Path
+        var err error
+
+        k, rest := pathSplit(key)
+
+        // we don't need to convert the index keys to paths
+        if k == "#" {
+                return path, nil
+        }
+
+        idx, err := strconv.Atoi(k)
+        if err != nil {
+                return path, err
+        }
+
+        path = cty.Path{cty.IndexStep{Key: cty.NumberIntVal(int64(idx))}}
+
+        if idx >= len(etys) {
+                return path, fmt.Errorf("index %s out of range in %#v", key, etys)
+        }
+
+        if rest == "" {
+                return path, nil
+        }
+
+        ty := etys[idx]
+
+        p, err := pathFromFlatmapKeyValue(rest, ty.ElementType())
+        if err != nil {
+                return path, err
+        }
+
+        return append(path, p...), nil
+}
+
+func pathFromFlatmapKeyMap(key string, ty cty.Type) (cty.Path, error) {
+        var path cty.Path
+        var err error
+
+        k, rest := key, ""
+        if !ty.ElementType().IsPrimitiveType() {
+                k, rest = pathSplit(key)
+        }
+
+        // we don't need to convert the index keys to paths
+        if k == "%" {
+                return path, nil
+        }
+
+        path = cty.Path{cty.IndexStep{Key: cty.StringVal(k)}}
+
+        if rest == "" {
+                return path, nil
+        }
+
+        p, err := pathFromFlatmapKeyValue(rest, ty.ElementType())
+        if err != nil {
+                return path, err
+        }
+
+        return append(path, p...), nil
+}
+
+func pathFromFlatmapKeyList(key string, ty cty.Type) (cty.Path, error) {
+        var path cty.Path
+        var err error
+
+        k, rest := pathSplit(key)
+
+        // we don't need to convert the index keys to paths
+        if key == "#" {
+                return path, nil
+        }
+
+        idx, err := strconv.Atoi(k)
+        if err != nil {
+                return path, err
+        }
+
+        path = cty.Path{cty.IndexStep{Key: cty.NumberIntVal(int64(idx))}}
+
+        if rest == "" {
+                return path, nil
+        }
+
+        p, err := pathFromFlatmapKeyValue(rest, ty.ElementType())
+        if err != nil {
+                return path, err
+        }
+
+        return append(path, p...), nil
+}
+
+func pathFromFlatmapKeySet(key string, ty cty.Type) (cty.Path, error) {
+        // once we hit a set, we can't return consistent paths, so just mark the
+        // set as a whole changed.
+        return nil, nil
+}
+
+// FlatmapKeyFromPath returns the flatmap equivalent of the given cty.Path for
+// use in generating legacy style diffs.
+func FlatmapKeyFromPath(path cty.Path) string {
+        var parts []string
+
+        for _, step := range path {
+                switch step := step.(type) {
+                case cty.GetAttrStep:
+                        parts = append(parts, step.Name)
+                case cty.IndexStep:
+                        switch ty := step.Key.Type(); {
+                        case ty == cty.String:
+                                parts = append(parts, step.Key.AsString())
+                        case ty == cty.Number:
+                                i, _ := step.Key.AsBigFloat().Int64()
+                                parts = append(parts, strconv.Itoa(int(i)))
+                        }
+                }
+        }
+
+        return strings.Join(parts, ".")
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/hcl2shim/values.go b/vendor/github.com/hashicorp/terraform/config/hcl2shim/values.go
index 0b697a5..daeb0b8 100644
--- a/vendor/github.com/hashicorp/terraform/config/hcl2shim/values.go
+++ b/vendor/github.com/hashicorp/terraform/config/hcl2shim/values.go
@@ -6,6 +6,8 @@ import (
 
         "github.com/hashicorp/hil/ast"
         "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/configs/configschema"
 )
 
 // UnknownVariableValue is a sentinel value that can be used
@@ -14,6 +16,108 @@ import (
 // unknown keys.
 const UnknownVariableValue = "74D93920-ED26-11E3-AC10-0800200C9A66"
 
+// ConfigValueFromHCL2Block is like ConfigValueFromHCL2 but it works only for
+// known object values and uses the provided block schema to perform some
+// additional normalization to better mimic the shape of value that the old
+// HCL1/HIL-based codepaths would've produced.
+//
+// In particular, it discards the collections that we use to represent nested
+// blocks (other than NestingSingle) if they are empty, which better mimics
+// the HCL1 behavior because HCL1 had no knowledge of the schema and so didn't
+// know that an unspecified block _could_ exist.
+//
+// The given object value must conform to the schema's implied type or this
+// function will panic or produce incorrect results.
+//
+// This is primarily useful for the final transition from new-style values to
+// terraform.ResourceConfig before calling to a legacy provider, since
+// helper/schema (the old provider SDK) is particularly sensitive to these
+// subtle differences within its validation code.
+func ConfigValueFromHCL2Block(v cty.Value, schema *configschema.Block) map[string]interface{} {
+        if v.IsNull() {
+                return nil
+        }
+        if !v.IsKnown() {
+                panic("ConfigValueFromHCL2Block used with unknown value")
+        }
+        if !v.Type().IsObjectType() {
+                panic(fmt.Sprintf("ConfigValueFromHCL2Block used with non-object value %#v", v))
+        }
+
+        atys := v.Type().AttributeTypes()
+        ret := make(map[string]interface{})
+
+        for name := range schema.Attributes {
+                if _, exists := atys[name]; !exists {
+                        continue
+                }
+
+                av := v.GetAttr(name)
+                if av.IsNull() {
+                        // Skip nulls altogether, to better mimic how HCL1 would behave
+                        continue
+                }
+                ret[name] = ConfigValueFromHCL2(av)
+        }
+
+        for name, blockS := range schema.BlockTypes {
+                if _, exists := atys[name]; !exists {
+                        continue
+                }
+                bv := v.GetAttr(name)
+                if !bv.IsKnown() {
+                        ret[name] = UnknownVariableValue
+                        continue
+                }
+                if bv.IsNull() {
+                        continue
+                }
+
+                switch blockS.Nesting {
+
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        ret[name] = ConfigValueFromHCL2Block(bv, &blockS.Block)
+
+                case configschema.NestingList, configschema.NestingSet:
+                        l := bv.LengthInt()
+                        if l == 0 {
+                                // skip empty collections to better mimic how HCL1 would behave
+                                continue
+                        }
+
+                        elems := make([]interface{}, 0, l)
+                        for it := bv.ElementIterator(); it.Next(); {
+                                _, ev := it.Element()
+                                if !ev.IsKnown() {
+                                        elems = append(elems, UnknownVariableValue)
+                                        continue
+                                }
+                                elems = append(elems, ConfigValueFromHCL2Block(ev, &blockS.Block))
+                        }
+                        ret[name] = elems
+
+                case configschema.NestingMap:
+                        if bv.LengthInt() == 0 {
+                                // skip empty collections to better mimic how HCL1 would behave
+                                continue
+                        }
+
+                        elems := make(map[string]interface{})
+                        for it := bv.ElementIterator(); it.Next(); {
+                                ek, ev := it.Element()
+                                if !ev.IsKnown() {
+                                        elems[ek.AsString()] = UnknownVariableValue
+                                        continue
+                                }
+                                elems[ek.AsString()] = ConfigValueFromHCL2Block(ev, &blockS.Block)
+                        }
+                        ret[name] = elems
+                }
+        }
+
+        return ret
+}
+
 // ConfigValueFromHCL2 converts a value from HCL2 (really, from the cty dynamic
 // types library that HCL2 uses) to a value type that matches what would've
 // been produced from the HCL-based interpolator for an equivalent structure.
@@ -73,7 +177,10 @@ func ConfigValueFromHCL2(v cty.Value) interface{} {
                 it := v.ElementIterator()
                 for it.Next() {
                         ek, ev := it.Element()
-                        l[ek.AsString()] = ConfigValueFromHCL2(ev)
+                        cv := ConfigValueFromHCL2(ev)
+                        if cv != nil {
+                                l[ek.AsString()] = cv
+                        }
                 }
                 return l
         }
diff --git a/vendor/github.com/hashicorp/terraform/config/hcl2shim/values_equiv.go b/vendor/github.com/hashicorp/terraform/config/hcl2shim/values_equiv.go
new file mode 100644
index 0000000..92f0213
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/hcl2shim/values_equiv.go
@@ -0,0 +1,214 @@
+package hcl2shim
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// ValuesSDKEquivalent returns true if both of the given values seem equivalent
+// as far as the legacy SDK diffing code would be concerned.
+//
+// Since SDK diffing is a fuzzy, inexact operation, this function is also
+// fuzzy and inexact. It will err on the side of returning false if it
+// encounters an ambiguous situation. Ambiguity is most common in the presence
+// of sets because in practice it is impossible to exactly correlate
+// nonequal-but-equivalent set elements because they have no identity separate
+// from their value.
+//
+// This must be used _only_ for comparing values for equivalence within the
+// SDK planning code. It is only meaningful to compare the "prior state"
+// provided by Terraform Core with the "planned new state" produced by the
+// legacy SDK code via shims. In particular it is not valid to use this
+// function with their the config value or the "proposed new state" value
+// because they contain only the subset of data that Terraform Core itself is
+// able to determine.
+func ValuesSDKEquivalent(a, b cty.Value) bool {
+        if a == cty.NilVal || b == cty.NilVal {
+                // We don't generally expect nils to appear, but we'll allow them
+                // for robustness since the data structures produced by legacy SDK code
+                // can sometimes be non-ideal.
+                return a == b // equivalent if they are _both_ nil
+        }
+        if a.RawEquals(b) {
+                // Easy case. We use RawEquals because we want two unknowns to be
+                // considered equal here, whereas "Equals" would return unknown.
+                return true
+        }
+        if !a.IsKnown() || !b.IsKnown() {
+                // Two unknown values are equivalent regardless of type. A known is
+                // never equivalent to an unknown.
+                return a.IsKnown() == b.IsKnown()
+        }
+        if aZero, bZero := valuesSDKEquivalentIsNullOrZero(a), valuesSDKEquivalentIsNullOrZero(b); aZero || bZero {
+                // Two null/zero values are equivalent regardless of type. A non-zero is
+                // never equivalent to a zero.
+                return aZero == bZero
+        }
+
+        // If we get down here then we are guaranteed that both a and b are known,
+        // non-null values.
+
+        aTy := a.Type()
+        bTy := b.Type()
+        switch {
+        case aTy.IsSetType() && bTy.IsSetType():
+                return valuesSDKEquivalentSets(a, b)
+        case aTy.IsListType() && bTy.IsListType():
+                return valuesSDKEquivalentSequences(a, b)
+        case aTy.IsTupleType() && bTy.IsTupleType():
+                return valuesSDKEquivalentSequences(a, b)
+        case aTy.IsMapType() && bTy.IsMapType():
+                return valuesSDKEquivalentMappings(a, b)
+        case aTy.IsObjectType() && bTy.IsObjectType():
+                return valuesSDKEquivalentMappings(a, b)
+        case aTy == cty.Number && bTy == cty.Number:
+                return valuesSDKEquivalentNumbers(a, b)
+        default:
+                // We've now covered all the interesting cases, so anything that falls
+                // down here cannot be equivalent.
+                return false
+        }
+}
+
+// valuesSDKEquivalentIsNullOrZero returns true if the given value is either
+// null or is the "zero value" (in the SDK/Go sense) for its type.
+func valuesSDKEquivalentIsNullOrZero(v cty.Value) bool {
+        if v == cty.NilVal {
+                return true
+        }
+
+        ty := v.Type()
+        switch {
+        case !v.IsKnown():
+                return false
+        case v.IsNull():
+                return true
+
+        // After this point, v is always known and non-null
+        case ty.IsListType() || ty.IsSetType() || ty.IsMapType() || ty.IsObjectType() || ty.IsTupleType():
+                return v.LengthInt() == 0
+        case ty == cty.String:
+                return v.RawEquals(cty.StringVal(""))
+        case ty == cty.Number:
+                return v.RawEquals(cty.Zero)
+        case ty == cty.Bool:
+                return v.RawEquals(cty.False)
+        default:
+                // The above is exhaustive, but for robustness we'll consider anything
+                // else to _not_ be zero unless it is null.
+                return false
+        }
+}
+
+// valuesSDKEquivalentSets returns true only if each of the elements in a can
+// be correlated with at least one equivalent element in b and vice-versa.
+// This is a fuzzy operation that prefers to signal non-equivalence if it cannot
+// be certain that all elements are accounted for.
+func valuesSDKEquivalentSets(a, b cty.Value) bool {
+        if aLen, bLen := a.LengthInt(), b.LengthInt(); aLen != bLen {
+                return false
+        }
+
+        // Our methodology here is a little tricky, to deal with the fact that
+        // it's impossible to directly correlate two non-equal set elements because
+        // they don't have identities separate from their values.
+        // The approach is to count the number of equivalent elements each element
+        // of a has in b and vice-versa, and then return true only if each element
+        // in both sets has at least one equivalent.
+        as := a.AsValueSlice()
+        bs := b.AsValueSlice()
+        aeqs := make([]bool, len(as))
+        beqs := make([]bool, len(bs))
+        for ai, av := range as {
+                for bi, bv := range bs {
+                        if ValuesSDKEquivalent(av, bv) {
+                                aeqs[ai] = true
+                                beqs[bi] = true
+                        }
+                }
+        }
+
+        for _, eq := range aeqs {
+                if !eq {
+                        return false
+                }
+        }
+        for _, eq := range beqs {
+                if !eq {
+                        return false
+                }
+        }
+        return true
+}
+
+// valuesSDKEquivalentSequences decides equivalence for two sequence values
+// (lists or tuples).
+func valuesSDKEquivalentSequences(a, b cty.Value) bool {
+        as := a.AsValueSlice()
+        bs := b.AsValueSlice()
+        if len(as) != len(bs) {
+                return false
+        }
+
+        for i := range as {
+                if !ValuesSDKEquivalent(as[i], bs[i]) {
+                        return false
+                }
+        }
+        return true
+}
+
+// valuesSDKEquivalentMappings decides equivalence for two mapping values
+// (maps or objects).
+func valuesSDKEquivalentMappings(a, b cty.Value) bool {
+        as := a.AsValueMap()
+        bs := b.AsValueMap()
+        if len(as) != len(bs) {
+                return false
+        }
+
+        for k, av := range as {
+                bv, ok := bs[k]
+                if !ok {
+                        return false
+                }
+                if !ValuesSDKEquivalent(av, bv) {
+                        return false
+                }
+        }
+        return true
+}
+
+// valuesSDKEquivalentNumbers decides equivalence for two number values based
+// on the fact that the SDK uses int and float64 representations while
+// cty (and thus Terraform Core) uses big.Float, and so we expect to lose
+// precision in the round-trip.
+//
+// This does _not_ attempt to allow for an epsilon difference that may be
+// caused by accumulated innacuracy in a float calculation, under the
+// expectation that providers generally do not actually do compuations on
+// floats and instead just pass string representations of them on verbatim
+// to remote APIs. A remote API _itself_ may introduce inaccuracy, but that's
+// a problem for the provider itself to deal with, based on its knowledge of
+// the remote system, e.g. using DiffSuppressFunc.
+func valuesSDKEquivalentNumbers(a, b cty.Value) bool {
+        if a.RawEquals(b) {
+                return true // easy
+        }
+
+        af := a.AsBigFloat()
+        bf := b.AsBigFloat()
+
+        if af.IsInt() != bf.IsInt() {
+                return false
+        }
+        if af.IsInt() && bf.IsInt() {
+                return false // a.RawEquals(b) test above is good enough for integers
+        }
+
+        // The SDK supports only int and float64, so if it's not an integer
+        // we know that only a float64-level of precision can possibly be
+        // significant.
+        af64, _ := af.Float64()
+        bf64, _ := bf.Float64()
+        return af64 == bf64
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go b/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go
index 421edb0..6a2050c 100644
--- a/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go
+++ b/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go
@@ -47,6 +47,20 @@ func stringSliceToVariableValue(values []string) []ast.Variable {
         return output
 }
 
+// listVariableSliceToVariableValue converts a list of lists into the value
+// required to be returned from interpolation functions which return TypeList.
+func listVariableSliceToVariableValue(values [][]ast.Variable) []ast.Variable {
+        output := make([]ast.Variable, len(values))
+
+        for index, value := range values {
+                output[index] = ast.Variable{
+                        Type:  ast.TypeList,
+                        Value: value,
+                }
+        }
+        return output
+}
+
 func listVariableValueToStringSlice(values []ast.Variable) ([]string, error) {
         output := make([]string, len(values))
         for index, value := range values {
@@ -61,74 +75,69 @@ func listVariableValueToStringSlice(values []ast.Variable) ([]string, error) {
 // Funcs is the mapping of built-in functions for configuration.
 func Funcs() map[string]ast.Function {
         return map[string]ast.Function{
-                "abs":              interpolationFuncAbs(),
-                "basename":         interpolationFuncBasename(),
-                "base64decode":     interpolationFuncBase64Decode(),
-                "base64encode":     interpolationFuncBase64Encode(),
-                "base64gzip":       interpolationFuncBase64Gzip(),
-                "base64sha256":     interpolationFuncBase64Sha256(),
-                "base64sha512":     interpolationFuncBase64Sha512(),
-                "bcrypt":           interpolationFuncBcrypt(),
-                "ceil":             interpolationFuncCeil(),
-                "chomp":            interpolationFuncChomp(),
-                "cidrhost":         interpolationFuncCidrHost(),
-                "cidrnetmask":      interpolationFuncCidrNetmask(),
-                "cidrsubnet":       interpolationFuncCidrSubnet(),
-                "coalesce":         interpolationFuncCoalesce(),
-                "coalescelist":     interpolationFuncCoalesceList(),
-                "compact":          interpolationFuncCompact(),
-                "concat":           interpolationFuncConcat(),
-                "contains":         interpolationFuncContains(),
-                "dirname":          interpolationFuncDirname(),
-                "distinct":         interpolationFuncDistinct(),
-                "element":          interpolationFuncElement(),
-                "chunklist":        interpolationFuncChunklist(),
-                "file":             interpolationFuncFile(),
-                "filebase64sha256": interpolationFuncMakeFileHash(interpolationFuncBase64Sha256()),
-                "filebase64sha512": interpolationFuncMakeFileHash(interpolationFuncBase64Sha512()),
-                "filemd5":          interpolationFuncMakeFileHash(interpolationFuncMd5()),
-                "filesha1":         interpolationFuncMakeFileHash(interpolationFuncSha1()),
-                "filesha256":       interpolationFuncMakeFileHash(interpolationFuncSha256()),
-                "filesha512":       interpolationFuncMakeFileHash(interpolationFuncSha512()),
-                "matchkeys":        interpolationFuncMatchKeys(),
-                "flatten":          interpolationFuncFlatten(),
-                "floor":            interpolationFuncFloor(),
-                "format":           interpolationFuncFormat(),
-                "formatlist":       interpolationFuncFormatList(),
-                "indent":           interpolationFuncIndent(),
-                "index":            interpolationFuncIndex(),
-                "join":             interpolationFuncJoin(),
-                "jsonencode":       interpolationFuncJSONEncode(),
-                "length":           interpolationFuncLength(),
-                "list":             interpolationFuncList(),
-                "log":              interpolationFuncLog(),
-                "lower":            interpolationFuncLower(),
-                "map":              interpolationFuncMap(),
-                "max":              interpolationFuncMax(),
-                "md5":              interpolationFuncMd5(),
-                "merge":            interpolationFuncMerge(),
-                "min":              interpolationFuncMin(),
-                "pathexpand":       interpolationFuncPathExpand(),
-                "pow":              interpolationFuncPow(),
-                "uuid":             interpolationFuncUUID(),
-                "replace":          interpolationFuncReplace(),
-                "rsadecrypt":       interpolationFuncRsaDecrypt(),
-                "sha1":             interpolationFuncSha1(),
-                "sha256":           interpolationFuncSha256(),
-                "sha512":           interpolationFuncSha512(),
-                "signum":           interpolationFuncSignum(),
-                "slice":            interpolationFuncSlice(),
-                "sort":             interpolationFuncSort(),
-                "split":            interpolationFuncSplit(),
-                "substr":           interpolationFuncSubstr(),
-                "timestamp":        interpolationFuncTimestamp(),
-                "timeadd":          interpolationFuncTimeAdd(),
-                "title":            interpolationFuncTitle(),
-                "transpose":        interpolationFuncTranspose(),
-                "trimspace":        interpolationFuncTrimSpace(),
-                "upper":            interpolationFuncUpper(),
-                "urlencode":        interpolationFuncURLEncode(),
-                "zipmap":           interpolationFuncZipMap(),
+                "abs":          interpolationFuncAbs(),
+                "basename":     interpolationFuncBasename(),
+                "base64decode": interpolationFuncBase64Decode(),
+                "base64encode": interpolationFuncBase64Encode(),
+                "base64gzip":   interpolationFuncBase64Gzip(),
+                "base64sha256": interpolationFuncBase64Sha256(),
+                "base64sha512": interpolationFuncBase64Sha512(),
+                "bcrypt":       interpolationFuncBcrypt(),
+                "ceil":         interpolationFuncCeil(),
+                "chomp":        interpolationFuncChomp(),
+                "cidrhost":     interpolationFuncCidrHost(),
+                "cidrnetmask":  interpolationFuncCidrNetmask(),
+                "cidrsubnet":   interpolationFuncCidrSubnet(),
+                "coalesce":     interpolationFuncCoalesce(),
+                "coalescelist": interpolationFuncCoalesceList(),
+                "compact":      interpolationFuncCompact(),
+                "concat":       interpolationFuncConcat(),
+                "contains":     interpolationFuncContains(),
+                "dirname":      interpolationFuncDirname(),
+                "distinct":     interpolationFuncDistinct(),
+                "element":      interpolationFuncElement(),
+                "chunklist":    interpolationFuncChunklist(),
+                "file":         interpolationFuncFile(),
+                "matchkeys":    interpolationFuncMatchKeys(),
+                "flatten":      interpolationFuncFlatten(),
+                "floor":        interpolationFuncFloor(),
+                "format":       interpolationFuncFormat(),
+                "formatlist":   interpolationFuncFormatList(),
+                "indent":       interpolationFuncIndent(),
+                "index":        interpolationFuncIndex(),
+                "join":         interpolationFuncJoin(),
+                "jsonencode":   interpolationFuncJSONEncode(),
+                "length":       interpolationFuncLength(),
+                "list":         interpolationFuncList(),
+                "log":          interpolationFuncLog(),
+                "lower":        interpolationFuncLower(),
+                "map":          interpolationFuncMap(),
+                "max":          interpolationFuncMax(),
+                "md5":          interpolationFuncMd5(),
+                "merge":        interpolationFuncMerge(),
+                "min":          interpolationFuncMin(),
+                "pathexpand":   interpolationFuncPathExpand(),
+                "pow":          interpolationFuncPow(),
+                "uuid":         interpolationFuncUUID(),
+                "replace":      interpolationFuncReplace(),
+                "reverse":      interpolationFuncReverse(),
+                "rsadecrypt":   interpolationFuncRsaDecrypt(),
+                "sha1":         interpolationFuncSha1(),
+                "sha256":       interpolationFuncSha256(),
+                "sha512":       interpolationFuncSha512(),
+                "signum":       interpolationFuncSignum(),
+                "slice":        interpolationFuncSlice(),
+                "sort":         interpolationFuncSort(),
+                "split":        interpolationFuncSplit(),
+                "substr":       interpolationFuncSubstr(),
+                "timestamp":    interpolationFuncTimestamp(),
+                "timeadd":      interpolationFuncTimeAdd(),
+                "title":        interpolationFuncTitle(),
+                "transpose":    interpolationFuncTranspose(),
+                "trimspace":    interpolationFuncTrimSpace(),
+                "upper":        interpolationFuncUpper(),
+                "urlencode":    interpolationFuncURLEncode(),
+                "zipmap":       interpolationFuncZipMap(),
         }
 }
 
@@ -947,6 +956,25 @@ func interpolationFuncReplace() ast.Function {
         }
 }
 
+// interpolationFuncReverse implements the "reverse" function that does list reversal
+func interpolationFuncReverse() ast.Function {
+        return ast.Function{
+                ArgTypes:   []ast.Type{ast.TypeList},
+                ReturnType: ast.TypeList,
+                Variadic:   false,
+                Callback: func(args []interface{}) (interface{}, error) {
+                        inputList := args[0].([]ast.Variable)
+
+                        reversedList := make([]ast.Variable, len(inputList))
+                        for idx := range inputList {
+                                reversedList[len(inputList)-1-idx] = inputList[idx]
+                        }
+
+                        return reversedList, nil
+                },
+        }
+}
+
 func interpolationFuncLength() ast.Function {
         return ast.Function{
                 ArgTypes:   []ast.Type{ast.TypeAny},
@@ -1731,24 +1759,3 @@ func interpolationFuncRsaDecrypt() ast.Function {
                 },
         }
 }
-
-// interpolationFuncMakeFileHash constructs a function that hashes the contents
-// of a file by combining the implementations of the file(...) function and
-// a given other function that is assumed to take a single string argument and
-// return a hash value.
-func interpolationFuncMakeFileHash(hashFunc ast.Function) ast.Function {
-        fileFunc := interpolationFuncFile()
-
-        return ast.Function{
-                ArgTypes:   []ast.Type{ast.TypeString},
-                ReturnType: ast.TypeString,
-                Callback: func(args []interface{}) (interface{}, error) {
-                        filename := args[0].(string)
-                        contents, err := fileFunc.Callback([]interface{}{filename})
-                        if err != nil {
-                                return nil, err
-                        }
-                        return hashFunc.Callback([]interface{}{contents})
-                },
-        }
-}
diff --git a/vendor/github.com/hashicorp/terraform/config/module/storage.go b/vendor/github.com/hashicorp/terraform/config/module/storage.go
index 58e3a10..7734cbc 100644
--- a/vendor/github.com/hashicorp/terraform/config/module/storage.go
+++ b/vendor/github.com/hashicorp/terraform/config/module/storage.go
@@ -7,7 +7,6 @@ import (
         "log"
         "os"
         "path/filepath"
-        "strings"
 
         getter "github.com/hashicorp/go-getter"
         "github.com/hashicorp/terraform/registry"
@@ -101,21 +100,6 @@ func (s Storage) loadManifest() (moduleManifest, error) {
         if err := json.Unmarshal(data, &manifest); err != nil {
                 return manifest, err
         }
-
-        for i, rec := range manifest.Modules {
-                // If the path was recorded before we changed to always using a
-                // slash as separator, we delete the record from the manifest so
-                // it can be discovered again and will be recorded using a slash.
-                if strings.Contains(rec.Dir, "\\") {
-                        manifest.Modules[i] = manifest.Modules[len(manifest.Modules)-1]
-                        manifest.Modules = manifest.Modules[:len(manifest.Modules)-1]
-                        continue
-                }
-
-                // Make sure we use the correct path separator.
-                rec.Dir = filepath.FromSlash(rec.Dir)
-        }
-
         return manifest, nil
 }
 
@@ -146,9 +130,6 @@ func (s Storage) recordModule(rec moduleRecord) error {
                 }
         }
 
-        // Make sure we always use a slash separator.
-        rec.Dir = filepath.ToSlash(rec.Dir)
-
         manifest.Modules = append(manifest.Modules, rec)
 
         js, err := json.Marshal(manifest)
@@ -331,7 +312,7 @@ func (s Storage) findRegistryModule(mSource, constraint string) (moduleRecord, e
         // we need to lookup available versions
         // Only on Get if it's not found, on unconditionally on Update
         if (s.Mode == GetModeGet && !found) || (s.Mode == GetModeUpdate) {
-                resp, err := s.registry.Versions(mod)
+                resp, err := s.registry.ModuleVersions(mod)
                 if err != nil {
                         return rec, err
                 }
@@ -351,7 +332,7 @@ func (s Storage) findRegistryModule(mSource, constraint string) (moduleRecord, e
 
                 rec.Version = match.Version
 
-                rec.url, err = s.registry.Location(mod, rec.Version)
+                rec.url, err = s.registry.ModuleLocation(mod, rec.Version)
                 if err != nil {
                         return rec, err
                 }
diff --git a/vendor/github.com/hashicorp/terraform/config/resource_mode_string.go b/vendor/github.com/hashicorp/terraform/config/resource_mode_string.go
index 8a55e06..0105278 100644
--- a/vendor/github.com/hashicorp/terraform/config/resource_mode_string.go
+++ b/vendor/github.com/hashicorp/terraform/config/resource_mode_string.go
@@ -4,6 +4,14 @@ package config
 
 import "strconv"
 
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[ManagedResourceMode-0]
+        _ = x[DataResourceMode-1]
+}
+
 const _ResourceMode_name = "ManagedResourceModeDataResourceMode"
 
 var _ResourceMode_index = [...]uint8{0, 19, 35}
diff --git a/vendor/github.com/hashicorp/terraform/configs/backend.go b/vendor/github.com/hashicorp/terraform/configs/backend.go
new file mode 100644
index 0000000..6df7ddd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/backend.go
@@ -0,0 +1,55 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Backend represents a "backend" block inside a "terraform" block in a module
+// or file.
+type Backend struct {
+        Type   string
+        Config hcl.Body
+
+        TypeRange hcl.Range
+        DeclRange hcl.Range
+}
+
+func decodeBackendBlock(block *hcl.Block) (*Backend, hcl.Diagnostics) {
+        return &Backend{
+                Type:      block.Labels[0],
+                TypeRange: block.LabelRanges[0],
+                Config:    block.Body,
+                DeclRange: block.DefRange,
+        }, nil
+}
+
+// Hash produces a hash value for the reciever that covers the type and the
+// portions of the config that conform to the given schema.
+//
+// If the config does not conform to the schema then the result is not
+// meaningful for comparison since it will be based on an incomplete result.
+//
+// As an exception, required attributes in the schema are treated as optional
+// for the purpose of hashing, so that an incomplete configuration can still
+// be hashed. Other errors, such as extraneous attributes, have no such special
+// case.
+func (b *Backend) Hash(schema *configschema.Block) int {
+        // Don't fail if required attributes are not set. Instead, we'll just
+        // hash them as nulls.
+        schema = schema.NoneRequired()
+        spec := schema.DecoderSpec()
+        val, _ := hcldec.Decode(b.Config, spec, nil)
+        if val == cty.NilVal {
+                val = cty.UnknownVal(schema.ImpliedType())
+        }
+
+        toHash := cty.TupleVal([]cty.Value{
+                cty.StringVal(b.Type),
+                val,
+        })
+
+        return toHash.Hash()
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/compat_shim.go b/vendor/github.com/hashicorp/terraform/configs/compat_shim.go
new file mode 100644
index 0000000..66037fc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/compat_shim.go
@@ -0,0 +1,116 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// -------------------------------------------------------------------------
+// Functions in this file are compatibility shims intended to ease conversion
+// from the old configuration loader. Any use of these functions that makes
+// a change should generate a deprecation warning explaining to the user how
+// to update their code for new patterns.
+//
+// Shims are particularly important for any patterns that have been widely
+// documented in books, tutorials, etc. Users will still be starting from
+// these examples and we want to help them adopt the latest patterns rather
+// than leave them stranded.
+// -------------------------------------------------------------------------
+
+// shimTraversalInString takes any arbitrary expression and checks if it is
+// a quoted string in the native syntax. If it _is_, then it is parsed as a
+// traversal and re-wrapped into a synthetic traversal expression and a
+// warning is generated. Otherwise, the given expression is just returned
+// verbatim.
+//
+// This function has no effect on expressions from the JSON syntax, since
+// traversals in strings are the required pattern in that syntax.
+//
+// If wantKeyword is set, the generated warning diagnostic will talk about
+// keywords rather than references. The behavior is otherwise unchanged, and
+// the caller remains responsible for checking that the result is indeed
+// a keyword, e.g. using hcl.ExprAsKeyword.
+func shimTraversalInString(expr hcl.Expression, wantKeyword bool) (hcl.Expression, hcl.Diagnostics) {
+        // ObjectConsKeyExpr is a special wrapper type used for keys on object
+        // constructors to deal with the fact that naked identifiers are normally
+        // handled as "bareword" strings rather than as variable references. Since
+        // we know we're interpreting as a traversal anyway (and thus it won't
+        // matter whether it's a string or an identifier) we can safely just unwrap
+        // here and then process whatever we find inside as normal.
+        if ocke, ok := expr.(*hclsyntax.ObjectConsKeyExpr); ok {
+                expr = ocke.Wrapped
+        }
+
+        if !exprIsNativeQuotedString(expr) {
+                return expr, nil
+        }
+
+        strVal, diags := expr.Value(nil)
+        if diags.HasErrors() || strVal.IsNull() || !strVal.IsKnown() {
+                // Since we're not even able to attempt a shim here, we'll discard
+                // the diagnostics we saw so far and let the caller's own error
+                // handling take care of reporting the invalid expression.
+                return expr, nil
+        }
+
+        // The position handling here isn't _quite_ right because it won't
+        // take into account any escape sequences in the literal string, but
+        // it should be close enough for any error reporting to make sense.
+        srcRange := expr.Range()
+        startPos := srcRange.Start // copy
+        startPos.Column++          // skip initial quote
+        startPos.Byte++            // skip initial quote
+
+        traversal, tDiags := hclsyntax.ParseTraversalAbs(
+                []byte(strVal.AsString()),
+                srcRange.Filename,
+                startPos,
+        )
+        diags = append(diags, tDiags...)
+
+        // For initial release our deprecation warnings are disabled to allow
+        // a period where modules can be compatible with both old and new
+        // conventions.
+        // FIXME: Re-enable these deprecation warnings in a release prior to
+        // Terraform 0.13 and then remove the shims altogether for 0.13.
+        /*
+                if wantKeyword {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagWarning,
+                                Summary:  "Quoted keywords are deprecated",
+                                Detail:   "In this context, keywords are expected literally rather than in quotes. Previous versions of Terraform required quotes, but that usage is now deprecated. Remove the quotes surrounding this keyword to silence this warning.",
+                                Subject:  &srcRange,
+                        })
+                } else {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagWarning,
+                                Summary:  "Quoted references are deprecated",
+                                Detail:   "In this context, references are expected literally rather than in quotes. Previous versions of Terraform required quotes, but that usage is now deprecated. Remove the quotes surrounding this reference to silence this warning.",
+                                Subject:  &srcRange,
+                        })
+                }
+        */
+
+        return &hclsyntax.ScopeTraversalExpr{
+                Traversal: traversal,
+                SrcRange:  srcRange,
+        }, diags
+}
+
+// shimIsIgnoreChangesStar returns true if the given expression seems to be
+// a string literal whose value is "*". This is used to support a legacy
+// form of ignore_changes = all .
+//
+// This function does not itself emit any diagnostics, so it's the caller's
+// responsibility to emit a warning diagnostic when this function returns true.
+func shimIsIgnoreChangesStar(expr hcl.Expression) bool {
+        val, valDiags := expr.Value(nil)
+        if valDiags.HasErrors() {
+                return false
+        }
+        if val.Type() != cty.String || val.IsNull() || !val.IsKnown() {
+                return false
+        }
+        return val.AsString() == "*"
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/config.go b/vendor/github.com/hashicorp/terraform/configs/config.go
new file mode 100644
index 0000000..8294312
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/config.go
@@ -0,0 +1,205 @@
+package configs
+
+import (
+        "sort"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// A Config is a node in the tree of modules within a configuration.
+//
+// The module tree is constructed by following ModuleCall instances recursively
+// through the root module transitively into descendent modules.
+//
+// A module tree described in *this* package represents the static tree
+// represented by configuration. During evaluation a static ModuleNode may
+// expand into zero or more module instances depending on the use of count and
+// for_each configuration attributes within each call.
+type Config struct {
+        // RootModule points to the Config for the root module within the same
+        // module tree as this module. If this module _is_ the root module then
+        // this is self-referential.
+        Root *Config
+
+        // ParentModule points to the Config for the module that directly calls
+        // this module. If this is the root module then this field is nil.
+        Parent *Config
+
+        // Path is a sequence of module logical names that traverse from the root
+        // module to this config. Path is empty for the root module.
+        //
+        // This should only be used to display paths to the end-user in rare cases
+        // where we are talking about the static module tree, before module calls
+        // have been resolved. In most cases, an addrs.ModuleInstance describing
+        // a node in the dynamic module tree is better, since it will then include
+        // any keys resulting from evaluating "count" and "for_each" arguments.
+        Path addrs.Module
+
+        // ChildModules points to the Config for each of the direct child modules
+        // called from this module. The keys in this map match the keys in
+        // Module.ModuleCalls.
+        Children map[string]*Config
+
+        // Module points to the object describing the configuration for the
+        // various elements (variables, resources, etc) defined by this module.
+        Module *Module
+
+        // CallRange is the source range for the header of the module block that
+        // requested this module.
+        //
+        // This field is meaningless for the root module, where its contents are undefined.
+        CallRange hcl.Range
+
+        // SourceAddr is the source address that the referenced module was requested
+        // from, as specified in configuration.
+        //
+        // This field is meaningless for the root module, where its contents are undefined.
+        SourceAddr string
+
+        // SourceAddrRange is the location in the configuration source where the
+        // SourceAddr value was set, for use in diagnostic messages.
+        //
+        // This field is meaningless for the root module, where its contents are undefined.
+        SourceAddrRange hcl.Range
+
+        // Version is the specific version that was selected for this module,
+        // based on version constraints given in configuration.
+        //
+        // This field is nil if the module was loaded from a non-registry source,
+        // since versions are not supported for other sources.
+        //
+        // This field is meaningless for the root module, where it will always
+        // be nil.
+        Version *version.Version
+}
+
+// NewEmptyConfig constructs a single-node configuration tree with an empty
+// root module. This is generally a pretty useless thing to do, so most callers
+// should instead use BuildConfig.
+func NewEmptyConfig() *Config {
+        ret := &Config{}
+        ret.Root = ret
+        ret.Children = make(map[string]*Config)
+        ret.Module = &Module{}
+        return ret
+}
+
+// Depth returns the number of "hops" the receiver is from the root of its
+// module tree, with the root module having a depth of zero.
+func (c *Config) Depth() int {
+        ret := 0
+        this := c
+        for this.Parent != nil {
+                ret++
+                this = this.Parent
+        }
+        return ret
+}
+
+// DeepEach calls the given function once for each module in the tree, starting
+// with the receiver.
+//
+// A parent is always called before its children and children of a particular
+// node are visited in lexicographic order by their names.
+func (c *Config) DeepEach(cb func(c *Config)) {
+        cb(c)
+
+        names := make([]string, 0, len(c.Children))
+        for name := range c.Children {
+                names = append(names, name)
+        }
+
+        for _, name := range names {
+                c.Children[name].DeepEach(cb)
+        }
+}
+
+// AllModules returns a slice of all the receiver and all of its descendent
+// nodes in the module tree, in the same order they would be visited by
+// DeepEach.
+func (c *Config) AllModules() []*Config {
+        var ret []*Config
+        c.DeepEach(func(c *Config) {
+                ret = append(ret, c)
+        })
+        return ret
+}
+
+// Descendent returns the descendent config that has the given path beneath
+// the receiver, or nil if there is no such module.
+//
+// The path traverses the static module tree, prior to any expansion to handle
+// count and for_each arguments.
+//
+// An empty path will just return the receiver, and is therefore pointless.
+func (c *Config) Descendent(path addrs.Module) *Config {
+        current := c
+        for _, name := range path {
+                current = current.Children[name]
+                if current == nil {
+                        return nil
+                }
+        }
+        return current
+}
+
+// DescendentForInstance is like Descendent except that it accepts a path
+// to a particular module instance in the dynamic module graph, returning
+// the node from the static module graph that corresponds to it.
+//
+// All instances created by a particular module call share the same
+// configuration, so the keys within the given path are disregarded.
+func (c *Config) DescendentForInstance(path addrs.ModuleInstance) *Config {
+        current := c
+        for _, step := range path {
+                current = current.Children[step.Name]
+                if current == nil {
+                        return nil
+                }
+        }
+        return current
+}
+
+// ProviderTypes returns the names of each distinct provider type referenced
+// in the receiving configuration.
+//
+// This is a helper for easily determining which provider types are required
+// to fully interpret the configuration, though it does not include version
+// information and so callers are expected to have already dealt with
+// provider version selection in an earlier step and have identified suitable
+// versions for each provider.
+func (c *Config) ProviderTypes() []string {
+        m := make(map[string]struct{})
+        c.gatherProviderTypes(m)
+
+        ret := make([]string, 0, len(m))
+        for k := range m {
+                ret = append(ret, k)
+        }
+        sort.Strings(ret)
+        return ret
+}
+func (c *Config) gatherProviderTypes(m map[string]struct{}) {
+        if c == nil {
+                return
+        }
+
+        for _, pc := range c.Module.ProviderConfigs {
+                m[pc.Name] = struct{}{}
+        }
+        for _, rc := range c.Module.ManagedResources {
+                providerAddr := rc.ProviderConfigAddr()
+                m[providerAddr.Type] = struct{}{}
+        }
+        for _, rc := range c.Module.DataResources {
+                providerAddr := rc.ProviderConfigAddr()
+                m[providerAddr.Type] = struct{}{}
+        }
+
+        // Must also visit our child modules, recursively.
+        for _, cc := range c.Children {
+                cc.gatherProviderTypes(m)
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/config_build.go b/vendor/github.com/hashicorp/terraform/configs/config_build.go
new file mode 100644
index 0000000..948b2c8
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/config_build.go
@@ -0,0 +1,179 @@
+package configs
+
+import (
+        "sort"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// BuildConfig constructs a Config from a root module by loading all of its
+// descendent modules via the given ModuleWalker.
+//
+// The result is a module tree that has so far only had basic module- and
+// file-level invariants validated. If the returned diagnostics contains errors,
+// the returned module tree may be incomplete but can still be used carefully
+// for static analysis.
+func BuildConfig(root *Module, walker ModuleWalker) (*Config, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        cfg := &Config{
+                Module: root,
+        }
+        cfg.Root = cfg // Root module is self-referential.
+        cfg.Children, diags = buildChildModules(cfg, walker)
+        return cfg, diags
+}
+
+func buildChildModules(parent *Config, walker ModuleWalker) (map[string]*Config, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        ret := map[string]*Config{}
+
+        calls := parent.Module.ModuleCalls
+
+        // We'll sort the calls by their local names so that they'll appear in a
+        // predictable order in any logging that's produced during the walk.
+        callNames := make([]string, 0, len(calls))
+        for k := range calls {
+                callNames = append(callNames, k)
+        }
+        sort.Strings(callNames)
+
+        for _, callName := range callNames {
+                call := calls[callName]
+                path := make([]string, len(parent.Path)+1)
+                copy(path, parent.Path)
+                path[len(path)-1] = call.Name
+
+                req := ModuleRequest{
+                        Name:              call.Name,
+                        Path:              path,
+                        SourceAddr:        call.SourceAddr,
+                        SourceAddrRange:   call.SourceAddrRange,
+                        VersionConstraint: call.Version,
+                        Parent:            parent,
+                        CallRange:         call.DeclRange,
+                }
+
+                mod, ver, modDiags := walker.LoadModule(&req)
+                diags = append(diags, modDiags...)
+                if mod == nil {
+                        // nil can be returned if the source address was invalid and so
+                        // nothing could be loaded whatsoever. LoadModule should've
+                        // returned at least one error diagnostic in that case.
+                        continue
+                }
+
+                child := &Config{
+                        Parent:          parent,
+                        Root:            parent.Root,
+                        Path:            path,
+                        Module:          mod,
+                        CallRange:       call.DeclRange,
+                        SourceAddr:      call.SourceAddr,
+                        SourceAddrRange: call.SourceAddrRange,
+                        Version:         ver,
+                }
+
+                child.Children, modDiags = buildChildModules(child, walker)
+
+                ret[call.Name] = child
+        }
+
+        return ret, diags
+}
+
+// A ModuleWalker knows how to find and load a child module given details about
+// the module to be loaded and a reference to its partially-loaded parent
+// Config.
+type ModuleWalker interface {
+        // LoadModule finds and loads a requested child module.
+        //
+        // If errors are detected during loading, implementations should return them
+        // in the diagnostics object. If the diagnostics object contains any errors
+        // then the caller will tolerate the returned module being nil or incomplete.
+        // If no errors are returned, it should be non-nil and complete.
+        //
+        // Full validation need not have been performed but an implementation should
+        // ensure that the basic file- and module-validations performed by the
+        // LoadConfigDir function (valid syntax, no namespace collisions, etc) have
+        // been performed before returning a module.
+        LoadModule(req *ModuleRequest) (*Module, *version.Version, hcl.Diagnostics)
+}
+
+// ModuleWalkerFunc is an implementation of ModuleWalker that directly wraps
+// a callback function, for more convenient use of that interface.
+type ModuleWalkerFunc func(req *ModuleRequest) (*Module, *version.Version, hcl.Diagnostics)
+
+// LoadModule implements ModuleWalker.
+func (f ModuleWalkerFunc) LoadModule(req *ModuleRequest) (*Module, *version.Version, hcl.Diagnostics) {
+        return f(req)
+}
+
+// ModuleRequest is used with the ModuleWalker interface to describe a child
+// module that must be loaded.
+type ModuleRequest struct {
+        // Name is the "logical name" of the module call within configuration.
+        // This is provided in case the name is used as part of a storage key
+        // for the module, but implementations must otherwise treat it as an
+        // opaque string. It is guaranteed to have already been validated as an
+        // HCL identifier and UTF-8 encoded.
+        Name string
+
+        // Path is a list of logical names that traverse from the root module to
+        // this module. This can be used, for example, to form a lookup key for
+        // each distinct module call in a configuration, allowing for multiple
+        // calls with the same name at different points in the tree.
+        Path addrs.Module
+
+        // SourceAddr is the source address string provided by the user in
+        // configuration.
+        SourceAddr string
+
+        // SourceAddrRange is the source range for the SourceAddr value as it
+        // was provided in configuration. This can and should be used to generate
+        // diagnostics about the source address having invalid syntax, referring
+        // to a non-existent object, etc.
+        SourceAddrRange hcl.Range
+
+        // VersionConstraint is the version constraint applied to the module in
+        // configuration. This data structure includes the source range for
+        // the constraint, which can and should be used to generate diagnostics
+        // about constraint-related issues, such as constraints that eliminate all
+        // available versions of a module whose source is otherwise valid.
+        VersionConstraint VersionConstraint
+
+        // Parent is the partially-constructed module tree node that the loaded
+        // module will be added to. Callers may refer to any field of this
+        // structure except Children, which is still under construction when
+        // ModuleRequest objects are created and thus has undefined content.
+        // The main reason this is provided is so that full module paths can
+        // be constructed for uniqueness.
+        Parent *Config
+
+        // CallRange is the source range for the header of the "module" block
+        // in configuration that prompted this request. This can be used as the
+        // subject of an error diagnostic that relates to the module call itself,
+        // rather than to either its source address or its version number.
+        CallRange hcl.Range
+}
+
+// DisabledModuleWalker is a ModuleWalker that doesn't support
+// child modules at all, and so will return an error if asked to load one.
+//
+// This is provided primarily for testing. There is no good reason to use this
+// in the main application.
+var DisabledModuleWalker ModuleWalker
+
+func init() {
+        DisabledModuleWalker = ModuleWalkerFunc(func(req *ModuleRequest) (*Module, *version.Version, hcl.Diagnostics) {
+                return nil, nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Child modules are not supported",
+                                Detail:   "Child module calls are not allowed in this context.",
+                                Subject:  &req.CallRange,
+                        },
+                }
+        })
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/copy_dir.go b/vendor/github.com/hashicorp/terraform/configs/configload/copy_dir.go
new file mode 100644
index 0000000..ebbeb3b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/copy_dir.go
@@ -0,0 +1,125 @@
+package configload
+
+import (
+        "io"
+        "os"
+        "path/filepath"
+        "strings"
+)
+
+// copyDir copies the src directory contents into dst. Both directories
+// should already exist.
+func copyDir(dst, src string) error {
+        src, err := filepath.EvalSymlinks(src)
+        if err != nil {
+                return err
+        }
+
+        walkFn := func(path string, info os.FileInfo, err error) error {
+                if err != nil {
+                        return err
+                }
+
+                if path == src {
+                        return nil
+                }
+
+                if strings.HasPrefix(filepath.Base(path), ".") {
+                        // Skip any dot files
+                        if info.IsDir() {
+                                return filepath.SkipDir
+                        } else {
+                                return nil
+                        }
+                }
+
+                // The "path" has the src prefixed to it. We need to join our
+                // destination with the path without the src on it.
+                dstPath := filepath.Join(dst, path[len(src):])
+
+                // we don't want to try and copy the same file over itself.
+                if eq, err := sameFile(path, dstPath); eq {
+                        return nil
+                } else if err != nil {
+                        return err
+                }
+
+                // If we have a directory, make that subdirectory, then continue
+                // the walk.
+                if info.IsDir() {
+                        if path == filepath.Join(src, dst) {
+                                // dst is in src; don't walk it.
+                                return nil
+                        }
+
+                        if err := os.MkdirAll(dstPath, 0755); err != nil {
+                                return err
+                        }
+
+                        return nil
+                }
+
+                // If the current path is a symlink, recreate the symlink relative to
+                // the dst directory
+                if info.Mode()&os.ModeSymlink == os.ModeSymlink {
+                        target, err := os.Readlink(path)
+                        if err != nil {
+                                return err
+                        }
+
+                        return os.Symlink(target, dstPath)
+                }
+
+                // If we have a file, copy the contents.
+                srcF, err := os.Open(path)
+                if err != nil {
+                        return err
+                }
+                defer srcF.Close()
+
+                dstF, err := os.Create(dstPath)
+                if err != nil {
+                        return err
+                }
+                defer dstF.Close()
+
+                if _, err := io.Copy(dstF, srcF); err != nil {
+                        return err
+                }
+
+                // Chmod it
+                return os.Chmod(dstPath, info.Mode())
+        }
+
+        return filepath.Walk(src, walkFn)
+}
+
+// sameFile tried to determine if to paths are the same file.
+// If the paths don't match, we lookup the inode on supported systems.
+func sameFile(a, b string) (bool, error) {
+        if a == b {
+                return true, nil
+        }
+
+        aIno, err := inode(a)
+        if err != nil {
+                if os.IsNotExist(err) {
+                        return false, nil
+                }
+                return false, err
+        }
+
+        bIno, err := inode(b)
+        if err != nil {
+                if os.IsNotExist(err) {
+                        return false, nil
+                }
+                return false, err
+        }
+
+        if aIno > 0 && aIno == bIno {
+                return true, nil
+        }
+
+        return false, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/doc.go b/vendor/github.com/hashicorp/terraform/configs/configload/doc.go
new file mode 100644
index 0000000..8b615f9
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/doc.go
@@ -0,0 +1,4 @@
+// Package configload knows how to install modules into the .terraform/modules
+// directory and to load modules from those installed locations. It is used
+// in conjunction with the LoadConfig function in the parent package.
+package configload
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/getter.go b/vendor/github.com/hashicorp/terraform/configs/configload/getter.go
new file mode 100644
index 0000000..4a3dace
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/getter.go
@@ -0,0 +1,150 @@
+package configload
+
+import (
+        "fmt"
+        "log"
+        "os"
+        "path/filepath"
+
+        cleanhttp "github.com/hashicorp/go-cleanhttp"
+        getter "github.com/hashicorp/go-getter"
+)
+
+// We configure our own go-getter detector and getter sets here, because
+// the set of sources we support is part of Terraform's documentation and
+// so we don't want any new sources introduced in go-getter to sneak in here
+// and work even though they aren't documented. This also insulates us from
+// any meddling that might be done by other go-getter callers linked into our
+// executable.
+
+var goGetterDetectors = []getter.Detector{
+        new(getter.GitHubDetector),
+        new(getter.BitBucketDetector),
+        new(getter.S3Detector),
+        new(getter.FileDetector),
+}
+
+var goGetterNoDetectors = []getter.Detector{}
+
+var goGetterDecompressors = map[string]getter.Decompressor{
+        "bz2": new(getter.Bzip2Decompressor),
+        "gz":  new(getter.GzipDecompressor),
+        "xz":  new(getter.XzDecompressor),
+        "zip": new(getter.ZipDecompressor),
+
+        "tar.bz2":  new(getter.TarBzip2Decompressor),
+        "tar.tbz2": new(getter.TarBzip2Decompressor),
+
+        "tar.gz": new(getter.TarGzipDecompressor),
+        "tgz":    new(getter.TarGzipDecompressor),
+
+        "tar.xz": new(getter.TarXzDecompressor),
+        "txz":    new(getter.TarXzDecompressor),
+}
+
+var goGetterGetters = map[string]getter.Getter{
+        "file":  new(getter.FileGetter),
+        "git":   new(getter.GitGetter),
+        "hg":    new(getter.HgGetter),
+        "s3":    new(getter.S3Getter),
+        "http":  getterHTTPGetter,
+        "https": getterHTTPGetter,
+}
+
+var getterHTTPClient = cleanhttp.DefaultClient()
+
+var getterHTTPGetter = &getter.HttpGetter{
+        Client: getterHTTPClient,
+        Netrc:  true,
+}
+
+// A reusingGetter is a helper for the module installer that remembers
+// the final resolved addresses of all of the sources it has already been
+// asked to install, and will copy from a prior installation directory if
+// it has the same resolved source address.
+//
+// The keys in a reusingGetter are resolved and trimmed source addresses
+// (with a scheme always present, and without any "subdir" component),
+// and the values are the paths where each source was previously installed.
+type reusingGetter map[string]string
+
+// getWithGoGetter retrieves the package referenced in the given address
+// into the installation path and then returns the full path to any subdir
+// indicated in the address.
+//
+// The errors returned by this function are those surfaced by the underlying
+// go-getter library, which have very inconsistent quality as
+// end-user-actionable error messages. At this time we do not have any
+// reasonable way to improve these error messages at this layer because
+// the underlying errors are not separatelyr recognizable.
+func (g reusingGetter) getWithGoGetter(instPath, addr string) (string, error) {
+        packageAddr, subDir := splitAddrSubdir(addr)
+
+        log.Printf("[DEBUG] will download %q to %s", packageAddr, instPath)
+
+        realAddr, err := getter.Detect(packageAddr, instPath, getter.Detectors)
+        if err != nil {
+                return "", err
+        }
+
+        var realSubDir string
+        realAddr, realSubDir = splitAddrSubdir(realAddr)
+        if realSubDir != "" {
+                subDir = filepath.Join(realSubDir, subDir)
+        }
+
+        if realAddr != packageAddr {
+                log.Printf("[TRACE] go-getter detectors rewrote %q to %q", packageAddr, realAddr)
+        }
+
+        if prevDir, exists := g[realAddr]; exists {
+                log.Printf("[TRACE] copying previous install %s to %s", prevDir, instPath)
+                err := os.Mkdir(instPath, os.ModePerm)
+                if err != nil {
+                        return "", fmt.Errorf("failed to create directory %s: %s", instPath, err)
+                }
+                err = copyDir(instPath, prevDir)
+                if err != nil {
+                        return "", fmt.Errorf("failed to copy from %s to %s: %s", prevDir, instPath, err)
+                }
+        } else {
+                log.Printf("[TRACE] fetching %q to %q", realAddr, instPath)
+                client := getter.Client{
+                        Src: realAddr,
+                        Dst: instPath,
+                        Pwd: instPath,
+
+                        Mode: getter.ClientModeDir,
+
+                        Detectors:     goGetterNoDetectors, // we already did detection above
+                        Decompressors: goGetterDecompressors,
+                        Getters:       goGetterGetters,
+                }
+                err = client.Get()
+                if err != nil {
+                        return "", err
+                }
+                // Remember where we installed this so we might reuse this directory
+                // on subsequent calls to avoid re-downloading.
+                g[realAddr] = instPath
+        }
+
+        // Our subDir string can contain wildcards until this point, so that
+        // e.g. a subDir of * can expand to one top-level directory in a .tar.gz
+        // archive. Now that we've expanded the archive successfully we must
+        // resolve that into a concrete path.
+        var finalDir string
+        if subDir != "" {
+                finalDir, err = getter.SubdirGlob(instPath, subDir)
+                log.Printf("[TRACE] expanded %q to %q", subDir, finalDir)
+                if err != nil {
+                        return "", err
+                }
+        } else {
+                finalDir = instPath
+        }
+
+        // If we got this far then we have apparently succeeded in downloading
+        // the requested object!
+        return filepath.Clean(finalDir), nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/inode.go b/vendor/github.com/hashicorp/terraform/configs/configload/inode.go
new file mode 100644
index 0000000..57df041
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/inode.go
@@ -0,0 +1,21 @@
+// +build linux darwin openbsd netbsd solaris dragonfly
+
+package configload
+
+import (
+        "fmt"
+        "os"
+        "syscall"
+)
+
+// lookup the inode of a file on posix systems
+func inode(path string) (uint64, error) {
+        stat, err := os.Stat(path)
+        if err != nil {
+                return 0, err
+        }
+        if st, ok := stat.Sys().(*syscall.Stat_t); ok {
+                return st.Ino, nil
+        }
+        return 0, fmt.Errorf("could not determine file inode")
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/inode_freebsd.go b/vendor/github.com/hashicorp/terraform/configs/configload/inode_freebsd.go
new file mode 100644
index 0000000..4dc28ea
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/inode_freebsd.go
@@ -0,0 +1,21 @@
+// +build freebsd
+
+package configload
+
+import (
+        "fmt"
+        "os"
+        "syscall"
+)
+
+// lookup the inode of a file on posix systems
+func inode(path string) (uint64, error) {
+        stat, err := os.Stat(path)
+        if err != nil {
+                return 0, err
+        }
+        if st, ok := stat.Sys().(*syscall.Stat_t); ok {
+                return uint64(st.Ino), nil
+        }
+        return 0, fmt.Errorf("could not determine file inode")
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/inode_windows.go b/vendor/github.com/hashicorp/terraform/configs/configload/inode_windows.go
new file mode 100644
index 0000000..0d22e67
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/inode_windows.go
@@ -0,0 +1,8 @@
+// +build windows
+
+package configload
+
+// no syscall.Stat_t on windows, return 0 for inodes
+func inode(path string) (uint64, error) {
+        return 0, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/loader.go b/vendor/github.com/hashicorp/terraform/configs/configload/loader.go
new file mode 100644
index 0000000..416b48f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/loader.go
@@ -0,0 +1,150 @@
+package configload
+
+import (
+        "fmt"
+        "path/filepath"
+
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/registry"
+        "github.com/hashicorp/terraform/svchost/disco"
+        "github.com/spf13/afero"
+)
+
+// A Loader instance is the main entry-point for loading configurations via
+// this package.
+//
+// It extends the general config-loading functionality in the parent package
+// "configs" to support installation of modules from remote sources and
+// loading full configurations using modules that were previously installed.
+type Loader struct {
+        // parser is used to read configuration
+        parser *configs.Parser
+
+        // modules is used to install and locate descendent modules that are
+        // referenced (directly or indirectly) from the root module.
+        modules moduleMgr
+}
+
+// Config is used with NewLoader to specify configuration arguments for the
+// loader.
+type Config struct {
+        // ModulesDir is a path to a directory where descendent modules are
+        // (or should be) installed. (This is usually the
+        // .terraform/modules directory, in the common case where this package
+        // is being loaded from the main Terraform CLI package.)
+        ModulesDir string
+
+        // Services is the service discovery client to use when locating remote
+        // module registry endpoints. If this is nil then registry sources are
+        // not supported, which should be true only in specialized circumstances
+        // such as in tests.
+        Services *disco.Disco
+}
+
+// NewLoader creates and returns a loader that reads configuration from the
+// real OS filesystem.
+//
+// The loader has some internal state about the modules that are currently
+// installed, which is read from disk as part of this function. If that
+// manifest cannot be read then an error will be returned.
+func NewLoader(config *Config) (*Loader, error) {
+        fs := afero.NewOsFs()
+        parser := configs.NewParser(fs)
+        reg := registry.NewClient(config.Services, nil)
+
+        ret := &Loader{
+                parser: parser,
+                modules: moduleMgr{
+                        FS:         afero.Afero{Fs: fs},
+                        CanInstall: true,
+                        Dir:        config.ModulesDir,
+                        Services:   config.Services,
+                        Registry:   reg,
+                },
+        }
+
+        err := ret.modules.readModuleManifestSnapshot()
+        if err != nil {
+                return nil, fmt.Errorf("failed to read module manifest: %s", err)
+        }
+
+        return ret, nil
+}
+
+// ModulesDir returns the path to the directory where the loader will look for
+// the local cache of remote module packages.
+func (l *Loader) ModulesDir() string {
+        return l.modules.Dir
+}
+
+// RefreshModules updates the in-memory cache of the module manifest from the
+// module manifest file on disk. This is not necessary in normal use because
+// module installation and configuration loading are separate steps, but it
+// can be useful in tests where module installation is done as a part of
+// configuration loading by a helper function.
+//
+// Call this function after any module installation where an existing loader
+// is already alive and may be used again later.
+//
+// An error is returned if the manifest file cannot be read.
+func (l *Loader) RefreshModules() error {
+        if l == nil {
+                // Nothing to do, then.
+                return nil
+        }
+        return l.modules.readModuleManifestSnapshot()
+}
+
+// Parser returns the underlying parser for this loader.
+//
+// This is useful for loading other sorts of files than the module directories
+// that a loader deals with, since then they will share the source code cache
+// for this loader and can thus be shown as snippets in diagnostic messages.
+func (l *Loader) Parser() *configs.Parser {
+        return l.parser
+}
+
+// Sources returns the source code cache for the underlying parser of this
+// loader. This is a shorthand for l.Parser().Sources().
+func (l *Loader) Sources() map[string][]byte {
+        return l.parser.Sources()
+}
+
+// IsConfigDir returns true if and only if the given directory contains at
+// least one Terraform configuration file. This is a wrapper around calling
+// the same method name on the loader's parser.
+func (l *Loader) IsConfigDir(path string) bool {
+        return l.parser.IsConfigDir(path)
+}
+
+// ImportSources writes into the receiver's source code the given source
+// code buffers.
+//
+// This is useful in the situation where an ancillary loader is created for
+// some reason (e.g. loading config from a plan file) but the cached source
+// code from that loader must be imported into the "main" loader in order
+// to return source code snapshots in diagnostic messages.
+//
+//     loader.ImportSources(otherLoader.Sources())
+func (l *Loader) ImportSources(sources map[string][]byte) {
+        p := l.Parser()
+        for name, src := range sources {
+                p.ForceFileSource(name, src)
+        }
+}
+
+// ImportSourcesFromSnapshot writes into the receiver's source code the
+// source files from the given snapshot.
+//
+// This is similar to ImportSources but knows how to unpack and flatten a
+// snapshot data structure to get the corresponding flat source file map.
+func (l *Loader) ImportSourcesFromSnapshot(snap *Snapshot) {
+        p := l.Parser()
+        for _, m := range snap.Modules {
+                baseDir := m.Dir
+                for fn, src := range m.Files {
+                        fullPath := filepath.Join(baseDir, fn)
+                        p.ForceFileSource(fullPath, src)
+                }
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/loader_load.go b/vendor/github.com/hashicorp/terraform/configs/configload/loader_load.go
new file mode 100644
index 0000000..93a9420
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/loader_load.go
@@ -0,0 +1,97 @@
+package configload
+
+import (
+        "fmt"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs"
+)
+
+// LoadConfig reads the Terraform module in the given directory and uses it as the
+// root module to build the static module tree that represents a configuration,
+// assuming that all required descendent modules have already been installed.
+//
+// If error diagnostics are returned, the returned configuration may be either
+// nil or incomplete. In the latter case, cautious static analysis is possible
+// in spite of the errors.
+//
+// LoadConfig performs the basic syntax and uniqueness validations that are
+// required to process the individual modules, and also detects
+func (l *Loader) LoadConfig(rootDir string) (*configs.Config, hcl.Diagnostics) {
+        rootMod, diags := l.parser.LoadConfigDir(rootDir)
+        if rootMod == nil {
+                return nil, diags
+        }
+
+        cfg, cDiags := configs.BuildConfig(rootMod, configs.ModuleWalkerFunc(l.moduleWalkerLoad))
+        diags = append(diags, cDiags...)
+
+        return cfg, diags
+}
+
+// moduleWalkerLoad is a configs.ModuleWalkerFunc for loading modules that
+// are presumed to have already been installed. A different function
+// (moduleWalkerInstall) is used for installation.
+func (l *Loader) moduleWalkerLoad(req *configs.ModuleRequest) (*configs.Module, *version.Version, hcl.Diagnostics) {
+        // Since we're just loading here, we expect that all referenced modules
+        // will be already installed and described in our manifest. However, we
+        // do verify that the manifest and the configuration are in agreement
+        // so that we can prompt the user to run "terraform init" if not.
+
+        key := l.modules.manifest.ModuleKey(req.Path)
+        record, exists := l.modules.manifest[key]
+
+        if !exists {
+                return nil, nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Module not installed",
+                                Detail:   "This module is not yet installed. Run \"terraform init\" to install all modules required by this configuration.",
+                                Subject:  &req.CallRange,
+                        },
+                }
+        }
+
+        var diags hcl.Diagnostics
+
+        // Check for inconsistencies between manifest and config
+        if req.SourceAddr != record.SourceAddr {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Module source has changed",
+                        Detail:   "The source address was changed since this module was installed. Run \"terraform init\" to install all modules required by this configuration.",
+                        Subject:  &req.SourceAddrRange,
+                })
+        }
+        if !req.VersionConstraint.Required.Check(record.Version) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Module version requirements have changed",
+                        Detail: fmt.Sprintf(
+                                "The version requirements have changed since this module was installed and the installed version (%s) is no longer acceptable. Run \"terraform init\" to install all modules required by this configuration.",
+                                record.Version,
+                        ),
+                        Subject: &req.SourceAddrRange,
+                })
+        }
+
+        mod, mDiags := l.parser.LoadConfigDir(record.Dir)
+        diags = append(diags, mDiags...)
+        if mod == nil {
+                // nil specifically indicates that the directory does not exist or
+                // cannot be read, so in this case we'll discard any generic diagnostics
+                // returned from LoadConfigDir and produce our own context-sensitive
+                // error message.
+                return nil, nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Module not installed",
+                                Detail:   fmt.Sprintf("This module's local cache directory %s could not be read. Run \"terraform init\" to install all modules required by this configuration.", record.Dir),
+                                Subject:  &req.CallRange,
+                        },
+                }
+        }
+
+        return mod, record.Version, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/loader_snapshot.go b/vendor/github.com/hashicorp/terraform/configs/configload/loader_snapshot.go
new file mode 100644
index 0000000..44c6439
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/loader_snapshot.go
@@ -0,0 +1,504 @@
+package configload
+
+import (
+        "fmt"
+        "io"
+        "os"
+        "path/filepath"
+        "sort"
+        "time"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/internal/modsdir"
+        "github.com/spf13/afero"
+)
+
+// LoadConfigWithSnapshot is a variant of LoadConfig that also simultaneously
+// creates an in-memory snapshot of the configuration files used, which can
+// be later used to create a loader that may read only from this snapshot.
+func (l *Loader) LoadConfigWithSnapshot(rootDir string) (*configs.Config, *Snapshot, hcl.Diagnostics) {
+        rootMod, diags := l.parser.LoadConfigDir(rootDir)
+        if rootMod == nil {
+                return nil, nil, diags
+        }
+
+        snap := &Snapshot{
+                Modules: map[string]*SnapshotModule{},
+        }
+        walker := l.makeModuleWalkerSnapshot(snap)
+        cfg, cDiags := configs.BuildConfig(rootMod, walker)
+        diags = append(diags, cDiags...)
+
+        addDiags := l.addModuleToSnapshot(snap, "", rootDir, "", nil)
+        diags = append(diags, addDiags...)
+
+        return cfg, snap, diags
+}
+
+// NewLoaderFromSnapshot creates a Loader that reads files only from the
+// given snapshot.
+//
+// A snapshot-based loader cannot install modules, so calling InstallModules
+// on the return value will cause a panic.
+//
+// A snapshot-based loader also has access only to configuration files. Its
+// underlying parser does not have access to other files in the native
+// filesystem, such as values files. For those, either use a normal loader
+// (created by NewLoader) or use the configs.Parser API directly.
+func NewLoaderFromSnapshot(snap *Snapshot) *Loader {
+        fs := snapshotFS{snap}
+        parser := configs.NewParser(fs)
+
+        ret := &Loader{
+                parser: parser,
+                modules: moduleMgr{
+                        FS:         afero.Afero{Fs: fs},
+                        CanInstall: false,
+                        manifest:   snap.moduleManifest(),
+                },
+        }
+
+        return ret
+}
+
+// Snapshot is an in-memory representation of the source files from a
+// configuration, which can be used as an alternative configurations source
+// for a loader with NewLoaderFromSnapshot.
+//
+// The primary purpose of a Snapshot is to build the configuration portion
+// of a plan file (see ../../plans/planfile) so that it can later be reloaded
+// and used to recover the exact configuration that the plan was built from.
+type Snapshot struct {
+        // Modules is a map from opaque module keys (suitable for use as directory
+        // names on all supported operating systems) to the snapshot information
+        // about each module.
+        Modules map[string]*SnapshotModule
+}
+
+// NewEmptySnapshot constructs and returns a snapshot containing only an empty
+// root module. This is not useful for anything except placeholders in tests.
+func NewEmptySnapshot() *Snapshot {
+        return &Snapshot{
+                Modules: map[string]*SnapshotModule{
+                        "": &SnapshotModule{
+                                Files: map[string][]byte{},
+                        },
+                },
+        }
+}
+
+// SnapshotModule represents a single module within a Snapshot.
+type SnapshotModule struct {
+        // Dir is the path, relative to the root directory given when the
+        // snapshot was created, where the module appears in the snapshot's
+        // virtual filesystem.
+        Dir string
+
+        // Files is a map from each configuration file filename for the
+        // module to a raw byte representation of the source file contents.
+        Files map[string][]byte
+
+        // SourceAddr is the source address given for this module in configuration.
+        SourceAddr string `json:"Source"`
+
+        // Version is the version of the module that is installed, or nil if
+        // the module is installed from a source that does not support versions.
+        Version *version.Version `json:"-"`
+}
+
+// moduleManifest constructs a module manifest based on the contents of
+// the receiving snapshot.
+func (s *Snapshot) moduleManifest() modsdir.Manifest {
+        ret := make(modsdir.Manifest)
+
+        for k, modSnap := range s.Modules {
+                ret[k] = modsdir.Record{
+                        Key:        k,
+                        Dir:        modSnap.Dir,
+                        SourceAddr: modSnap.SourceAddr,
+                        Version:    modSnap.Version,
+                }
+        }
+
+        return ret
+}
+
+// makeModuleWalkerSnapshot creates a configs.ModuleWalker that will exhibit
+// the same lookup behaviors as l.moduleWalkerLoad but will additionally write
+// source files from the referenced modules into the given snapshot.
+func (l *Loader) makeModuleWalkerSnapshot(snap *Snapshot) configs.ModuleWalker {
+        return configs.ModuleWalkerFunc(
+                func(req *configs.ModuleRequest) (*configs.Module, *version.Version, hcl.Diagnostics) {
+                        mod, v, diags := l.moduleWalkerLoad(req)
+                        if diags.HasErrors() {
+                                return mod, v, diags
+                        }
+
+                        key := l.modules.manifest.ModuleKey(req.Path)
+                        record, exists := l.modules.manifest[key]
+
+                        if !exists {
+                                // Should never happen, since otherwise moduleWalkerLoader would've
+                                // returned an error and we would've returned already.
+                                panic(fmt.Sprintf("module %s is not present in manifest", key))
+                        }
+
+                        addDiags := l.addModuleToSnapshot(snap, key, record.Dir, record.SourceAddr, record.Version)
+                        diags = append(diags, addDiags...)
+
+                        return mod, v, diags
+                },
+        )
+}
+
+func (l *Loader) addModuleToSnapshot(snap *Snapshot, key string, dir string, sourceAddr string, v *version.Version) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        primaryFiles, overrideFiles, moreDiags := l.parser.ConfigDirFiles(dir)
+        if moreDiags.HasErrors() {
+                // Any diagnostics we get here should be already present
+                // in diags, so it's weird if we get here but we'll allow it
+                // and return a general error message in that case.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Failed to read directory for module",
+                        Detail:   fmt.Sprintf("The source directory %s could not be read", dir),
+                })
+                return diags
+        }
+
+        snapMod := &SnapshotModule{
+                Dir:        dir,
+                Files:      map[string][]byte{},
+                SourceAddr: sourceAddr,
+                Version:    v,
+        }
+
+        files := make([]string, 0, len(primaryFiles)+len(overrideFiles))
+        files = append(files, primaryFiles...)
+        files = append(files, overrideFiles...)
+        sources := l.Sources() // should be populated with all the files we need by now
+        for _, filePath := range files {
+                filename := filepath.Base(filePath)
+                src, exists := sources[filePath]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing source file for snapshot",
+                                Detail:   fmt.Sprintf("The source code for file %s could not be found to produce a configuration snapshot.", filePath),
+                        })
+                        continue
+                }
+                snapMod.Files[filepath.Clean(filename)] = src
+        }
+
+        snap.Modules[key] = snapMod
+
+        return diags
+}
+
+// snapshotFS is an implementation of afero.Fs that reads from a snapshot.
+//
+// This is not intended as a general-purpose filesystem implementation. Instead,
+// it just supports the minimal functionality required to support the
+// configuration loader and parser as an implementation detail of creating
+// a loader from a snapshot.
+type snapshotFS struct {
+        snap *Snapshot
+}
+
+var _ afero.Fs = snapshotFS{}
+
+func (fs snapshotFS) Create(name string) (afero.File, error) {
+        return nil, fmt.Errorf("cannot create file inside configuration snapshot")
+}
+
+func (fs snapshotFS) Mkdir(name string, perm os.FileMode) error {
+        return fmt.Errorf("cannot create directory inside configuration snapshot")
+}
+
+func (fs snapshotFS) MkdirAll(name string, perm os.FileMode) error {
+        return fmt.Errorf("cannot create directories inside configuration snapshot")
+}
+
+func (fs snapshotFS) Open(name string) (afero.File, error) {
+
+        // Our "filesystem" is sparsely populated only with the directories
+        // mentioned by modules in our snapshot, so the high-level process
+        // for opening a file is:
+        // - Find the module snapshot corresponding to the containing directory
+        // - Find the file within that snapshot
+        // - Wrap the resulting byte slice in a snapshotFile to return
+        //
+        // The other possibility handled here is if the given name is for the
+        // module directory itself, in which case we'll return a snapshotDir
+        // instead.
+        //
+        // This function doesn't try to be incredibly robust in supporting
+        // different permutations of paths, etc because in practice we only
+        // need to support the path forms that our own loader and parser will
+        // generate.
+
+        dir := filepath.Dir(name)
+        fn := filepath.Base(name)
+        directDir := filepath.Clean(name)
+
+        // First we'll check to see if this is an exact path for a module directory.
+        // We need to do this first (rather than as part of the next loop below)
+        // because a module in a child directory of another module can otherwise
+        // appear to be a file in that parent directory.
+        for _, candidate := range fs.snap.Modules {
+                modDir := filepath.Clean(candidate.Dir)
+                if modDir == directDir {
+                        // We've matched the module directory itself
+                        filenames := make([]string, 0, len(candidate.Files))
+                        for n := range candidate.Files {
+                                filenames = append(filenames, n)
+                        }
+                        sort.Strings(filenames)
+                        return snapshotDir{
+                                filenames: filenames,
+                        }, nil
+                }
+        }
+
+        // If we get here then the given path isn't a module directory exactly, so
+        // we'll treat it as a file path and try to find a module directory it
+        // could be located in.
+        var modSnap *SnapshotModule
+        for _, candidate := range fs.snap.Modules {
+                modDir := filepath.Clean(candidate.Dir)
+                if modDir == dir {
+                        modSnap = candidate
+                        break
+                }
+        }
+        if modSnap == nil {
+                return nil, os.ErrNotExist
+        }
+
+        src, exists := modSnap.Files[fn]
+        if !exists {
+                return nil, os.ErrNotExist
+        }
+
+        return &snapshotFile{
+                src: src,
+        }, nil
+}
+
+func (fs snapshotFS) OpenFile(name string, flag int, perm os.FileMode) (afero.File, error) {
+        return fs.Open(name)
+}
+
+func (fs snapshotFS) Remove(name string) error {
+        return fmt.Errorf("cannot remove file inside configuration snapshot")
+}
+
+func (fs snapshotFS) RemoveAll(path string) error {
+        return fmt.Errorf("cannot remove files inside configuration snapshot")
+}
+
+func (fs snapshotFS) Rename(old, new string) error {
+        return fmt.Errorf("cannot rename file inside configuration snapshot")
+}
+
+func (fs snapshotFS) Stat(name string) (os.FileInfo, error) {
+        f, err := fs.Open(name)
+        if err != nil {
+                return nil, err
+        }
+        _, isDir := f.(snapshotDir)
+        return snapshotFileInfo{
+                name:  filepath.Base(name),
+                isDir: isDir,
+        }, nil
+}
+
+func (fs snapshotFS) Name() string {
+        return "ConfigSnapshotFS"
+}
+
+func (fs snapshotFS) Chmod(name string, mode os.FileMode) error {
+        return fmt.Errorf("cannot set file mode inside configuration snapshot")
+}
+
+func (fs snapshotFS) Chtimes(name string, atime, mtime time.Time) error {
+        return fmt.Errorf("cannot set file times inside configuration snapshot")
+}
+
+type snapshotFile struct {
+        snapshotFileStub
+        src []byte
+        at  int64
+}
+
+var _ afero.File = (*snapshotFile)(nil)
+
+func (f *snapshotFile) Read(p []byte) (n int, err error) {
+        if len(p) > 0 && f.at == int64(len(f.src)) {
+                return 0, io.EOF
+        }
+        if f.at > int64(len(f.src)) {
+                return 0, io.ErrUnexpectedEOF
+        }
+        if int64(len(f.src))-f.at >= int64(len(p)) {
+                n = len(p)
+        } else {
+                n = int(int64(len(f.src)) - f.at)
+        }
+        copy(p, f.src[f.at:f.at+int64(n)])
+        f.at += int64(n)
+        return
+}
+
+func (f *snapshotFile) ReadAt(p []byte, off int64) (n int, err error) {
+        f.at = off
+        return f.Read(p)
+}
+
+func (f *snapshotFile) Seek(offset int64, whence int) (int64, error) {
+        switch whence {
+        case 0:
+                f.at = offset
+        case 1:
+                f.at += offset
+        case 2:
+                f.at = int64(len(f.src)) + offset
+        }
+        return f.at, nil
+}
+
+type snapshotDir struct {
+        snapshotFileStub
+        filenames []string
+        at        int
+}
+
+var _ afero.File = snapshotDir{}
+
+func (f snapshotDir) Readdir(count int) ([]os.FileInfo, error) {
+        names, err := f.Readdirnames(count)
+        if err != nil {
+                return nil, err
+        }
+        ret := make([]os.FileInfo, len(names))
+        for i, name := range names {
+                ret[i] = snapshotFileInfo{
+                        name:  name,
+                        isDir: false,
+                }
+        }
+        return ret, nil
+}
+
+func (f snapshotDir) Readdirnames(count int) ([]string, error) {
+        var outLen int
+        names := f.filenames[f.at:]
+        if count > 0 {
+                if len(names) < count {
+                        outLen = len(names)
+                } else {
+                        outLen = count
+                }
+                if len(names) == 0 {
+                        return nil, io.EOF
+                }
+        } else {
+                outLen = len(names)
+        }
+        f.at += outLen
+
+        return names[:outLen], nil
+}
+
+// snapshotFileInfo is a minimal implementation of os.FileInfo to support our
+// virtual filesystem from snapshots.
+type snapshotFileInfo struct {
+        name  string
+        isDir bool
+}
+
+var _ os.FileInfo = snapshotFileInfo{}
+
+func (fi snapshotFileInfo) Name() string {
+        return fi.name
+}
+
+func (fi snapshotFileInfo) Size() int64 {
+        // In practice, our parser and loader never call Size
+        return -1
+}
+
+func (fi snapshotFileInfo) Mode() os.FileMode {
+        return os.ModePerm
+}
+
+func (fi snapshotFileInfo) ModTime() time.Time {
+        return time.Now()
+}
+
+func (fi snapshotFileInfo) IsDir() bool {
+        return fi.isDir
+}
+
+func (fi snapshotFileInfo) Sys() interface{} {
+        return nil
+}
+
+type snapshotFileStub struct{}
+
+func (f snapshotFileStub) Close() error {
+        return nil
+}
+
+func (f snapshotFileStub) Read(p []byte) (n int, err error) {
+        return 0, fmt.Errorf("cannot read")
+}
+
+func (f snapshotFileStub) ReadAt(p []byte, off int64) (n int, err error) {
+        return 0, fmt.Errorf("cannot read")
+}
+
+func (f snapshotFileStub) Seek(offset int64, whence int) (int64, error) {
+        return 0, fmt.Errorf("cannot seek")
+}
+
+func (f snapshotFileStub) Write(p []byte) (n int, err error) {
+        return f.WriteAt(p, 0)
+}
+
+func (f snapshotFileStub) WriteAt(p []byte, off int64) (n int, err error) {
+        return 0, fmt.Errorf("cannot write to file in snapshot")
+}
+
+func (f snapshotFileStub) WriteString(s string) (n int, err error) {
+        return 0, fmt.Errorf("cannot write to file in snapshot")
+}
+
+func (f snapshotFileStub) Name() string {
+        // in practice, the loader and parser never use this
+        return "<unimplemented>"
+}
+
+func (f snapshotFileStub) Readdir(count int) ([]os.FileInfo, error) {
+        return nil, fmt.Errorf("cannot use Readdir on a file")
+}
+
+func (f snapshotFileStub) Readdirnames(count int) ([]string, error) {
+        return nil, fmt.Errorf("cannot use Readdir on a file")
+}
+
+func (f snapshotFileStub) Stat() (os.FileInfo, error) {
+        return nil, fmt.Errorf("cannot stat")
+}
+
+func (f snapshotFileStub) Sync() error {
+        return nil
+}
+
+func (f snapshotFileStub) Truncate(size int64) error {
+        return fmt.Errorf("cannot write to file in snapshot")
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/module_mgr.go b/vendor/github.com/hashicorp/terraform/configs/configload/module_mgr.go
new file mode 100644
index 0000000..3c410ee
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/module_mgr.go
@@ -0,0 +1,76 @@
+package configload
+
+import (
+        "os"
+        "path/filepath"
+
+        "github.com/hashicorp/terraform/internal/modsdir"
+        "github.com/hashicorp/terraform/registry"
+        "github.com/hashicorp/terraform/svchost/disco"
+        "github.com/spf13/afero"
+)
+
+type moduleMgr struct {
+        FS afero.Afero
+
+        // CanInstall is true for a module manager that can support installation.
+        //
+        // This must be set only if FS is an afero.OsFs, because the installer
+        // (which uses go-getter) is not aware of the virtual filesystem
+        // abstraction and will always write into the "real" filesystem.
+        CanInstall bool
+
+        // Dir is the path where descendent modules are (or will be) installed.
+        Dir string
+
+        // Services is a service discovery client that will be used to find
+        // remote module registry endpoints. This object may be pre-loaded with
+        // cached discovery information.
+        Services *disco.Disco
+
+        // Registry is a client for the module registry protocol, which is used
+        // when a module is requested from a registry source.
+        Registry *registry.Client
+
+        // manifest tracks the currently-installed modules for this manager.
+        //
+        // The loader may read this. Only the installer may write to it, and
+        // after a set of updates are completed the installer must call
+        // writeModuleManifestSnapshot to persist a snapshot of the manifest
+        // to disk for use on subsequent runs.
+        manifest modsdir.Manifest
+}
+
+func (m *moduleMgr) manifestSnapshotPath() string {
+        return filepath.Join(m.Dir, modsdir.ManifestSnapshotFilename)
+}
+
+// readModuleManifestSnapshot loads a manifest snapshot from the filesystem.
+func (m *moduleMgr) readModuleManifestSnapshot() error {
+        r, err := m.FS.Open(m.manifestSnapshotPath())
+        if err != nil {
+                if os.IsNotExist(err) {
+                        // We'll treat a missing file as an empty manifest
+                        m.manifest = make(modsdir.Manifest)
+                        return nil
+                }
+                return err
+        }
+
+        m.manifest, err = modsdir.ReadManifestSnapshot(r)
+        return err
+}
+
+// writeModuleManifestSnapshot writes a snapshot of the current manifest
+// to the filesystem.
+//
+// The caller must guarantee no concurrent modifications of the manifest for
+// the duration of a call to this function, or the behavior is undefined.
+func (m *moduleMgr) writeModuleManifestSnapshot() error {
+        w, err := m.FS.Create(m.manifestSnapshotPath())
+        if err != nil {
+                return err
+        }
+
+        return m.manifest.WriteSnapshot(w)
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/source_addr.go b/vendor/github.com/hashicorp/terraform/configs/configload/source_addr.go
new file mode 100644
index 0000000..594cf64
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/source_addr.go
@@ -0,0 +1,45 @@
+package configload
+
+import (
+        "strings"
+
+        "github.com/hashicorp/go-getter"
+
+        "github.com/hashicorp/terraform/registry/regsrc"
+)
+
+var localSourcePrefixes = []string{
+        "./",
+        "../",
+        ".\\",
+        "..\\",
+}
+
+func isLocalSourceAddr(addr string) bool {
+        for _, prefix := range localSourcePrefixes {
+                if strings.HasPrefix(addr, prefix) {
+                        return true
+                }
+        }
+        return false
+}
+
+func isRegistrySourceAddr(addr string) bool {
+        _, err := regsrc.ParseModuleSource(addr)
+        return err == nil
+}
+
+// splitAddrSubdir splits the given address (which is assumed to be a
+// registry address or go-getter-style address) into a package portion
+// and a sub-directory portion.
+//
+// The package portion defines what should be downloaded and then the
+// sub-directory portion, if present, specifies a sub-directory within
+// the downloaded object (an archive, VCS repository, etc) that contains
+// the module's configuration files.
+//
+// The subDir portion will be returned as empty if no subdir separator
+// ("//") is present in the address.
+func splitAddrSubdir(addr string) (packageAddr, subDir string) {
+        return getter.SourceDirSubdir(addr)
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configload/testing.go b/vendor/github.com/hashicorp/terraform/configs/configload/testing.go
new file mode 100644
index 0000000..86ca9d1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configload/testing.go
@@ -0,0 +1,43 @@
+package configload
+
+import (
+        "io/ioutil"
+        "os"
+        "testing"
+)
+
+// NewLoaderForTests is a variant of NewLoader that is intended to be more
+// convenient for unit tests.
+//
+// The loader's modules directory is a separate temporary directory created
+// for each call. Along with the created loader, this function returns a
+// cleanup function that should be called before the test completes in order
+// to remove that temporary directory.
+//
+// In the case of any errors, t.Fatal (or similar) will be called to halt
+// execution of the test, so the calling test does not need to handle errors
+// itself.
+func NewLoaderForTests(t *testing.T) (*Loader, func()) {
+        t.Helper()
+
+        modulesDir, err := ioutil.TempDir("", "tf-configs")
+        if err != nil {
+                t.Fatalf("failed to create temporary modules dir: %s", err)
+                return nil, func() {}
+        }
+
+        cleanup := func() {
+                os.RemoveAll(modulesDir)
+        }
+
+        loader, err := NewLoader(&Config{
+                ModulesDir: modulesDir,
+        })
+        if err != nil {
+                cleanup()
+                t.Fatalf("failed to create config loader: %s", err)
+                return nil, func() {}
+        }
+
+        return loader, cleanup
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/coerce_value.go b/vendor/github.com/hashicorp/terraform/configs/configschema/coerce_value.go
new file mode 100644
index 0000000..e59f58d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/coerce_value.go
@@ -0,0 +1,274 @@
+package configschema
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+)
+
+// CoerceValue attempts to force the given value to conform to the type
+// implied by the receiever, while also applying the same validation and
+// transformation rules that would be applied by the decoder specification
+// returned by method DecoderSpec.
+//
+// This is useful in situations where a configuration must be derived from
+// an already-decoded value. It is always better to decode directly from
+// configuration where possible since then source location information is
+// still available to produce diagnostics, but in special situations this
+// function allows a compatible result to be obtained even if the
+// configuration objects are not available.
+//
+// If the given value cannot be converted to conform to the receiving schema
+// then an error is returned describing one of possibly many problems. This
+// error may be a cty.PathError indicating a position within the nested
+// data structure where the problem applies.
+func (b *Block) CoerceValue(in cty.Value) (cty.Value, error) {
+        var path cty.Path
+        return b.coerceValue(in, path)
+}
+
+func (b *Block) coerceValue(in cty.Value, path cty.Path) (cty.Value, error) {
+        switch {
+        case in.IsNull():
+                return cty.NullVal(b.ImpliedType()), nil
+        case !in.IsKnown():
+                return cty.UnknownVal(b.ImpliedType()), nil
+        }
+
+        ty := in.Type()
+        if !ty.IsObjectType() {
+                return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("an object is required")
+        }
+
+        for name := range ty.AttributeTypes() {
+                if _, defined := b.Attributes[name]; defined {
+                        continue
+                }
+                if _, defined := b.BlockTypes[name]; defined {
+                        continue
+                }
+                return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("unexpected attribute %q", name)
+        }
+
+        attrs := make(map[string]cty.Value)
+
+        for name, attrS := range b.Attributes {
+                var val cty.Value
+                switch {
+                case ty.HasAttribute(name):
+                        val = in.GetAttr(name)
+                case attrS.Computed || attrS.Optional:
+                        val = cty.NullVal(attrS.Type)
+                default:
+                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("attribute %q is required", name)
+                }
+
+                val, err := attrS.coerceValue(val, append(path, cty.GetAttrStep{Name: name}))
+                if err != nil {
+                        return cty.UnknownVal(b.ImpliedType()), err
+                }
+
+                attrs[name] = val
+        }
+        for typeName, blockS := range b.BlockTypes {
+                switch blockS.Nesting {
+
+                case NestingSingle, NestingGroup:
+                        switch {
+                        case ty.HasAttribute(typeName):
+                                var err error
+                                val := in.GetAttr(typeName)
+                                attrs[typeName], err = blockS.coerceValue(val, append(path, cty.GetAttrStep{Name: typeName}))
+                                if err != nil {
+                                        return cty.UnknownVal(b.ImpliedType()), err
+                                }
+                        case blockS.MinItems != 1 && blockS.MaxItems != 1:
+                                if blockS.Nesting == NestingGroup {
+                                        attrs[typeName] = blockS.EmptyValue()
+                                } else {
+                                        attrs[typeName] = cty.NullVal(blockS.ImpliedType())
+                                }
+                        default:
+                                // We use the word "attribute" here because we're talking about
+                                // the cty sense of that word rather than the HCL sense.
+                                return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("attribute %q is required", typeName)
+                        }
+
+                case NestingList:
+                        switch {
+                        case ty.HasAttribute(typeName):
+                                coll := in.GetAttr(typeName)
+
+                                switch {
+                                case coll.IsNull():
+                                        attrs[typeName] = cty.NullVal(cty.List(blockS.ImpliedType()))
+                                        continue
+                                case !coll.IsKnown():
+                                        attrs[typeName] = cty.UnknownVal(cty.List(blockS.ImpliedType()))
+                                        continue
+                                }
+
+                                if !coll.CanIterateElements() {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("must be a list")
+                                }
+                                l := coll.LengthInt()
+                                if l < blockS.MinItems {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("insufficient items for attribute %q; must have at least %d", typeName, blockS.MinItems)
+                                }
+                                if l > blockS.MaxItems && blockS.MaxItems > 0 {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("too many items for attribute %q; cannot have more than %d", typeName, blockS.MaxItems)
+                                }
+                                if l == 0 {
+                                        attrs[typeName] = cty.ListValEmpty(blockS.ImpliedType())
+                                        continue
+                                }
+                                elems := make([]cty.Value, 0, l)
+                                {
+                                        path = append(path, cty.GetAttrStep{Name: typeName})
+                                        for it := coll.ElementIterator(); it.Next(); {
+                                                var err error
+                                                idx, val := it.Element()
+                                                val, err = blockS.coerceValue(val, append(path, cty.IndexStep{Key: idx}))
+                                                if err != nil {
+                                                        return cty.UnknownVal(b.ImpliedType()), err
+                                                }
+                                                elems = append(elems, val)
+                                        }
+                                }
+                                attrs[typeName] = cty.ListVal(elems)
+                        case blockS.MinItems == 0:
+                                attrs[typeName] = cty.ListValEmpty(blockS.ImpliedType())
+                        default:
+                                return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("attribute %q is required", typeName)
+                        }
+
+                case NestingSet:
+                        switch {
+                        case ty.HasAttribute(typeName):
+                                coll := in.GetAttr(typeName)
+
+                                switch {
+                                case coll.IsNull():
+                                        attrs[typeName] = cty.NullVal(cty.Set(blockS.ImpliedType()))
+                                        continue
+                                case !coll.IsKnown():
+                                        attrs[typeName] = cty.UnknownVal(cty.Set(blockS.ImpliedType()))
+                                        continue
+                                }
+
+                                if !coll.CanIterateElements() {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("must be a set")
+                                }
+                                l := coll.LengthInt()
+                                if l < blockS.MinItems {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("insufficient items for attribute %q; must have at least %d", typeName, blockS.MinItems)
+                                }
+                                if l > blockS.MaxItems && blockS.MaxItems > 0 {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("too many items for attribute %q; cannot have more than %d", typeName, blockS.MaxItems)
+                                }
+                                if l == 0 {
+                                        attrs[typeName] = cty.SetValEmpty(blockS.ImpliedType())
+                                        continue
+                                }
+                                elems := make([]cty.Value, 0, l)
+                                {
+                                        path = append(path, cty.GetAttrStep{Name: typeName})
+                                        for it := coll.ElementIterator(); it.Next(); {
+                                                var err error
+                                                idx, val := it.Element()
+                                                val, err = blockS.coerceValue(val, append(path, cty.IndexStep{Key: idx}))
+                                                if err != nil {
+                                                        return cty.UnknownVal(b.ImpliedType()), err
+                                                }
+                                                elems = append(elems, val)
+                                        }
+                                }
+                                attrs[typeName] = cty.SetVal(elems)
+                        case blockS.MinItems == 0:
+                                attrs[typeName] = cty.SetValEmpty(blockS.ImpliedType())
+                        default:
+                                return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("attribute %q is required", typeName)
+                        }
+
+                case NestingMap:
+                        switch {
+                        case ty.HasAttribute(typeName):
+                                coll := in.GetAttr(typeName)
+
+                                switch {
+                                case coll.IsNull():
+                                        attrs[typeName] = cty.NullVal(cty.Map(blockS.ImpliedType()))
+                                        continue
+                                case !coll.IsKnown():
+                                        attrs[typeName] = cty.UnknownVal(cty.Map(blockS.ImpliedType()))
+                                        continue
+                                }
+
+                                if !coll.CanIterateElements() {
+                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("must be a map")
+                                }
+                                l := coll.LengthInt()
+                                if l == 0 {
+                                        attrs[typeName] = cty.MapValEmpty(blockS.ImpliedType())
+                                        continue
+                                }
+                                elems := make(map[string]cty.Value)
+                                {
+                                        path = append(path, cty.GetAttrStep{Name: typeName})
+                                        for it := coll.ElementIterator(); it.Next(); {
+                                                var err error
+                                                key, val := it.Element()
+                                                if key.Type() != cty.String || key.IsNull() || !key.IsKnown() {
+                                                        return cty.UnknownVal(b.ImpliedType()), path.NewErrorf("must be a map")
+                                                }
+                                                val, err = blockS.coerceValue(val, append(path, cty.IndexStep{Key: key}))
+                                                if err != nil {
+                                                        return cty.UnknownVal(b.ImpliedType()), err
+                                                }
+                                                elems[key.AsString()] = val
+                                        }
+                                }
+
+                                // If the attribute values here contain any DynamicPseudoTypes,
+                                // the concrete type must be an object.
+                                useObject := false
+                                switch {
+                                case coll.Type().IsObjectType():
+                                        useObject = true
+                                default:
+                                        // It's possible that we were given a map, and need to coerce it to an object
+                                        ety := coll.Type().ElementType()
+                                        for _, v := range elems {
+                                                if !v.Type().Equals(ety) {
+                                                        useObject = true
+                                                        break
+                                                }
+                                        }
+                                }
+
+                                if useObject {
+                                        attrs[typeName] = cty.ObjectVal(elems)
+                                } else {
+                                        attrs[typeName] = cty.MapVal(elems)
+                                }
+                        default:
+                                attrs[typeName] = cty.MapValEmpty(blockS.ImpliedType())
+                        }
+
+                default:
+                        // should never happen because above is exhaustive
+                        panic(fmt.Errorf("unsupported nesting mode %#v", blockS.Nesting))
+                }
+        }
+
+        return cty.ObjectVal(attrs), nil
+}
+
+func (a *Attribute) coerceValue(in cty.Value, path cty.Path) (cty.Value, error) {
+        val, err := convert.Convert(in, a.Type)
+        if err != nil {
+                return cty.UnknownVal(a.Type), path.NewError(err)
+        }
+        return val, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/decoder_spec.go b/vendor/github.com/hashicorp/terraform/configs/configschema/decoder_spec.go
new file mode 100644
index 0000000..d8f41ea
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/decoder_spec.go
@@ -0,0 +1,117 @@
+package configschema
+
+import (
+        "github.com/hashicorp/hcl2/hcldec"
+)
+
+var mapLabelNames = []string{"key"}
+
+// DecoderSpec returns a hcldec.Spec that can be used to decode a HCL Body
+// using the facilities in the hcldec package.
+//
+// The returned specification is guaranteed to return a value of the same type
+// returned by method ImpliedType, but it may contain null values if any of the
+// block attributes are defined as optional and/or computed respectively.
+func (b *Block) DecoderSpec() hcldec.Spec {
+        ret := hcldec.ObjectSpec{}
+        if b == nil {
+                return ret
+        }
+
+        for name, attrS := range b.Attributes {
+                ret[name] = attrS.decoderSpec(name)
+        }
+
+        for name, blockS := range b.BlockTypes {
+                if _, exists := ret[name]; exists {
+                        // This indicates an invalid schema, since it's not valid to
+                        // define both an attribute and a block type of the same name.
+                        // However, we don't raise this here since it's checked by
+                        // InternalValidate.
+                        continue
+                }
+
+                childSpec := blockS.Block.DecoderSpec()
+
+                switch blockS.Nesting {
+                case NestingSingle, NestingGroup:
+                        ret[name] = &hcldec.BlockSpec{
+                                TypeName: name,
+                                Nested:   childSpec,
+                                Required: blockS.MinItems == 1 && blockS.MaxItems >= 1,
+                        }
+                        if blockS.Nesting == NestingGroup {
+                                ret[name] = &hcldec.DefaultSpec{
+                                        Primary: ret[name],
+                                        Default: &hcldec.LiteralSpec{
+                                                Value: blockS.EmptyValue(),
+                                        },
+                                }
+                        }
+                case NestingList:
+                        // We prefer to use a list where possible, since it makes our
+                        // implied type more complete, but if there are any
+                        // dynamically-typed attributes inside we must use a tuple
+                        // instead, at the expense of our type then not being predictable.
+                        if blockS.Block.ImpliedType().HasDynamicTypes() {
+                                ret[name] = &hcldec.BlockTupleSpec{
+                                        TypeName: name,
+                                        Nested:   childSpec,
+                                        MinItems: blockS.MinItems,
+                                        MaxItems: blockS.MaxItems,
+                                }
+                        } else {
+                                ret[name] = &hcldec.BlockListSpec{
+                                        TypeName: name,
+                                        Nested:   childSpec,
+                                        MinItems: blockS.MinItems,
+                                        MaxItems: blockS.MaxItems,
+                                }
+                        }
+                case NestingSet:
+                        // We forbid dynamically-typed attributes inside NestingSet in
+                        // InternalValidate, so we don't do anything special to handle
+                        // that here. (There is no set analog to tuple and object types,
+                        // because cty's set implementation depends on knowing the static
+                        // type in order to properly compute its internal hashes.)
+                        ret[name] = &hcldec.BlockSetSpec{
+                                TypeName: name,
+                                Nested:   childSpec,
+                                MinItems: blockS.MinItems,
+                                MaxItems: blockS.MaxItems,
+                        }
+                case NestingMap:
+                        // We prefer to use a list where possible, since it makes our
+                        // implied type more complete, but if there are any
+                        // dynamically-typed attributes inside we must use a tuple
+                        // instead, at the expense of our type then not being predictable.
+                        if blockS.Block.ImpliedType().HasDynamicTypes() {
+                                ret[name] = &hcldec.BlockObjectSpec{
+                                        TypeName:   name,
+                                        Nested:     childSpec,
+                                        LabelNames: mapLabelNames,
+                                }
+                        } else {
+                                ret[name] = &hcldec.BlockMapSpec{
+                                        TypeName:   name,
+                                        Nested:     childSpec,
+                                        LabelNames: mapLabelNames,
+                                }
+                        }
+                default:
+                        // Invalid nesting type is just ignored. It's checked by
+                        // InternalValidate.
+                        continue
+                }
+        }
+
+        return ret
+}
+
+func (a *Attribute) decoderSpec(name string) hcldec.Spec {
+        return &hcldec.AttrSpec{
+                Name:     name,
+                Type:     a.Type,
+                Required: a.Required,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/doc.go b/vendor/github.com/hashicorp/terraform/configs/configschema/doc.go
index caf8d73..caf8d73 100644
--- a/vendor/github.com/hashicorp/terraform/config/configschema/doc.go
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/doc.go
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/empty_value.go b/vendor/github.com/hashicorp/terraform/configs/configschema/empty_value.go
new file mode 100644
index 0000000..005da56
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/empty_value.go
@@ -0,0 +1,59 @@
+package configschema
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// EmptyValue returns the "empty value" for the recieving block, which for
+// a block type is a non-null object where all of the attribute values are
+// the empty values of the block's attributes and nested block types.
+//
+// In other words, it returns the value that would be returned if an empty
+// block were decoded against the recieving schema, assuming that no required
+// attribute or block constraints were honored.
+func (b *Block) EmptyValue() cty.Value {
+        vals := make(map[string]cty.Value)
+        for name, attrS := range b.Attributes {
+                vals[name] = attrS.EmptyValue()
+        }
+        for name, blockS := range b.BlockTypes {
+                vals[name] = blockS.EmptyValue()
+        }
+        return cty.ObjectVal(vals)
+}
+
+// EmptyValue returns the "empty value" for the receiving attribute, which is
+// the value that would be returned if there were no definition of the attribute
+// at all, ignoring any required constraint.
+func (a *Attribute) EmptyValue() cty.Value {
+        return cty.NullVal(a.Type)
+}
+
+// EmptyValue returns the "empty value" for when there are zero nested blocks
+// present of the receiving type.
+func (b *NestedBlock) EmptyValue() cty.Value {
+        switch b.Nesting {
+        case NestingSingle:
+                return cty.NullVal(b.Block.ImpliedType())
+        case NestingGroup:
+                return b.Block.EmptyValue()
+        case NestingList:
+                if ty := b.Block.ImpliedType(); ty.HasDynamicTypes() {
+                        return cty.EmptyTupleVal
+                } else {
+                        return cty.ListValEmpty(ty)
+                }
+        case NestingMap:
+                if ty := b.Block.ImpliedType(); ty.HasDynamicTypes() {
+                        return cty.EmptyObjectVal
+                } else {
+                        return cty.MapValEmpty(ty)
+                }
+        case NestingSet:
+                return cty.SetValEmpty(b.Block.ImpliedType())
+        default:
+                // Should never get here because the above is intended to be exhaustive,
+                // but we'll be robust and return a result nonetheless.
+                return cty.NullVal(cty.DynamicPseudoType)
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/implied_type.go b/vendor/github.com/hashicorp/terraform/configs/configschema/implied_type.go
new file mode 100644
index 0000000..c0ee841
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/implied_type.go
@@ -0,0 +1,42 @@
+package configschema
+
+import (
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// ImpliedType returns the cty.Type that would result from decoding a
+// configuration block using the receiving block schema.
+//
+// ImpliedType always returns a result, even if the given schema is
+// inconsistent. Code that creates configschema.Block objects should be
+// tested using the InternalValidate method to detect any inconsistencies
+// that would cause this method to fall back on defaults and assumptions.
+func (b *Block) ImpliedType() cty.Type {
+        if b == nil {
+                return cty.EmptyObject
+        }
+
+        return hcldec.ImpliedType(b.DecoderSpec())
+}
+
+// ContainsSensitive returns true if any of the attributes of the receiving
+// block or any of its descendent blocks are marked as sensitive.
+//
+// Blocks themselves cannot be sensitive as a whole -- sensitivity is a
+// per-attribute idea -- but sometimes we want to include a whole object
+// decoded from a block in some UI output, and that is safe to do only if
+// none of the contained attributes are sensitive.
+func (b *Block) ContainsSensitive() bool {
+        for _, attrS := range b.Attributes {
+                if attrS.Sensitive {
+                        return true
+                }
+        }
+        for _, blockS := range b.BlockTypes {
+                if blockS.ContainsSensitive() {
+                        return true
+                }
+        }
+        return false
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/internal_validate.go b/vendor/github.com/hashicorp/terraform/configs/configschema/internal_validate.go
index 33cbe88..ebf1abb 100644
--- a/vendor/github.com/hashicorp/terraform/config/configschema/internal_validate.go
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/internal_validate.go
@@ -72,10 +72,23 @@ func (b *Block) internalValidate(prefix string, err error) error {
                         case blockS.MinItems < 0 || blockS.MinItems > 1:
                                 err = multierror.Append(err, fmt.Errorf("%s%s: MinItems and MaxItems must be set to either 0 or 1 in NestingSingle mode", prefix, name))
                         }
+                case NestingGroup:
+                        if blockS.MinItems != 0 || blockS.MaxItems != 0 {
+                                err = multierror.Append(err, fmt.Errorf("%s%s: MinItems and MaxItems cannot be used in NestingGroup mode", prefix, name))
+                        }
                 case NestingList, NestingSet:
                         if blockS.MinItems > blockS.MaxItems && blockS.MaxItems != 0 {
                                 err = multierror.Append(err, fmt.Errorf("%s%s: MinItems must be less than or equal to MaxItems in %s mode", prefix, name, blockS.Nesting))
                         }
+                        if blockS.Nesting == NestingSet {
+                                ety := blockS.Block.ImpliedType()
+                                if ety.HasDynamicTypes() {
+                                        // This is not permitted because the HCL (cty) set implementation
+                                        // needs to know the exact type of set elements in order to
+                                        // properly hash them, and so can't support mixed types.
+                                        err = multierror.Append(err, fmt.Errorf("%s%s: NestingSet blocks may not contain attributes of cty.DynamicPseudoType", prefix, name))
+                                }
+                        }
                 case NestingMap:
                         if blockS.MinItems != 0 || blockS.MaxItems != 0 {
                                 err = multierror.Append(err, fmt.Errorf("%s%s: MinItems and MaxItems must both be 0 in NestingMap mode", prefix, name))
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/nestingmode_string.go b/vendor/github.com/hashicorp/terraform/configs/configschema/nestingmode_string.go
new file mode 100644
index 0000000..febe743
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/nestingmode_string.go
@@ -0,0 +1,28 @@
+// Code generated by "stringer -type=NestingMode"; DO NOT EDIT.
+
+package configschema
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[nestingModeInvalid-0]
+        _ = x[NestingSingle-1]
+        _ = x[NestingGroup-2]
+        _ = x[NestingList-3]
+        _ = x[NestingSet-4]
+        _ = x[NestingMap-5]
+}
+
+const _NestingMode_name = "nestingModeInvalidNestingSingleNestingGroupNestingListNestingSetNestingMap"
+
+var _NestingMode_index = [...]uint8{0, 18, 31, 43, 54, 64, 74}
+
+func (i NestingMode) String() string {
+        if i < 0 || i >= NestingMode(len(_NestingMode_index)-1) {
+                return "NestingMode(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+        return _NestingMode_name[_NestingMode_index[i]:_NestingMode_index[i+1]]
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/none_required.go b/vendor/github.com/hashicorp/terraform/configs/configschema/none_required.go
new file mode 100644
index 0000000..0be3b8f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/none_required.go
@@ -0,0 +1,38 @@
+package configschema
+
+// NoneRequired returns a deep copy of the receiver with any required
+// attributes translated to optional.
+func (b *Block) NoneRequired() *Block {
+        ret := &Block{}
+
+        if b.Attributes != nil {
+                ret.Attributes = make(map[string]*Attribute, len(b.Attributes))
+        }
+        for name, attrS := range b.Attributes {
+                ret.Attributes[name] = attrS.forceOptional()
+        }
+
+        if b.BlockTypes != nil {
+                ret.BlockTypes = make(map[string]*NestedBlock, len(b.BlockTypes))
+        }
+        for name, blockS := range b.BlockTypes {
+                ret.BlockTypes[name] = blockS.noneRequired()
+        }
+
+        return ret
+}
+
+func (b *NestedBlock) noneRequired() *NestedBlock {
+        ret := *b
+        ret.Block = *(ret.Block.NoneRequired())
+        ret.MinItems = 0
+        ret.MaxItems = 0
+        return &ret
+}
+
+func (a *Attribute) forceOptional() *Attribute {
+        ret := *a
+        ret.Optional = true
+        ret.Required = false
+        return &ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/schema.go b/vendor/github.com/hashicorp/terraform/configs/configschema/schema.go
index 9a8ee55..5a67334 100644
--- a/vendor/github.com/hashicorp/terraform/config/configschema/schema.go
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/schema.go
@@ -28,6 +28,12 @@ type Attribute struct {
         // Type is a type specification that the attribute's value must conform to.
         Type cty.Type
 
+        // Description is an English-language description of the purpose and
+        // usage of the attribute. A description should be concise and use only
+        // one or two sentences, leaving full definition to longer-form
+        // documentation defined elsewhere.
+        Description string
+
         // Required, if set to true, specifies that an omitted or null value is
         // not permitted.
         Required bool
@@ -87,6 +93,23 @@ const (
         // provided directly as an object value.
         NestingSingle
 
+        // NestingGroup is similar to NestingSingle in that it calls for only a
+        // single instance of a given block type with no labels, but it additonally
+        // guarantees that its result will never be null, even if the block is
+        // absent, and instead the nested attributes and blocks will be treated
+        // as absent in that case. (Any required attributes or blocks within the
+        // nested block are not enforced unless the block is explicitly present
+        // in the configuration, so they are all effectively optional when the
+        // block is not present.)
+        //
+        // This is useful for the situation where a remote API has a feature that
+        // is always enabled but has a group of settings related to that feature
+        // that themselves have default values. By using NestingGroup instead of
+        // NestingSingle in that case, generated plans will show the block as
+        // present even when not present in configuration, thus allowing any
+        // default values within to be displayed to the user.
+        NestingGroup
+
         // NestingList indicates that multiple blocks of the given type are
         // permitted, with no labels, and that their corresponding objects should
         // be provided in a list.
diff --git a/vendor/github.com/hashicorp/terraform/configs/configschema/validate_traversal.go b/vendor/github.com/hashicorp/terraform/configs/configschema/validate_traversal.go
new file mode 100644
index 0000000..a41e930
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/configschema/validate_traversal.go
@@ -0,0 +1,173 @@
+package configschema
+
+import (
+        "fmt"
+        "sort"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/helper/didyoumean"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// StaticValidateTraversal checks whether the given traversal (which must be
+// relative) refers to a construct in the receiving schema, returning error
+// diagnostics if any problems are found.
+//
+// This method is "optimistic" in that it will not return errors for possible
+// problems that cannot be detected statically. It is possible that an
+// traversal which passed static validation will still fail when evaluated.
+func (b *Block) StaticValidateTraversal(traversal hcl.Traversal) tfdiags.Diagnostics {
+        if !traversal.IsRelative() {
+                panic("StaticValidateTraversal on absolute traversal")
+        }
+        if len(traversal) == 0 {
+                return nil
+        }
+
+        var diags tfdiags.Diagnostics
+
+        next := traversal[0]
+        after := traversal[1:]
+
+        var name string
+        switch step := next.(type) {
+        case hcl.TraverseAttr:
+                name = step.Name
+        case hcl.TraverseIndex:
+                // No other traversal step types are allowed directly at a block.
+                // If it looks like the user was trying to use index syntax to
+                // access an attribute then we'll produce a specialized message.
+                key := step.Key
+                if key.Type() == cty.String && key.IsKnown() && !key.IsNull() {
+                        maybeName := key.AsString()
+                        if hclsyntax.ValidIdentifier(maybeName) {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  `Invalid index operation`,
+                                        Detail:   fmt.Sprintf(`Only attribute access is allowed here. Did you mean to access attribute %q using the dot operator?`, maybeName),
+                                        Subject:  &step.SrcRange,
+                                })
+                                return diags
+                        }
+                }
+                // If it looks like some other kind of index then we'll use a generic error.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid index operation`,
+                        Detail:   `Only attribute access is allowed here, using the dot operator.`,
+                        Subject:  &step.SrcRange,
+                })
+                return diags
+        default:
+                // No other traversal types should appear in a normal valid traversal,
+                // but we'll handle this with a generic error anyway to be robust.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid operation`,
+                        Detail:   `Only attribute access is allowed here, using the dot operator.`,
+                        Subject:  next.SourceRange().Ptr(),
+                })
+                return diags
+        }
+
+        if attrS, exists := b.Attributes[name]; exists {
+                // For attribute validation we will just apply the rest of the
+                // traversal to an unknown value of the attribute type and pass
+                // through HCL's own errors, since we don't want to replicate all of
+                // HCL's type checking rules here.
+                val := cty.UnknownVal(attrS.Type)
+                _, hclDiags := after.TraverseRel(val)
+                diags = diags.Append(hclDiags)
+                return diags
+        }
+
+        if blockS, exists := b.BlockTypes[name]; exists {
+                moreDiags := blockS.staticValidateTraversal(name, after)
+                diags = diags.Append(moreDiags)
+                return diags
+        }
+
+        // If we get here then the name isn't valid at all. We'll collect up
+        // all of the names that _are_ valid to use as suggestions.
+        var suggestions []string
+        for name := range b.Attributes {
+                suggestions = append(suggestions, name)
+        }
+        for name := range b.BlockTypes {
+                suggestions = append(suggestions, name)
+        }
+        sort.Strings(suggestions)
+        suggestion := didyoumean.NameSuggestion(name, suggestions)
+        if suggestion != "" {
+                suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+        }
+        diags = diags.Append(&hcl.Diagnostic{
+                Severity: hcl.DiagError,
+                Summary:  `Unsupported attribute`,
+                Detail:   fmt.Sprintf(`This object has no argument, nested block, or exported attribute named %q.%s`, name, suggestion),
+                Subject:  next.SourceRange().Ptr(),
+        })
+
+        return diags
+}
+
+func (b *NestedBlock) staticValidateTraversal(typeName string, traversal hcl.Traversal) tfdiags.Diagnostics {
+        if b.Nesting == NestingSingle || b.Nesting == NestingGroup {
+                // Single blocks are easy: just pass right through.
+                return b.Block.StaticValidateTraversal(traversal)
+        }
+
+        if len(traversal) == 0 {
+                // It's always valid to access a nested block's attribute directly.
+                return nil
+        }
+
+        var diags tfdiags.Diagnostics
+        next := traversal[0]
+        after := traversal[1:]
+
+        switch b.Nesting {
+
+        case NestingSet:
+                // Can't traverse into a set at all, since it does not have any keys
+                // to index with.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Cannot index a set value`,
+                        Detail:   fmt.Sprintf(`Block type %q is represented by a set of objects, and set elements do not have addressable keys. To find elements matching specific criteria, use a "for" expression with an "if" clause.`, typeName),
+                        Subject:  next.SourceRange().Ptr(),
+                })
+                return diags
+
+        case NestingList:
+                if _, ok := next.(hcl.TraverseIndex); ok {
+                        moreDiags := b.Block.StaticValidateTraversal(after)
+                        diags = diags.Append(moreDiags)
+                } else {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  `Invalid operation`,
+                                Detail:   fmt.Sprintf(`Block type %q is represented by a list of objects, so it must be indexed using a numeric key, like .%s[0].`, typeName, typeName),
+                                Subject:  next.SourceRange().Ptr(),
+                        })
+                }
+                return diags
+
+        case NestingMap:
+                // Both attribute and index steps are valid for maps, so we'll just
+                // pass through here and let normal evaluation catch an
+                // incorrectly-typed index key later, if present.
+                moreDiags := b.Block.StaticValidateTraversal(after)
+                diags = diags.Append(moreDiags)
+                return diags
+
+        default:
+                // Invalid nesting type is just ignored. It's checked by
+                // InternalValidate. (Note that we handled NestingSingle separately
+                // back at the start of this function.)
+                return nil
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/depends_on.go b/vendor/github.com/hashicorp/terraform/configs/depends_on.go
new file mode 100644
index 0000000..b198476
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/depends_on.go
@@ -0,0 +1,23 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+func decodeDependsOn(attr *hcl.Attribute) ([]hcl.Traversal, hcl.Diagnostics) {
+        var ret []hcl.Traversal
+        exprs, diags := hcl.ExprList(attr.Expr)
+
+        for _, expr := range exprs {
+                expr, shimDiags := shimTraversalInString(expr, false)
+                diags = append(diags, shimDiags...)
+
+                traversal, travDiags := hcl.AbsTraversalForExpr(expr)
+                diags = append(diags, travDiags...)
+                if len(traversal) != 0 {
+                        ret = append(ret, traversal)
+                }
+        }
+
+        return ret, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/doc.go b/vendor/github.com/hashicorp/terraform/configs/doc.go
new file mode 100644
index 0000000..f01eb79
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/doc.go
@@ -0,0 +1,19 @@
+// Package configs contains types that represent Terraform configurations and
+// the different elements thereof.
+//
+// The functionality in this package can be used for some static analyses of
+// Terraform configurations, but this package generally exposes representations
+// of the configuration source code rather than the result of evaluating these
+// objects. The sibling package "lang" deals with evaluation of structures
+// and expressions in the configuration.
+//
+// Due to its close relationship with HCL, this package makes frequent use
+// of types from the HCL API, including raw HCL diagnostic messages. Such
+// diagnostics can be converted into Terraform-flavored diagnostics, if needed,
+// using functions in the sibling package tfdiags.
+//
+// The Parser type is the main entry-point into this package. The LoadConfigDir
+// method can be used to load a single module directory, and then a full
+// configuration (including any descendent modules) can be produced using
+// the top-level BuildConfig method.
+package configs
diff --git a/vendor/github.com/hashicorp/terraform/configs/module.go b/vendor/github.com/hashicorp/terraform/configs/module.go
new file mode 100644
index 0000000..250f9d3
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/module.go
@@ -0,0 +1,404 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Module is a container for a set of configuration constructs that are
+// evaluated within a common namespace.
+type Module struct {
+        // SourceDir is the filesystem directory that the module was loaded from.
+        //
+        // This is populated automatically only for configurations loaded with
+        // LoadConfigDir. If the parser is using a virtual filesystem then the
+        // path here will be in terms of that virtual filesystem.
+
+        // Any other caller that constructs a module directly with NewModule may
+        // assign a suitable value to this attribute before using it for other
+        // purposes. It should be treated as immutable by all consumers of Module
+        // values.
+        SourceDir string
+
+        CoreVersionConstraints []VersionConstraint
+
+        Backend              *Backend
+        ProviderConfigs      map[string]*Provider
+        ProviderRequirements map[string][]VersionConstraint
+
+        Variables map[string]*Variable
+        Locals    map[string]*Local
+        Outputs   map[string]*Output
+
+        ModuleCalls map[string]*ModuleCall
+
+        ManagedResources map[string]*Resource
+        DataResources    map[string]*Resource
+}
+
+// File describes the contents of a single configuration file.
+//
+// Individual files are not usually used alone, but rather combined together
+// with other files (conventionally, those in the same directory) to produce
+// a *Module, using NewModule.
+//
+// At the level of an individual file we represent directly the structural
+// elements present in the file, without any attempt to detect conflicting
+// declarations. A File object can therefore be used for some basic static
+// analysis of individual elements, but must be built into a Module to detect
+// duplicate declarations.
+type File struct {
+        CoreVersionConstraints []VersionConstraint
+
+        Backends             []*Backend
+        ProviderConfigs      []*Provider
+        ProviderRequirements []*ProviderRequirement
+
+        Variables []*Variable
+        Locals    []*Local
+        Outputs   []*Output
+
+        ModuleCalls []*ModuleCall
+
+        ManagedResources []*Resource
+        DataResources    []*Resource
+}
+
+// NewModule takes a list of primary files and a list of override files and
+// produces a *Module by combining the files together.
+//
+// If there are any conflicting declarations in the given files -- for example,
+// if the same variable name is defined twice -- then the resulting module
+// will be incomplete and error diagnostics will be returned. Careful static
+// analysis of the returned Module is still possible in this case, but the
+// module will probably not be semantically valid.
+func NewModule(primaryFiles, overrideFiles []*File) (*Module, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        mod := &Module{
+                ProviderConfigs:      map[string]*Provider{},
+                ProviderRequirements: map[string][]VersionConstraint{},
+                Variables:            map[string]*Variable{},
+                Locals:               map[string]*Local{},
+                Outputs:              map[string]*Output{},
+                ModuleCalls:          map[string]*ModuleCall{},
+                ManagedResources:     map[string]*Resource{},
+                DataResources:        map[string]*Resource{},
+        }
+
+        for _, file := range primaryFiles {
+                fileDiags := mod.appendFile(file)
+                diags = append(diags, fileDiags...)
+        }
+
+        for _, file := range overrideFiles {
+                fileDiags := mod.mergeFile(file)
+                diags = append(diags, fileDiags...)
+        }
+
+        return mod, diags
+}
+
+// ResourceByAddr returns the configuration for the resource with the given
+// address, or nil if there is no such resource.
+func (m *Module) ResourceByAddr(addr addrs.Resource) *Resource {
+        key := addr.String()
+        switch addr.Mode {
+        case addrs.ManagedResourceMode:
+                return m.ManagedResources[key]
+        case addrs.DataResourceMode:
+                return m.DataResources[key]
+        default:
+                return nil
+        }
+}
+
+func (m *Module) appendFile(file *File) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        for _, constraint := range file.CoreVersionConstraints {
+                // If there are any conflicting requirements then we'll catch them
+                // when we actually check these constraints.
+                m.CoreVersionConstraints = append(m.CoreVersionConstraints, constraint)
+        }
+
+        for _, b := range file.Backends {
+                if m.Backend != nil {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Duplicate backend configuration",
+                                Detail:   fmt.Sprintf("A module may have only one backend configuration. The backend was previously configured at %s.", m.Backend.DeclRange),
+                                Subject:  &b.DeclRange,
+                        })
+                        continue
+                }
+                m.Backend = b
+        }
+
+        for _, pc := range file.ProviderConfigs {
+                key := pc.moduleUniqueKey()
+                if existing, exists := m.ProviderConfigs[key]; exists {
+                        if existing.Alias == "" {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Duplicate provider configuration",
+                                        Detail:   fmt.Sprintf("A default (non-aliased) provider configuration for %q was already given at %s. If multiple configurations are required, set the \"alias\" argument for alternative configurations.", existing.Name, existing.DeclRange),
+                                        Subject:  &pc.DeclRange,
+                                })
+                        } else {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Duplicate provider configuration",
+                                        Detail:   fmt.Sprintf("A provider configuration for %q with alias %q was already given at %s. Each configuration for the same provider must have a distinct alias.", existing.Name, existing.Alias, existing.DeclRange),
+                                        Subject:  &pc.DeclRange,
+                                })
+                        }
+                        continue
+                }
+                m.ProviderConfigs[key] = pc
+        }
+
+        for _, reqd := range file.ProviderRequirements {
+                m.ProviderRequirements[reqd.Name] = append(m.ProviderRequirements[reqd.Name], reqd.Requirement)
+        }
+
+        for _, v := range file.Variables {
+                if existing, exists := m.Variables[v.Name]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Duplicate variable declaration",
+                                Detail:   fmt.Sprintf("A variable named %q was already declared at %s. Variable names must be unique within a module.", existing.Name, existing.DeclRange),
+                                Subject:  &v.DeclRange,
+                        })
+                }
+                m.Variables[v.Name] = v
+        }
+
+        for _, l := range file.Locals {
+                if existing, exists := m.Locals[l.Name]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Duplicate local value definition",
+                                Detail:   fmt.Sprintf("A local value named %q was already defined at %s. Local value names must be unique within a module.", existing.Name, existing.DeclRange),
+                                Subject:  &l.DeclRange,
+                        })
+                }
+                m.Locals[l.Name] = l
+        }
+
+        for _, o := range file.Outputs {
+                if existing, exists := m.Outputs[o.Name]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Duplicate output definition",
+                                Detail:   fmt.Sprintf("An output named %q was already defined at %s. Output names must be unique within a module.", existing.Name, existing.DeclRange),
+                                Subject:  &o.DeclRange,
+                        })
+                }
+                m.Outputs[o.Name] = o
+        }
+
+        for _, mc := range file.ModuleCalls {
+                if existing, exists := m.ModuleCalls[mc.Name]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Duplicate module call",
+                                Detail:   fmt.Sprintf("An module call named %q was already defined at %s. Module calls must have unique names within a module.", existing.Name, existing.DeclRange),
+                                Subject:  &mc.DeclRange,
+                        })
+                }
+                m.ModuleCalls[mc.Name] = mc
+        }
+
+        for _, r := range file.ManagedResources {
+                key := r.moduleUniqueKey()
+                if existing, exists := m.ManagedResources[key]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Duplicate resource %q configuration", existing.Type),
+                                Detail:   fmt.Sprintf("A %s resource named %q was already declared at %s. Resource names must be unique per type in each module.", existing.Type, existing.Name, existing.DeclRange),
+                                Subject:  &r.DeclRange,
+                        })
+                        continue
+                }
+                m.ManagedResources[key] = r
+        }
+
+        for _, r := range file.DataResources {
+                key := r.moduleUniqueKey()
+                if existing, exists := m.DataResources[key]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Duplicate data %q configuration", existing.Type),
+                                Detail:   fmt.Sprintf("A %s data resource named %q was already declared at %s. Resource names must be unique per type in each module.", existing.Type, existing.Name, existing.DeclRange),
+                                Subject:  &r.DeclRange,
+                        })
+                        continue
+                }
+                m.DataResources[key] = r
+        }
+
+        return diags
+}
+
+func (m *Module) mergeFile(file *File) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        if len(file.CoreVersionConstraints) != 0 {
+                // This is a bit of a strange case for overriding since we normally
+                // would union together across multiple files anyway, but we'll
+                // allow it and have each override file clobber any existing list.
+                m.CoreVersionConstraints = nil
+                for _, constraint := range file.CoreVersionConstraints {
+                        m.CoreVersionConstraints = append(m.CoreVersionConstraints, constraint)
+                }
+        }
+
+        if len(file.Backends) != 0 {
+                switch len(file.Backends) {
+                case 1:
+                        m.Backend = file.Backends[0]
+                default:
+                        // An override file with multiple backends is still invalid, even
+                        // though it can override backends from _other_ files.
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Duplicate backend configuration",
+                                Detail:   fmt.Sprintf("Each override file may have only one backend configuration. A backend was previously configured at %s.", file.Backends[0].DeclRange),
+                                Subject:  &file.Backends[1].DeclRange,
+                        })
+                }
+        }
+
+        for _, pc := range file.ProviderConfigs {
+                key := pc.moduleUniqueKey()
+                existing, exists := m.ProviderConfigs[key]
+                if pc.Alias == "" {
+                        // We allow overriding a non-existing _default_ provider configuration
+                        // because the user model is that an absent provider configuration
+                        // implies an empty provider configuration, which is what the user
+                        // is therefore overriding here.
+                        if exists {
+                                mergeDiags := existing.merge(pc)
+                                diags = append(diags, mergeDiags...)
+                        } else {
+                                m.ProviderConfigs[key] = pc
+                        }
+                } else {
+                        // For aliased providers, there must be a base configuration to
+                        // override. This allows us to detect and report alias typos
+                        // that might otherwise cause the override to not apply.
+                        if !exists {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Missing base provider configuration for override",
+                                        Detail:   fmt.Sprintf("There is no %s provider configuration with the alias %q. An override file can only override an aliased provider configuration that was already defined in a primary configuration file.", pc.Name, pc.Alias),
+                                        Subject:  &pc.DeclRange,
+                                })
+                                continue
+                        }
+                        mergeDiags := existing.merge(pc)
+                        diags = append(diags, mergeDiags...)
+                }
+        }
+
+        if len(file.ProviderRequirements) != 0 {
+                mergeProviderVersionConstraints(m.ProviderRequirements, file.ProviderRequirements)
+        }
+
+        for _, v := range file.Variables {
+                existing, exists := m.Variables[v.Name]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing base variable declaration to override",
+                                Detail:   fmt.Sprintf("There is no variable named %q. An override file can only override a variable that was already declared in a primary configuration file.", v.Name),
+                                Subject:  &v.DeclRange,
+                        })
+                        continue
+                }
+                mergeDiags := existing.merge(v)
+                diags = append(diags, mergeDiags...)
+        }
+
+        for _, l := range file.Locals {
+                existing, exists := m.Locals[l.Name]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing base local value definition to override",
+                                Detail:   fmt.Sprintf("There is no local value named %q. An override file can only override a local value that was already defined in a primary configuration file.", l.Name),
+                                Subject:  &l.DeclRange,
+                        })
+                        continue
+                }
+                mergeDiags := existing.merge(l)
+                diags = append(diags, mergeDiags...)
+        }
+
+        for _, o := range file.Outputs {
+                existing, exists := m.Outputs[o.Name]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing base output definition to override",
+                                Detail:   fmt.Sprintf("There is no output named %q. An override file can only override an output that was already defined in a primary configuration file.", o.Name),
+                                Subject:  &o.DeclRange,
+                        })
+                        continue
+                }
+                mergeDiags := existing.merge(o)
+                diags = append(diags, mergeDiags...)
+        }
+
+        for _, mc := range file.ModuleCalls {
+                existing, exists := m.ModuleCalls[mc.Name]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing module call to override",
+                                Detail:   fmt.Sprintf("There is no module call named %q. An override file can only override a module call that was defined in a primary configuration file.", mc.Name),
+                                Subject:  &mc.DeclRange,
+                        })
+                        continue
+                }
+                mergeDiags := existing.merge(mc)
+                diags = append(diags, mergeDiags...)
+        }
+
+        for _, r := range file.ManagedResources {
+                key := r.moduleUniqueKey()
+                existing, exists := m.ManagedResources[key]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing resource to override",
+                                Detail:   fmt.Sprintf("There is no %s resource named %q. An override file can only override a resource block defined in a primary configuration file.", r.Type, r.Name),
+                                Subject:  &r.DeclRange,
+                        })
+                        continue
+                }
+                mergeDiags := existing.merge(r)
+                diags = append(diags, mergeDiags...)
+        }
+
+        for _, r := range file.DataResources {
+                key := r.moduleUniqueKey()
+                existing, exists := m.DataResources[key]
+                if !exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing data resource to override",
+                                Detail:   fmt.Sprintf("There is no %s data resource named %q. An override file can only override a data block defined in a primary configuration file.", r.Type, r.Name),
+                                Subject:  &r.DeclRange,
+                        })
+                        continue
+                }
+                mergeDiags := existing.merge(r)
+                diags = append(diags, mergeDiags...)
+        }
+
+        return diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/module_call.go b/vendor/github.com/hashicorp/terraform/configs/module_call.go
new file mode 100644
index 0000000..8c3ba67
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/module_call.go
@@ -0,0 +1,188 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/gohcl"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+)
+
+// ModuleCall represents a "module" block in a module or file.
+type ModuleCall struct {
+        Name string
+
+        SourceAddr      string
+        SourceAddrRange hcl.Range
+        SourceSet       bool
+
+        Config hcl.Body
+
+        Version VersionConstraint
+
+        Count   hcl.Expression
+        ForEach hcl.Expression
+
+        Providers []PassedProviderConfig
+
+        DependsOn []hcl.Traversal
+
+        DeclRange hcl.Range
+}
+
+func decodeModuleBlock(block *hcl.Block, override bool) (*ModuleCall, hcl.Diagnostics) {
+        mc := &ModuleCall{
+                Name:      block.Labels[0],
+                DeclRange: block.DefRange,
+        }
+
+        schema := moduleBlockSchema
+        if override {
+                schema = schemaForOverrides(schema)
+        }
+
+        content, remain, diags := block.Body.PartialContent(schema)
+        mc.Config = remain
+
+        if !hclsyntax.ValidIdentifier(mc.Name) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid module instance name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[0],
+                })
+        }
+
+        if attr, exists := content.Attributes["source"]; exists {
+                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &mc.SourceAddr)
+                diags = append(diags, valDiags...)
+                mc.SourceAddrRange = attr.Expr.Range()
+                mc.SourceSet = true
+        }
+
+        if attr, exists := content.Attributes["version"]; exists {
+                var versionDiags hcl.Diagnostics
+                mc.Version, versionDiags = decodeVersionConstraint(attr)
+                diags = append(diags, versionDiags...)
+        }
+
+        if attr, exists := content.Attributes["count"]; exists {
+                mc.Count = attr.Expr
+
+                // We currently parse this, but don't yet do anything with it.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved argument name in module block",
+                        Detail:   fmt.Sprintf("The name %q is reserved for use in a future version of Terraform.", attr.Name),
+                        Subject:  &attr.NameRange,
+                })
+        }
+
+        if attr, exists := content.Attributes["for_each"]; exists {
+                mc.ForEach = attr.Expr
+
+                // We currently parse this, but don't yet do anything with it.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved argument name in module block",
+                        Detail:   fmt.Sprintf("The name %q is reserved for use in a future version of Terraform.", attr.Name),
+                        Subject:  &attr.NameRange,
+                })
+        }
+
+        if attr, exists := content.Attributes["depends_on"]; exists {
+                deps, depsDiags := decodeDependsOn(attr)
+                diags = append(diags, depsDiags...)
+                mc.DependsOn = append(mc.DependsOn, deps...)
+
+                // We currently parse this, but don't yet do anything with it.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved argument name in module block",
+                        Detail:   fmt.Sprintf("The name %q is reserved for use in a future version of Terraform.", attr.Name),
+                        Subject:  &attr.NameRange,
+                })
+        }
+
+        if attr, exists := content.Attributes["providers"]; exists {
+                seen := make(map[string]hcl.Range)
+                pairs, pDiags := hcl.ExprMap(attr.Expr)
+                diags = append(diags, pDiags...)
+                for _, pair := range pairs {
+                        key, keyDiags := decodeProviderConfigRef(pair.Key, "providers")
+                        diags = append(diags, keyDiags...)
+                        value, valueDiags := decodeProviderConfigRef(pair.Value, "providers")
+                        diags = append(diags, valueDiags...)
+                        if keyDiags.HasErrors() || valueDiags.HasErrors() {
+                                continue
+                        }
+
+                        matchKey := key.String()
+                        if prev, exists := seen[matchKey]; exists {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Duplicate provider address",
+                                        Detail:   fmt.Sprintf("A provider configuration was already passed to %s at %s. Each child provider configuration can be assigned only once.", matchKey, prev),
+                                        Subject:  pair.Value.Range().Ptr(),
+                                })
+                                continue
+                        }
+
+                        rng := hcl.RangeBetween(pair.Key.Range(), pair.Value.Range())
+                        seen[matchKey] = rng
+                        mc.Providers = append(mc.Providers, PassedProviderConfig{
+                                InChild:  key,
+                                InParent: value,
+                        })
+                }
+        }
+
+        // Reserved block types (all of them)
+        for _, block := range content.Blocks {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved block type name in module block",
+                        Detail:   fmt.Sprintf("The block type name %q is reserved for use by Terraform in a future version.", block.Type),
+                        Subject:  &block.TypeRange,
+                })
+        }
+
+        return mc, diags
+}
+
+// PassedProviderConfig represents a provider config explicitly passed down to
+// a child module, possibly giving it a new local address in the process.
+type PassedProviderConfig struct {
+        InChild  *ProviderConfigRef
+        InParent *ProviderConfigRef
+}
+
+var moduleBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name:     "source",
+                        Required: true,
+                },
+                {
+                        Name: "version",
+                },
+                {
+                        Name: "count",
+                },
+                {
+                        Name: "for_each",
+                },
+                {
+                        Name: "depends_on",
+                },
+                {
+                        Name: "providers",
+                },
+        },
+        Blocks: []hcl.BlockHeaderSchema{
+                // These are all reserved for future use.
+                {Type: "lifecycle"},
+                {Type: "locals"},
+                {Type: "provider", LabelNames: []string{"type"}},
+        },
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/module_merge.go b/vendor/github.com/hashicorp/terraform/configs/module_merge.go
new file mode 100644
index 0000000..12614c1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/module_merge.go
@@ -0,0 +1,247 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+)
+
+// The methods in this file are used by Module.mergeFile to apply overrides
+// to our different configuration elements. These methods all follow the
+// pattern of mutating the receiver to incorporate settings from the parameter,
+// returning error diagnostics if any aspect of the parameter cannot be merged
+// into the receiver for some reason.
+//
+// User expectation is that anything _explicitly_ set in the given object
+// should take precedence over the corresponding settings in the receiver,
+// but that anything omitted in the given object should be left unchanged.
+// In some cases it may be reasonable to do a "deep merge" of certain nested
+// features, if it is possible to unambiguously correlate the nested elements
+// and their behaviors are orthogonal to each other.
+
+func (p *Provider) merge(op *Provider) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        if op.Version.Required != nil {
+                p.Version = op.Version
+        }
+
+        p.Config = MergeBodies(p.Config, op.Config)
+
+        return diags
+}
+
+func mergeProviderVersionConstraints(recv map[string][]VersionConstraint, ovrd []*ProviderRequirement) {
+        // Any provider name that's mentioned in the override gets nilled out in
+        // our map so that we'll rebuild it below. Any provider not mentioned is
+        // left unchanged.
+        for _, reqd := range ovrd {
+                delete(recv, reqd.Name)
+        }
+        for _, reqd := range ovrd {
+                recv[reqd.Name] = append(recv[reqd.Name], reqd.Requirement)
+        }
+}
+
+func (v *Variable) merge(ov *Variable) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        if ov.DescriptionSet {
+                v.Description = ov.Description
+                v.DescriptionSet = ov.DescriptionSet
+        }
+        if ov.Default != cty.NilVal {
+                v.Default = ov.Default
+        }
+        if ov.Type != cty.NilType {
+                v.Type = ov.Type
+        }
+        if ov.ParsingMode != 0 {
+                v.ParsingMode = ov.ParsingMode
+        }
+
+        // If the override file overrode type without default or vice-versa then
+        // it may have created an invalid situation, which we'll catch now by
+        // attempting to re-convert the value.
+        //
+        // Note that here we may be re-converting an already-converted base value
+        // from the base config. This will be a no-op if the type was not changed,
+        // but in particular might be user-observable in the edge case where the
+        // literal value in config could've been converted to the overridden type
+        // constraint but the converted value cannot. In practice, this situation
+        // should be rare since most of our conversions are interchangable.
+        if v.Default != cty.NilVal {
+                val, err := convert.Convert(v.Default, v.Type)
+                if err != nil {
+                        // What exactly we'll say in the error message here depends on whether
+                        // it was Default or Type that was overridden here.
+                        switch {
+                        case ov.Type != cty.NilType && ov.Default == cty.NilVal:
+                                // If only the type was overridden
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid default value for variable",
+                                        Detail:   fmt.Sprintf("Overriding this variable's type constraint has made its default value invalid: %s.", err),
+                                        Subject:  &ov.DeclRange,
+                                })
+                        case ov.Type == cty.NilType && ov.Default != cty.NilVal:
+                                // Only the default was overridden
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid default value for variable",
+                                        Detail:   fmt.Sprintf("The overridden default value for this variable is not compatible with the variable's type constraint: %s.", err),
+                                        Subject:  &ov.DeclRange,
+                                })
+                        default:
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid default value for variable",
+                                        Detail:   fmt.Sprintf("This variable's default value is not compatible with its type constraint: %s.", err),
+                                        Subject:  &ov.DeclRange,
+                                })
+                        }
+                } else {
+                        v.Default = val
+                }
+        }
+
+        return diags
+}
+
+func (l *Local) merge(ol *Local) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        // Since a local is just a single expression in configuration, the
+        // override definition entirely replaces the base definition, including
+        // the source range so that we'll send the user to the right place if
+        // there is an error.
+        l.Expr = ol.Expr
+        l.DeclRange = ol.DeclRange
+
+        return diags
+}
+
+func (o *Output) merge(oo *Output) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        if oo.Description != "" {
+                o.Description = oo.Description
+        }
+        if oo.Expr != nil {
+                o.Expr = oo.Expr
+        }
+        if oo.SensitiveSet {
+                o.Sensitive = oo.Sensitive
+                o.SensitiveSet = oo.SensitiveSet
+        }
+
+        // We don't allow depends_on to be overridden because that is likely to
+        // cause confusing misbehavior.
+        if len(oo.DependsOn) != 0 {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Unsupported override",
+                        Detail:   "The depends_on argument may not be overridden.",
+                        Subject:  oo.DependsOn[0].SourceRange().Ptr(), // the first item is the closest range we have
+                })
+        }
+
+        return diags
+}
+
+func (mc *ModuleCall) merge(omc *ModuleCall) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        if omc.SourceSet {
+                mc.SourceAddr = omc.SourceAddr
+                mc.SourceAddrRange = omc.SourceAddrRange
+                mc.SourceSet = omc.SourceSet
+        }
+
+        if omc.Count != nil {
+                mc.Count = omc.Count
+        }
+
+        if omc.ForEach != nil {
+                mc.ForEach = omc.ForEach
+        }
+
+        if len(omc.Version.Required) != 0 {
+                mc.Version = omc.Version
+        }
+
+        mc.Config = MergeBodies(mc.Config, omc.Config)
+
+        // We don't allow depends_on to be overridden because that is likely to
+        // cause confusing misbehavior.
+        if len(mc.DependsOn) != 0 {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Unsupported override",
+                        Detail:   "The depends_on argument may not be overridden.",
+                        Subject:  mc.DependsOn[0].SourceRange().Ptr(), // the first item is the closest range we have
+                })
+        }
+
+        return diags
+}
+
+func (r *Resource) merge(or *Resource) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        if r.Mode != or.Mode {
+                // This is always a programming error, since managed and data resources
+                // are kept in separate maps in the configuration structures.
+                panic(fmt.Errorf("can't merge %s into %s", or.Mode, r.Mode))
+        }
+
+        if or.Count != nil {
+                r.Count = or.Count
+        }
+        if or.ForEach != nil {
+                r.ForEach = or.ForEach
+        }
+        if or.ProviderConfigRef != nil {
+                r.ProviderConfigRef = or.ProviderConfigRef
+        }
+        if r.Mode == addrs.ManagedResourceMode {
+                // or.Managed is always non-nil for managed resource mode
+
+                if or.Managed.Connection != nil {
+                        r.Managed.Connection = or.Managed.Connection
+                }
+                if or.Managed.CreateBeforeDestroySet {
+                        r.Managed.CreateBeforeDestroy = or.Managed.CreateBeforeDestroy
+                        r.Managed.CreateBeforeDestroySet = or.Managed.CreateBeforeDestroySet
+                }
+                if len(or.Managed.IgnoreChanges) != 0 {
+                        r.Managed.IgnoreChanges = or.Managed.IgnoreChanges
+                }
+                if or.Managed.PreventDestroySet {
+                        r.Managed.PreventDestroy = or.Managed.PreventDestroy
+                        r.Managed.PreventDestroySet = or.Managed.PreventDestroySet
+                }
+                if len(or.Managed.Provisioners) != 0 {
+                        r.Managed.Provisioners = or.Managed.Provisioners
+                }
+        }
+
+        r.Config = MergeBodies(r.Config, or.Config)
+
+        // We don't allow depends_on to be overridden because that is likely to
+        // cause confusing misbehavior.
+        if len(or.DependsOn) != 0 {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Unsupported override",
+                        Detail:   "The depends_on argument may not be overridden.",
+                        Subject:  or.DependsOn[0].SourceRange().Ptr(), // the first item is the closest range we have
+                })
+        }
+
+        return diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/module_merge_body.go b/vendor/github.com/hashicorp/terraform/configs/module_merge_body.go
new file mode 100644
index 0000000..0ed561e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/module_merge_body.go
@@ -0,0 +1,143 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// MergeBodies creates a new HCL body that contains a combination of the
+// given base and override bodies. Attributes and blocks defined in the
+// override body take precedence over those of the same name defined in
+// the base body.
+//
+// If any block of a particular type appears in "override" then it will
+// replace _all_ of the blocks of the same type in "base" in the new
+// body.
+func MergeBodies(base, override hcl.Body) hcl.Body {
+        return mergeBody{
+                Base:     base,
+                Override: override,
+        }
+}
+
+// mergeBody is a hcl.Body implementation that wraps a pair of other bodies
+// and allows attributes and blocks within the override to take precedence
+// over those defined in the base body.
+//
+// This is used to deal with dynamically-processed bodies in Module.mergeFile.
+// It uses a shallow-only merging strategy where direct attributes defined
+// in Override will override attributes of the same name in Base, while any
+// blocks defined in Override will hide all blocks of the same type in Base.
+//
+// This cannot possibly "do the right thing" in all cases, because we don't
+// have enough information about user intent. However, this behavior is intended
+// to be reasonable for simple overriding use-cases.
+type mergeBody struct {
+        Base     hcl.Body
+        Override hcl.Body
+}
+
+var _ hcl.Body = mergeBody{}
+
+func (b mergeBody) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        baseSchema := schemaWithDynamic(schema)
+        overrideSchema := schemaWithDynamic(schemaForOverrides(schema))
+
+        baseContent, _, cDiags := b.Base.PartialContent(baseSchema)
+        diags = append(diags, cDiags...)
+        overrideContent, _, cDiags := b.Override.PartialContent(overrideSchema)
+        diags = append(diags, cDiags...)
+
+        content := b.prepareContent(baseContent, overrideContent)
+
+        return content, diags
+}
+
+func (b mergeBody) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        baseSchema := schemaWithDynamic(schema)
+        overrideSchema := schemaWithDynamic(schemaForOverrides(schema))
+
+        baseContent, baseRemain, cDiags := b.Base.PartialContent(baseSchema)
+        diags = append(diags, cDiags...)
+        overrideContent, overrideRemain, cDiags := b.Override.PartialContent(overrideSchema)
+        diags = append(diags, cDiags...)
+
+        content := b.prepareContent(baseContent, overrideContent)
+
+        remain := MergeBodies(baseRemain, overrideRemain)
+
+        return content, remain, diags
+}
+
+func (b mergeBody) prepareContent(base *hcl.BodyContent, override *hcl.BodyContent) *hcl.BodyContent {
+        content := &hcl.BodyContent{
+                Attributes: make(hcl.Attributes),
+        }
+
+        // For attributes we just assign from each map in turn and let the override
+        // map clobber any matching entries from base.
+        for k, a := range base.Attributes {
+                content.Attributes[k] = a
+        }
+        for k, a := range override.Attributes {
+                content.Attributes[k] = a
+        }
+
+        // Things are a little more interesting for blocks because they arrive
+        // as a flat list. Our merging semantics call for us to suppress blocks
+        // from base if at least one block of the same type appears in override.
+        // We explicitly do not try to correlate and deeply merge nested blocks,
+        // since we don't have enough context here to infer user intent.
+
+        overriddenBlockTypes := make(map[string]bool)
+        for _, block := range override.Blocks {
+                if block.Type == "dynamic" {
+                        overriddenBlockTypes[block.Labels[0]] = true
+                        continue
+                }
+                overriddenBlockTypes[block.Type] = true
+        }
+        for _, block := range base.Blocks {
+                // We skip over dynamic blocks whose type label is an overridden type
+                // but note that below we do still leave them as dynamic blocks in
+                // the result because expanding the dynamic blocks that are left is
+                // done much later during the core graph walks, where we can safely
+                // evaluate the expressions.
+                if block.Type == "dynamic" && overriddenBlockTypes[block.Labels[0]] {
+                        continue
+                }
+                if overriddenBlockTypes[block.Type] {
+                        continue
+                }
+                content.Blocks = append(content.Blocks, block)
+        }
+        for _, block := range override.Blocks {
+                content.Blocks = append(content.Blocks, block)
+        }
+
+        return content
+}
+
+func (b mergeBody) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        ret := make(hcl.Attributes)
+
+        baseAttrs, aDiags := b.Base.JustAttributes()
+        diags = append(diags, aDiags...)
+        overrideAttrs, aDiags := b.Override.JustAttributes()
+        diags = append(diags, aDiags...)
+
+        for k, a := range baseAttrs {
+                ret[k] = a
+        }
+        for k, a := range overrideAttrs {
+                ret[k] = a
+        }
+
+        return ret, diags
+}
+
+func (b mergeBody) MissingItemRange() hcl.Range {
+        return b.Base.MissingItemRange()
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/named_values.go b/vendor/github.com/hashicorp/terraform/configs/named_values.go
new file mode 100644
index 0000000..6f6b469
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/named_values.go
@@ -0,0 +1,364 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/ext/typeexpr"
+        "github.com/hashicorp/hcl2/gohcl"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// A consistent detail message for all "not a valid identifier" diagnostics.
+const badIdentifierDetail = "A name must start with a letter and may contain only letters, digits, underscores, and dashes."
+
+// Variable represents a "variable" block in a module or file.
+type Variable struct {
+        Name        string
+        Description string
+        Default     cty.Value
+        Type        cty.Type
+        ParsingMode VariableParsingMode
+
+        DescriptionSet bool
+
+        DeclRange hcl.Range
+}
+
+func decodeVariableBlock(block *hcl.Block, override bool) (*Variable, hcl.Diagnostics) {
+        v := &Variable{
+                Name:      block.Labels[0],
+                DeclRange: block.DefRange,
+        }
+
+        // Unless we're building an override, we'll set some defaults
+        // which we might override with attributes below. We leave these
+        // as zero-value in the override case so we can recognize whether
+        // or not they are set when we merge.
+        if !override {
+                v.Type = cty.DynamicPseudoType
+                v.ParsingMode = VariableParseLiteral
+        }
+
+        content, diags := block.Body.Content(variableBlockSchema)
+
+        if !hclsyntax.ValidIdentifier(v.Name) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid variable name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[0],
+                })
+        }
+
+        // Don't allow declaration of variables that would conflict with the
+        // reserved attribute and block type names in a "module" block, since
+        // these won't be usable for child modules.
+        for _, attr := range moduleBlockSchema.Attributes {
+                if attr.Name == v.Name {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid variable name",
+                                Detail:   fmt.Sprintf("The variable name %q is reserved due to its special meaning inside module blocks.", attr.Name),
+                                Subject:  &block.LabelRanges[0],
+                        })
+                }
+        }
+        for _, blockS := range moduleBlockSchema.Blocks {
+                if blockS.Type == v.Name {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid variable name",
+                                Detail:   fmt.Sprintf("The variable name %q is reserved due to its special meaning inside module blocks.", blockS.Type),
+                                Subject:  &block.LabelRanges[0],
+                        })
+                }
+        }
+
+        if attr, exists := content.Attributes["description"]; exists {
+                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &v.Description)
+                diags = append(diags, valDiags...)
+                v.DescriptionSet = true
+        }
+
+        if attr, exists := content.Attributes["type"]; exists {
+                ty, parseMode, tyDiags := decodeVariableType(attr.Expr)
+                diags = append(diags, tyDiags...)
+                v.Type = ty
+                v.ParsingMode = parseMode
+        }
+
+        if attr, exists := content.Attributes["default"]; exists {
+                val, valDiags := attr.Expr.Value(nil)
+                diags = append(diags, valDiags...)
+
+                // Convert the default to the expected type so we can catch invalid
+                // defaults early and allow later code to assume validity.
+                // Note that this depends on us having already processed any "type"
+                // attribute above.
+                // However, we can't do this if we're in an override file where
+                // the type might not be set; we'll catch that during merge.
+                if v.Type != cty.NilType {
+                        var err error
+                        val, err = convert.Convert(val, v.Type)
+                        if err != nil {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid default value for variable",
+                                        Detail:   fmt.Sprintf("This default value is not compatible with the variable's type constraint: %s.", err),
+                                        Subject:  attr.Expr.Range().Ptr(),
+                                })
+                                val = cty.DynamicVal
+                        }
+                }
+
+                v.Default = val
+        }
+
+        return v, diags
+}
+
+func decodeVariableType(expr hcl.Expression) (cty.Type, VariableParsingMode, hcl.Diagnostics) {
+        if exprIsNativeQuotedString(expr) {
+                // Here we're accepting the pre-0.12 form of variable type argument where
+                // the string values "string", "list" and "map" are accepted has a hint
+                // about the type used primarily for deciding how to parse values
+                // given on the command line and in environment variables.
+                // Only the native syntax ends up in this codepath; we handle the
+                // JSON syntax (which is, of course, quoted even in the new format)
+                // in the normal codepath below.
+                val, diags := expr.Value(nil)
+                if diags.HasErrors() {
+                        return cty.DynamicPseudoType, VariableParseHCL, diags
+                }
+                str := val.AsString()
+                switch str {
+                case "string":
+                        return cty.String, VariableParseLiteral, diags
+                case "list":
+                        return cty.List(cty.DynamicPseudoType), VariableParseHCL, diags
+                case "map":
+                        return cty.Map(cty.DynamicPseudoType), VariableParseHCL, diags
+                default:
+                        return cty.DynamicPseudoType, VariableParseHCL, hcl.Diagnostics{{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid legacy variable type hint",
+                                Detail:   `The legacy variable type hint form, using a quoted string, allows only the values "string", "list", and "map". To provide a full type expression, remove the surrounding quotes and give the type expression directly.`,
+                                Subject:  expr.Range().Ptr(),
+                        }}
+                }
+        }
+
+        // First we'll deal with some shorthand forms that the HCL-level type
+        // expression parser doesn't include. These both emulate pre-0.12 behavior
+        // of allowing a list or map of any element type as long as all of the
+        // elements are consistent. This is the same as list(any) or map(any).
+        switch hcl.ExprAsKeyword(expr) {
+        case "list":
+                return cty.List(cty.DynamicPseudoType), VariableParseHCL, nil
+        case "map":
+                return cty.Map(cty.DynamicPseudoType), VariableParseHCL, nil
+        }
+
+        ty, diags := typeexpr.TypeConstraint(expr)
+        if diags.HasErrors() {
+                return cty.DynamicPseudoType, VariableParseHCL, diags
+        }
+
+        switch {
+        case ty.IsPrimitiveType():
+                // Primitive types use literal parsing.
+                return ty, VariableParseLiteral, diags
+        default:
+                // Everything else uses HCL parsing
+                return ty, VariableParseHCL, diags
+        }
+}
+
+// VariableParsingMode defines how values of a particular variable given by
+// text-only mechanisms (command line arguments and environment variables)
+// should be parsed to produce the final value.
+type VariableParsingMode rune
+
+// VariableParseLiteral is a variable parsing mode that just takes the given
+// string directly as a cty.String value.
+const VariableParseLiteral VariableParsingMode = 'L'
+
+// VariableParseHCL is a variable parsing mode that attempts to parse the given
+// string as an HCL expression and returns the result.
+const VariableParseHCL VariableParsingMode = 'H'
+
+// Parse uses the receiving parsing mode to process the given variable value
+// string, returning the result along with any diagnostics.
+//
+// A VariableParsingMode does not know the expected type of the corresponding
+// variable, so it's the caller's responsibility to attempt to convert the
+// result to the appropriate type and return to the user any diagnostics that
+// conversion may produce.
+//
+// The given name is used to create a synthetic filename in case any diagnostics
+// must be generated about the given string value. This should be the name
+// of the root module variable whose value will be populated from the given
+// string.
+//
+// If the returned diagnostics has errors, the returned value may not be
+// valid.
+func (m VariableParsingMode) Parse(name, value string) (cty.Value, hcl.Diagnostics) {
+        switch m {
+        case VariableParseLiteral:
+                return cty.StringVal(value), nil
+        case VariableParseHCL:
+                fakeFilename := fmt.Sprintf("<value for var.%s>", name)
+                expr, diags := hclsyntax.ParseExpression([]byte(value), fakeFilename, hcl.Pos{Line: 1, Column: 1})
+                if diags.HasErrors() {
+                        return cty.DynamicVal, diags
+                }
+                val, valDiags := expr.Value(nil)
+                diags = append(diags, valDiags...)
+                return val, diags
+        default:
+                // Should never happen
+                panic(fmt.Errorf("Parse called on invalid VariableParsingMode %#v", m))
+        }
+}
+
+// Output represents an "output" block in a module or file.
+type Output struct {
+        Name        string
+        Description string
+        Expr        hcl.Expression
+        DependsOn   []hcl.Traversal
+        Sensitive   bool
+
+        DescriptionSet bool
+        SensitiveSet   bool
+
+        DeclRange hcl.Range
+}
+
+func decodeOutputBlock(block *hcl.Block, override bool) (*Output, hcl.Diagnostics) {
+        o := &Output{
+                Name:      block.Labels[0],
+                DeclRange: block.DefRange,
+        }
+
+        schema := outputBlockSchema
+        if override {
+                schema = schemaForOverrides(schema)
+        }
+
+        content, diags := block.Body.Content(schema)
+
+        if !hclsyntax.ValidIdentifier(o.Name) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid output name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[0],
+                })
+        }
+
+        if attr, exists := content.Attributes["description"]; exists {
+                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &o.Description)
+                diags = append(diags, valDiags...)
+                o.DescriptionSet = true
+        }
+
+        if attr, exists := content.Attributes["value"]; exists {
+                o.Expr = attr.Expr
+        }
+
+        if attr, exists := content.Attributes["sensitive"]; exists {
+                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &o.Sensitive)
+                diags = append(diags, valDiags...)
+                o.SensitiveSet = true
+        }
+
+        if attr, exists := content.Attributes["depends_on"]; exists {
+                deps, depsDiags := decodeDependsOn(attr)
+                diags = append(diags, depsDiags...)
+                o.DependsOn = append(o.DependsOn, deps...)
+        }
+
+        return o, diags
+}
+
+// Local represents a single entry from a "locals" block in a module or file.
+// The "locals" block itself is not represented, because it serves only to
+// provide context for us to interpret its contents.
+type Local struct {
+        Name string
+        Expr hcl.Expression
+
+        DeclRange hcl.Range
+}
+
+func decodeLocalsBlock(block *hcl.Block) ([]*Local, hcl.Diagnostics) {
+        attrs, diags := block.Body.JustAttributes()
+        if len(attrs) == 0 {
+                return nil, diags
+        }
+
+        locals := make([]*Local, 0, len(attrs))
+        for name, attr := range attrs {
+                if !hclsyntax.ValidIdentifier(name) {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid local value name",
+                                Detail:   badIdentifierDetail,
+                                Subject:  &attr.NameRange,
+                        })
+                }
+
+                locals = append(locals, &Local{
+                        Name:      name,
+                        Expr:      attr.Expr,
+                        DeclRange: attr.Range,
+                })
+        }
+        return locals, diags
+}
+
+// Addr returns the address of the local value declared by the receiver,
+// relative to its containing module.
+func (l *Local) Addr() addrs.LocalValue {
+        return addrs.LocalValue{
+                Name: l.Name,
+        }
+}
+
+var variableBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "description",
+                },
+                {
+                        Name: "default",
+                },
+                {
+                        Name: "type",
+                },
+        },
+}
+
+var outputBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "description",
+                },
+                {
+                        Name:     "value",
+                        Required: true,
+                },
+                {
+                        Name: "depends_on",
+                },
+                {
+                        Name: "sensitive",
+                },
+        },
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/parser.go b/vendor/github.com/hashicorp/terraform/configs/parser.go
new file mode 100644
index 0000000..8176fa1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/parser.go
@@ -0,0 +1,100 @@
+package configs
+
+import (
+        "fmt"
+        "strings"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hclparse"
+        "github.com/spf13/afero"
+)
+
+// Parser is the main interface to read configuration files and other related
+// files from disk.
+//
+// It retains a cache of all files that are loaded so that they can be used
+// to create source code snippets in diagnostics, etc.
+type Parser struct {
+        fs afero.Afero
+        p  *hclparse.Parser
+}
+
+// NewParser creates and returns a new Parser that reads files from the given
+// filesystem. If a nil filesystem is passed then the system's "real" filesystem
+// will be used, via afero.OsFs.
+func NewParser(fs afero.Fs) *Parser {
+        if fs == nil {
+                fs = afero.OsFs{}
+        }
+
+        return &Parser{
+                fs: afero.Afero{Fs: fs},
+                p:  hclparse.NewParser(),
+        }
+}
+
+// LoadHCLFile is a low-level method that reads the file at the given path,
+// parses it, and returns the hcl.Body representing its root. In many cases
+// it is better to use one of the other Load*File methods on this type,
+// which additionally decode the root body in some way and return a higher-level
+// construct.
+//
+// If the file cannot be read at all -- e.g. because it does not exist -- then
+// this method will return a nil body and error diagnostics. In this case
+// callers may wish to ignore the provided error diagnostics and produce
+// a more context-sensitive error instead.
+//
+// The file will be parsed using the HCL native syntax unless the filename
+// ends with ".json", in which case the HCL JSON syntax will be used.
+func (p *Parser) LoadHCLFile(path string) (hcl.Body, hcl.Diagnostics) {
+        src, err := p.fs.ReadFile(path)
+
+        if err != nil {
+                return nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Failed to read file",
+                                Detail:   fmt.Sprintf("The file %q could not be read.", path),
+                        },
+                }
+        }
+
+        var file *hcl.File
+        var diags hcl.Diagnostics
+        switch {
+        case strings.HasSuffix(path, ".json"):
+                file, diags = p.p.ParseJSON(src, path)
+        default:
+                file, diags = p.p.ParseHCL(src, path)
+        }
+
+        // If the returned file or body is nil, then we'll return a non-nil empty
+        // body so we'll meet our contract that nil means an error reading the file.
+        if file == nil || file.Body == nil {
+                return hcl.EmptyBody(), diags
+        }
+
+        return file.Body, diags
+}
+
+// Sources returns a map of the cached source buffers for all files that
+// have been loaded through this parser, with source filenames (as requested
+// when each file was opened) as the keys.
+func (p *Parser) Sources() map[string][]byte {
+        return p.p.Sources()
+}
+
+// ForceFileSource artificially adds source code to the cache of file sources,
+// as if it had been loaded from the given filename.
+//
+// This should be used only in special situations where configuration is loaded
+// some other way. Most callers should load configuration via methods of
+// Parser, which will update the sources cache automatically.
+func (p *Parser) ForceFileSource(filename string, src []byte) {
+        // We'll make a synthetic hcl.File here just so we can reuse the
+        // existing cache.
+        p.p.AddFile(filename, &hcl.File{
+                Body:  hcl.EmptyBody(),
+                Bytes: src,
+        })
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/parser_config.go b/vendor/github.com/hashicorp/terraform/configs/parser_config.go
new file mode 100644
index 0000000..7f2ff27
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/parser_config.go
@@ -0,0 +1,247 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// LoadConfigFile reads the file at the given path and parses it as a config
+// file.
+//
+// If the file cannot be read -- for example, if it does not exist -- then
+// a nil *File will be returned along with error diagnostics. Callers may wish
+// to disregard the returned diagnostics in this case and instead generate
+// their own error message(s) with additional context.
+//
+// If the returned diagnostics has errors when a non-nil map is returned
+// then the map may be incomplete but should be valid enough for careful
+// static analysis.
+//
+// This method wraps LoadHCLFile, and so it inherits the syntax selection
+// behaviors documented for that method.
+func (p *Parser) LoadConfigFile(path string) (*File, hcl.Diagnostics) {
+        return p.loadConfigFile(path, false)
+}
+
+// LoadConfigFileOverride is the same as LoadConfigFile except that it relaxes
+// certain required attribute constraints in order to interpret the given
+// file as an overrides file.
+func (p *Parser) LoadConfigFileOverride(path string) (*File, hcl.Diagnostics) {
+        return p.loadConfigFile(path, true)
+}
+
+func (p *Parser) loadConfigFile(path string, override bool) (*File, hcl.Diagnostics) {
+
+        body, diags := p.LoadHCLFile(path)
+        if body == nil {
+                return nil, diags
+        }
+
+        file := &File{}
+
+        var reqDiags hcl.Diagnostics
+        file.CoreVersionConstraints, reqDiags = sniffCoreVersionRequirements(body)
+        diags = append(diags, reqDiags...)
+
+        content, contentDiags := body.Content(configFileSchema)
+        diags = append(diags, contentDiags...)
+
+        for _, block := range content.Blocks {
+                switch block.Type {
+
+                case "terraform":
+                        content, contentDiags := block.Body.Content(terraformBlockSchema)
+                        diags = append(diags, contentDiags...)
+
+                        // We ignore the "terraform_version" attribute here because
+                        // sniffCoreVersionRequirements already dealt with that above.
+
+                        for _, innerBlock := range content.Blocks {
+                                switch innerBlock.Type {
+
+                                case "backend":
+                                        backendCfg, cfgDiags := decodeBackendBlock(innerBlock)
+                                        diags = append(diags, cfgDiags...)
+                                        if backendCfg != nil {
+                                                file.Backends = append(file.Backends, backendCfg)
+                                        }
+
+                                case "required_providers":
+                                        reqs, reqsDiags := decodeRequiredProvidersBlock(innerBlock)
+                                        diags = append(diags, reqsDiags...)
+                                        file.ProviderRequirements = append(file.ProviderRequirements, reqs...)
+
+                                default:
+                                        // Should never happen because the above cases should be exhaustive
+                                        // for all block type names in our schema.
+                                        continue
+
+                                }
+                        }
+
+                case "provider":
+                        cfg, cfgDiags := decodeProviderBlock(block)
+                        diags = append(diags, cfgDiags...)
+                        if cfg != nil {
+                                file.ProviderConfigs = append(file.ProviderConfigs, cfg)
+                        }
+
+                case "variable":
+                        cfg, cfgDiags := decodeVariableBlock(block, override)
+                        diags = append(diags, cfgDiags...)
+                        if cfg != nil {
+                                file.Variables = append(file.Variables, cfg)
+                        }
+
+                case "locals":
+                        defs, defsDiags := decodeLocalsBlock(block)
+                        diags = append(diags, defsDiags...)
+                        file.Locals = append(file.Locals, defs...)
+
+                case "output":
+                        cfg, cfgDiags := decodeOutputBlock(block, override)
+                        diags = append(diags, cfgDiags...)
+                        if cfg != nil {
+                                file.Outputs = append(file.Outputs, cfg)
+                        }
+
+                case "module":
+                        cfg, cfgDiags := decodeModuleBlock(block, override)
+                        diags = append(diags, cfgDiags...)
+                        if cfg != nil {
+                                file.ModuleCalls = append(file.ModuleCalls, cfg)
+                        }
+
+                case "resource":
+                        cfg, cfgDiags := decodeResourceBlock(block)
+                        diags = append(diags, cfgDiags...)
+                        if cfg != nil {
+                                file.ManagedResources = append(file.ManagedResources, cfg)
+                        }
+
+                case "data":
+                        cfg, cfgDiags := decodeDataBlock(block)
+                        diags = append(diags, cfgDiags...)
+                        if cfg != nil {
+                                file.DataResources = append(file.DataResources, cfg)
+                        }
+
+                default:
+                        // Should never happen because the above cases should be exhaustive
+                        // for all block type names in our schema.
+                        continue
+
+                }
+        }
+
+        return file, diags
+}
+
+// sniffCoreVersionRequirements does minimal parsing of the given body for
+// "terraform" blocks with "required_version" attributes, returning the
+// requirements found.
+//
+// This is intended to maximize the chance that we'll be able to read the
+// requirements (syntax errors notwithstanding) even if the config file contains
+// constructs that might've been added in future Terraform versions
+//
+// This is a "best effort" sort of method which will return constraints it is
+// able to find, but may return no constraints at all if the given body is
+// so invalid that it cannot be decoded at all.
+func sniffCoreVersionRequirements(body hcl.Body) ([]VersionConstraint, hcl.Diagnostics) {
+        rootContent, _, diags := body.PartialContent(configFileVersionSniffRootSchema)
+
+        var constraints []VersionConstraint
+
+        for _, block := range rootContent.Blocks {
+                content, _, blockDiags := block.Body.PartialContent(configFileVersionSniffBlockSchema)
+                diags = append(diags, blockDiags...)
+
+                attr, exists := content.Attributes["required_version"]
+                if !exists {
+                        continue
+                }
+
+                constraint, constraintDiags := decodeVersionConstraint(attr)
+                diags = append(diags, constraintDiags...)
+                if !constraintDiags.HasErrors() {
+                        constraints = append(constraints, constraint)
+                }
+        }
+
+        return constraints, diags
+}
+
+// configFileSchema is the schema for the top-level of a config file. We use
+// the low-level HCL API for this level so we can easily deal with each
+// block type separately with its own decoding logic.
+var configFileSchema = &hcl.BodySchema{
+        Blocks: []hcl.BlockHeaderSchema{
+                {
+                        Type: "terraform",
+                },
+                {
+                        Type:       "provider",
+                        LabelNames: []string{"name"},
+                },
+                {
+                        Type:       "variable",
+                        LabelNames: []string{"name"},
+                },
+                {
+                        Type: "locals",
+                },
+                {
+                        Type:       "output",
+                        LabelNames: []string{"name"},
+                },
+                {
+                        Type:       "module",
+                        LabelNames: []string{"name"},
+                },
+                {
+                        Type:       "resource",
+                        LabelNames: []string{"type", "name"},
+                },
+                {
+                        Type:       "data",
+                        LabelNames: []string{"type", "name"},
+                },
+        },
+}
+
+// terraformBlockSchema is the schema for a top-level "terraform" block in
+// a configuration file.
+var terraformBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "required_version",
+                },
+        },
+        Blocks: []hcl.BlockHeaderSchema{
+                {
+                        Type:       "backend",
+                        LabelNames: []string{"type"},
+                },
+                {
+                        Type: "required_providers",
+                },
+        },
+}
+
+// configFileVersionSniffRootSchema is a schema for sniffCoreVersionRequirements
+var configFileVersionSniffRootSchema = &hcl.BodySchema{
+        Blocks: []hcl.BlockHeaderSchema{
+                {
+                        Type: "terraform",
+                },
+        },
+}
+
+// configFileVersionSniffBlockSchema is a schema for sniffCoreVersionRequirements
+var configFileVersionSniffBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "required_version",
+                },
+        },
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/parser_config_dir.go b/vendor/github.com/hashicorp/terraform/configs/parser_config_dir.go
new file mode 100644
index 0000000..3014cb4
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/parser_config_dir.go
@@ -0,0 +1,142 @@
+package configs
+
+import (
+        "fmt"
+        "path/filepath"
+        "strings"
+
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// LoadConfigDir reads the .tf and .tf.json files in the given directory
+// as config files (using LoadConfigFile) and then combines these files into
+// a single Module.
+//
+// If this method returns nil, that indicates that the given directory does not
+// exist at all or could not be opened for some reason. Callers may wish to
+// detect this case and ignore the returned diagnostics so that they can
+// produce a more context-aware error message in that case.
+//
+// If this method returns a non-nil module while error diagnostics are returned
+// then the module may be incomplete but can be used carefully for static
+// analysis.
+//
+// This file does not consider a directory with no files to be an error, and
+// will simply return an empty module in that case. Callers should first call
+// Parser.IsConfigDir if they wish to recognize that situation.
+//
+// .tf files are parsed using the HCL native syntax while .tf.json files are
+// parsed using the HCL JSON syntax.
+func (p *Parser) LoadConfigDir(path string) (*Module, hcl.Diagnostics) {
+        primaryPaths, overridePaths, diags := p.dirFiles(path)
+        if diags.HasErrors() {
+                return nil, diags
+        }
+
+        primary, fDiags := p.loadFiles(primaryPaths, false)
+        diags = append(diags, fDiags...)
+        override, fDiags := p.loadFiles(overridePaths, true)
+        diags = append(diags, fDiags...)
+
+        mod, modDiags := NewModule(primary, override)
+        diags = append(diags, modDiags...)
+
+        mod.SourceDir = path
+
+        return mod, diags
+}
+
+// ConfigDirFiles returns lists of the primary and override files configuration
+// files in the given directory.
+//
+// If the given directory does not exist or cannot be read, error diagnostics
+// are returned. If errors are returned, the resulting lists may be incomplete.
+func (p Parser) ConfigDirFiles(dir string) (primary, override []string, diags hcl.Diagnostics) {
+        return p.dirFiles(dir)
+}
+
+// IsConfigDir determines whether the given path refers to a directory that
+// exists and contains at least one Terraform config file (with a .tf or
+// .tf.json extension.)
+func (p *Parser) IsConfigDir(path string) bool {
+        primaryPaths, overridePaths, _ := p.dirFiles(path)
+        return (len(primaryPaths) + len(overridePaths)) > 0
+}
+
+func (p *Parser) loadFiles(paths []string, override bool) ([]*File, hcl.Diagnostics) {
+        var files []*File
+        var diags hcl.Diagnostics
+
+        for _, path := range paths {
+                var f *File
+                var fDiags hcl.Diagnostics
+                if override {
+                        f, fDiags = p.LoadConfigFileOverride(path)
+                } else {
+                        f, fDiags = p.LoadConfigFile(path)
+                }
+                diags = append(diags, fDiags...)
+                if f != nil {
+                        files = append(files, f)
+                }
+        }
+
+        return files, diags
+}
+
+func (p *Parser) dirFiles(dir string) (primary, override []string, diags hcl.Diagnostics) {
+        infos, err := p.fs.ReadDir(dir)
+        if err != nil {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Failed to read module directory",
+                        Detail:   fmt.Sprintf("Module directory %s does not exist or cannot be read.", dir),
+                })
+                return
+        }
+
+        for _, info := range infos {
+                if info.IsDir() {
+                        // We only care about files
+                        continue
+                }
+
+                name := info.Name()
+                ext := fileExt(name)
+                if ext == "" || IsIgnoredFile(name) {
+                        continue
+                }
+
+                baseName := name[:len(name)-len(ext)] // strip extension
+                isOverride := baseName == "override" || strings.HasSuffix(baseName, "_override")
+
+                fullPath := filepath.Join(dir, name)
+                if isOverride {
+                        override = append(override, fullPath)
+                } else {
+                        primary = append(primary, fullPath)
+                }
+        }
+
+        return
+}
+
+// fileExt returns the Terraform configuration extension of the given
+// path, or a blank string if it is not a recognized extension.
+func fileExt(path string) string {
+        if strings.HasSuffix(path, ".tf") {
+                return ".tf"
+        } else if strings.HasSuffix(path, ".tf.json") {
+                return ".tf.json"
+        } else {
+                return ""
+        }
+}
+
+// IsIgnoredFile returns true if the given filename (which must not have a
+// directory path ahead of it) should be ignored as e.g. an editor swap file.
+func IsIgnoredFile(name string) bool {
+        return strings.HasPrefix(name, ".") || // Unix-like hidden files
+                strings.HasSuffix(name, "~") || // vim
+                strings.HasPrefix(name, "#") && strings.HasSuffix(name, "#") // emacs
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/parser_values.go b/vendor/github.com/hashicorp/terraform/configs/parser_values.go
new file mode 100644
index 0000000..b7f1c1c
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/parser_values.go
@@ -0,0 +1,43 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// LoadValuesFile reads the file at the given path and parses it as a "values
+// file", which is an HCL config file whose top-level attributes are treated
+// as arbitrary key.value pairs.
+//
+// If the file cannot be read -- for example, if it does not exist -- then
+// a nil map will be returned along with error diagnostics. Callers may wish
+// to disregard the returned diagnostics in this case and instead generate
+// their own error message(s) with additional context.
+//
+// If the returned diagnostics has errors when a non-nil map is returned
+// then the map may be incomplete but should be valid enough for careful
+// static analysis.
+//
+// This method wraps LoadHCLFile, and so it inherits the syntax selection
+// behaviors documented for that method.
+func (p *Parser) LoadValuesFile(path string) (map[string]cty.Value, hcl.Diagnostics) {
+        body, diags := p.LoadHCLFile(path)
+        if body == nil {
+                return nil, diags
+        }
+
+        vals := make(map[string]cty.Value)
+        attrs, attrDiags := body.JustAttributes()
+        diags = append(diags, attrDiags...)
+        if attrs == nil {
+                return vals, diags
+        }
+
+        for name, attr := range attrs {
+                val, valDiags := attr.Expr.Value(nil)
+                diags = append(diags, valDiags...)
+                vals[name] = val
+        }
+
+        return vals, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/provider.go b/vendor/github.com/hashicorp/terraform/configs/provider.go
new file mode 100644
index 0000000..d01d5cf
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/provider.go
@@ -0,0 +1,144 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/gohcl"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Provider represents a "provider" block in a module or file. A provider
+// block is a provider configuration, and there can be zero or more
+// configurations for each actual provider.
+type Provider struct {
+        Name       string
+        NameRange  hcl.Range
+        Alias      string
+        AliasRange *hcl.Range // nil if no alias set
+
+        Version VersionConstraint
+
+        Config hcl.Body
+
+        DeclRange hcl.Range
+}
+
+func decodeProviderBlock(block *hcl.Block) (*Provider, hcl.Diagnostics) {
+        content, config, diags := block.Body.PartialContent(providerBlockSchema)
+
+        provider := &Provider{
+                Name:      block.Labels[0],
+                NameRange: block.LabelRanges[0],
+                Config:    config,
+                DeclRange: block.DefRange,
+        }
+
+        if attr, exists := content.Attributes["alias"]; exists {
+                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &provider.Alias)
+                diags = append(diags, valDiags...)
+                provider.AliasRange = attr.Expr.Range().Ptr()
+
+                if !hclsyntax.ValidIdentifier(provider.Alias) {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid provider configuration alias",
+                                Detail:   fmt.Sprintf("An alias must be a valid name. %s", badIdentifierDetail),
+                        })
+                }
+        }
+
+        if attr, exists := content.Attributes["version"]; exists {
+                var versionDiags hcl.Diagnostics
+                provider.Version, versionDiags = decodeVersionConstraint(attr)
+                diags = append(diags, versionDiags...)
+        }
+
+        // Reserved attribute names
+        for _, name := range []string{"count", "depends_on", "for_each", "source"} {
+                if attr, exists := content.Attributes[name]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Reserved argument name in provider block",
+                                Detail:   fmt.Sprintf("The provider argument name %q is reserved for use by Terraform in a future version.", name),
+                                Subject:  &attr.NameRange,
+                        })
+                }
+        }
+
+        // Reserved block types (all of them)
+        for _, block := range content.Blocks {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved block type name in provider block",
+                        Detail:   fmt.Sprintf("The block type name %q is reserved for use by Terraform in a future version.", block.Type),
+                        Subject:  &block.TypeRange,
+                })
+        }
+
+        return provider, diags
+}
+
+// Addr returns the address of the receiving provider configuration, relative
+// to its containing module.
+func (p *Provider) Addr() addrs.ProviderConfig {
+        return addrs.ProviderConfig{
+                Type:  p.Name,
+                Alias: p.Alias,
+        }
+}
+
+func (p *Provider) moduleUniqueKey() string {
+        if p.Alias != "" {
+                return fmt.Sprintf("%s.%s", p.Name, p.Alias)
+        }
+        return p.Name
+}
+
+// ProviderRequirement represents a declaration of a dependency on a particular
+// provider version without actually configuring that provider. This is used in
+// child modules that expect a provider to be passed in from their parent.
+type ProviderRequirement struct {
+        Name        string
+        Requirement VersionConstraint
+}
+
+func decodeRequiredProvidersBlock(block *hcl.Block) ([]*ProviderRequirement, hcl.Diagnostics) {
+        attrs, diags := block.Body.JustAttributes()
+        var reqs []*ProviderRequirement
+        for name, attr := range attrs {
+                req, reqDiags := decodeVersionConstraint(attr)
+                diags = append(diags, reqDiags...)
+                if !diags.HasErrors() {
+                        reqs = append(reqs, &ProviderRequirement{
+                                Name:        name,
+                                Requirement: req,
+                        })
+                }
+        }
+        return reqs, diags
+}
+
+var providerBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "alias",
+                },
+                {
+                        Name: "version",
+                },
+
+                // Attribute names reserved for future expansion.
+                {Name: "count"},
+                {Name: "depends_on"},
+                {Name: "for_each"},
+                {Name: "source"},
+        },
+        Blocks: []hcl.BlockHeaderSchema{
+                // _All_ of these are reserved for future expansion.
+                {Type: "lifecycle"},
+                {Type: "locals"},
+        },
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/provisioner.go b/vendor/github.com/hashicorp/terraform/configs/provisioner.go
new file mode 100644
index 0000000..b031dd0
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/provisioner.go
@@ -0,0 +1,150 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// Provisioner represents a "provisioner" block when used within a
+// "resource" block in a module or file.
+type Provisioner struct {
+        Type       string
+        Config     hcl.Body
+        Connection *Connection
+        When       ProvisionerWhen
+        OnFailure  ProvisionerOnFailure
+
+        DeclRange hcl.Range
+        TypeRange hcl.Range
+}
+
+func decodeProvisionerBlock(block *hcl.Block) (*Provisioner, hcl.Diagnostics) {
+        pv := &Provisioner{
+                Type:      block.Labels[0],
+                TypeRange: block.LabelRanges[0],
+                DeclRange: block.DefRange,
+                When:      ProvisionerWhenCreate,
+                OnFailure: ProvisionerOnFailureFail,
+        }
+
+        content, config, diags := block.Body.PartialContent(provisionerBlockSchema)
+        pv.Config = config
+
+        if attr, exists := content.Attributes["when"]; exists {
+                expr, shimDiags := shimTraversalInString(attr.Expr, true)
+                diags = append(diags, shimDiags...)
+
+                switch hcl.ExprAsKeyword(expr) {
+                case "create":
+                        pv.When = ProvisionerWhenCreate
+                case "destroy":
+                        pv.When = ProvisionerWhenDestroy
+                default:
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid \"when\" keyword",
+                                Detail:   "The \"when\" argument requires one of the following keywords: create or destroy.",
+                                Subject:  expr.Range().Ptr(),
+                        })
+                }
+        }
+
+        if attr, exists := content.Attributes["on_failure"]; exists {
+                expr, shimDiags := shimTraversalInString(attr.Expr, true)
+                diags = append(diags, shimDiags...)
+
+                switch hcl.ExprAsKeyword(expr) {
+                case "continue":
+                        pv.OnFailure = ProvisionerOnFailureContinue
+                case "fail":
+                        pv.OnFailure = ProvisionerOnFailureFail
+                default:
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid \"on_failure\" keyword",
+                                Detail:   "The \"on_failure\" argument requires one of the following keywords: continue or fail.",
+                                Subject:  attr.Expr.Range().Ptr(),
+                        })
+                }
+        }
+
+        var seenConnection *hcl.Block
+        for _, block := range content.Blocks {
+                switch block.Type {
+
+                case "connection":
+                        if seenConnection != nil {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Duplicate connection block",
+                                        Detail:   fmt.Sprintf("This provisioner already has a connection block at %s.", seenConnection.DefRange),
+                                        Subject:  &block.DefRange,
+                                })
+                                continue
+                        }
+                        seenConnection = block
+
+                        //conn, connDiags := decodeConnectionBlock(block)
+                        //diags = append(diags, connDiags...)
+                        pv.Connection = &Connection{
+                                Config:    block.Body,
+                                DeclRange: block.DefRange,
+                        }
+
+                default:
+                        // Any other block types are ones we've reserved for future use,
+                        // so they get a generic message.
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Reserved block type name in provisioner block",
+                                Detail:   fmt.Sprintf("The block type name %q is reserved for use by Terraform in a future version.", block.Type),
+                                Subject:  &block.TypeRange,
+                        })
+                }
+        }
+
+        return pv, diags
+}
+
+// Connection represents a "connection" block when used within either a
+// "resource" or "provisioner" block in a module or file.
+type Connection struct {
+        Config hcl.Body
+
+        DeclRange hcl.Range
+}
+
+// ProvisionerWhen is an enum for valid values for when to run provisioners.
+type ProvisionerWhen int
+
+//go:generate stringer -type ProvisionerWhen
+
+const (
+        ProvisionerWhenInvalid ProvisionerWhen = iota
+        ProvisionerWhenCreate
+        ProvisionerWhenDestroy
+)
+
+// ProvisionerOnFailure is an enum for valid values for on_failure options
+// for provisioners.
+type ProvisionerOnFailure int
+
+//go:generate stringer -type ProvisionerOnFailure
+
+const (
+        ProvisionerOnFailureInvalid ProvisionerOnFailure = iota
+        ProvisionerOnFailureContinue
+        ProvisionerOnFailureFail
+)
+
+var provisionerBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {Name: "when"},
+                {Name: "on_failure"},
+        },
+        Blocks: []hcl.BlockHeaderSchema{
+                {Type: "connection"},
+                {Type: "lifecycle"}, // reserved for future use
+        },
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/provisioneronfailure_string.go b/vendor/github.com/hashicorp/terraform/configs/provisioneronfailure_string.go
new file mode 100644
index 0000000..7ff5a6e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/provisioneronfailure_string.go
@@ -0,0 +1,25 @@
+// Code generated by "stringer -type ProvisionerOnFailure"; DO NOT EDIT.
+
+package configs
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[ProvisionerOnFailureInvalid-0]
+        _ = x[ProvisionerOnFailureContinue-1]
+        _ = x[ProvisionerOnFailureFail-2]
+}
+
+const _ProvisionerOnFailure_name = "ProvisionerOnFailureInvalidProvisionerOnFailureContinueProvisionerOnFailureFail"
+
+var _ProvisionerOnFailure_index = [...]uint8{0, 27, 55, 79}
+
+func (i ProvisionerOnFailure) String() string {
+        if i < 0 || i >= ProvisionerOnFailure(len(_ProvisionerOnFailure_index)-1) {
+                return "ProvisionerOnFailure(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+        return _ProvisionerOnFailure_name[_ProvisionerOnFailure_index[i]:_ProvisionerOnFailure_index[i+1]]
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/provisionerwhen_string.go b/vendor/github.com/hashicorp/terraform/configs/provisionerwhen_string.go
new file mode 100644
index 0000000..9f21b3a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/provisionerwhen_string.go
@@ -0,0 +1,25 @@
+// Code generated by "stringer -type ProvisionerWhen"; DO NOT EDIT.
+
+package configs
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[ProvisionerWhenInvalid-0]
+        _ = x[ProvisionerWhenCreate-1]
+        _ = x[ProvisionerWhenDestroy-2]
+}
+
+const _ProvisionerWhen_name = "ProvisionerWhenInvalidProvisionerWhenCreateProvisionerWhenDestroy"
+
+var _ProvisionerWhen_index = [...]uint8{0, 22, 43, 65}
+
+func (i ProvisionerWhen) String() string {
+        if i < 0 || i >= ProvisionerWhen(len(_ProvisionerWhen_index)-1) {
+                return "ProvisionerWhen(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+        return _ProvisionerWhen_name[_ProvisionerWhen_index[i]:_ProvisionerWhen_index[i+1]]
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/resource.go b/vendor/github.com/hashicorp/terraform/configs/resource.go
new file mode 100644
index 0000000..de1a343
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/resource.go
@@ -0,0 +1,486 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/gohcl"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Resource represents a "resource" or "data" block in a module or file.
+type Resource struct {
+        Mode    addrs.ResourceMode
+        Name    string
+        Type    string
+        Config  hcl.Body
+        Count   hcl.Expression
+        ForEach hcl.Expression
+
+        ProviderConfigRef *ProviderConfigRef
+
+        DependsOn []hcl.Traversal
+
+        // Managed is populated only for Mode = addrs.ManagedResourceMode,
+        // containing the additional fields that apply to managed resources.
+        // For all other resource modes, this field is nil.
+        Managed *ManagedResource
+
+        DeclRange hcl.Range
+        TypeRange hcl.Range
+}
+
+// ManagedResource represents a "resource" block in a module or file.
+type ManagedResource struct {
+        Connection   *Connection
+        Provisioners []*Provisioner
+
+        CreateBeforeDestroy bool
+        PreventDestroy      bool
+        IgnoreChanges       []hcl.Traversal
+        IgnoreAllChanges    bool
+
+        CreateBeforeDestroySet bool
+        PreventDestroySet      bool
+}
+
+func (r *Resource) moduleUniqueKey() string {
+        return r.Addr().String()
+}
+
+// Addr returns a resource address for the receiver that is relative to the
+// resource's containing module.
+func (r *Resource) Addr() addrs.Resource {
+        return addrs.Resource{
+                Mode: r.Mode,
+                Type: r.Type,
+                Name: r.Name,
+        }
+}
+
+// ProviderConfigAddr returns the address for the provider configuration
+// that should be used for this resource. This function implements the
+// default behavior of extracting the type from the resource type name if
+// an explicit "provider" argument was not provided.
+func (r *Resource) ProviderConfigAddr() addrs.ProviderConfig {
+        if r.ProviderConfigRef == nil {
+                return r.Addr().DefaultProviderConfig()
+        }
+
+        return addrs.ProviderConfig{
+                Type:  r.ProviderConfigRef.Name,
+                Alias: r.ProviderConfigRef.Alias,
+        }
+}
+
+func decodeResourceBlock(block *hcl.Block) (*Resource, hcl.Diagnostics) {
+        r := &Resource{
+                Mode:      addrs.ManagedResourceMode,
+                Type:      block.Labels[0],
+                Name:      block.Labels[1],
+                DeclRange: block.DefRange,
+                TypeRange: block.LabelRanges[0],
+                Managed:   &ManagedResource{},
+        }
+
+        content, remain, diags := block.Body.PartialContent(resourceBlockSchema)
+        r.Config = remain
+
+        if !hclsyntax.ValidIdentifier(r.Type) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid resource type name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[0],
+                })
+        }
+        if !hclsyntax.ValidIdentifier(r.Name) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid resource name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[1],
+                })
+        }
+
+        if attr, exists := content.Attributes["count"]; exists {
+                r.Count = attr.Expr
+        }
+
+        if attr, exists := content.Attributes["for_each"]; exists {
+                r.ForEach = attr.Expr
+                // We currently parse this, but don't yet do anything with it.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved argument name in resource block",
+                        Detail:   fmt.Sprintf("The name %q is reserved for use in a future version of Terraform.", attr.Name),
+                        Subject:  &attr.NameRange,
+                })
+        }
+
+        if attr, exists := content.Attributes["provider"]; exists {
+                var providerDiags hcl.Diagnostics
+                r.ProviderConfigRef, providerDiags = decodeProviderConfigRef(attr.Expr, "provider")
+                diags = append(diags, providerDiags...)
+        }
+
+        if attr, exists := content.Attributes["depends_on"]; exists {
+                deps, depsDiags := decodeDependsOn(attr)
+                diags = append(diags, depsDiags...)
+                r.DependsOn = append(r.DependsOn, deps...)
+        }
+
+        var seenLifecycle *hcl.Block
+        var seenConnection *hcl.Block
+        for _, block := range content.Blocks {
+                switch block.Type {
+                case "lifecycle":
+                        if seenLifecycle != nil {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Duplicate lifecycle block",
+                                        Detail:   fmt.Sprintf("This resource already has a lifecycle block at %s.", seenLifecycle.DefRange),
+                                        Subject:  &block.DefRange,
+                                })
+                                continue
+                        }
+                        seenLifecycle = block
+
+                        lcContent, lcDiags := block.Body.Content(resourceLifecycleBlockSchema)
+                        diags = append(diags, lcDiags...)
+
+                        if attr, exists := lcContent.Attributes["create_before_destroy"]; exists {
+                                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &r.Managed.CreateBeforeDestroy)
+                                diags = append(diags, valDiags...)
+                                r.Managed.CreateBeforeDestroySet = true
+                        }
+
+                        if attr, exists := lcContent.Attributes["prevent_destroy"]; exists {
+                                valDiags := gohcl.DecodeExpression(attr.Expr, nil, &r.Managed.PreventDestroy)
+                                diags = append(diags, valDiags...)
+                                r.Managed.PreventDestroySet = true
+                        }
+
+                        if attr, exists := lcContent.Attributes["ignore_changes"]; exists {
+
+                                // ignore_changes can either be a list of relative traversals
+                                // or it can be just the keyword "all" to ignore changes to this
+                                // resource entirely.
+                                //   ignore_changes = [ami, instance_type]
+                                //   ignore_changes = all
+                                // We also allow two legacy forms for compatibility with earlier
+                                // versions:
+                                //   ignore_changes = ["ami", "instance_type"]
+                                //   ignore_changes = ["*"]
+
+                                kw := hcl.ExprAsKeyword(attr.Expr)
+
+                                switch {
+                                case kw == "all":
+                                        r.Managed.IgnoreAllChanges = true
+                                default:
+                                        exprs, listDiags := hcl.ExprList(attr.Expr)
+                                        diags = append(diags, listDiags...)
+
+                                        var ignoreAllRange hcl.Range
+
+                                        for _, expr := range exprs {
+
+                                                // our expr might be the literal string "*", which
+                                                // we accept as a deprecated way of saying "all".
+                                                if shimIsIgnoreChangesStar(expr) {
+                                                        r.Managed.IgnoreAllChanges = true
+                                                        ignoreAllRange = expr.Range()
+                                                        diags = append(diags, &hcl.Diagnostic{
+                                                                Severity: hcl.DiagWarning,
+                                                                Summary:  "Deprecated ignore_changes wildcard",
+                                                                Detail:   "The [\"*\"] form of ignore_changes wildcard is deprecated. Use \"ignore_changes = all\" to ignore changes to all attributes.",
+                                                                Subject:  attr.Expr.Range().Ptr(),
+                                                        })
+                                                        continue
+                                                }
+
+                                                expr, shimDiags := shimTraversalInString(expr, false)
+                                                diags = append(diags, shimDiags...)
+
+                                                traversal, travDiags := hcl.RelTraversalForExpr(expr)
+                                                diags = append(diags, travDiags...)
+                                                if len(traversal) != 0 {
+                                                        r.Managed.IgnoreChanges = append(r.Managed.IgnoreChanges, traversal)
+                                                }
+                                        }
+
+                                        if r.Managed.IgnoreAllChanges && len(r.Managed.IgnoreChanges) != 0 {
+                                                diags = append(diags, &hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Invalid ignore_changes ruleset",
+                                                        Detail:   "Cannot mix wildcard string \"*\" with non-wildcard references.",
+                                                        Subject:  &ignoreAllRange,
+                                                        Context:  attr.Expr.Range().Ptr(),
+                                                })
+                                        }
+
+                                }
+
+                        }
+
+                case "connection":
+                        if seenConnection != nil {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Duplicate connection block",
+                                        Detail:   fmt.Sprintf("This resource already has a connection block at %s.", seenConnection.DefRange),
+                                        Subject:  &block.DefRange,
+                                })
+                                continue
+                        }
+                        seenConnection = block
+
+                        r.Managed.Connection = &Connection{
+                                Config:    block.Body,
+                                DeclRange: block.DefRange,
+                        }
+
+                case "provisioner":
+                        pv, pvDiags := decodeProvisionerBlock(block)
+                        diags = append(diags, pvDiags...)
+                        if pv != nil {
+                                r.Managed.Provisioners = append(r.Managed.Provisioners, pv)
+                        }
+
+                default:
+                        // Any other block types are ones we've reserved for future use,
+                        // so they get a generic message.
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Reserved block type name in resource block",
+                                Detail:   fmt.Sprintf("The block type name %q is reserved for use by Terraform in a future version.", block.Type),
+                                Subject:  &block.TypeRange,
+                        })
+                }
+        }
+
+        return r, diags
+}
+
+func decodeDataBlock(block *hcl.Block) (*Resource, hcl.Diagnostics) {
+        r := &Resource{
+                Mode:      addrs.DataResourceMode,
+                Type:      block.Labels[0],
+                Name:      block.Labels[1],
+                DeclRange: block.DefRange,
+                TypeRange: block.LabelRanges[0],
+        }
+
+        content, remain, diags := block.Body.PartialContent(dataBlockSchema)
+        r.Config = remain
+
+        if !hclsyntax.ValidIdentifier(r.Type) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid data source name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[0],
+                })
+        }
+        if !hclsyntax.ValidIdentifier(r.Name) {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid data resource name",
+                        Detail:   badIdentifierDetail,
+                        Subject:  &block.LabelRanges[1],
+                })
+        }
+
+        if attr, exists := content.Attributes["count"]; exists {
+                r.Count = attr.Expr
+        }
+
+        if attr, exists := content.Attributes["for_each"]; exists {
+                r.ForEach = attr.Expr
+                // We currently parse this, but don't yet do anything with it.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Reserved argument name in module block",
+                        Detail:   fmt.Sprintf("The name %q is reserved for use in a future version of Terraform.", attr.Name),
+                        Subject:  &attr.NameRange,
+                })
+        }
+
+        if attr, exists := content.Attributes["provider"]; exists {
+                var providerDiags hcl.Diagnostics
+                r.ProviderConfigRef, providerDiags = decodeProviderConfigRef(attr.Expr, "provider")
+                diags = append(diags, providerDiags...)
+        }
+
+        if attr, exists := content.Attributes["depends_on"]; exists {
+                deps, depsDiags := decodeDependsOn(attr)
+                diags = append(diags, depsDiags...)
+                r.DependsOn = append(r.DependsOn, deps...)
+        }
+
+        for _, block := range content.Blocks {
+                // All of the block types we accept are just reserved for future use, but some get a specialized error message.
+                switch block.Type {
+                case "lifecycle":
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Unsupported lifecycle block",
+                                Detail:   "Data resources do not have lifecycle settings, so a lifecycle block is not allowed.",
+                                Subject:  &block.DefRange,
+                        })
+                default:
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Reserved block type name in data block",
+                                Detail:   fmt.Sprintf("The block type name %q is reserved for use by Terraform in a future version.", block.Type),
+                                Subject:  &block.TypeRange,
+                        })
+                }
+        }
+
+        return r, diags
+}
+
+type ProviderConfigRef struct {
+        Name       string
+        NameRange  hcl.Range
+        Alias      string
+        AliasRange *hcl.Range // nil if alias not set
+}
+
+func decodeProviderConfigRef(expr hcl.Expression, argName string) (*ProviderConfigRef, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        var shimDiags hcl.Diagnostics
+        expr, shimDiags = shimTraversalInString(expr, false)
+        diags = append(diags, shimDiags...)
+
+        traversal, travDiags := hcl.AbsTraversalForExpr(expr)
+
+        // AbsTraversalForExpr produces only generic errors, so we'll discard
+        // the errors given and produce our own with extra context. If we didn't
+        // get any errors then we might still have warnings, though.
+        if !travDiags.HasErrors() {
+                diags = append(diags, travDiags...)
+        }
+
+        if len(traversal) < 1 || len(traversal) > 2 {
+                // A provider reference was given as a string literal in the legacy
+                // configuration language and there are lots of examples out there
+                // showing that usage, so we'll sniff for that situation here and
+                // produce a specialized error message for it to help users find
+                // the new correct form.
+                if exprIsNativeQuotedString(expr) {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid provider configuration reference",
+                                Detail:   "A provider configuration reference must not be given in quotes.",
+                                Subject:  expr.Range().Ptr(),
+                        })
+                        return nil, diags
+                }
+
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid provider configuration reference",
+                        Detail:   fmt.Sprintf("The %s argument requires a provider type name, optionally followed by a period and then a configuration alias.", argName),
+                        Subject:  expr.Range().Ptr(),
+                })
+                return nil, diags
+        }
+
+        ret := &ProviderConfigRef{
+                Name:      traversal.RootName(),
+                NameRange: traversal[0].SourceRange(),
+        }
+
+        if len(traversal) > 1 {
+                aliasStep, ok := traversal[1].(hcl.TraverseAttr)
+                if !ok {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid provider configuration reference",
+                                Detail:   "Provider name must either stand alone or be followed by a period and then a configuration alias.",
+                                Subject:  traversal[1].SourceRange().Ptr(),
+                        })
+                        return ret, diags
+                }
+
+                ret.Alias = aliasStep.Name
+                ret.AliasRange = aliasStep.SourceRange().Ptr()
+        }
+
+        return ret, diags
+}
+
+// Addr returns the provider config address corresponding to the receiving
+// config reference.
+//
+// This is a trivial conversion, essentially just discarding the source
+// location information and keeping just the addressing information.
+func (r *ProviderConfigRef) Addr() addrs.ProviderConfig {
+        return addrs.ProviderConfig{
+                Type:  r.Name,
+                Alias: r.Alias,
+        }
+}
+
+func (r *ProviderConfigRef) String() string {
+        if r == nil {
+                return "<nil>"
+        }
+        if r.Alias != "" {
+                return fmt.Sprintf("%s.%s", r.Name, r.Alias)
+        }
+        return r.Name
+}
+
+var commonResourceAttributes = []hcl.AttributeSchema{
+        {
+                Name: "count",
+        },
+        {
+                Name: "for_each",
+        },
+        {
+                Name: "provider",
+        },
+        {
+                Name: "depends_on",
+        },
+}
+
+var resourceBlockSchema = &hcl.BodySchema{
+        Attributes: commonResourceAttributes,
+        Blocks: []hcl.BlockHeaderSchema{
+                {Type: "locals"}, // reserved for future use
+                {Type: "lifecycle"},
+                {Type: "connection"},
+                {Type: "provisioner", LabelNames: []string{"type"}},
+        },
+}
+
+var dataBlockSchema = &hcl.BodySchema{
+        Attributes: commonResourceAttributes,
+        Blocks: []hcl.BlockHeaderSchema{
+                {Type: "lifecycle"}, // reserved for future use
+                {Type: "locals"},    // reserved for future use
+        },
+}
+
+var resourceLifecycleBlockSchema = &hcl.BodySchema{
+        Attributes: []hcl.AttributeSchema{
+                {
+                        Name: "create_before_destroy",
+                },
+                {
+                        Name: "prevent_destroy",
+                },
+                {
+                        Name: "ignore_changes",
+                },
+        },
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/synth_body.go b/vendor/github.com/hashicorp/terraform/configs/synth_body.go
new file mode 100644
index 0000000..3ae1bff
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/synth_body.go
@@ -0,0 +1,118 @@
+package configs
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// SynthBody produces a synthetic hcl.Body that behaves as if it had attributes
+// corresponding to the elements given in the values map.
+//
+// This is useful in situations where, for example, values provided on the
+// command line can override values given in configuration, using MergeBodies.
+//
+// The given filename is used in case any diagnostics are returned. Since
+// the created body is synthetic, it is likely that this will not be a "real"
+// filename. For example, if from a command line argument it could be
+// a representation of that argument's name, such as "-var=...".
+func SynthBody(filename string, values map[string]cty.Value) hcl.Body {
+        return synthBody{
+                Filename: filename,
+                Values:   values,
+        }
+}
+
+type synthBody struct {
+        Filename string
+        Values   map[string]cty.Value
+}
+
+func (b synthBody) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) {
+        content, remain, diags := b.PartialContent(schema)
+        remainS := remain.(synthBody)
+        for name := range remainS.Values {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Unsupported attribute",
+                        Detail:   fmt.Sprintf("An attribute named %q is not expected here.", name),
+                        Subject:  b.synthRange().Ptr(),
+                })
+        }
+        return content, diags
+}
+
+func (b synthBody) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        content := &hcl.BodyContent{
+                Attributes:       make(hcl.Attributes),
+                MissingItemRange: b.synthRange(),
+        }
+
+        remainValues := make(map[string]cty.Value)
+        for attrName, val := range b.Values {
+                remainValues[attrName] = val
+        }
+
+        for _, attrS := range schema.Attributes {
+                delete(remainValues, attrS.Name)
+                val, defined := b.Values[attrS.Name]
+                if !defined {
+                        if attrS.Required {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Missing required attribute",
+                                        Detail:   fmt.Sprintf("The attribute %q is required, but no definition was found.", attrS.Name),
+                                        Subject:  b.synthRange().Ptr(),
+                                })
+                        }
+                        continue
+                }
+                content.Attributes[attrS.Name] = b.synthAttribute(attrS.Name, val)
+        }
+
+        // We just ignore blocks altogether, because this body type never has
+        // nested blocks.
+
+        remain := synthBody{
+                Filename: b.Filename,
+                Values:   remainValues,
+        }
+
+        return content, remain, diags
+}
+
+func (b synthBody) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
+        ret := make(hcl.Attributes)
+        for name, val := range b.Values {
+                ret[name] = b.synthAttribute(name, val)
+        }
+        return ret, nil
+}
+
+func (b synthBody) MissingItemRange() hcl.Range {
+        return b.synthRange()
+}
+
+func (b synthBody) synthAttribute(name string, val cty.Value) *hcl.Attribute {
+        rng := b.synthRange()
+        return &hcl.Attribute{
+                Name: name,
+                Expr: &hclsyntax.LiteralValueExpr{
+                        Val:      val,
+                        SrcRange: rng,
+                },
+                NameRange: rng,
+                Range:     rng,
+        }
+}
+
+func (b synthBody) synthRange() hcl.Range {
+        return hcl.Range{
+                Filename: b.Filename,
+                Start:    hcl.Pos{Line: 1, Column: 1},
+                End:      hcl.Pos{Line: 1, Column: 1},
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/util.go b/vendor/github.com/hashicorp/terraform/configs/util.go
new file mode 100644
index 0000000..5fbde43
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/util.go
@@ -0,0 +1,63 @@
+package configs
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+)
+
+// exprIsNativeQuotedString determines whether the given expression looks like
+// it's a quoted string in the HCL native syntax.
+//
+// This should be used sparingly only for situations where our legacy HCL
+// decoding would've expected a keyword or reference in quotes but our new
+// decoding expects the keyword or reference to be provided directly as
+// an identifier-based expression.
+func exprIsNativeQuotedString(expr hcl.Expression) bool {
+        _, ok := expr.(*hclsyntax.TemplateExpr)
+        return ok
+}
+
+// schemaForOverrides takes a *hcl.BodySchema and produces a new one that is
+// equivalent except that any required attributes are forced to not be required.
+//
+// This is useful for dealing with "override" config files, which are allowed
+// to omit things that they don't wish to override from the main configuration.
+//
+// The returned schema may have some pointers in common with the given schema,
+// so neither the given schema nor the returned schema should be modified after
+// using this function in order to avoid confusion.
+//
+// Overrides are rarely used, so it's recommended to just create the override
+// schema on the fly only when it's needed, rather than storing it in a global
+// variable as we tend to do for a primary schema.
+func schemaForOverrides(schema *hcl.BodySchema) *hcl.BodySchema {
+        ret := &hcl.BodySchema{
+                Attributes: make([]hcl.AttributeSchema, len(schema.Attributes)),
+                Blocks:     schema.Blocks,
+        }
+
+        for i, attrS := range schema.Attributes {
+                ret.Attributes[i] = attrS
+                ret.Attributes[i].Required = false
+        }
+
+        return ret
+}
+
+// schemaWithDynamic takes a *hcl.BodySchema and produces a new one that
+// is equivalent except that it accepts an additional block type "dynamic" with
+// a single label, used to recognize usage of the HCL dynamic block extension.
+func schemaWithDynamic(schema *hcl.BodySchema) *hcl.BodySchema {
+        ret := &hcl.BodySchema{
+                Attributes: schema.Attributes,
+                Blocks:     make([]hcl.BlockHeaderSchema, len(schema.Blocks), len(schema.Blocks)+1),
+        }
+
+        copy(ret.Blocks, schema.Blocks)
+        ret.Blocks = append(ret.Blocks, hcl.BlockHeaderSchema{
+                Type:       "dynamic",
+                LabelNames: []string{"type"},
+        })
+
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/variable_type_hint.go b/vendor/github.com/hashicorp/terraform/configs/variable_type_hint.go
new file mode 100644
index 0000000..204efd1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/variable_type_hint.go
@@ -0,0 +1,45 @@
+package configs
+
+// VariableTypeHint is an enumeration used for the Variable.TypeHint field,
+// which is an incompletely-specified type for the variable which is used
+// as a hint for whether a value provided in an ambiguous context (on the
+// command line or in an environment variable) should be taken literally as a
+// string or parsed as an HCL expression to produce a data structure.
+//
+// The type hint is applied to runtime values as well, but since it does not
+// accurately describe a precise type it is not fully-sufficient to infer
+// the dynamic type of a value passed through a variable.
+//
+// These hints use inaccurate terminology for historical reasons. Full details
+// are in the documentation for each constant in this enumeration, but in
+// summary:
+//
+//     TypeHintString requires a primitive type
+//     TypeHintList requires a type that could be converted to a tuple
+//     TypeHintMap requires a type that could be converted to an object
+type VariableTypeHint rune
+
+//go:generate stringer -type VariableTypeHint
+
+// TypeHintNone indicates the absense of a type hint. Values specified in
+// ambiguous contexts will be treated as literal strings, as if TypeHintString
+// were selected, but no runtime value checks will be applied. This is reasonable
+// type hint for a module that is never intended to be used at the top-level
+// of a configuration, since descendent modules never recieve values from
+// ambiguous contexts.
+const TypeHintNone VariableTypeHint = 0
+
+// TypeHintString spec indicates that a value provided in an ambiguous context
+// should be treated as a literal string, and additionally requires that the
+// runtime value for the variable is of a primitive type (string, number, bool).
+const TypeHintString VariableTypeHint = 'S'
+
+// TypeHintList indicates that a value provided in an ambiguous context should
+// be treated as an HCL expression, and additionally requires that the
+// runtime value for the variable is of an tuple, list, or set type.
+const TypeHintList VariableTypeHint = 'L'
+
+// TypeHintMap indicates that a value provided in an ambiguous context should
+// be treated as an HCL expression, and additionally requires that the
+// runtime value for the variable is of an object or map type.
+const TypeHintMap VariableTypeHint = 'M'
diff --git a/vendor/github.com/hashicorp/terraform/configs/variabletypehint_string.go b/vendor/github.com/hashicorp/terraform/configs/variabletypehint_string.go
new file mode 100644
index 0000000..2b50428
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/variabletypehint_string.go
@@ -0,0 +1,39 @@
+// Code generated by "stringer -type VariableTypeHint"; DO NOT EDIT.
+
+package configs
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[TypeHintNone-0]
+        _ = x[TypeHintString-83]
+        _ = x[TypeHintList-76]
+        _ = x[TypeHintMap-77]
+}
+
+const (
+        _VariableTypeHint_name_0 = "TypeHintNone"
+        _VariableTypeHint_name_1 = "TypeHintListTypeHintMap"
+        _VariableTypeHint_name_2 = "TypeHintString"
+)
+
+var (
+        _VariableTypeHint_index_1 = [...]uint8{0, 12, 23}
+)
+
+func (i VariableTypeHint) String() string {
+        switch {
+        case i == 0:
+                return _VariableTypeHint_name_0
+        case 76 <= i && i <= 77:
+                i -= 76
+                return _VariableTypeHint_name_1[_VariableTypeHint_index_1[i]:_VariableTypeHint_index_1[i+1]]
+        case i == 83:
+                return _VariableTypeHint_name_2
+        default:
+                return "VariableTypeHint(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/configs/version_constraint.go b/vendor/github.com/hashicorp/terraform/configs/version_constraint.go
new file mode 100644
index 0000000..7aa19ef
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/configs/version_constraint.go
@@ -0,0 +1,64 @@
+package configs
+
+import (
+        "fmt"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+)
+
+// VersionConstraint represents a version constraint on some resource
+// (e.g. Terraform Core, a provider, a module, ...) that carries with it
+// a source range so that a helpful diagnostic can be printed in the event
+// that a particular constraint does not match.
+type VersionConstraint struct {
+        Required  version.Constraints
+        DeclRange hcl.Range
+}
+
+func decodeVersionConstraint(attr *hcl.Attribute) (VersionConstraint, hcl.Diagnostics) {
+        ret := VersionConstraint{
+                DeclRange: attr.Range,
+        }
+
+        val, diags := attr.Expr.Value(nil)
+        if diags.HasErrors() {
+                return ret, diags
+        }
+        var err error
+        val, err = convert.Convert(val, cty.String)
+        if err != nil {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid version constraint",
+                        Detail:   fmt.Sprintf("A string value is required for %s.", attr.Name),
+                        Subject:  attr.Expr.Range().Ptr(),
+                })
+                return ret, diags
+        }
+
+        if val.IsNull() {
+                // A null version constraint is strange, but we'll just treat it
+                // like an empty constraint set.
+                return ret, diags
+        }
+
+        constraintStr := val.AsString()
+        constraints, err := version.NewConstraint(constraintStr)
+        if err != nil {
+                // NewConstraint doesn't return user-friendly errors, so we'll just
+                // ignore the provided error and produce our own generic one.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid version constraint",
+                        Detail:   "This string does not use correct version constraint syntax.", // Not very actionable :(
+                        Subject:  attr.Expr.Range().Ptr(),
+                })
+                return ret, diags
+        }
+
+        ret.Required = constraints
+        return ret, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/dag/dag.go b/vendor/github.com/hashicorp/terraform/dag/dag.go
index b7eb10c..77c67ef 100644
--- a/vendor/github.com/hashicorp/terraform/dag/dag.go
+++ b/vendor/github.com/hashicorp/terraform/dag/dag.go
@@ -5,6 +5,8 @@ import (
         "sort"
         "strings"
 
+        "github.com/hashicorp/terraform/tfdiags"
+
         "github.com/hashicorp/go-multierror"
 )
 
@@ -15,7 +17,7 @@ type AcyclicGraph struct {
 }
 
 // WalkFunc is the callback used for walking the graph.
-type WalkFunc func(Vertex) error
+type WalkFunc func(Vertex) tfdiags.Diagnostics
 
 // DepthWalkFunc is a walk function that also receives the current depth of the
 // walk as an argument
@@ -161,9 +163,9 @@ func (g *AcyclicGraph) Cycles() [][]Vertex {
 }
 
 // Walk walks the graph, calling your callback as each node is visited.
-// This will walk nodes in parallel if it can. Because the walk is done
-// in parallel, the error returned will be a multierror.
-func (g *AcyclicGraph) Walk(cb WalkFunc) error {
+// This will walk nodes in parallel if it can. The resulting diagnostics
+// contains problems from all graphs visited, in no particular order.
+func (g *AcyclicGraph) Walk(cb WalkFunc) tfdiags.Diagnostics {
         defer g.debug.BeginOperation(typeWalk, "").End("")
 
         w := &Walker{Callback: cb, Reverse: true}
diff --git a/vendor/github.com/hashicorp/terraform/dag/walk.go b/vendor/github.com/hashicorp/terraform/dag/walk.go
index f03b100..1c926c2 100644
--- a/vendor/github.com/hashicorp/terraform/dag/walk.go
+++ b/vendor/github.com/hashicorp/terraform/dag/walk.go
@@ -2,12 +2,11 @@ package dag
 
 import (
         "errors"
-        "fmt"
         "log"
         "sync"
         "time"
 
-        "github.com/hashicorp/go-multierror"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // Walker is used to walk every vertex of a graph in parallel.
@@ -54,10 +53,15 @@ type Walker struct {
         // if new vertices are added.
         wait sync.WaitGroup
 
-        // errMap contains the errors recorded so far for execution. Reading
-        // and writing should hold errLock.
-        errMap  map[Vertex]error
-        errLock sync.Mutex
+        // diagsMap contains the diagnostics recorded so far for execution,
+        // and upstreamFailed contains all the vertices whose problems were
+        // caused by upstream failures, and thus whose diagnostics should be
+        // excluded from the final set.
+        //
+        // Readers and writers of either map must hold diagsLock.
+        diagsMap       map[Vertex]tfdiags.Diagnostics
+        upstreamFailed map[Vertex]struct{}
+        diagsLock      sync.Mutex
 }
 
 type walkerVertex struct {
@@ -98,31 +102,30 @@ type walkerVertex struct {
 // user-returned error.
 var errWalkUpstream = errors.New("upstream dependency failed")
 
-// Wait waits for the completion of the walk and returns any errors (
-// in the form of a multierror) that occurred. Update should be called
-// to populate the walk with vertices and edges prior to calling this.
+// Wait waits for the completion of the walk and returns diagnostics describing
+// any problems that arose. Update should be called to populate the walk with
+// vertices and edges prior to calling this.
 //
 // Wait will return as soon as all currently known vertices are complete.
 // If you plan on calling Update with more vertices in the future, you
 // should not call Wait until after this is done.
-func (w *Walker) Wait() error {
+func (w *Walker) Wait() tfdiags.Diagnostics {
         // Wait for completion
         w.wait.Wait()
 
-        // Grab the error lock
-        w.errLock.Lock()
-        defer w.errLock.Unlock()
-
-        // Build the error
-        var result error
-        for v, err := range w.errMap {
-                if err != nil && err != errWalkUpstream {
-                        result = multierror.Append(result, fmt.Errorf(
-                                "%s: %s", VertexName(v), err))
+        var diags tfdiags.Diagnostics
+        w.diagsLock.Lock()
+        for v, vDiags := range w.diagsMap {
+                if _, upstream := w.upstreamFailed[v]; upstream {
+                        // Ignore diagnostics for nodes that had failed upstreams, since
+                        // the downstream diagnostics are likely to be redundant.
+                        continue
                 }
+                diags = diags.Append(vDiags)
         }
+        w.diagsLock.Unlock()
 
-        return result
+        return diags
 }
 
 // Update updates the currently executing walk with the given graph.
@@ -136,6 +139,7 @@ func (w *Walker) Wait() error {
 // Multiple Updates can be called in parallel. Update can be called at any
 // time during a walk.
 func (w *Walker) Update(g *AcyclicGraph) {
+        log.Print("[TRACE] dag/walk: updating graph")
         var v, e *Set
         if g != nil {
                 v, e = g.vertices, g.edges
@@ -381,25 +385,34 @@ func (w *Walker) walkVertex(v Vertex, info *walkerVertex) {
         }
 
         // Run our callback or note that our upstream failed
-        var err error
+        var diags tfdiags.Diagnostics
+        var upstreamFailed bool
         if depsSuccess {
-                log.Printf("[TRACE] dag/walk: walking %q", VertexName(v))
-                err = w.Callback(v)
+                log.Printf("[TRACE] dag/walk: visiting %q", VertexName(v))
+                diags = w.Callback(v)
         } else {
-                log.Printf("[TRACE] dag/walk: upstream errored, not walking %q", VertexName(v))
-                err = errWalkUpstream
+                log.Printf("[TRACE] dag/walk: upstream of %q errored, so skipping", VertexName(v))
+                // This won't be displayed to the user because we'll set upstreamFailed,
+                // but we need to ensure there's at least one error in here so that
+                // the failures will cascade downstream.
+                diags = diags.Append(errors.New("upstream dependencies failed"))
+                upstreamFailed = true
         }
 
-        // Record the error
-        if err != nil {
-                w.errLock.Lock()
-                defer w.errLock.Unlock()
-
-                if w.errMap == nil {
-                        w.errMap = make(map[Vertex]error)
-                }
-                w.errMap[v] = err
+        // Record the result (we must do this after execution because we mustn't
+        // hold diagsLock while visiting a vertex.)
+        w.diagsLock.Lock()
+        if w.diagsMap == nil {
+                w.diagsMap = make(map[Vertex]tfdiags.Diagnostics)
+        }
+        w.diagsMap[v] = diags
+        if w.upstreamFailed == nil {
+                w.upstreamFailed = make(map[Vertex]struct{})
         }
+        if upstreamFailed {
+                w.upstreamFailed[v] = struct{}{}
+        }
+        w.diagsLock.Unlock()
 }
 
 func (w *Walker) waitDeps(
@@ -407,6 +420,7 @@ func (w *Walker) waitDeps(
         deps map[Vertex]<-chan struct{},
         doneCh chan<- bool,
         cancelCh <-chan struct{}) {
+
         // For each dependency given to us, wait for it to complete
         for dep, depCh := range deps {
         DepSatisfied:
@@ -423,17 +437,17 @@ func (w *Walker) waitDeps(
                                 return
 
                         case <-time.After(time.Second * 5):
-                                log.Printf("[TRACE] dag/walk: vertex %q, waiting for: %q",
+                                log.Printf("[TRACE] dag/walk: vertex %q is waiting for %q",
                                         VertexName(v), VertexName(dep))
                         }
                 }
         }
 
         // Dependencies satisfied! We need to check if any errored
-        w.errLock.Lock()
-        defer w.errLock.Unlock()
-        for dep, _ := range deps {
-                if w.errMap[dep] != nil {
+        w.diagsLock.Lock()
+        defer w.diagsLock.Unlock()
+        for dep := range deps {
+                if w.diagsMap[dep].HasErrors() {
                         // One of our dependencies failed, so return false
                         doneCh <- false
                         return
diff --git a/vendor/github.com/hashicorp/terraform/helper/didyoumean/name_suggestion.go b/vendor/github.com/hashicorp/terraform/helper/didyoumean/name_suggestion.go
new file mode 100644
index 0000000..54899bc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/didyoumean/name_suggestion.go
@@ -0,0 +1,24 @@
+package didyoumean
+
+import (
+        "github.com/agext/levenshtein"
+)
+
+// NameSuggestion tries to find a name from the given slice of suggested names
+// that is close to the given name and returns it if found. If no suggestion
+// is close enough, returns the empty string.
+//
+// The suggestions are tried in order, so earlier suggestions take precedence
+// if the given string is similar to two or more suggestions.
+//
+// This function is intended to be used with a relatively-small number of
+// suggestions. It's not optimized for hundreds or thousands of them.
+func NameSuggestion(given string, suggestions []string) string {
+        for _, suggestion := range suggestions {
+                dist := levenshtein.Distance(given, suggestion, nil)
+                if dist < 3 { // threshold determined experimentally
+                        return suggestion
+                }
+        }
+        return ""
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/plugin/doc.go b/vendor/github.com/hashicorp/terraform/helper/plugin/doc.go
new file mode 100644
index 0000000..82b5937
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/plugin/doc.go
@@ -0,0 +1,6 @@
+// Package plugin contains types and functions to help Terraform plugins
+// implement the plugin rpc interface.
+// The primary Provider type will be responsible for converting from the grpc
+// wire protocol to the types and methods known to the provider
+// implementations.
+package plugin
diff --git a/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provider.go b/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provider.go
new file mode 100644
index 0000000..510f47f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provider.go
@@ -0,0 +1,1338 @@
+package plugin
+
+import (
+        "encoding/json"
+        "errors"
+        "fmt"
+        "log"
+        "strconv"
+
+        "github.com/zclconf/go-cty/cty"
+        ctyconvert "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/msgpack"
+        context "golang.org/x/net/context"
+
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/helper/schema"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/plugin/convert"
+        "github.com/hashicorp/terraform/terraform"
+)
+
+const newExtraKey = "_new_extra_shim"
+
+// NewGRPCProviderServerShim wraps a terraform.ResourceProvider in a
+// proto.ProviderServer implementation. If the provided provider is not a
+// *schema.Provider, this will return nil,
+func NewGRPCProviderServerShim(p terraform.ResourceProvider) *GRPCProviderServer {
+        sp, ok := p.(*schema.Provider)
+        if !ok {
+                return nil
+        }
+
+        return &GRPCProviderServer{
+                provider: sp,
+        }
+}
+
+// GRPCProviderServer handles the server, or plugin side of the rpc connection.
+type GRPCProviderServer struct {
+        provider *schema.Provider
+}
+
+func (s *GRPCProviderServer) GetSchema(_ context.Context, req *proto.GetProviderSchema_Request) (*proto.GetProviderSchema_Response, error) {
+        // Here we are certain that the provider is being called through grpc, so
+        // make sure the feature flag for helper/schema is set
+        schema.SetProto5()
+
+        resp := &proto.GetProviderSchema_Response{
+                ResourceSchemas:   make(map[string]*proto.Schema),
+                DataSourceSchemas: make(map[string]*proto.Schema),
+        }
+
+        resp.Provider = &proto.Schema{
+                Block: convert.ConfigSchemaToProto(s.getProviderSchemaBlock()),
+        }
+
+        for typ, res := range s.provider.ResourcesMap {
+                resp.ResourceSchemas[typ] = &proto.Schema{
+                        Version: int64(res.SchemaVersion),
+                        Block:   convert.ConfigSchemaToProto(res.CoreConfigSchema()),
+                }
+        }
+
+        for typ, dat := range s.provider.DataSourcesMap {
+                resp.DataSourceSchemas[typ] = &proto.Schema{
+                        Version: int64(dat.SchemaVersion),
+                        Block:   convert.ConfigSchemaToProto(dat.CoreConfigSchema()),
+                }
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) getProviderSchemaBlock() *configschema.Block {
+        return schema.InternalMap(s.provider.Schema).CoreConfigSchema()
+}
+
+func (s *GRPCProviderServer) getResourceSchemaBlock(name string) *configschema.Block {
+        res := s.provider.ResourcesMap[name]
+        return res.CoreConfigSchema()
+}
+
+func (s *GRPCProviderServer) getDatasourceSchemaBlock(name string) *configschema.Block {
+        dat := s.provider.DataSourcesMap[name]
+        return dat.CoreConfigSchema()
+}
+
+func (s *GRPCProviderServer) PrepareProviderConfig(_ context.Context, req *proto.PrepareProviderConfig_Request) (*proto.PrepareProviderConfig_Response, error) {
+        resp := &proto.PrepareProviderConfig_Response{}
+
+        schemaBlock := s.getProviderSchemaBlock()
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // lookup any required, top-level attributes that are Null, and see if we
+        // have a Default value available.
+        configVal, err = cty.Transform(configVal, func(path cty.Path, val cty.Value) (cty.Value, error) {
+                // we're only looking for top-level attributes
+                if len(path) != 1 {
+                        return val, nil
+                }
+
+                // nothing to do if we already have a value
+                if !val.IsNull() {
+                        return val, nil
+                }
+
+                // get the Schema definition for this attribute
+                getAttr, ok := path[0].(cty.GetAttrStep)
+                // these should all exist, but just ignore anything strange
+                if !ok {
+                        return val, nil
+                }
+
+                attrSchema := s.provider.Schema[getAttr.Name]
+                // continue to ignore anything that doesn't match
+                if attrSchema == nil {
+                        return val, nil
+                }
+
+                // this is deprecated, so don't set it
+                if attrSchema.Deprecated != "" || attrSchema.Removed != "" {
+                        return val, nil
+                }
+
+                // find a default value if it exists
+                def, err := attrSchema.DefaultValue()
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, fmt.Errorf("error getting default for %q: %s", getAttr.Name, err))
+                        return val, err
+                }
+
+                // no default
+                if def == nil {
+                        return val, nil
+                }
+
+                // create a cty.Value and make sure it's the correct type
+                tmpVal := hcl2shim.HCL2ValueFromConfigValue(def)
+
+                // helper/schema used to allow setting "" to a bool
+                if val.Type() == cty.Bool && tmpVal.RawEquals(cty.StringVal("")) {
+                        // return a warning about the conversion
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, "provider set empty string as default value for bool "+getAttr.Name)
+                        tmpVal = cty.False
+                }
+
+                val, err = ctyconvert.Convert(tmpVal, val.Type())
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, fmt.Errorf("error setting default for %q: %s", getAttr.Name, err))
+                }
+
+                return val, err
+        })
+        if err != nil {
+                // any error here was already added to the diagnostics
+                return resp, nil
+        }
+
+        configVal, err = schemaBlock.CoerceValue(configVal)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // Ensure there are no nulls that will cause helper/schema to panic.
+        if err := validateConfigNulls(configVal, nil); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, schemaBlock)
+
+        warns, errs := s.provider.Validate(config)
+        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, convert.WarnsAndErrsToProto(warns, errs))
+
+        preparedConfigMP, err := msgpack.Marshal(configVal, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        resp.PreparedConfig = &proto.DynamicValue{Msgpack: preparedConfigMP}
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ValidateResourceTypeConfig(_ context.Context, req *proto.ValidateResourceTypeConfig_Request) (*proto.ValidateResourceTypeConfig_Response, error) {
+        resp := &proto.ValidateResourceTypeConfig_Response{}
+
+        schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, schemaBlock)
+
+        warns, errs := s.provider.ValidateResource(req.TypeName, config)
+        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, convert.WarnsAndErrsToProto(warns, errs))
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ValidateDataSourceConfig(_ context.Context, req *proto.ValidateDataSourceConfig_Request) (*proto.ValidateDataSourceConfig_Response, error) {
+        resp := &proto.ValidateDataSourceConfig_Response{}
+
+        schemaBlock := s.getDatasourceSchemaBlock(req.TypeName)
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // Ensure there are no nulls that will cause helper/schema to panic.
+        if err := validateConfigNulls(configVal, nil); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, schemaBlock)
+
+        warns, errs := s.provider.ValidateDataSource(req.TypeName, config)
+        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, convert.WarnsAndErrsToProto(warns, errs))
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) UpgradeResourceState(_ context.Context, req *proto.UpgradeResourceState_Request) (*proto.UpgradeResourceState_Response, error) {
+        resp := &proto.UpgradeResourceState_Response{}
+
+        res := s.provider.ResourcesMap[req.TypeName]
+        schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
+        version := int(req.Version)
+
+        jsonMap := map[string]interface{}{}
+        var err error
+
+        switch {
+        // We first need to upgrade a flatmap state if it exists.
+        // There should never be both a JSON and Flatmap state in the request.
+        case len(req.RawState.Flatmap) > 0:
+                jsonMap, version, err = s.upgradeFlatmapState(version, req.RawState.Flatmap, res)
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        // if there's a JSON state, we need to decode it.
+        case len(req.RawState.Json) > 0:
+                err = json.Unmarshal(req.RawState.Json, &jsonMap)
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        default:
+                log.Println("[DEBUG] no state provided to upgrade")
+                return resp, nil
+        }
+
+        // complete the upgrade of the JSON states
+        jsonMap, err = s.upgradeJSONState(version, jsonMap, res)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // The provider isn't required to clean out removed fields
+        s.removeAttributes(jsonMap, schemaBlock.ImpliedType())
+
+        // now we need to turn the state into the default json representation, so
+        // that it can be re-decoded using the actual schema.
+        val, err := schema.JSONMapToStateValue(jsonMap, schemaBlock)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // encode the final state to the expected msgpack format
+        newStateMP, err := msgpack.Marshal(val, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        resp.UpgradedState = &proto.DynamicValue{Msgpack: newStateMP}
+        return resp, nil
+}
+
+// upgradeFlatmapState takes a legacy flatmap state, upgrades it using Migrate
+// state if necessary, and converts it to the new JSON state format decoded as a
+// map[string]interface{}.
+// upgradeFlatmapState returns the json map along with the corresponding schema
+// version.
+func (s *GRPCProviderServer) upgradeFlatmapState(version int, m map[string]string, res *schema.Resource) (map[string]interface{}, int, error) {
+        // this will be the version we've upgraded so, defaulting to the given
+        // version in case no migration was called.
+        upgradedVersion := version
+
+        // first determine if we need to call the legacy MigrateState func
+        requiresMigrate := version < res.SchemaVersion
+
+        schemaType := res.CoreConfigSchema().ImpliedType()
+
+        // if there are any StateUpgraders, then we need to only compare
+        // against the first version there
+        if len(res.StateUpgraders) > 0 {
+                requiresMigrate = version < res.StateUpgraders[0].Version
+        }
+
+        if requiresMigrate {
+                if res.MigrateState == nil {
+                        return nil, 0, errors.New("cannot upgrade state, missing MigrateState function")
+                }
+
+                is := &terraform.InstanceState{
+                        ID:         m["id"],
+                        Attributes: m,
+                        Meta: map[string]interface{}{
+                                "schema_version": strconv.Itoa(version),
+                        },
+                }
+
+                is, err := res.MigrateState(version, is, s.provider.Meta())
+                if err != nil {
+                        return nil, 0, err
+                }
+
+                // re-assign the map in case there was a copy made, making sure to keep
+                // the ID
+                m := is.Attributes
+                m["id"] = is.ID
+
+                // if there are further upgraders, then we've only updated that far
+                if len(res.StateUpgraders) > 0 {
+                        schemaType = res.StateUpgraders[0].Type
+                        upgradedVersion = res.StateUpgraders[0].Version
+                }
+        } else {
+                // the schema version may be newer than the MigrateState functions
+                // handled and older than the current, but still stored in the flatmap
+                // form. If that's the case, we need to find the correct schema type to
+                // convert the state.
+                for _, upgrader := range res.StateUpgraders {
+                        if upgrader.Version == version {
+                                schemaType = upgrader.Type
+                                break
+                        }
+                }
+        }
+
+        // now we know the state is up to the latest version that handled the
+        // flatmap format state. Now we can upgrade the format and continue from
+        // there.
+        newConfigVal, err := hcl2shim.HCL2ValueFromFlatmap(m, schemaType)
+        if err != nil {
+                return nil, 0, err
+        }
+
+        jsonMap, err := schema.StateValueToJSONMap(newConfigVal, schemaType)
+        return jsonMap, upgradedVersion, err
+}
+
+func (s *GRPCProviderServer) upgradeJSONState(version int, m map[string]interface{}, res *schema.Resource) (map[string]interface{}, error) {
+        var err error
+
+        for _, upgrader := range res.StateUpgraders {
+                if version != upgrader.Version {
+                        continue
+                }
+
+                m, err = upgrader.Upgrade(m, s.provider.Meta())
+                if err != nil {
+                        return nil, err
+                }
+                version++
+        }
+
+        return m, nil
+}
+
+// Remove any attributes no longer present in the schema, so that the json can
+// be correctly decoded.
+func (s *GRPCProviderServer) removeAttributes(v interface{}, ty cty.Type) {
+        // we're only concerned with finding maps that corespond to object
+        // attributes
+        switch v := v.(type) {
+        case []interface{}:
+                // If these aren't blocks the next call will be a noop
+                if ty.IsListType() || ty.IsSetType() {
+                        eTy := ty.ElementType()
+                        for _, eV := range v {
+                                s.removeAttributes(eV, eTy)
+                        }
+                }
+                return
+        case map[string]interface{}:
+                // map blocks aren't yet supported, but handle this just in case
+                if ty.IsMapType() {
+                        eTy := ty.ElementType()
+                        for _, eV := range v {
+                                s.removeAttributes(eV, eTy)
+                        }
+                        return
+                }
+
+                if ty == cty.DynamicPseudoType {
+                        log.Printf("[DEBUG] ignoring dynamic block: %#v\n", v)
+                        return
+                }
+
+                if !ty.IsObjectType() {
+                        // This shouldn't happen, and will fail to decode further on, so
+                        // there's no need to handle it here.
+                        log.Printf("[WARN] unexpected type %#v for map in json state", ty)
+                        return
+                }
+
+                attrTypes := ty.AttributeTypes()
+                for attr, attrV := range v {
+                        attrTy, ok := attrTypes[attr]
+                        if !ok {
+                                log.Printf("[DEBUG] attribute %q no longer present in schema", attr)
+                                delete(v, attr)
+                                continue
+                        }
+
+                        s.removeAttributes(attrV, attrTy)
+                }
+        }
+}
+
+func (s *GRPCProviderServer) Stop(_ context.Context, _ *proto.Stop_Request) (*proto.Stop_Response, error) {
+        resp := &proto.Stop_Response{}
+
+        err := s.provider.Stop()
+        if err != nil {
+                resp.Error = err.Error()
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) Configure(_ context.Context, req *proto.Configure_Request) (*proto.Configure_Response, error) {
+        resp := &proto.Configure_Response{}
+
+        schemaBlock := s.getProviderSchemaBlock()
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        s.provider.TerraformVersion = req.TerraformVersion
+
+        // Ensure there are no nulls that will cause helper/schema to panic.
+        if err := validateConfigNulls(configVal, nil); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, schemaBlock)
+        err = s.provider.Configure(config)
+        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ReadResource(_ context.Context, req *proto.ReadResource_Request) (*proto.ReadResource_Response, error) {
+        resp := &proto.ReadResource_Response{}
+
+        res := s.provider.ResourcesMap[req.TypeName]
+        schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
+        stateVal, err := msgpack.Unmarshal(req.CurrentState.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        instanceState, err := res.ShimInstanceStateFromValue(stateVal)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        newInstanceState, err := res.RefreshWithoutUpgrade(instanceState, s.provider.Meta())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        if newInstanceState == nil || newInstanceState.ID == "" {
+                // The old provider API used an empty id to signal that the remote
+                // object appears to have been deleted, but our new protocol expects
+                // to see a null value (in the cty sense) in that case.
+                newStateMP, err := msgpack.Marshal(cty.NullVal(schemaBlock.ImpliedType()), schemaBlock.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                }
+                resp.NewState = &proto.DynamicValue{
+                        Msgpack: newStateMP,
+                }
+                return resp, nil
+        }
+
+        // helper/schema should always copy the ID over, but do it again just to be safe
+        newInstanceState.Attributes["id"] = newInstanceState.ID
+
+        newStateVal, err := hcl2shim.HCL2ValueFromFlatmap(newInstanceState.Attributes, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        newStateVal = normalizeNullValues(newStateVal, stateVal, false)
+        newStateVal = copyTimeoutValues(newStateVal, stateVal)
+
+        newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        resp.NewState = &proto.DynamicValue{
+                Msgpack: newStateMP,
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) PlanResourceChange(_ context.Context, req *proto.PlanResourceChange_Request) (*proto.PlanResourceChange_Response, error) {
+        resp := &proto.PlanResourceChange_Response{}
+
+        // This is a signal to Terraform Core that we're doing the best we can to
+        // shim the legacy type system of the SDK onto the Terraform type system
+        // but we need it to cut us some slack. This setting should not be taken
+        // forward to any new SDK implementations, since setting it prevents us
+        // from catching certain classes of provider bug that can lead to
+        // confusing downstream errors.
+        resp.LegacyTypeSystem = true
+
+        res := s.provider.ResourcesMap[req.TypeName]
+        schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
+        priorStateVal, err := msgpack.Unmarshal(req.PriorState.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        create := priorStateVal.IsNull()
+
+        proposedNewStateVal, err := msgpack.Unmarshal(req.ProposedNewState.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // We don't usually plan destroys, but this can return early in any case.
+        if proposedNewStateVal.IsNull() {
+                resp.PlannedState = req.ProposedNewState
+                return resp, nil
+        }
+
+        info := &terraform.InstanceInfo{
+                Type: req.TypeName,
+        }
+
+        priorState, err := res.ShimInstanceStateFromValue(priorStateVal)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        priorPrivate := make(map[string]interface{})
+        if len(req.PriorPrivate) > 0 {
+                if err := json.Unmarshal(req.PriorPrivate, &priorPrivate); err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        }
+
+        priorState.Meta = priorPrivate
+
+        // Ensure there are no nulls that will cause helper/schema to panic.
+        if err := validateConfigNulls(proposedNewStateVal, nil); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // turn the proposed state into a legacy configuration
+        cfg := terraform.NewResourceConfigShimmed(proposedNewStateVal, schemaBlock)
+
+        diff, err := s.provider.SimpleDiff(info, priorState, cfg)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // if this is a new instance, we need to make sure ID is going to be computed
+        if create {
+                if diff == nil {
+                        diff = terraform.NewInstanceDiff()
+                }
+
+                diff.Attributes["id"] = &terraform.ResourceAttrDiff{
+                        NewComputed: true,
+                }
+        }
+
+        if diff == nil || len(diff.Attributes) == 0 {
+                // schema.Provider.Diff returns nil if it ends up making a diff with no
+                // changes, but our new interface wants us to return an actual change
+                // description that _shows_ there are no changes. This is always the
+                // prior state, because we force a diff above if this is a new instance.
+                resp.PlannedState = req.PriorState
+                return resp, nil
+        }
+
+        if priorState == nil {
+                priorState = &terraform.InstanceState{}
+        }
+
+        // now we need to apply the diff to the prior state, so get the planned state
+        plannedAttrs, err := diff.Apply(priorState.Attributes, schemaBlock)
+
+        plannedStateVal, err := hcl2shim.HCL2ValueFromFlatmap(plannedAttrs, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        plannedStateVal, err = schemaBlock.CoerceValue(plannedStateVal)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        plannedStateVal = normalizeNullValues(plannedStateVal, proposedNewStateVal, false)
+
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        plannedStateVal = copyTimeoutValues(plannedStateVal, proposedNewStateVal)
+
+        // The old SDK code has some imprecisions that cause it to sometimes
+        // generate differences that the SDK itself does not consider significant
+        // but Terraform Core would. To avoid producing weird do-nothing diffs
+        // in that case, we'll check if the provider as produced something we
+        // think is "equivalent" to the prior state and just return the prior state
+        // itself if so, thus ensuring that Terraform Core will treat this as
+        // a no-op. See the docs for ValuesSDKEquivalent for some caveats on its
+        // accuracy.
+        forceNoChanges := false
+        if hcl2shim.ValuesSDKEquivalent(priorStateVal, plannedStateVal) {
+                plannedStateVal = priorStateVal
+                forceNoChanges = true
+        }
+
+        // if this was creating the resource, we need to set any remaining computed
+        // fields
+        if create {
+                plannedStateVal = SetUnknowns(plannedStateVal, schemaBlock)
+        }
+
+        plannedMP, err := msgpack.Marshal(plannedStateVal, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        resp.PlannedState = &proto.DynamicValue{
+                Msgpack: plannedMP,
+        }
+
+        // Now we need to store any NewExtra values, which are where any actual
+        // StateFunc modified config fields are hidden.
+        privateMap := diff.Meta
+        if privateMap == nil {
+                privateMap = map[string]interface{}{}
+        }
+
+        newExtra := map[string]interface{}{}
+
+        for k, v := range diff.Attributes {
+                if v.NewExtra != nil {
+                        newExtra[k] = v.NewExtra
+                }
+        }
+        privateMap[newExtraKey] = newExtra
+
+        // the Meta field gets encoded into PlannedPrivate
+        plannedPrivate, err := json.Marshal(privateMap)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        resp.PlannedPrivate = plannedPrivate
+
+        // collect the attributes that require instance replacement, and convert
+        // them to cty.Paths.
+        var requiresNew []string
+        if !forceNoChanges {
+                for attr, d := range diff.Attributes {
+                        if d.RequiresNew {
+                                requiresNew = append(requiresNew, attr)
+                        }
+                }
+        }
+
+        // If anything requires a new resource already, or the "id" field indicates
+        // that we will be creating a new resource, then we need to add that to
+        // RequiresReplace so that core can tell if the instance is being replaced
+        // even if changes are being suppressed via "ignore_changes".
+        id := plannedStateVal.GetAttr("id")
+        if len(requiresNew) > 0 || id.IsNull() || !id.IsKnown() {
+                requiresNew = append(requiresNew, "id")
+        }
+
+        requiresReplace, err := hcl2shim.RequiresReplace(requiresNew, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // convert these to the protocol structures
+        for _, p := range requiresReplace {
+                resp.RequiresReplace = append(resp.RequiresReplace, pathToAttributePath(p))
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ApplyResourceChange(_ context.Context, req *proto.ApplyResourceChange_Request) (*proto.ApplyResourceChange_Response, error) {
+        resp := &proto.ApplyResourceChange_Response{
+                // Start with the existing state as a fallback
+                NewState: req.PriorState,
+        }
+
+        res := s.provider.ResourcesMap[req.TypeName]
+        schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
+        priorStateVal, err := msgpack.Unmarshal(req.PriorState.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        plannedStateVal, err := msgpack.Unmarshal(req.PlannedState.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        info := &terraform.InstanceInfo{
+                Type: req.TypeName,
+        }
+
+        priorState, err := res.ShimInstanceStateFromValue(priorStateVal)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        private := make(map[string]interface{})
+        if len(req.PlannedPrivate) > 0 {
+                if err := json.Unmarshal(req.PlannedPrivate, &private); err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        }
+
+        var diff *terraform.InstanceDiff
+        destroy := false
+
+        // a null state means we are destroying the instance
+        if plannedStateVal.IsNull() {
+                destroy = true
+                diff = &terraform.InstanceDiff{
+                        Attributes: make(map[string]*terraform.ResourceAttrDiff),
+                        Meta:       make(map[string]interface{}),
+                        Destroy:    true,
+                }
+        } else {
+                diff, err = schema.DiffFromValues(priorStateVal, plannedStateVal, stripResourceModifiers(res))
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        }
+
+        if diff == nil {
+                diff = &terraform.InstanceDiff{
+                        Attributes: make(map[string]*terraform.ResourceAttrDiff),
+                        Meta:       make(map[string]interface{}),
+                }
+        }
+
+        // add NewExtra Fields that may have been stored in the private data
+        if newExtra := private[newExtraKey]; newExtra != nil {
+                for k, v := range newExtra.(map[string]interface{}) {
+                        d := diff.Attributes[k]
+
+                        if d == nil {
+                                d = &terraform.ResourceAttrDiff{}
+                        }
+
+                        d.NewExtra = v
+                        diff.Attributes[k] = d
+                }
+        }
+
+        if private != nil {
+                diff.Meta = private
+        }
+
+        for k, d := range diff.Attributes {
+                // We need to turn off any RequiresNew. There could be attributes
+                // without changes in here inserted by helper/schema, but if they have
+                // RequiresNew then the state will be dropped from the ResourceData.
+                d.RequiresNew = false
+
+                // Check that any "removed" attributes that don't actually exist in the
+                // prior state, or helper/schema will confuse itself
+                if d.NewRemoved {
+                        if _, ok := priorState.Attributes[k]; !ok {
+                                delete(diff.Attributes, k)
+                        }
+                }
+        }
+
+        newInstanceState, err := s.provider.Apply(info, priorState, diff)
+        // we record the error here, but continue processing any returned state.
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+        }
+        newStateVal := cty.NullVal(schemaBlock.ImpliedType())
+
+        // Always return a null value for destroy.
+        // While this is usually indicated by a nil state, check for missing ID or
+        // attributes in the case of a provider failure.
+        if destroy || newInstanceState == nil || newInstanceState.Attributes == nil || newInstanceState.ID == "" {
+                newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+                resp.NewState = &proto.DynamicValue{
+                        Msgpack: newStateMP,
+                }
+                return resp, nil
+        }
+
+        // We keep the null val if we destroyed the resource, otherwise build the
+        // entire object, even if the new state was nil.
+        newStateVal, err = schema.StateValueFromInstanceState(newInstanceState, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        newStateVal = normalizeNullValues(newStateVal, plannedStateVal, true)
+
+        newStateVal = copyTimeoutValues(newStateVal, plannedStateVal)
+
+        newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        resp.NewState = &proto.DynamicValue{
+                Msgpack: newStateMP,
+        }
+
+        meta, err := json.Marshal(newInstanceState.Meta)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        resp.Private = meta
+
+        // This is a signal to Terraform Core that we're doing the best we can to
+        // shim the legacy type system of the SDK onto the Terraform type system
+        // but we need it to cut us some slack. This setting should not be taken
+        // forward to any new SDK implementations, since setting it prevents us
+        // from catching certain classes of provider bug that can lead to
+        // confusing downstream errors.
+        resp.LegacyTypeSystem = true
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ImportResourceState(_ context.Context, req *proto.ImportResourceState_Request) (*proto.ImportResourceState_Response, error) {
+        resp := &proto.ImportResourceState_Response{}
+
+        info := &terraform.InstanceInfo{
+                Type: req.TypeName,
+        }
+
+        newInstanceStates, err := s.provider.ImportState(info, req.Id)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        for _, is := range newInstanceStates {
+                // copy the ID again just to be sure it wasn't missed
+                is.Attributes["id"] = is.ID
+
+                resourceType := is.Ephemeral.Type
+                if resourceType == "" {
+                        resourceType = req.TypeName
+                }
+
+                schemaBlock := s.getResourceSchemaBlock(resourceType)
+                newStateVal, err := hcl2shim.HCL2ValueFromFlatmap(is.Attributes, schemaBlock.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+
+                newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+
+                meta, err := json.Marshal(is.Meta)
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+
+                importedResource := &proto.ImportResourceState_ImportedResource{
+                        TypeName: resourceType,
+                        State: &proto.DynamicValue{
+                                Msgpack: newStateMP,
+                        },
+                        Private: meta,
+                }
+
+                resp.ImportedResources = append(resp.ImportedResources, importedResource)
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ReadDataSource(_ context.Context, req *proto.ReadDataSource_Request) (*proto.ReadDataSource_Response, error) {
+        resp := &proto.ReadDataSource_Response{}
+
+        schemaBlock := s.getDatasourceSchemaBlock(req.TypeName)
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        info := &terraform.InstanceInfo{
+                Type: req.TypeName,
+        }
+
+        // Ensure there are no nulls that will cause helper/schema to panic.
+        if err := validateConfigNulls(configVal, nil); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, schemaBlock)
+
+        // we need to still build the diff separately with the Read method to match
+        // the old behavior
+        diff, err := s.provider.ReadDataDiff(info, config)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // now we can get the new complete data source
+        newInstanceState, err := s.provider.ReadDataApply(info, diff)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        newStateVal, err := schema.StateValueFromInstanceState(newInstanceState, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        newStateVal = copyTimeoutValues(newStateVal, configVal)
+
+        newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        resp.State = &proto.DynamicValue{
+                Msgpack: newStateMP,
+        }
+        return resp, nil
+}
+
+func pathToAttributePath(path cty.Path) *proto.AttributePath {
+        var steps []*proto.AttributePath_Step
+
+        for _, step := range path {
+                switch s := step.(type) {
+                case cty.GetAttrStep:
+                        steps = append(steps, &proto.AttributePath_Step{
+                                Selector: &proto.AttributePath_Step_AttributeName{
+                                        AttributeName: s.Name,
+                                },
+                        })
+                case cty.IndexStep:
+                        ty := s.Key.Type()
+                        switch ty {
+                        case cty.Number:
+                                i, _ := s.Key.AsBigFloat().Int64()
+                                steps = append(steps, &proto.AttributePath_Step{
+                                        Selector: &proto.AttributePath_Step_ElementKeyInt{
+                                                ElementKeyInt: i,
+                                        },
+                                })
+                        case cty.String:
+                                steps = append(steps, &proto.AttributePath_Step{
+                                        Selector: &proto.AttributePath_Step_ElementKeyString{
+                                                ElementKeyString: s.Key.AsString(),
+                                        },
+                                })
+                        }
+                }
+        }
+
+        return &proto.AttributePath{Steps: steps}
+}
+
+// helper/schema throws away timeout values from the config and stores them in
+// the Private/Meta fields. we need to copy those values into the planned state
+// so that core doesn't see a perpetual diff with the timeout block.
+func copyTimeoutValues(to cty.Value, from cty.Value) cty.Value {
+        // if `to` is null we are planning to remove it altogether.
+        if to.IsNull() {
+                return to
+        }
+        toAttrs := to.AsValueMap()
+        // We need to remove the key since the hcl2shims will add a non-null block
+        // because we can't determine if a single block was null from the flatmapped
+        // values. This needs to conform to the correct schema for marshaling, so
+        // change the value to null rather than deleting it from the object map.
+        timeouts, ok := toAttrs[schema.TimeoutsConfigKey]
+        if ok {
+                toAttrs[schema.TimeoutsConfigKey] = cty.NullVal(timeouts.Type())
+        }
+
+        // if from is null then there are no timeouts to copy
+        if from.IsNull() {
+                return cty.ObjectVal(toAttrs)
+        }
+
+        fromAttrs := from.AsValueMap()
+        timeouts, ok = fromAttrs[schema.TimeoutsConfigKey]
+
+        // timeouts shouldn't be unknown, but don't copy possibly invalid values either
+        if !ok || timeouts.IsNull() || !timeouts.IsWhollyKnown() {
+                // no timeouts block to copy
+                return cty.ObjectVal(toAttrs)
+        }
+
+        toAttrs[schema.TimeoutsConfigKey] = timeouts
+
+        return cty.ObjectVal(toAttrs)
+}
+
+// stripResourceModifiers takes a *schema.Resource and returns a deep copy with all
+// StateFuncs and CustomizeDiffs removed. This will be used during apply to
+// create a diff from a planned state where the diff modifications have already
+// been applied.
+func stripResourceModifiers(r *schema.Resource) *schema.Resource {
+        if r == nil {
+                return nil
+        }
+        // start with a shallow copy
+        newResource := new(schema.Resource)
+        *newResource = *r
+
+        newResource.CustomizeDiff = nil
+        newResource.Schema = map[string]*schema.Schema{}
+
+        for k, s := range r.Schema {
+                newResource.Schema[k] = stripSchema(s)
+        }
+
+        return newResource
+}
+
+func stripSchema(s *schema.Schema) *schema.Schema {
+        if s == nil {
+                return nil
+        }
+        // start with a shallow copy
+        newSchema := new(schema.Schema)
+        *newSchema = *s
+
+        newSchema.StateFunc = nil
+
+        switch e := newSchema.Elem.(type) {
+        case *schema.Schema:
+                newSchema.Elem = stripSchema(e)
+        case *schema.Resource:
+                newSchema.Elem = stripResourceModifiers(e)
+        }
+
+        return newSchema
+}
+
+// Zero values and empty containers may be interchanged by the apply process.
+// When there is a discrepency between src and dst value being null or empty,
+// prefer the src value. This takes a little more liberty with set types, since
+// we can't correlate modified set values. In the case of sets, if the src set
+// was wholly known we assume the value was correctly applied and copy that
+// entirely to the new value.
+// While apply prefers the src value, during plan we prefer dst whenever there
+// is an unknown or a set is involved, since the plan can alter the value
+// however it sees fit. This however means that a CustomizeDiffFunction may not
+// be able to change a null to an empty value or vice versa, but that should be
+// very uncommon nor was it reliable before 0.12 either.
+func normalizeNullValues(dst, src cty.Value, apply bool) cty.Value {
+        ty := dst.Type()
+        if !src.IsNull() && !src.IsKnown() {
+                // Return src during plan to retain unknown interpolated placeholders,
+                // which could be lost if we're only updating a resource. If this is a
+                // read scenario, then there shouldn't be any unknowns at all.
+                if dst.IsNull() && !apply {
+                        return src
+                }
+                return dst
+        }
+
+        // Handle null/empty changes for collections during apply.
+        // A change between null and empty values prefers src to make sure the state
+        // is consistent between plan and apply.
+        if ty.IsCollectionType() && apply {
+                dstEmpty := !dst.IsNull() && dst.IsKnown() && dst.LengthInt() == 0
+                srcEmpty := !src.IsNull() && src.IsKnown() && src.LengthInt() == 0
+
+                if (src.IsNull() && dstEmpty) || (srcEmpty && dst.IsNull()) {
+                        return src
+                }
+        }
+
+        if src.IsNull() || !src.IsKnown() || !dst.IsKnown() {
+                return dst
+        }
+
+        switch {
+        case ty.IsMapType(), ty.IsObjectType():
+                var dstMap map[string]cty.Value
+                if !dst.IsNull() {
+                        dstMap = dst.AsValueMap()
+                }
+                if dstMap == nil {
+                        dstMap = map[string]cty.Value{}
+                }
+
+                srcMap := src.AsValueMap()
+                for key, v := range srcMap {
+                        dstVal, ok := dstMap[key]
+                        if !ok && apply && ty.IsMapType() {
+                                // don't transfer old map values to dst during apply
+                                continue
+                        }
+
+                        if dstVal == cty.NilVal {
+                                if !apply && ty.IsMapType() {
+                                        // let plan shape this map however it wants
+                                        continue
+                                }
+                                dstVal = cty.NullVal(v.Type())
+                        }
+
+                        dstMap[key] = normalizeNullValues(dstVal, v, apply)
+                }
+
+                // you can't call MapVal/ObjectVal with empty maps, but nothing was
+                // copied in anyway. If the dst is nil, and the src is known, assume the
+                // src is correct.
+                if len(dstMap) == 0 {
+                        if dst.IsNull() && src.IsWhollyKnown() && apply {
+                                return src
+                        }
+                        return dst
+                }
+
+                if ty.IsMapType() {
+                        // helper/schema will populate an optional+computed map with
+                        // unknowns which we have to fixup here.
+                        // It would be preferable to simply prevent any known value from
+                        // becoming unknown, but concessions have to be made to retain the
+                        // broken legacy behavior when possible.
+                        for k, srcVal := range srcMap {
+                                if !srcVal.IsNull() && srcVal.IsKnown() {
+                                        dstVal, ok := dstMap[k]
+                                        if !ok {
+                                                continue
+                                        }
+
+                                        if !dstVal.IsNull() && !dstVal.IsKnown() {
+                                                dstMap[k] = srcVal
+                                        }
+                                }
+                        }
+
+                        return cty.MapVal(dstMap)
+                }
+
+                return cty.ObjectVal(dstMap)
+
+        case ty.IsSetType():
+                // If the original was wholly known, then we expect that is what the
+                // provider applied. The apply process loses too much information to
+                // reliably re-create the set.
+                if src.IsWhollyKnown() && apply {
+                        return src
+                }
+
+        case ty.IsListType(), ty.IsTupleType():
+                // If the dst is null, and the src is known, then we lost an empty value
+                // so take the original.
+                if dst.IsNull() {
+                        if src.IsWhollyKnown() && src.LengthInt() == 0 && apply {
+                                return src
+                        }
+
+                        // if dst is null and src only contains unknown values, then we lost
+                        // those during a read or plan.
+                        if !apply && !src.IsNull() {
+                                allUnknown := true
+                                for _, v := range src.AsValueSlice() {
+                                        if v.IsKnown() {
+                                                allUnknown = false
+                                                break
+                                        }
+                                }
+                                if allUnknown {
+                                        return src
+                                }
+                        }
+
+                        return dst
+                }
+
+                // if the lengths are identical, then iterate over each element in succession.
+                srcLen := src.LengthInt()
+                dstLen := dst.LengthInt()
+                if srcLen == dstLen && srcLen > 0 {
+                        srcs := src.AsValueSlice()
+                        dsts := dst.AsValueSlice()
+
+                        for i := 0; i < srcLen; i++ {
+                                dsts[i] = normalizeNullValues(dsts[i], srcs[i], apply)
+                        }
+
+                        if ty.IsTupleType() {
+                                return cty.TupleVal(dsts)
+                        }
+                        return cty.ListVal(dsts)
+                }
+
+        case ty.IsPrimitiveType():
+                if dst.IsNull() && src.IsWhollyKnown() && apply {
+                        return src
+                }
+        }
+
+        return dst
+}
+
+// validateConfigNulls checks a config value for unsupported nulls before
+// attempting to shim the value. While null values can mostly be ignored in the
+// configuration, since they're not supported in HCL1, the case where a null
+// appears in a list-like attribute (list, set, tuple) will present a nil value
+// to helper/schema which can panic. Return an error to the user in this case,
+// indicating the attribute with the null value.
+func validateConfigNulls(v cty.Value, path cty.Path) []*proto.Diagnostic {
+        var diags []*proto.Diagnostic
+        if v.IsNull() || !v.IsKnown() {
+                return diags
+        }
+
+        switch {
+        case v.Type().IsListType() || v.Type().IsSetType() || v.Type().IsTupleType():
+                it := v.ElementIterator()
+                for it.Next() {
+                        kv, ev := it.Element()
+                        if ev.IsNull() {
+                                diags = append(diags, &proto.Diagnostic{
+                                        Severity:  proto.Diagnostic_ERROR,
+                                        Summary:   "Null value found in list",
+                                        Detail:    "Null values are not allowed for this attribute value.",
+                                        Attribute: convert.PathToAttributePath(append(path, cty.IndexStep{Key: kv})),
+                                })
+                                continue
+                        }
+
+                        d := validateConfigNulls(ev, append(path, cty.IndexStep{Key: kv}))
+                        diags = convert.AppendProtoDiag(diags, d)
+                }
+
+        case v.Type().IsMapType() || v.Type().IsObjectType():
+                it := v.ElementIterator()
+                for it.Next() {
+                        kv, ev := it.Element()
+                        var step cty.PathStep
+                        switch {
+                        case v.Type().IsMapType():
+                                step = cty.IndexStep{Key: kv}
+                        case v.Type().IsObjectType():
+                                step = cty.GetAttrStep{Name: kv.AsString()}
+                        }
+                        d := validateConfigNulls(ev, append(path, step))
+                        diags = convert.AppendProtoDiag(diags, d)
+                }
+        }
+
+        return diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provisioner.go b/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provisioner.go
new file mode 100644
index 0000000..14494e4
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provisioner.go
@@ -0,0 +1,147 @@
+package plugin
+
+import (
+        "log"
+
+        "github.com/hashicorp/terraform/helper/schema"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/plugin/convert"
+        "github.com/hashicorp/terraform/terraform"
+        "github.com/zclconf/go-cty/cty"
+        ctyconvert "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/msgpack"
+        context "golang.org/x/net/context"
+)
+
+// NewGRPCProvisionerServerShim wraps a terraform.ResourceProvisioner in a
+// proto.ProvisionerServer implementation. If the provided provisioner is not a
+// *schema.Provisioner, this will return nil,
+func NewGRPCProvisionerServerShim(p terraform.ResourceProvisioner) *GRPCProvisionerServer {
+        sp, ok := p.(*schema.Provisioner)
+        if !ok {
+                return nil
+        }
+        return &GRPCProvisionerServer{
+                provisioner: sp,
+        }
+}
+
+type GRPCProvisionerServer struct {
+        provisioner *schema.Provisioner
+}
+
+func (s *GRPCProvisionerServer) GetSchema(_ context.Context, req *proto.GetProvisionerSchema_Request) (*proto.GetProvisionerSchema_Response, error) {
+        resp := &proto.GetProvisionerSchema_Response{}
+
+        resp.Provisioner = &proto.Schema{
+                Block: convert.ConfigSchemaToProto(schema.InternalMap(s.provisioner.Schema).CoreConfigSchema()),
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProvisionerServer) ValidateProvisionerConfig(_ context.Context, req *proto.ValidateProvisionerConfig_Request) (*proto.ValidateProvisionerConfig_Response, error) {
+        resp := &proto.ValidateProvisionerConfig_Response{}
+
+        cfgSchema := schema.InternalMap(s.provisioner.Schema).CoreConfigSchema()
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, cfgSchema.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, cfgSchema)
+
+        warns, errs := s.provisioner.Validate(config)
+        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, convert.WarnsAndErrsToProto(warns, errs))
+
+        return resp, nil
+}
+
+// stringMapFromValue converts a cty.Value to a map[stirng]string.
+// This will panic if the val is not a cty.Map(cty.String).
+func stringMapFromValue(val cty.Value) map[string]string {
+        m := map[string]string{}
+        if val.IsNull() || !val.IsKnown() {
+                return m
+        }
+
+        for it := val.ElementIterator(); it.Next(); {
+                ak, av := it.Element()
+                name := ak.AsString()
+
+                if !av.IsKnown() || av.IsNull() {
+                        continue
+                }
+
+                av, _ = ctyconvert.Convert(av, cty.String)
+                m[name] = av.AsString()
+        }
+
+        return m
+}
+
+// uiOutput implements the terraform.UIOutput interface to adapt the grpc
+// stream to the legacy Provisioner.Apply method.
+type uiOutput struct {
+        srv proto.Provisioner_ProvisionResourceServer
+}
+
+func (o uiOutput) Output(s string) {
+        err := o.srv.Send(&proto.ProvisionResource_Response{
+                Output: s,
+        })
+        if err != nil {
+                log.Printf("[ERROR] %s", err)
+        }
+}
+
+func (s *GRPCProvisionerServer) ProvisionResource(req *proto.ProvisionResource_Request, srv proto.Provisioner_ProvisionResourceServer) error {
+        // We send back a diagnostics over the stream if there was a
+        // provisioner-side problem.
+        srvResp := &proto.ProvisionResource_Response{}
+
+        cfgSchema := schema.InternalMap(s.provisioner.Schema).CoreConfigSchema()
+        cfgVal, err := msgpack.Unmarshal(req.Config.Msgpack, cfgSchema.ImpliedType())
+        if err != nil {
+                srvResp.Diagnostics = convert.AppendProtoDiag(srvResp.Diagnostics, err)
+                srv.Send(srvResp)
+                return nil
+        }
+        resourceConfig := terraform.NewResourceConfigShimmed(cfgVal, cfgSchema)
+
+        connVal, err := msgpack.Unmarshal(req.Connection.Msgpack, cty.Map(cty.String))
+        if err != nil {
+                srvResp.Diagnostics = convert.AppendProtoDiag(srvResp.Diagnostics, err)
+                srv.Send(srvResp)
+                return nil
+        }
+
+        conn := stringMapFromValue(connVal)
+
+        instanceState := &terraform.InstanceState{
+                Ephemeral: terraform.EphemeralState{
+                        ConnInfo: conn,
+                },
+                Meta: make(map[string]interface{}),
+        }
+
+        err = s.provisioner.Apply(uiOutput{srv}, instanceState, resourceConfig)
+        if err != nil {
+                srvResp.Diagnostics = convert.AppendProtoDiag(srvResp.Diagnostics, err)
+                srv.Send(srvResp)
+        }
+        return nil
+}
+
+func (s *GRPCProvisionerServer) Stop(_ context.Context, req *proto.Stop_Request) (*proto.Stop_Response, error) {
+        resp := &proto.Stop_Response{}
+
+        err := s.provisioner.Stop()
+        if err != nil {
+                resp.Error = err.Error()
+        }
+
+        return resp, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/plugin/unknown.go b/vendor/github.com/hashicorp/terraform/helper/plugin/unknown.go
new file mode 100644
index 0000000..64a6784
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/plugin/unknown.go
@@ -0,0 +1,131 @@
+package plugin
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// SetUnknowns takes a cty.Value, and compares it to the schema setting any null
+// values which are computed to unknown.
+func SetUnknowns(val cty.Value, schema *configschema.Block) cty.Value {
+        if !val.IsKnown() {
+                return val
+        }
+
+        // If the object was null, we still need to handle the top level attributes
+        // which might be computed, but we don't need to expand the blocks.
+        if val.IsNull() {
+                objMap := map[string]cty.Value{}
+                allNull := true
+                for name, attr := range schema.Attributes {
+                        switch {
+                        case attr.Computed:
+                                objMap[name] = cty.UnknownVal(attr.Type)
+                                allNull = false
+                        default:
+                                objMap[name] = cty.NullVal(attr.Type)
+                        }
+                }
+
+                // If this object has no unknown attributes, then we can leave it null.
+                if allNull {
+                        return val
+                }
+
+                return cty.ObjectVal(objMap)
+        }
+
+        valMap := val.AsValueMap()
+        newVals := make(map[string]cty.Value)
+
+        for name, attr := range schema.Attributes {
+                v := valMap[name]
+
+                if attr.Computed && v.IsNull() {
+                        newVals[name] = cty.UnknownVal(attr.Type)
+                        continue
+                }
+
+                newVals[name] = v
+        }
+
+        for name, blockS := range schema.BlockTypes {
+                blockVal := valMap[name]
+                if blockVal.IsNull() || !blockVal.IsKnown() {
+                        newVals[name] = blockVal
+                        continue
+                }
+
+                blockValType := blockVal.Type()
+                blockElementType := blockS.Block.ImpliedType()
+
+                // This switches on the value type here, so we can correctly switch
+                // between Tuples/Lists and Maps/Objects.
+                switch {
+                case blockS.Nesting == configschema.NestingSingle || blockS.Nesting == configschema.NestingGroup:
+                        // NestingSingle is the only exception here, where we treat the
+                        // block directly as an object
+                        newVals[name] = SetUnknowns(blockVal, &blockS.Block)
+
+                case blockValType.IsSetType(), blockValType.IsListType(), blockValType.IsTupleType():
+                        listVals := blockVal.AsValueSlice()
+                        newListVals := make([]cty.Value, 0, len(listVals))
+
+                        for _, v := range listVals {
+                                newListVals = append(newListVals, SetUnknowns(v, &blockS.Block))
+                        }
+
+                        switch {
+                        case blockValType.IsSetType():
+                                switch len(newListVals) {
+                                case 0:
+                                        newVals[name] = cty.SetValEmpty(blockElementType)
+                                default:
+                                        newVals[name] = cty.SetVal(newListVals)
+                                }
+                        case blockValType.IsListType():
+                                switch len(newListVals) {
+                                case 0:
+                                        newVals[name] = cty.ListValEmpty(blockElementType)
+                                default:
+                                        newVals[name] = cty.ListVal(newListVals)
+                                }
+                        case blockValType.IsTupleType():
+                                newVals[name] = cty.TupleVal(newListVals)
+                        }
+
+                case blockValType.IsMapType(), blockValType.IsObjectType():
+                        mapVals := blockVal.AsValueMap()
+                        newMapVals := make(map[string]cty.Value)
+
+                        for k, v := range mapVals {
+                                newMapVals[k] = SetUnknowns(v, &blockS.Block)
+                        }
+
+                        switch {
+                        case blockValType.IsMapType():
+                                switch len(newMapVals) {
+                                case 0:
+                                        newVals[name] = cty.MapValEmpty(blockElementType)
+                                default:
+                                        newVals[name] = cty.MapVal(newMapVals)
+                                }
+                        case blockValType.IsObjectType():
+                                if len(newMapVals) == 0 {
+                                        // We need to populate empty values to make a valid object.
+                                        for attr, ty := range blockElementType.AttributeTypes() {
+                                                newMapVals[attr] = cty.NullVal(ty)
+                                        }
+                                }
+                                newVals[name] = cty.ObjectVal(newMapVals)
+                        }
+
+                default:
+                        panic(fmt.Sprintf("failed to set unknown values for nested block %q:%#v", name, blockValType))
+                }
+        }
+
+        return cty.ObjectVal(newVals)
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/grpc_test_provider.go b/vendor/github.com/hashicorp/terraform/helper/resource/grpc_test_provider.go
new file mode 100644
index 0000000..0742e99
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/grpc_test_provider.go
@@ -0,0 +1,43 @@
+package resource
+
+import (
+        "context"
+        "net"
+        "time"
+
+        "github.com/hashicorp/terraform/helper/plugin"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        tfplugin "github.com/hashicorp/terraform/plugin"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/terraform"
+        "google.golang.org/grpc"
+        "google.golang.org/grpc/test/bufconn"
+)
+
+// GRPCTestProvider takes a legacy ResourceProvider, wraps it in the new GRPC
+// shim and starts it in a grpc server using an inmem connection. It returns a
+// GRPCClient for this new server to test the shimmed resource provider.
+func GRPCTestProvider(rp terraform.ResourceProvider) providers.Interface {
+        listener := bufconn.Listen(256 * 1024)
+        grpcServer := grpc.NewServer()
+
+        p := plugin.NewGRPCProviderServerShim(rp)
+        proto.RegisterProviderServer(grpcServer, p)
+
+        go grpcServer.Serve(listener)
+
+        conn, err := grpc.Dial("", grpc.WithDialer(func(string, time.Duration) (net.Conn, error) {
+                return listener.Dial()
+        }), grpc.WithInsecure())
+        if err != nil {
+                panic(err)
+        }
+
+        var pp tfplugin.GRPCProviderPlugin
+        client, _ := pp.GRPCClient(context.Background(), nil, conn)
+
+        grpcClient := client.(*tfplugin.GRPCProvider)
+        grpcClient.TestServer = grpcServer
+
+        return grpcClient
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/state.go b/vendor/github.com/hashicorp/terraform/helper/resource/state.go
index c34e21b..88a8396 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/state.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/state.go
@@ -38,7 +38,7 @@ type StateChangeConf struct {
 // specified in the configuration using the specified Refresh() func,
 // waiting the number of seconds specified in the timeout configuration.
 //
-// If the Refresh function returns a error, exit immediately with that error.
+// If the Refresh function returns an error, exit immediately with that error.
 //
 // If the Refresh function returns a state other than the Target state or one
 // listed in Pending, return immediately with an error.
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/state_shim.go b/vendor/github.com/hashicorp/terraform/helper/resource/state_shim.go
new file mode 100644
index 0000000..b2aff99
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/state_shim.go
@@ -0,0 +1,163 @@
+package resource
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/helper/schema"
+
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/terraform"
+)
+
+// shimState takes a new *states.State and reverts it to a legacy state for the provider ACC tests
+func shimNewState(newState *states.State, providers map[string]terraform.ResourceProvider) (*terraform.State, error) {
+        state := terraform.NewState()
+
+        // in the odd case of a nil state, let the helper packages handle it
+        if newState == nil {
+                return nil, nil
+        }
+
+        for _, newMod := range newState.Modules {
+                mod := state.AddModule(newMod.Addr)
+
+                for name, out := range newMod.OutputValues {
+                        outputType := ""
+                        val := hcl2shim.ConfigValueFromHCL2(out.Value)
+                        ty := out.Value.Type()
+                        switch {
+                        case ty == cty.String:
+                                outputType = "string"
+                        case ty.IsTupleType() || ty.IsListType():
+                                outputType = "list"
+                        case ty.IsMapType():
+                                outputType = "map"
+                        }
+
+                        mod.Outputs[name] = &terraform.OutputState{
+                                Type:      outputType,
+                                Value:     val,
+                                Sensitive: out.Sensitive,
+                        }
+                }
+
+                for _, res := range newMod.Resources {
+                        resType := res.Addr.Type
+                        providerType := res.ProviderConfig.ProviderConfig.Type
+
+                        resource := getResource(providers, providerType, res.Addr)
+
+                        for key, i := range res.Instances {
+                                flatmap, err := shimmedAttributes(i.Current, resource)
+                                if err != nil {
+                                        return nil, fmt.Errorf("error decoding state for %q: %s", resType, err)
+                                }
+
+                                resState := &terraform.ResourceState{
+                                        Type: resType,
+                                        Primary: &terraform.InstanceState{
+                                                ID:         flatmap["id"],
+                                                Attributes: flatmap,
+                                                Tainted:    i.Current.Status == states.ObjectTainted,
+                                        },
+                                        Provider: res.ProviderConfig.String(),
+                                }
+                                if i.Current.SchemaVersion != 0 {
+                                        resState.Primary.Meta = map[string]interface{}{
+                                                "schema_version": i.Current.SchemaVersion,
+                                        }
+                                }
+
+                                for _, dep := range i.Current.Dependencies {
+                                        resState.Dependencies = append(resState.Dependencies, dep.String())
+                                }
+
+                                // convert the indexes to the old style flapmap indexes
+                                idx := ""
+                                switch key.(type) {
+                                case addrs.IntKey:
+                                        // don't add numeric index values to resources with a count of 0
+                                        if len(res.Instances) > 1 {
+                                                idx = fmt.Sprintf(".%d", key)
+                                        }
+                                case addrs.StringKey:
+                                        idx = "." + key.String()
+                                }
+
+                                mod.Resources[res.Addr.String()+idx] = resState
+
+                                // add any deposed instances
+                                for _, dep := range i.Deposed {
+                                        flatmap, err := shimmedAttributes(dep, resource)
+                                        if err != nil {
+                                                return nil, fmt.Errorf("error decoding deposed state for %q: %s", resType, err)
+                                        }
+
+                                        deposed := &terraform.InstanceState{
+                                                ID:         flatmap["id"],
+                                                Attributes: flatmap,
+                                                Tainted:    dep.Status == states.ObjectTainted,
+                                        }
+                                        if dep.SchemaVersion != 0 {
+                                                deposed.Meta = map[string]interface{}{
+                                                        "schema_version": dep.SchemaVersion,
+                                                }
+                                        }
+
+                                        resState.Deposed = append(resState.Deposed, deposed)
+                                }
+                        }
+                }
+        }
+
+        return state, nil
+}
+
+func getResource(providers map[string]terraform.ResourceProvider, providerName string, addr addrs.Resource) *schema.Resource {
+        p := providers[providerName]
+        if p == nil {
+                panic(fmt.Sprintf("provider %q not found in test step", providerName))
+        }
+
+        // this is only for tests, so should only see schema.Providers
+        provider := p.(*schema.Provider)
+
+        switch addr.Mode {
+        case addrs.ManagedResourceMode:
+                resource := provider.ResourcesMap[addr.Type]
+                if resource != nil {
+                        return resource
+                }
+        case addrs.DataResourceMode:
+                resource := provider.DataSourcesMap[addr.Type]
+                if resource != nil {
+                        return resource
+                }
+        }
+
+        panic(fmt.Sprintf("resource %s not found in test step", addr.Type))
+}
+
+func shimmedAttributes(instance *states.ResourceInstanceObjectSrc, res *schema.Resource) (map[string]string, error) {
+        flatmap := instance.AttrsFlat
+        if flatmap != nil {
+                return flatmap, nil
+        }
+
+        // if we have json attrs, they need to be decoded
+        rio, err := instance.Decode(res.CoreConfigSchema().ImpliedType())
+        if err != nil {
+                return nil, err
+        }
+
+        instanceState, err := res.ShimInstanceStateFromValue(rio.Value)
+        if err != nil {
+                return nil, err
+        }
+
+        return instanceState.Attributes, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
index b97673f..aa7454d 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
@@ -1,6 +1,7 @@
 package resource
 
 import (
+        "bytes"
         "flag"
         "fmt"
         "io"
@@ -18,9 +19,18 @@ import (
         "github.com/hashicorp/errwrap"
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/logutils"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/mitchellh/colorstring"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/command/format"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configload"
         "github.com/hashicorp/terraform/helper/logging"
+        "github.com/hashicorp/terraform/internal/initwd"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
         "github.com/hashicorp/terraform/terraform"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // flagSweep is a flag available when running tests on the command line. It
@@ -373,6 +383,10 @@ type TestStep struct {
         // be refreshed and don't matter.
         ImportStateVerify       bool
         ImportStateVerifyIgnore []string
+
+        // provider s is used internally to maintain a reference to the
+        // underlying providers during the tests
+        providers map[string]terraform.ResourceProvider
 }
 
 // Set to a file mask in sprintf format where %s is test name
@@ -467,10 +481,22 @@ func Test(t TestT, c TestCase) {
                 c.PreCheck()
         }
 
+        // get instances of all providers, so we can use the individual
+        // resources to shim the state during the tests.
+        providers := make(map[string]terraform.ResourceProvider)
+        for name, pf := range testProviderFactories(c) {
+                p, err := pf()
+                if err != nil {
+                        t.Fatal(err)
+                }
+                providers[name] = p
+        }
+
         providerResolver, err := testProviderResolver(c)
         if err != nil {
                 t.Fatal(err)
         }
+
         opts := terraform.ContextOpts{ProviderResolver: providerResolver}
 
         // A single state variable to track the lifecycle, starting with no state
@@ -481,6 +507,10 @@ func Test(t TestT, c TestCase) {
         idRefresh := c.IDRefreshName != ""
         errored := false
         for i, step := range c.Steps {
+                // insert the providers into the step so we can get the resources for
+                // shimming the state
+                step.providers = providers
+
                 var err error
                 log.Printf("[DEBUG] Test: Executing step %d", i)
 
@@ -535,8 +565,7 @@ func Test(t TestT, c TestCase) {
                                 }
                         } else {
                                 errored = true
-                                t.Error(fmt.Sprintf(
-                                        "Step %d error: %s", i, err))
+                                t.Error(fmt.Sprintf("Step %d error: %s", i, detailedErrorMessage(err)))
                                 break
                         }
                 }
@@ -591,6 +620,7 @@ func Test(t TestT, c TestCase) {
                         Destroy:                   true,
                         PreventDiskCleanup:        lastStep.PreventDiskCleanup,
                         PreventPostDestroyRefresh: c.PreventPostDestroyRefresh,
+                        providers:                 providers,
                 }
 
                 log.Printf("[WARN] Test: Executing destroy step")
@@ -620,39 +650,50 @@ func testProviderConfig(c TestCase) string {
         return strings.Join(lines, "")
 }
 
-// testProviderResolver is a helper to build a ResourceProviderResolver
-// with pre instantiated ResourceProviders, so that we can reset them for the
-// test, while only calling the factory function once.
-// Any errors are stored so that they can be returned by the factory in
-// terraform to match non-test behavior.
-func testProviderResolver(c TestCase) (terraform.ResourceProviderResolver, error) {
-        ctxProviders := c.ProviderFactories
-        if ctxProviders == nil {
-                ctxProviders = make(map[string]terraform.ResourceProviderFactory)
+// testProviderFactories combines the fixed Providers and
+// ResourceProviderFactory functions into a single map of
+// ResourceProviderFactory functions.
+func testProviderFactories(c TestCase) map[string]terraform.ResourceProviderFactory {
+        ctxProviders := make(map[string]terraform.ResourceProviderFactory)
+        for k, pf := range c.ProviderFactories {
+                ctxProviders[k] = pf
         }
 
         // add any fixed providers
         for k, p := range c.Providers {
                 ctxProviders[k] = terraform.ResourceProviderFactoryFixed(p)
         }
+        return ctxProviders
+}
+
+// testProviderResolver is a helper to build a ResourceProviderResolver
+// with pre instantiated ResourceProviders, so that we can reset them for the
+// test, while only calling the factory function once.
+// Any errors are stored so that they can be returned by the factory in
+// terraform to match non-test behavior.
+func testProviderResolver(c TestCase) (providers.Resolver, error) {
+        ctxProviders := testProviderFactories(c)
+
+        // wrap the old provider factories in the test grpc server so they can be
+        // called from terraform.
+        newProviders := make(map[string]providers.Factory)
 
-        // reset the providers if needed
         for k, pf := range ctxProviders {
-                // we can ignore any errors here, if we don't have a provider to reset
-                // the error will be handled later
-                p, err := pf()
-                if err != nil {
-                        return nil, err
-                }
-                if p, ok := p.(TestProvider); ok {
-                        err := p.TestReset()
+                factory := pf // must copy to ensure each closure sees its own value
+                newProviders[k] = func() (providers.Interface, error) {
+                        p, err := factory()
                         if err != nil {
-                                return nil, fmt.Errorf("[ERROR] failed to reset provider %q: %s", k, err)
+                                return nil, err
                         }
+
+                        // The provider is wrapped in a GRPCTestProvider so that it can be
+                        // passed back to terraform core as a providers.Interface, rather
+                        // than the legacy ResourceProvider.
+                        return GRPCTestProvider(p), nil
                 }
         }
 
-        return terraform.ResourceProviderResolverFixed(ctxProviders), nil
+        return providers.ResolverFixed(newProviders), nil
 }
 
 // UnitTest is a helper to force the acceptance testing harness to run in the
@@ -670,33 +711,40 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
                 return nil
         }
 
-        name := fmt.Sprintf("%s.foo", r.Type)
+        addr := addrs.Resource{
+                Mode: addrs.ManagedResourceMode,
+                Type: r.Type,
+                Name: "foo",
+        }.Instance(addrs.NoKey)
+        absAddr := addr.Absolute(addrs.RootModuleInstance)
 
         // Build the state. The state is just the resource with an ID. There
         // are no attributes. We only set what is needed to perform a refresh.
-        state := terraform.NewState()
-        state.RootModule().Resources[name] = &terraform.ResourceState{
-                Type: r.Type,
-                Primary: &terraform.InstanceState{
-                        ID: r.Primary.ID,
+        state := states.NewState()
+        state.RootModule().SetResourceInstanceCurrent(
+                addr,
+                &states.ResourceInstanceObjectSrc{
+                        AttrsFlat: r.Primary.Attributes,
+                        Status:    states.ObjectReady,
                 },
-        }
+                addrs.ProviderConfig{Type: "placeholder"}.Absolute(addrs.RootModuleInstance),
+        )
 
         // Create the config module. We use the full config because Refresh
         // doesn't have access to it and we may need things like provider
         // configurations. The initial implementation of id-only checks used
         // an empty config module, but that caused the aforementioned problems.
-        mod, err := testModule(opts, step)
+        cfg, err := testConfig(opts, step)
         if err != nil {
                 return err
         }
 
         // Initialize the context
-        opts.Module = mod
+        opts.Config = cfg
         opts.State = state
-        ctx, err := terraform.NewContext(&opts)
-        if err != nil {
-                return err
+        ctx, ctxDiags := terraform.NewContext(&opts)
+        if ctxDiags.HasErrors() {
+                return ctxDiags.Err()
         }
         if diags := ctx.Validate(); len(diags) > 0 {
                 if diags.HasErrors() {
@@ -707,20 +755,20 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
         }
 
         // Refresh!
-        state, err = ctx.Refresh()
-        if err != nil {
-                return fmt.Errorf("Error refreshing: %s", err)
+        state, refreshDiags := ctx.Refresh()
+        if refreshDiags.HasErrors() {
+                return refreshDiags.Err()
         }
 
         // Verify attribute equivalence.
-        actualR := state.RootModule().Resources[name]
+        actualR := state.ResourceInstance(absAddr)
         if actualR == nil {
                 return fmt.Errorf("Resource gone!")
         }
-        if actualR.Primary == nil {
+        if actualR.Current == nil {
                 return fmt.Errorf("Resource has no primary instance")
         }
-        actual := actualR.Primary.Attributes
+        actual := actualR.Current.AttrsFlat
         expected := r.Primary.Attributes
         // Remove fields we're ignoring
         for _, v := range c.IDRefreshIgnore {
@@ -756,15 +804,14 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
         return nil
 }
 
-func testModule(opts terraform.ContextOpts, step TestStep) (*module.Tree, error) {
+func testConfig(opts terraform.ContextOpts, step TestStep) (*configs.Config, error) {
         if step.PreConfig != nil {
                 step.PreConfig()
         }
 
         cfgPath, err := ioutil.TempDir("", "tf-test")
         if err != nil {
-                return nil, fmt.Errorf(
-                        "Error creating temporary directory for config: %s", err)
+                return nil, fmt.Errorf("Error creating temporary directory for config: %s", err)
         }
 
         if step.PreventDiskCleanup {
@@ -773,38 +820,38 @@ func testModule(opts terraform.ContextOpts, step TestStep) (*module.Tree, error)
                 defer os.RemoveAll(cfgPath)
         }
 
-        // Write the configuration
-        cfgF, err := os.Create(filepath.Join(cfgPath, "main.tf"))
+        // Write the main configuration file
+        err = ioutil.WriteFile(filepath.Join(cfgPath, "main.tf"), []byte(step.Config), os.ModePerm)
         if err != nil {
-                return nil, fmt.Errorf(
-                        "Error creating temporary file for config: %s", err)
+                return nil, fmt.Errorf("Error creating temporary file for config: %s", err)
         }
 
-        _, err = io.Copy(cfgF, strings.NewReader(step.Config))
-        cfgF.Close()
+        // Create directory for our child modules, if any.
+        modulesDir := filepath.Join(cfgPath, ".modules")
+        err = os.Mkdir(modulesDir, os.ModePerm)
         if err != nil {
-                return nil, fmt.Errorf(
-                        "Error creating temporary file for config: %s", err)
+                return nil, fmt.Errorf("Error creating child modules directory: %s", err)
         }
 
-        // Parse the configuration
-        mod, err := module.NewTreeModule("", cfgPath)
-        if err != nil {
-                return nil, fmt.Errorf(
-                        "Error loading configuration: %s", err)
+        inst := initwd.NewModuleInstaller(modulesDir, nil)
+        _, installDiags := inst.InstallModules(cfgPath, true, initwd.ModuleInstallHooksImpl{})
+        if installDiags.HasErrors() {
+                return nil, installDiags.Err()
         }
 
-        // Load the modules
-        modStorage := &module.Storage{
-                StorageDir: filepath.Join(cfgPath, ".tfmodules"),
-                Mode:       module.GetModeGet,
-        }
-        err = mod.Load(modStorage)
+        loader, err := configload.NewLoader(&configload.Config{
+                ModulesDir: modulesDir,
+        })
         if err != nil {
-                return nil, fmt.Errorf("Error downloading modules: %s", err)
+                return nil, fmt.Errorf("failed to create config loader: %s", err)
+        }
+
+        config, configDiags := loader.LoadConfig(cfgPath)
+        if configDiags.HasErrors() {
+                return nil, configDiags
         }
 
-        return mod, nil
+        return config, nil
 }
 
 func testResource(c TestStep, state *terraform.State) (*terraform.ResourceState, error) {
@@ -881,8 +928,9 @@ func TestCheckResourceAttrSet(name, key string) TestCheckFunc {
 // TestCheckModuleResourceAttrSet - as per TestCheckResourceAttrSet but with
 // support for non-root modules
 func TestCheckModuleResourceAttrSet(mp []string, name string, key string) TestCheckFunc {
+        mpt := addrs.Module(mp).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                is, err := modulePathPrimaryInstanceState(s, mpt, name)
                 if err != nil {
                         return err
                 }
@@ -915,8 +963,9 @@ func TestCheckResourceAttr(name, key, value string) TestCheckFunc {
 // TestCheckModuleResourceAttr - as per TestCheckResourceAttr but with
 // support for non-root modules
 func TestCheckModuleResourceAttr(mp []string, name string, key string, value string) TestCheckFunc {
+        mpt := addrs.Module(mp).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                is, err := modulePathPrimaryInstanceState(s, mpt, name)
                 if err != nil {
                         return err
                 }
@@ -926,7 +975,19 @@ func TestCheckModuleResourceAttr(mp []string, name string, key string, value str
 }
 
 func testCheckResourceAttr(is *terraform.InstanceState, name string, key string, value string) error {
+        // Empty containers may be elided from the state.
+        // If the intent here is to check for an empty container, allow the key to
+        // also be non-existent.
+        emptyCheck := false
+        if value == "0" && (strings.HasSuffix(key, ".#") || strings.HasSuffix(key, ".%")) {
+                emptyCheck = true
+        }
+
         if v, ok := is.Attributes[key]; !ok || v != value {
+                if emptyCheck && !ok {
+                        return nil
+                }
+
                 if !ok {
                         return fmt.Errorf("%s: Attribute '%s' not found", name, key)
                 }
@@ -957,8 +1018,9 @@ func TestCheckNoResourceAttr(name, key string) TestCheckFunc {
 // TestCheckModuleNoResourceAttr - as per TestCheckNoResourceAttr but with
 // support for non-root modules
 func TestCheckModuleNoResourceAttr(mp []string, name string, key string) TestCheckFunc {
+        mpt := addrs.Module(mp).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                is, err := modulePathPrimaryInstanceState(s, mpt, name)
                 if err != nil {
                         return err
                 }
@@ -968,7 +1030,20 @@ func TestCheckModuleNoResourceAttr(mp []string, name string, key string) TestChe
 }
 
 func testCheckNoResourceAttr(is *terraform.InstanceState, name string, key string) error {
-        if _, ok := is.Attributes[key]; ok {
+        // Empty containers may sometimes be included in the state.
+        // If the intent here is to check for an empty container, allow the value to
+        // also be "0".
+        emptyCheck := false
+        if strings.HasSuffix(key, ".#") || strings.HasSuffix(key, ".%") {
+                emptyCheck = true
+        }
+
+        val, exists := is.Attributes[key]
+        if emptyCheck && val == "0" {
+                return nil
+        }
+
+        if exists {
                 return fmt.Errorf("%s: Attribute '%s' found when not expected", name, key)
         }
 
@@ -991,8 +1066,9 @@ func TestMatchResourceAttr(name, key string, r *regexp.Regexp) TestCheckFunc {
 // TestModuleMatchResourceAttr - as per TestMatchResourceAttr but with
 // support for non-root modules
 func TestModuleMatchResourceAttr(mp []string, name string, key string, r *regexp.Regexp) TestCheckFunc {
+        mpt := addrs.Module(mp).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                is, err := modulePathPrimaryInstanceState(s, mpt, name)
                 if err != nil {
                         return err
                 }
@@ -1052,13 +1128,15 @@ func TestCheckResourceAttrPair(nameFirst, keyFirst, nameSecond, keySecond string
 // TestCheckModuleResourceAttrPair - as per TestCheckResourceAttrPair but with
 // support for non-root modules
 func TestCheckModuleResourceAttrPair(mpFirst []string, nameFirst string, keyFirst string, mpSecond []string, nameSecond string, keySecond string) TestCheckFunc {
+        mptFirst := addrs.Module(mpFirst).UnkeyedInstanceShim()
+        mptSecond := addrs.Module(mpSecond).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                isFirst, err := modulePathPrimaryInstanceState(s, mpFirst, nameFirst)
+                isFirst, err := modulePathPrimaryInstanceState(s, mptFirst, nameFirst)
                 if err != nil {
                         return err
                 }
 
-                isSecond, err := modulePathPrimaryInstanceState(s, mpSecond, nameSecond)
+                isSecond, err := modulePathPrimaryInstanceState(s, mptSecond, nameSecond)
                 if err != nil {
                         return err
                 }
@@ -1068,14 +1146,32 @@ func TestCheckModuleResourceAttrPair(mpFirst []string, nameFirst string, keyFirs
 }
 
 func testCheckResourceAttrPair(isFirst *terraform.InstanceState, nameFirst string, keyFirst string, isSecond *terraform.InstanceState, nameSecond string, keySecond string) error {
-        vFirst, ok := isFirst.Attributes[keyFirst]
-        if !ok {
-                return fmt.Errorf("%s: Attribute '%s' not found", nameFirst, keyFirst)
+        vFirst, okFirst := isFirst.Attributes[keyFirst]
+        vSecond, okSecond := isSecond.Attributes[keySecond]
+
+        // Container count values of 0 should not be relied upon, and not reliably
+        // maintained by helper/schema. For the purpose of tests, consider unset and
+        // 0 to be equal.
+        if len(keyFirst) > 2 && len(keySecond) > 2 && keyFirst[len(keyFirst)-2:] == keySecond[len(keySecond)-2:] &&
+                (strings.HasSuffix(keyFirst, ".#") || strings.HasSuffix(keyFirst, ".%")) {
+                // they have the same suffix, and it is a collection count key.
+                if vFirst == "0" || vFirst == "" {
+                        okFirst = false
+                }
+                if vSecond == "0" || vSecond == "" {
+                        okSecond = false
+                }
         }
 
-        vSecond, ok := isSecond.Attributes[keySecond]
-        if !ok {
-                return fmt.Errorf("%s: Attribute '%s' not found", nameSecond, keySecond)
+        if okFirst != okSecond {
+                if !okFirst {
+                        return fmt.Errorf("%s: Attribute %q not set, but %q is set in %s as %q", nameFirst, keyFirst, keySecond, nameSecond, vSecond)
+                }
+                return fmt.Errorf("%s: Attribute %q is %q, but %q is not set in %s", nameFirst, keyFirst, vFirst, keySecond, nameSecond)
+        }
+        if !(okFirst || okSecond) {
+                // If they both don't exist then they are equally unset, so that's okay.
+                return nil
         }
 
         if vFirst != vSecond {
@@ -1163,7 +1259,7 @@ func modulePrimaryInstanceState(s *terraform.State, ms *terraform.ModuleState, n
 
 // modulePathPrimaryInstanceState returns the primary instance state for the
 // given resource name in a given module path.
-func modulePathPrimaryInstanceState(s *terraform.State, mp []string, name string) (*terraform.InstanceState, error) {
+func modulePathPrimaryInstanceState(s *terraform.State, mp addrs.ModuleInstance, name string) (*terraform.InstanceState, error) {
         ms := s.ModuleByPath(mp)
         if ms == nil {
                 return nil, fmt.Errorf("No module found at: %s", mp)
@@ -1178,3 +1274,47 @@ func primaryInstanceState(s *terraform.State, name string) (*terraform.InstanceS
         ms := s.RootModule()
         return modulePrimaryInstanceState(s, ms, name)
 }
+
+// operationError is a specialized implementation of error used to describe
+// failures during one of the several operations performed for a particular
+// test case.
+type operationError struct {
+        OpName string
+        Diags  tfdiags.Diagnostics
+}
+
+func newOperationError(opName string, diags tfdiags.Diagnostics) error {
+        return operationError{opName, diags}
+}
+
+// Error returns a terse error string containing just the basic diagnostic
+// messages, for situations where normal Go error behavior is appropriate.
+func (err operationError) Error() string {
+        return fmt.Sprintf("errors during %s: %s", err.OpName, err.Diags.Err().Error())
+}
+
+// ErrorDetail is like Error except it includes verbosely-rendered diagnostics
+// similar to what would come from a normal Terraform run, which include
+// additional context not included in Error().
+func (err operationError) ErrorDetail() string {
+        var buf bytes.Buffer
+        fmt.Fprintf(&buf, "errors during %s:", err.OpName)
+        clr := &colorstring.Colorize{Disable: true, Colors: colorstring.DefaultColors}
+        for _, diag := range err.Diags {
+                diagStr := format.Diagnostic(diag, nil, clr, 78)
+                buf.WriteByte('\n')
+                buf.WriteString(diagStr)
+        }
+        return buf.String()
+}
+
+// detailedErrorMessage is a helper for calling ErrorDetail on an error if
+// it is an operationError or just taking Error otherwise.
+func detailedErrorMessage(err error) string {
+        switch tErr := err.(type) {
+        case operationError:
+                return tErr.ErrorDetail()
+        default:
+                return err.Error()
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
index 033f126..311fdb6 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
@@ -1,13 +1,23 @@
 package resource
 
 import (
+        "bufio"
+        "bytes"
         "errors"
         "fmt"
         "log"
+        "sort"
         "strings"
 
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/states"
+
         "github.com/hashicorp/errwrap"
+        "github.com/hashicorp/terraform/plans"
         "github.com/hashicorp/terraform/terraform"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // testStepConfig runs a config-mode test step
@@ -18,69 +28,79 @@ func testStepConfig(
         return testStep(opts, state, step)
 }
 
-func testStep(
-        opts terraform.ContextOpts,
-        state *terraform.State,
-        step TestStep) (*terraform.State, error) {
-        // Pre-taint any resources that have been defined in Taint, as long as this
-        // is not a destroy step.
+func testStep(opts terraform.ContextOpts, state *terraform.State, step TestStep) (*terraform.State, error) {
         if !step.Destroy {
                 if err := testStepTaint(state, step); err != nil {
                         return state, err
                 }
         }
 
-        mod, err := testModule(opts, step)
+        cfg, err := testConfig(opts, step)
         if err != nil {
                 return state, err
         }
 
+        var stepDiags tfdiags.Diagnostics
+
         // Build the context
-        opts.Module = mod
-        opts.State = state
-        opts.Destroy = step.Destroy
-        ctx, err := terraform.NewContext(&opts)
+        opts.Config = cfg
+        opts.State, err = terraform.ShimLegacyState(state)
         if err != nil {
-                return state, fmt.Errorf("Error initializing context: %s", err)
+                return nil, err
+        }
+
+        opts.Destroy = step.Destroy
+        ctx, stepDiags := terraform.NewContext(&opts)
+        if stepDiags.HasErrors() {
+                return state, fmt.Errorf("Error initializing context: %s", stepDiags.Err())
         }
-        if diags := ctx.Validate(); len(diags) > 0 {
-                if diags.HasErrors() {
-                        return nil, errwrap.Wrapf("config is invalid: {{err}}", diags.Err())
+        if stepDiags := ctx.Validate(); len(stepDiags) > 0 {
+                if stepDiags.HasErrors() {
+                        return state, errwrap.Wrapf("config is invalid: {{err}}", stepDiags.Err())
                 }
 
-                log.Printf("[WARN] Config warnings:\n%s", diags)
+                log.Printf("[WARN] Config warnings:\n%s", stepDiags)
         }
 
         // Refresh!
-        state, err = ctx.Refresh()
+        newState, stepDiags := ctx.Refresh()
+        // shim the state first so the test can check the state on errors
+
+        state, err = shimNewState(newState, step.providers)
         if err != nil {
-                return state, fmt.Errorf(
-                        "Error refreshing: %s", err)
+                return nil, err
+        }
+        if stepDiags.HasErrors() {
+                return state, newOperationError("refresh", stepDiags)
         }
 
         // If this step is a PlanOnly step, skip over this first Plan and subsequent
         // Apply, and use the follow up Plan that checks for perpetual diffs
         if !step.PlanOnly {
                 // Plan!
-                if p, err := ctx.Plan(); err != nil {
-                        return state, fmt.Errorf(
-                                "Error planning: %s", err)
+                if p, stepDiags := ctx.Plan(); stepDiags.HasErrors() {
+                        return state, newOperationError("plan", stepDiags)
                 } else {
-                        log.Printf("[WARN] Test: Step plan: %s", p)
+                        log.Printf("[WARN] Test: Step plan: %s", legacyPlanComparisonString(newState, p.Changes))
                 }
 
                 // We need to keep a copy of the state prior to destroying
-                // such that destroy steps can verify their behaviour in the check
+                // such that destroy steps can verify their behavior in the check
                 // function
                 stateBeforeApplication := state.DeepCopy()
 
-                // Apply!
-                state, err = ctx.Apply()
+                // Apply the diff, creating real resources.
+                newState, stepDiags = ctx.Apply()
+                // shim the state first so the test can check the state on errors
+                state, err = shimNewState(newState, step.providers)
                 if err != nil {
-                        return state, fmt.Errorf("Error applying: %s", err)
+                        return nil, err
+                }
+                if stepDiags.HasErrors() {
+                        return state, newOperationError("apply", stepDiags)
                 }
 
-                // Check! Excitement!
+                // Run any configured checks
                 if step.Check != nil {
                         if step.Destroy {
                                 if err := step.Check(stateBeforeApplication); err != nil {
@@ -96,31 +116,35 @@ func testStep(
 
         // Now, verify that Plan is now empty and we don't have a perpetual diff issue
         // We do this with TWO plans. One without a refresh.
-        var p *terraform.Plan
-        if p, err = ctx.Plan(); err != nil {
-                return state, fmt.Errorf("Error on follow-up plan: %s", err)
+        var p *plans.Plan
+        if p, stepDiags = ctx.Plan(); stepDiags.HasErrors() {
+                return state, newOperationError("follow-up plan", stepDiags)
         }
-        if p.Diff != nil && !p.Diff.Empty() {
+        if !p.Changes.Empty() {
                 if step.ExpectNonEmptyPlan {
-                        log.Printf("[INFO] Got non-empty plan, as expected:\n\n%s", p)
+                        log.Printf("[INFO] Got non-empty plan, as expected:\n\n%s", legacyPlanComparisonString(newState, p.Changes))
                 } else {
                         return state, fmt.Errorf(
-                                "After applying this step, the plan was not empty:\n\n%s", p)
+                                "After applying this step, the plan was not empty:\n\n%s", legacyPlanComparisonString(newState, p.Changes))
                 }
         }
 
         // And another after a Refresh.
         if !step.Destroy || (step.Destroy && !step.PreventPostDestroyRefresh) {
-                state, err = ctx.Refresh()
+                newState, stepDiags = ctx.Refresh()
+                if stepDiags.HasErrors() {
+                        return state, newOperationError("follow-up refresh", stepDiags)
+                }
+
+                state, err = shimNewState(newState, step.providers)
                 if err != nil {
-                        return state, fmt.Errorf(
-                                "Error on follow-up refresh: %s", err)
+                        return nil, err
                 }
         }
-        if p, err = ctx.Plan(); err != nil {
-                return state, fmt.Errorf("Error on second follow-up plan: %s", err)
+        if p, stepDiags = ctx.Plan(); stepDiags.HasErrors() {
+                return state, newOperationError("second follow-up refresh", stepDiags)
         }
-        empty := p.Diff == nil || p.Diff.Empty()
+        empty := p.Changes.Empty()
 
         // Data resources are tricky because they legitimately get instantiated
         // during refresh so that they will be already populated during the
@@ -128,35 +152,28 @@ func testStep(
         // config we'll end up wanting to destroy them again here. This is
         // acceptable and expected, and we'll treat it as "empty" for the
         // sake of this testing.
-        if step.Destroy {
+        if step.Destroy && !empty {
                 empty = true
-
-                for _, moduleDiff := range p.Diff.Modules {
-                        for k, instanceDiff := range moduleDiff.Resources {
-                                if !strings.HasPrefix(k, "data.") {
-                                        empty = false
-                                        break
-                                }
-
-                                if !instanceDiff.Destroy {
-                                        empty = false
-                                }
+                for _, change := range p.Changes.Resources {
+                        if change.Addr.Resource.Resource.Mode != addrs.DataResourceMode {
+                                empty = false
+                                break
                         }
                 }
         }
 
         if !empty {
                 if step.ExpectNonEmptyPlan {
-                        log.Printf("[INFO] Got non-empty plan, as expected:\n\n%s", p)
+                        log.Printf("[INFO] Got non-empty plan, as expected:\n\n%s", legacyPlanComparisonString(newState, p.Changes))
                 } else {
                         return state, fmt.Errorf(
                                 "After applying this step and refreshing, "+
-                                        "the plan was not empty:\n\n%s", p)
+                                        "the plan was not empty:\n\n%s", legacyPlanComparisonString(newState, p.Changes))
                 }
         }
 
         // Made it here, but expected a non-empty plan, fail!
-        if step.ExpectNonEmptyPlan && (p.Diff == nil || p.Diff.Empty()) {
+        if step.ExpectNonEmptyPlan && empty {
                 return state, fmt.Errorf("Expected a non-empty plan, but got an empty plan!")
         }
 
@@ -164,6 +181,213 @@ func testStep(
         return state, nil
 }
 
+// legacyPlanComparisonString produces a string representation of the changes
+// from a plan and a given state togther, as was formerly produced by the
+// String method of terraform.Plan.
+//
+// This is here only for compatibility with existing tests that predate our
+// new plan and state types, and should not be used in new tests. Instead, use
+// a library like "cmp" to do a deep equality  and diff on the two
+// data structures.
+func legacyPlanComparisonString(state *states.State, changes *plans.Changes) string {
+        return fmt.Sprintf(
+                "DIFF:\n\n%s\n\nSTATE:\n\n%s",
+                legacyDiffComparisonString(changes),
+                state.String(),
+        )
+}
+
+// legacyDiffComparisonString produces a string representation of the changes
+// from a planned changes object, as was formerly produced by the String method
+// of terraform.Diff.
+//
+// This is here only for compatibility with existing tests that predate our
+// new plan types, and should not be used in new tests. Instead, use a library
+// like "cmp" to do a deep equality check and diff on the two data structures.
+func legacyDiffComparisonString(changes *plans.Changes) string {
+        // The old string representation of a plan was grouped by module, but
+        // our new plan structure is not grouped in that way and so we'll need
+        // to preprocess it in order to produce that grouping.
+        type ResourceChanges struct {
+                Current *plans.ResourceInstanceChangeSrc
+                Deposed map[states.DeposedKey]*plans.ResourceInstanceChangeSrc
+        }
+        byModule := map[string]map[string]*ResourceChanges{}
+        resourceKeys := map[string][]string{}
+        requiresReplace := map[string][]string{}
+        var moduleKeys []string
+        for _, rc := range changes.Resources {
+                if rc.Action == plans.NoOp {
+                        // We won't mention no-op changes here at all, since the old plan
+                        // model we are emulating here didn't have such a concept.
+                        continue
+                }
+                moduleKey := rc.Addr.Module.String()
+                if _, exists := byModule[moduleKey]; !exists {
+                        moduleKeys = append(moduleKeys, moduleKey)
+                        byModule[moduleKey] = make(map[string]*ResourceChanges)
+                }
+                resourceKey := rc.Addr.Resource.String()
+                if _, exists := byModule[moduleKey][resourceKey]; !exists {
+                        resourceKeys[moduleKey] = append(resourceKeys[moduleKey], resourceKey)
+                        byModule[moduleKey][resourceKey] = &ResourceChanges{
+                                Deposed: make(map[states.DeposedKey]*plans.ResourceInstanceChangeSrc),
+                        }
+                }
+
+                if rc.DeposedKey == states.NotDeposed {
+                        byModule[moduleKey][resourceKey].Current = rc
+                } else {
+                        byModule[moduleKey][resourceKey].Deposed[rc.DeposedKey] = rc
+                }
+
+                rr := []string{}
+                for _, p := range rc.RequiredReplace.List() {
+                        rr = append(rr, hcl2shim.FlatmapKeyFromPath(p))
+                }
+                requiresReplace[resourceKey] = rr
+        }
+        sort.Strings(moduleKeys)
+        for _, ks := range resourceKeys {
+                sort.Strings(ks)
+        }
+
+        var buf bytes.Buffer
+
+        for _, moduleKey := range moduleKeys {
+                rcs := byModule[moduleKey]
+                var mBuf bytes.Buffer
+
+                for _, resourceKey := range resourceKeys[moduleKey] {
+                        rc := rcs[resourceKey]
+
+                        forceNewAttrs := requiresReplace[resourceKey]
+
+                        crud := "UPDATE"
+                        if rc.Current != nil {
+                                switch rc.Current.Action {
+                                case plans.DeleteThenCreate:
+                                        crud = "DESTROY/CREATE"
+                                case plans.CreateThenDelete:
+                                        crud = "CREATE/DESTROY"
+                                case plans.Delete:
+                                        crud = "DESTROY"
+                                case plans.Create:
+                                        crud = "CREATE"
+                                }
+                        } else {
+                                // We must be working on a deposed object then, in which
+                                // case destroying is the only possible action.
+                                crud = "DESTROY"
+                        }
+
+                        extra := ""
+                        if rc.Current == nil && len(rc.Deposed) > 0 {
+                                extra = " (deposed only)"
+                        }
+
+                        fmt.Fprintf(
+                                &mBuf, "%s: %s%s\n",
+                                crud, resourceKey, extra,
+                        )
+
+                        attrNames := map[string]bool{}
+                        var oldAttrs map[string]string
+                        var newAttrs map[string]string
+                        if rc.Current != nil {
+                                if before := rc.Current.Before; before != nil {
+                                        ty, err := before.ImpliedType()
+                                        if err == nil {
+                                                val, err := before.Decode(ty)
+                                                if err == nil {
+                                                        oldAttrs = hcl2shim.FlatmapValueFromHCL2(val)
+                                                        for k := range oldAttrs {
+                                                                attrNames[k] = true
+                                                        }
+                                                }
+                                        }
+                                }
+                                if after := rc.Current.After; after != nil {
+                                        ty, err := after.ImpliedType()
+                                        if err == nil {
+                                                val, err := after.Decode(ty)
+                                                if err == nil {
+                                                        newAttrs = hcl2shim.FlatmapValueFromHCL2(val)
+                                                        for k := range newAttrs {
+                                                                attrNames[k] = true
+                                                        }
+                                                }
+                                        }
+                                }
+                        }
+                        if oldAttrs == nil {
+                                oldAttrs = make(map[string]string)
+                        }
+                        if newAttrs == nil {
+                                newAttrs = make(map[string]string)
+                        }
+
+                        attrNamesOrder := make([]string, 0, len(attrNames))
+                        keyLen := 0
+                        for n := range attrNames {
+                                attrNamesOrder = append(attrNamesOrder, n)
+                                if len(n) > keyLen {
+                                        keyLen = len(n)
+                                }
+                        }
+                        sort.Strings(attrNamesOrder)
+
+                        for _, attrK := range attrNamesOrder {
+                                v := newAttrs[attrK]
+                                u := oldAttrs[attrK]
+
+                                if v == config.UnknownVariableValue {
+                                        v = "<computed>"
+                                }
+                                // NOTE: we don't support <sensitive> here because we would
+                                // need schema to do that. Excluding sensitive values
+                                // is now done at the UI layer, and so should not be tested
+                                // at the core layer.
+
+                                updateMsg := ""
+
+                                // This may not be as precise as in the old diff, as it matches
+                                // everything under the attribute that was originally marked as
+                                // ForceNew, but should help make it easier to determine what
+                                // caused replacement here.
+                                for _, k := range forceNewAttrs {
+                                        if strings.HasPrefix(attrK, k) {
+                                                updateMsg = " (forces new resource)"
+                                                break
+                                        }
+                                }
+
+                                fmt.Fprintf(
+                                        &mBuf, "  %s:%s %#v => %#v%s\n",
+                                        attrK,
+                                        strings.Repeat(" ", keyLen-len(attrK)),
+                                        u, v,
+                                        updateMsg,
+                                )
+                        }
+                }
+
+                if moduleKey == "" { // root module
+                        buf.Write(mBuf.Bytes())
+                        buf.WriteByte('\n')
+                        continue
+                }
+
+                fmt.Fprintf(&buf, "%s:\n", moduleKey)
+                s := bufio.NewScanner(&mBuf)
+                for s.Scan() {
+                        buf.WriteString(fmt.Sprintf("  %s\n", s.Text()))
+                }
+        }
+
+        return buf.String()
+}
+
 func testStepTaint(state *terraform.State, step TestStep) error {
         for _, p := range step.Taint {
                 m := state.RootModule()
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
index 94fef3c..e1b7aea 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
@@ -7,6 +7,12 @@ import (
         "strings"
 
         "github.com/davecgh/go-spew/spew"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/helper/schema"
+        "github.com/hashicorp/terraform/states"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -15,6 +21,7 @@ func testStepImportState(
         opts terraform.ContextOpts,
         state *terraform.State,
         step TestStep) (*terraform.State, error) {
+
         // Determine the ID to import
         var importId string
         switch {
@@ -41,33 +48,53 @@ func testStepImportState(
 
         // Setup the context. We initialize with an empty state. We use the
         // full config for provider configurations.
-        mod, err := testModule(opts, step)
+        cfg, err := testConfig(opts, step)
         if err != nil {
                 return state, err
         }
 
-        opts.Module = mod
-        opts.State = terraform.NewState()
-        ctx, err := terraform.NewContext(&opts)
-        if err != nil {
-                return state, err
+        opts.Config = cfg
+
+        // import tests start with empty state
+        opts.State = states.NewState()
+
+        ctx, stepDiags := terraform.NewContext(&opts)
+        if stepDiags.HasErrors() {
+                return state, stepDiags.Err()
         }
 
-        // Do the import!
-        newState, err := ctx.Import(&terraform.ImportOpts{
+        // The test step provides the resource address as a string, so we need
+        // to parse it to get an addrs.AbsResourceAddress to pass in to the
+        // import method.
+        traversal, hclDiags := hclsyntax.ParseTraversalAbs([]byte(step.ResourceName), "", hcl.Pos{})
+        if hclDiags.HasErrors() {
+                return nil, hclDiags
+        }
+        importAddr, stepDiags := addrs.ParseAbsResourceInstance(traversal)
+        if stepDiags.HasErrors() {
+                return nil, stepDiags.Err()
+        }
+
+        // Do the import
+        importedState, stepDiags := ctx.Import(&terraform.ImportOpts{
                 // Set the module so that any provider config is loaded
-                Module: mod,
+                Config: cfg,
 
                 Targets: []*terraform.ImportTarget{
                         &terraform.ImportTarget{
-                                Addr: step.ResourceName,
+                                Addr: importAddr,
                                 ID:   importId,
                         },
                 },
         })
+        if stepDiags.HasErrors() {
+                log.Printf("[ERROR] Test: ImportState failure: %s", stepDiags.Err())
+                return state, stepDiags.Err()
+        }
+
+        newState, err := shimNewState(importedState, step.providers)
         if err != nil {
-                log.Printf("[ERROR] Test: ImportState failure: %s", err)
-                return state, err
+                return nil, err
         }
 
         // Go through the new state and verify
@@ -75,7 +102,9 @@ func testStepImportState(
                 var states []*terraform.InstanceState
                 for _, r := range newState.RootModule().Resources {
                         if r.Primary != nil {
-                                states = append(states, r.Primary)
+                                is := r.Primary.DeepCopy()
+                                is.Ephemeral.Type = r.Type // otherwise the check function cannot see the type
+                                states = append(states, is)
                         }
                 }
                 if err := step.ImportStateCheck(states); err != nil {
@@ -102,30 +131,84 @@ func testStepImportState(
                                         r.Primary.ID)
                         }
 
+                        // We'll try our best to find the schema for this resource type
+                        // so we can ignore Removed fields during validation. If we fail
+                        // to find the schema then we won't ignore them and so the test
+                        // will need to rely on explicit ImportStateVerifyIgnore, though
+                        // this shouldn't happen in any reasonable case.
+                        var rsrcSchema *schema.Resource
+                        if providerAddr, diags := addrs.ParseAbsProviderConfigStr(r.Provider); !diags.HasErrors() {
+                                providerType := providerAddr.ProviderConfig.Type
+                                if provider, ok := step.providers[providerType]; ok {
+                                        if provider, ok := provider.(*schema.Provider); ok {
+                                                rsrcSchema = provider.ResourcesMap[r.Type]
+                                        }
+                                }
+                        }
+
+                        // don't add empty flatmapped containers, so we can more easily
+                        // compare the attributes
+                        skipEmpty := func(k, v string) bool {
+                                if strings.HasSuffix(k, ".#") || strings.HasSuffix(k, ".%") {
+                                        if v == "0" {
+                                                return true
+                                        }
+                                }
+                                return false
+                        }
+
                         // Compare their attributes
                         actual := make(map[string]string)
                         for k, v := range r.Primary.Attributes {
+                                if skipEmpty(k, v) {
+                                        continue
+                                }
                                 actual[k] = v
                         }
+
                         expected := make(map[string]string)
                         for k, v := range oldR.Primary.Attributes {
+                                if skipEmpty(k, v) {
+                                        continue
+                                }
                                 expected[k] = v
                         }
 
                         // Remove fields we're ignoring
                         for _, v := range step.ImportStateVerifyIgnore {
-                                for k, _ := range actual {
+                                for k := range actual {
                                         if strings.HasPrefix(k, v) {
                                                 delete(actual, k)
                                         }
                                 }
-                                for k, _ := range expected {
+                                for k := range expected {
                                         if strings.HasPrefix(k, v) {
                                                 delete(expected, k)
                                         }
                                 }
                         }
 
+                        // Also remove any attributes that are marked as "Removed" in the
+                        // schema, if we have a schema to check that against.
+                        if rsrcSchema != nil {
+                                for k := range actual {
+                                        for _, schema := range rsrcSchema.SchemasForFlatmapPath(k) {
+                                                if schema.Removed != "" {
+                                                        delete(actual, k)
+                                                        break
+                                                }
+                                        }
+                                }
+                                for k := range expected {
+                                        for _, schema := range rsrcSchema.SchemasForFlatmapPath(k) {
+                                                if schema.Removed != "" {
+                                                        delete(expected, k)
+                                                        break
+                                                }
+                                        }
+                                }
+                        }
+
                         if !reflect.DeepEqual(actual, expected) {
                                 // Determine only the different attributes
                                 for k, v := range expected {
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/backend.go b/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
index 57fbba7..c8d8ae2 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
@@ -2,8 +2,15 @@ package schema
 
 import (
         "context"
+        "fmt"
 
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/terraform"
+        ctyconvert "github.com/zclconf/go-cty/cty/convert"
 )
 
 // Backend represents a partial backend.Backend implementation and simplifies
@@ -38,41 +45,123 @@ func FromContextBackendConfig(ctx context.Context) *ResourceData {
         return ctx.Value(backendConfigKey).(*ResourceData)
 }
 
-func (b *Backend) Input(
-        input terraform.UIInput,
-        c *terraform.ResourceConfig) (*terraform.ResourceConfig, error) {
+func (b *Backend) ConfigSchema() *configschema.Block {
+        // This is an alias of CoreConfigSchema just to implement the
+        // backend.Backend interface.
+        return b.CoreConfigSchema()
+}
+
+func (b *Backend) PrepareConfig(configVal cty.Value) (cty.Value, tfdiags.Diagnostics) {
         if b == nil {
-                return c, nil
+                return configVal, nil
         }
+        var diags tfdiags.Diagnostics
+        var err error
 
-        return schemaMap(b.Schema).Input(input, c)
-}
+        // In order to use Transform below, this needs to be filled out completely
+        // according the schema.
+        configVal, err = b.CoreConfigSchema().CoerceValue(configVal)
+        if err != nil {
+                return configVal, diags.Append(err)
+        }
 
-func (b *Backend) Validate(c *terraform.ResourceConfig) ([]string, []error) {
-        if b == nil {
-                return nil, nil
+        // lookup any required, top-level attributes that are Null, and see if we
+        // have a Default value available.
+        configVal, err = cty.Transform(configVal, func(path cty.Path, val cty.Value) (cty.Value, error) {
+                // we're only looking for top-level attributes
+                if len(path) != 1 {
+                        return val, nil
+                }
+
+                // nothing to do if we already have a value
+                if !val.IsNull() {
+                        return val, nil
+                }
+
+                // get the Schema definition for this attribute
+                getAttr, ok := path[0].(cty.GetAttrStep)
+                // these should all exist, but just ignore anything strange
+                if !ok {
+                        return val, nil
+                }
+
+                attrSchema := b.Schema[getAttr.Name]
+                // continue to ignore anything that doesn't match
+                if attrSchema == nil {
+                        return val, nil
+                }
+
+                // this is deprecated, so don't set it
+                if attrSchema.Deprecated != "" || attrSchema.Removed != "" {
+                        return val, nil
+                }
+
+                // find a default value if it exists
+                def, err := attrSchema.DefaultValue()
+                if err != nil {
+                        diags = diags.Append(fmt.Errorf("error getting default for %q: %s", getAttr.Name, err))
+                        return val, err
+                }
+
+                // no default
+                if def == nil {
+                        return val, nil
+                }
+
+                // create a cty.Value and make sure it's the correct type
+                tmpVal := hcl2shim.HCL2ValueFromConfigValue(def)
+
+                // helper/schema used to allow setting "" to a bool
+                if val.Type() == cty.Bool && tmpVal.RawEquals(cty.StringVal("")) {
+                        // return a warning about the conversion
+                        diags = diags.Append("provider set empty string as default value for bool " + getAttr.Name)
+                        tmpVal = cty.False
+                }
+
+                val, err = ctyconvert.Convert(tmpVal, val.Type())
+                if err != nil {
+                        diags = diags.Append(fmt.Errorf("error setting default for %q: %s", getAttr.Name, err))
+                }
+
+                return val, err
+        })
+        if err != nil {
+                // any error here was already added to the diagnostics
+                return configVal, diags
         }
 
-        return schemaMap(b.Schema).Validate(c)
+        shimRC := b.shimConfig(configVal)
+        warns, errs := schemaMap(b.Schema).Validate(shimRC)
+        for _, warn := range warns {
+                diags = diags.Append(tfdiags.SimpleWarning(warn))
+        }
+        for _, err := range errs {
+                diags = diags.Append(err)
+        }
+        return configVal, diags
 }
 
-func (b *Backend) Configure(c *terraform.ResourceConfig) error {
+func (b *Backend) Configure(obj cty.Value) tfdiags.Diagnostics {
         if b == nil {
                 return nil
         }
 
+        var diags tfdiags.Diagnostics
         sm := schemaMap(b.Schema)
+        shimRC := b.shimConfig(obj)
 
         // Get a ResourceData for this configuration. To do this, we actually
         // generate an intermediary "diff" although that is never exposed.
-        diff, err := sm.Diff(nil, c, nil, nil)
+        diff, err := sm.Diff(nil, shimRC, nil, nil, true)
         if err != nil {
-                return err
+                diags = diags.Append(err)
+                return diags
         }
 
         data, err := sm.Data(nil, diff)
         if err != nil {
-                return err
+                diags = diags.Append(err)
+                return diags
         }
         b.config = data
 
@@ -80,11 +169,28 @@ func (b *Backend) Configure(c *terraform.ResourceConfig) error {
                 err = b.ConfigureFunc(context.WithValue(
                         context.Background(), backendConfigKey, data))
                 if err != nil {
-                        return err
+                        diags = diags.Append(err)
+                        return diags
                 }
         }
 
-        return nil
+        return diags
+}
+
+// shimConfig turns a new-style cty.Value configuration (which must be of
+// an object type) into a minimal old-style *terraform.ResourceConfig object
+// that should be populated enough to appease the not-yet-updated functionality
+// in this package. This should be removed once everything is updated.
+func (b *Backend) shimConfig(obj cty.Value) *terraform.ResourceConfig {
+        shimMap, ok := hcl2shim.ConfigValueFromHCL2(obj).(map[string]interface{})
+        if !ok {
+                // If the configVal was nil, we still want a non-nil map here.
+                shimMap = map[string]interface{}{}
+        }
+        return &terraform.ResourceConfig{
+                Config: shimMap,
+                Raw:    shimMap,
+        }
 }
 
 // Config returns the configuration. This is available after Configure is
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go b/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
index bf952f6..875677e 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
@@ -3,7 +3,7 @@ package schema
 import (
         "fmt"
 
-        "github.com/hashicorp/terraform/config/configschema"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/zclconf/go-cty/cty"
 )
 
@@ -39,14 +39,42 @@ func (m schemaMap) CoreConfigSchema() *configschema.Block {
                         ret.Attributes[name] = schema.coreConfigSchemaAttribute()
                         continue
                 }
-                switch schema.Elem.(type) {
-                case *Schema:
+                if schema.Type == TypeMap {
+                        // For TypeMap in particular, it isn't valid for Elem to be a
+                        // *Resource (since that would be ambiguous in flatmap) and
+                        // so Elem is treated as a TypeString schema if so. This matches
+                        // how the field readers treat this situation, for compatibility
+                        // with configurations targeting Terraform 0.11 and earlier.
+                        if _, isResource := schema.Elem.(*Resource); isResource {
+                                sch := *schema // shallow copy
+                                sch.Elem = &Schema{
+                                        Type: TypeString,
+                                }
+                                ret.Attributes[name] = sch.coreConfigSchemaAttribute()
+                                continue
+                        }
+                }
+                switch schema.ConfigMode {
+                case SchemaConfigModeAttr:
                         ret.Attributes[name] = schema.coreConfigSchemaAttribute()
-                case *Resource:
+                case SchemaConfigModeBlock:
                         ret.BlockTypes[name] = schema.coreConfigSchemaBlock()
-                default:
-                        // Should never happen for a valid schema
-                        panic(fmt.Errorf("invalid Schema.Elem %#v; need *Schema or *Resource", schema.Elem))
+                default: // SchemaConfigModeAuto, or any other invalid value
+                        if schema.Computed && !schema.Optional {
+                                // Computed-only schemas are always handled as attributes,
+                                // because they never appear in configuration.
+                                ret.Attributes[name] = schema.coreConfigSchemaAttribute()
+                                continue
+                        }
+                        switch schema.Elem.(type) {
+                        case *Schema, ValueType:
+                                ret.Attributes[name] = schema.coreConfigSchemaAttribute()
+                        case *Resource:
+                                ret.BlockTypes[name] = schema.coreConfigSchemaBlock()
+                        default:
+                                // Should never happen for a valid schema
+                                panic(fmt.Errorf("invalid Schema.Elem %#v; need *Schema or *Resource", schema.Elem))
+                        }
                 }
         }
 
@@ -58,12 +86,42 @@ func (m schemaMap) CoreConfigSchema() *configschema.Block {
 // Elem is an instance of Schema. Use coreConfigSchemaBlock for collections
 // whose elem is a whole resource.
 func (s *Schema) coreConfigSchemaAttribute() *configschema.Attribute {
+        // The Schema.DefaultFunc capability adds some extra weirdness here since
+        // it can be combined with "Required: true" to create a sitution where
+        // required-ness is conditional. Terraform Core doesn't share this concept,
+        // so we must sniff for this possibility here and conditionally turn
+        // off the "Required" flag if it looks like the DefaultFunc is going
+        // to provide a value.
+        // This is not 100% true to the original interface of DefaultFunc but
+        // works well enough for the EnvDefaultFunc and MultiEnvDefaultFunc
+        // situations, which are the main cases we care about.
+        //
+        // Note that this also has a consequence for commands that return schema
+        // information for documentation purposes: running those for certain
+        // providers will produce different results depending on which environment
+        // variables are set. We accept that weirdness in order to keep this
+        // interface to core otherwise simple.
+        reqd := s.Required
+        opt := s.Optional
+        if reqd && s.DefaultFunc != nil {
+                v, err := s.DefaultFunc()
+                // We can't report errors from here, so we'll instead just force
+                // "Required" to false and let the provider try calling its
+                // DefaultFunc again during the validate step, where it can then
+                // return the error.
+                if err != nil || (err == nil && v != nil) {
+                        reqd = false
+                        opt = true
+                }
+        }
+
         return &configschema.Attribute{
-                Type:      s.coreConfigSchemaType(),
-                Optional:  s.Optional,
-                Required:  s.Required,
-                Computed:  s.Computed,
-                Sensitive: s.Sensitive,
+                Type:        s.coreConfigSchemaType(),
+                Optional:    opt,
+                Required:    reqd,
+                Computed:    s.Computed,
+                Sensitive:   s.Sensitive,
+                Description: s.Description,
         }
 }
 
@@ -72,7 +130,7 @@ func (s *Schema) coreConfigSchemaAttribute() *configschema.Attribute {
 // of Resource, and will panic otherwise.
 func (s *Schema) coreConfigSchemaBlock() *configschema.NestedBlock {
         ret := &configschema.NestedBlock{}
-        if nested := s.Elem.(*Resource).CoreConfigSchema(); nested != nil {
+        if nested := s.Elem.(*Resource).coreConfigSchema(); nested != nil {
                 ret.Block = *nested
         }
         switch s.Type {
@@ -95,6 +153,20 @@ func (s *Schema) coreConfigSchemaBlock() *configschema.NestedBlock {
                 // blocks, but we can fake it by requiring at least one item.
                 ret.MinItems = 1
         }
+        if s.Optional && s.MinItems > 0 {
+                // Historically helper/schema would ignore MinItems if Optional were
+                // set, so we must mimic this behavior here to ensure that providers
+                // relying on that undocumented behavior can continue to operate as
+                // they did before.
+                ret.MinItems = 0
+        }
+        if s.Computed && !s.Optional {
+                // MinItems/MaxItems are meaningless for computed nested blocks, since
+                // they are never set by the user anyway. This ensures that we'll never
+                // generate weird errors about them.
+                ret.MinItems = 0
+                ret.MaxItems = 0
+        }
 
         return ret
 }
@@ -117,11 +189,16 @@ func (s *Schema) coreConfigSchemaType() cty.Type {
                 switch set := s.Elem.(type) {
                 case *Schema:
                         elemType = set.coreConfigSchemaType()
+                case ValueType:
+                        // This represents a mistake in the provider code, but it's a
+                        // common one so we'll just shim it.
+                        elemType = (&Schema{Type: set}).coreConfigSchemaType()
                 case *Resource:
-                        // In practice we don't actually use this for normal schema
-                        // construction because we construct a NestedBlock in that
-                        // case instead. See schemaMap.CoreConfigSchema.
-                        elemType = set.CoreConfigSchema().ImpliedType()
+                        // By default we construct a NestedBlock in this case, but this
+                        // behavior is selected either for computed-only schemas or
+                        // when ConfigMode is explicitly SchemaConfigModeBlock.
+                        // See schemaMap.CoreConfigSchema for the exact rules.
+                        elemType = set.coreConfigSchema().ImpliedType()
                 default:
                         if set != nil {
                                 // Should never happen for a valid schema
@@ -148,8 +225,85 @@ func (s *Schema) coreConfigSchemaType() cty.Type {
         }
 }
 
-// CoreConfigSchema is a convenient shortcut for calling CoreConfigSchema
-// on the resource's schema.
+// CoreConfigSchema is a convenient shortcut for calling CoreConfigSchema on
+// the resource's schema. CoreConfigSchema adds the implicitly required "id"
+// attribute for top level resources if it doesn't exist.
 func (r *Resource) CoreConfigSchema() *configschema.Block {
+        block := r.coreConfigSchema()
+
+        if block.Attributes == nil {
+                block.Attributes = map[string]*configschema.Attribute{}
+        }
+
+        // Add the implicitly required "id" field if it doesn't exist
+        if block.Attributes["id"] == nil {
+                block.Attributes["id"] = &configschema.Attribute{
+                        Type:     cty.String,
+                        Optional: true,
+                        Computed: true,
+                }
+        }
+
+        _, timeoutsAttr := block.Attributes[TimeoutsConfigKey]
+        _, timeoutsBlock := block.BlockTypes[TimeoutsConfigKey]
+
+        // Insert configured timeout values into the schema, as long as the schema
+        // didn't define anything else by that name.
+        if r.Timeouts != nil && !timeoutsAttr && !timeoutsBlock {
+                timeouts := configschema.Block{
+                        Attributes: map[string]*configschema.Attribute{},
+                }
+
+                if r.Timeouts.Create != nil {
+                        timeouts.Attributes[TimeoutCreate] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                if r.Timeouts.Read != nil {
+                        timeouts.Attributes[TimeoutRead] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                if r.Timeouts.Update != nil {
+                        timeouts.Attributes[TimeoutUpdate] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                if r.Timeouts.Delete != nil {
+                        timeouts.Attributes[TimeoutDelete] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                if r.Timeouts.Default != nil {
+                        timeouts.Attributes[TimeoutDefault] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                block.BlockTypes[TimeoutsConfigKey] = &configschema.NestedBlock{
+                        Nesting: configschema.NestingSingle,
+                        Block:   timeouts,
+                }
+        }
+
+        return block
+}
+
+func (r *Resource) coreConfigSchema() *configschema.Block {
+        return schemaMap(r.Schema).CoreConfigSchema()
+}
+
+// CoreConfigSchema is a convenient shortcut for calling CoreConfigSchema
+// on the backends's schema.
+func (r *Backend) CoreConfigSchema() *configschema.Block {
         return schemaMap(r.Schema).CoreConfigSchema()
 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
index b80b223..2a66a06 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
@@ -3,6 +3,7 @@ package schema
 import (
         "fmt"
         "strconv"
+        "strings"
 )
 
 // FieldReaders are responsible for decoding fields out of data into
@@ -41,6 +42,13 @@ func (r *FieldReadResult) ValueOrZero(s *Schema) interface{} {
         return s.ZeroValue()
 }
 
+// SchemasForFlatmapPath tries its best to find a sequence of schemas that
+// the given dot-delimited attribute path traverses through.
+func SchemasForFlatmapPath(path string, schemaMap map[string]*Schema) []*Schema {
+        parts := strings.Split(path, ".")
+        return addrToSchema(parts, schemaMap)
+}
+
 // addrToSchema finds the final element schema for the given address
 // and the given schema. It returns all the schemas that led to the final
 // schema. These are in order of the address (out to in).
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
index 55a301d..808375c 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
@@ -2,6 +2,7 @@ package schema
 
 import (
         "fmt"
+        "log"
         "strconv"
         "strings"
         "sync"
@@ -93,6 +94,22 @@ func (r *ConfigFieldReader) readField(
                 }
         }
 
+        if protoVersion5 {
+                switch schema.Type {
+                case TypeList, TypeSet, TypeMap, typeObject:
+                        // Check if the value itself is unknown.
+                        // The new protocol shims will add unknown values to this list of
+                        // ComputedKeys. This is the only way we have to indicate that a
+                        // collection is unknown in the config
+                        for _, unknown := range r.Config.ComputedKeys {
+                                if k == unknown {
+                                        log.Printf("[DEBUG] setting computed for %q from ComputedKeys", k)
+                                        return FieldReadResult{Computed: true, Exists: true}, nil
+                                }
+                        }
+                }
+        }
+
         switch schema.Type {
         case TypeBool, TypeFloat, TypeInt, TypeString:
                 return r.readPrimitive(k, schema)
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
index d558a5b..ae35b4a 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
@@ -174,6 +174,9 @@ func (r *DiffFieldReader) readPrimitive(
 
 func (r *DiffFieldReader) readSet(
         address []string, schema *Schema) (FieldReadResult, error) {
+        // copy address to ensure we don't modify the argument
+        address = append([]string(nil), address...)
+
         prefix := strings.Join(address, ".") + "."
 
         // Create the set that will be our result
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
index 054efe0..53f73b7 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
@@ -98,6 +98,9 @@ func (r *MapFieldReader) readPrimitive(
 
 func (r *MapFieldReader) readSet(
         address []string, schema *Schema) (FieldReadResult, error) {
+        // copy address to ensure we don't modify the argument
+        address = append([]string(nil), address...)
+
         // Get the number of elements in the list
         countRaw, err := r.readPrimitive(
                 append(address, "#"), &Schema{Type: TypeInt})
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
index 814c7ba..c09358b 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
@@ -297,13 +297,14 @@ func (w *MapFieldWriter) setSet(
         // we get the proper order back based on the hash code.
         if v := reflect.ValueOf(value); v.Kind() == reflect.Slice {
                 // Build a temp *ResourceData to use for the conversion
+                tempAddr := addr[len(addr)-1:]
                 tempSchema := *schema
                 tempSchema.Type = TypeList
-                tempSchemaMap := map[string]*Schema{addr[0]: &tempSchema}
+                tempSchemaMap := map[string]*Schema{tempAddr[0]: &tempSchema}
                 tempW := &MapFieldWriter{Schema: tempSchemaMap}
 
                 // Set the entire list, this lets us get sane values out of it
-                if err := tempW.WriteField(addr, value); err != nil {
+                if err := tempW.WriteField(tempAddr, value); err != nil {
                         return err
                 }
 
@@ -319,7 +320,7 @@ func (w *MapFieldWriter) setSet(
                 }
                 for i := 0; i < v.Len(); i++ {
                         is := strconv.FormatInt(int64(i), 10)
-                        result, err := tempR.ReadField(append(addrCopy, is))
+                        result, err := tempR.ReadField(append(tempAddr, is))
                         if err != nil {
                                 return err
                         }
@@ -340,6 +341,11 @@ func (w *MapFieldWriter) setSet(
         // problems when the old data isn't wiped first.
         w.clearTree(addr)
 
+        if value.(*Set) == nil {
+                w.result[k+".#"] = "0"
+                return nil
+        }
+
         for code, elem := range value.(*Set).m {
                 if err := w.set(append(addrCopy, code), elem); err != nil {
                         return err
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go b/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
index 38cd8c7..0184d7b 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
@@ -4,6 +4,18 @@ package schema
 
 import "strconv"
 
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[getSourceState-1]
+        _ = x[getSourceConfig-2]
+        _ = x[getSourceDiff-4]
+        _ = x[getSourceSet-8]
+        _ = x[getSourceExact-16]
+        _ = x[getSourceLevelMask-15]
+}
+
 const (
         _getSource_name_0 = "getSourceStategetSourceConfig"
         _getSource_name_1 = "getSourceDiff"
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/provider.go b/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
index 6cd325d..9702447 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
@@ -9,7 +9,7 @@ import (
 
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/configschema"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -64,6 +64,8 @@ type Provider struct {
         stopCtx       context.Context
         stopCtxCancel context.CancelFunc
         stopOnce      sync.Once
+
+        TerraformVersion string
 }
 
 // ConfigureFunc is the function used to configure a Provider.
@@ -251,7 +253,7 @@ func (p *Provider) Configure(c *terraform.ResourceConfig) error {
 
         // Get a ResourceData for this configuration. To do this, we actually
         // generate an intermediary "diff" although that is never exposed.
-        diff, err := sm.Diff(nil, c, nil, p.meta)
+        diff, err := sm.Diff(nil, c, nil, p.meta, true)
         if err != nil {
                 return err
         }
@@ -296,6 +298,20 @@ func (p *Provider) Diff(
         return r.Diff(s, c, p.meta)
 }
 
+// SimpleDiff is used by the new protocol wrappers to get a diff that doesn't
+// attempt to calculate ignore_changes.
+func (p *Provider) SimpleDiff(
+        info *terraform.InstanceInfo,
+        s *terraform.InstanceState,
+        c *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
+        r, ok := p.ResourcesMap[info.Type]
+        if !ok {
+                return nil, fmt.Errorf("unknown resource type: %s", info.Type)
+        }
+
+        return r.simpleDiff(s, c, p.meta)
+}
+
 // Refresh implementation of terraform.ResourceProvider interface.
 func (p *Provider) Refresh(
         info *terraform.InstanceInfo,
@@ -311,7 +327,7 @@ func (p *Provider) Refresh(
 // Resources implementation of terraform.ResourceProvider interface.
 func (p *Provider) Resources() []terraform.ResourceType {
         keys := make([]string, 0, len(p.ResourcesMap))
-        for k, _ := range p.ResourcesMap {
+        for k := range p.ResourcesMap {
                 keys = append(keys, k)
         }
         sort.Strings(keys)
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go b/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
index a8d42db..637e221 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
@@ -8,6 +8,7 @@ import (
 
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -121,6 +122,11 @@ func (p *Provisioner) Stop() error {
         return nil
 }
 
+// GetConfigSchema implementation of terraform.ResourceProvisioner interface.
+func (p *Provisioner) GetConfigSchema() (*configschema.Block, error) {
+        return schemaMap(p.Schema).CoreConfigSchema(), nil
+}
+
 // Apply implementation of terraform.ResourceProvisioner interface.
 func (p *Provisioner) Apply(
         o terraform.UIOutput,
@@ -146,7 +152,7 @@ func (p *Provisioner) Apply(
                 }
 
                 sm := schemaMap(p.ConnSchema)
-                diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil)
+                diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil, true)
                 if err != nil {
                         return err
                 }
@@ -160,7 +166,7 @@ func (p *Provisioner) Apply(
                 // Build the configuration data. Doing this requires making a "diff"
                 // even though that's never used. We use that just to get the correct types.
                 configMap := schemaMap(p.Schema)
-                diff, err := configMap.Diff(nil, c, nil, nil)
+                diff, err := configMap.Diff(nil, c, nil, nil, true)
                 if err != nil {
                         return err
                 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
index d3be2d6..b5e3065 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
@@ -8,6 +8,7 @@ import (
 
         "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/terraform"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // Resource represents a thing in Terraform that has a set of configurable
@@ -44,6 +45,12 @@ type Resource struct {
         // their Versioning at any integer >= 1
         SchemaVersion int
 
+        // MigrateState is deprecated and any new changes to a resource's schema
+        // should be handled by StateUpgraders. Existing MigrateState implementations
+        // should remain for compatibility with existing state. MigrateState will
+        // still be called if the stored SchemaVersion is less than the
+        // first version of the StateUpgraders.
+        //
         // MigrateState is responsible for updating an InstanceState with an old
         // version to the format expected by the current version of the Schema.
         //
@@ -56,6 +63,18 @@ type Resource struct {
         // needs to make any remote API calls.
         MigrateState StateMigrateFunc
 
+        // StateUpgraders contains the functions responsible for upgrading an
+        // existing state with an old schema version to a newer schema. It is
+        // called specifically by Terraform when the stored schema version is less
+        // than the current SchemaVersion of the Resource.
+        //
+        // StateUpgraders map specific schema versions to a StateUpgrader
+        // function. The registered versions are expected to be ordered,
+        // consecutive values. The initial value may be greater than 0 to account
+        // for legacy schemas that weren't recorded and can be handled by
+        // MigrateState.
+        StateUpgraders []StateUpgrader
+
         // The functions below are the CRUD operations for this resource.
         //
         // The only optional operation is Update. If Update is not implemented,
@@ -136,6 +155,27 @@ type Resource struct {
         Timeouts *ResourceTimeout
 }
 
+// ShimInstanceStateFromValue converts a cty.Value to a
+// terraform.InstanceState.
+func (r *Resource) ShimInstanceStateFromValue(state cty.Value) (*terraform.InstanceState, error) {
+        // Get the raw shimmed value. While this is correct, the set hashes don't
+        // match those from the Schema.
+        s := terraform.NewInstanceStateShimmedFromValue(state, r.SchemaVersion)
+
+        // We now rebuild the state through the ResourceData, so that the set indexes
+        // match what helper/schema expects.
+        data, err := schemaMap(r.Schema).Data(s, nil)
+        if err != nil {
+                return nil, err
+        }
+
+        s = data.State()
+        if s == nil {
+                s = &terraform.InstanceState{}
+        }
+        return s, nil
+}
+
 // See Resource documentation.
 type CreateFunc func(*ResourceData, interface{}) error
 
@@ -155,6 +195,27 @@ type ExistsFunc func(*ResourceData, interface{}) (bool, error)
 type StateMigrateFunc func(
         int, *terraform.InstanceState, interface{}) (*terraform.InstanceState, error)
 
+type StateUpgrader struct {
+        // Version is the version schema that this Upgrader will handle, converting
+        // it to Version+1.
+        Version int
+
+        // Type describes the schema that this function can upgrade. Type is
+        // required to decode the schema if the state was stored in a legacy
+        // flatmap format.
+        Type cty.Type
+
+        // Upgrade takes the JSON encoded state and the provider meta value, and
+        // upgrades the state one single schema version. The provided state is
+        // deocded into the default json types using a map[string]interface{}. It
+        // is up to the StateUpgradeFunc to ensure that the returned value can be
+        // encoded using the new schema.
+        Upgrade StateUpgradeFunc
+}
+
+// See StateUpgrader
+type StateUpgradeFunc func(rawState map[string]interface{}, meta interface{}) (map[string]interface{}, error)
+
 // See Resource documentation.
 type CustomizeDiffFunc func(*ResourceDiff, interface{}) error
 
@@ -247,7 +308,7 @@ func (r *Resource) Diff(
                 return nil, fmt.Errorf("[ERR] Error decoding timeout: %s", err)
         }
 
-        instanceDiff, err := schemaMap(r.Schema).Diff(s, c, r.CustomizeDiff, meta)
+        instanceDiff, err := schemaMap(r.Schema).Diff(s, c, r.CustomizeDiff, meta, true)
         if err != nil {
                 return instanceDiff, err
         }
@@ -263,6 +324,45 @@ func (r *Resource) Diff(
         return instanceDiff, err
 }
 
+func (r *Resource) simpleDiff(
+        s *terraform.InstanceState,
+        c *terraform.ResourceConfig,
+        meta interface{}) (*terraform.InstanceDiff, error) {
+
+        t := &ResourceTimeout{}
+        err := t.ConfigDecode(r, c)
+
+        if err != nil {
+                return nil, fmt.Errorf("[ERR] Error decoding timeout: %s", err)
+        }
+
+        instanceDiff, err := schemaMap(r.Schema).Diff(s, c, r.CustomizeDiff, meta, false)
+        if err != nil {
+                return instanceDiff, err
+        }
+
+        if instanceDiff == nil {
+                log.Printf("[DEBUG] Instance Diff is nil in SimpleDiff()")
+                return nil, err
+        }
+
+        // Make sure the old value is set in each of the instance diffs.
+        // This was done by the RequiresNew logic in the full legacy Diff.
+        for k, attr := range instanceDiff.Attributes {
+                if attr == nil {
+                        continue
+                }
+                if s != nil {
+                        attr.Old = s.Attributes[k]
+                }
+        }
+
+        if err := t.DiffEncode(instanceDiff); err != nil {
+                log.Printf("[ERR] Error encoding timeout to instance diff: %s", err)
+        }
+        return instanceDiff, err
+}
+
 // Validate validates the resource configuration against the schema.
 func (r *Resource) Validate(c *terraform.ResourceConfig) ([]string, []error) {
         warns, errs := schemaMap(r.Schema).Validate(c)
@@ -300,8 +400,11 @@ func (r *Resource) ReadDataApply(
         return r.recordCurrentSchemaVersion(state), err
 }
 
-// Refresh refreshes the state of the resource.
-func (r *Resource) Refresh(
+// RefreshWithoutUpgrade reads the instance state, but does not call
+// MigrateState or the StateUpgraders, since those are now invoked in a
+// separate API call.
+// RefreshWithoutUpgrade is part of the new plugin shims.
+func (r *Resource) RefreshWithoutUpgrade(
         s *terraform.InstanceState,
         meta interface{}) (*terraform.InstanceState, error) {
         // If the ID is already somehow blank, it doesn't exist
@@ -335,12 +438,60 @@ func (r *Resource) Refresh(
                 }
         }
 
-        needsMigration, stateSchemaVersion := r.checkSchemaVersion(s)
-        if needsMigration && r.MigrateState != nil {
-                s, err := r.MigrateState(stateSchemaVersion, s, meta)
+        data, err := schemaMap(r.Schema).Data(s, nil)
+        data.timeouts = &rt
+        if err != nil {
+                return s, err
+        }
+
+        err = r.Read(data, meta)
+        state := data.State()
+        if state != nil && state.ID == "" {
+                state = nil
+        }
+
+        return r.recordCurrentSchemaVersion(state), err
+}
+
+// Refresh refreshes the state of the resource.
+func (r *Resource) Refresh(
+        s *terraform.InstanceState,
+        meta interface{}) (*terraform.InstanceState, error) {
+        // If the ID is already somehow blank, it doesn't exist
+        if s.ID == "" {
+                return nil, nil
+        }
+
+        rt := ResourceTimeout{}
+        if _, ok := s.Meta[TimeoutKey]; ok {
+                if err := rt.StateDecode(s); err != nil {
+                        log.Printf("[ERR] Error decoding ResourceTimeout: %s", err)
+                }
+        }
+
+        if r.Exists != nil {
+                // Make a copy of data so that if it is modified it doesn't
+                // affect our Read later.
+                data, err := schemaMap(r.Schema).Data(s, nil)
+                data.timeouts = &rt
+
                 if err != nil {
                         return s, err
                 }
+
+                exists, err := r.Exists(data, meta)
+                if err != nil {
+                        return s, err
+                }
+                if !exists {
+                        return nil, nil
+                }
+        }
+
+        // there may be new StateUpgraders that need to be run
+        s, err := r.upgradeState(s, meta)
+        if err != nil {
+                return s, err
         }
 
         data, err := schemaMap(r.Schema).Data(s, nil)
@@ -358,6 +509,71 @@ func (r *Resource) Refresh(
         return r.recordCurrentSchemaVersion(state), err
 }
 
+func (r *Resource) upgradeState(s *terraform.InstanceState, meta interface{}) (*terraform.InstanceState, error) {
+        var err error
+
+        needsMigration, stateSchemaVersion := r.checkSchemaVersion(s)
+        migrate := needsMigration && r.MigrateState != nil
+
+        if migrate {
+                s, err = r.MigrateState(stateSchemaVersion, s, meta)
+                if err != nil {
+                        return s, err
+                }
+        }
+
+        if len(r.StateUpgraders) == 0 {
+                return s, nil
+        }
+
+        // If we ran MigrateState, then the stateSchemaVersion value is no longer
+        // correct. We can expect the first upgrade function to be the correct
+        // schema type version.
+        if migrate {
+                stateSchemaVersion = r.StateUpgraders[0].Version
+        }
+
+        schemaType := r.CoreConfigSchema().ImpliedType()
+        // find the expected type to convert the state
+        for _, upgrader := range r.StateUpgraders {
+                if stateSchemaVersion == upgrader.Version {
+                        schemaType = upgrader.Type
+                }
+        }
+
+        // StateUpgraders only operate on the new JSON format state, so the state
+        // need to be converted.
+        stateVal, err := StateValueFromInstanceState(s, schemaType)
+        if err != nil {
+                return nil, err
+        }
+
+        jsonState, err := StateValueToJSONMap(stateVal, schemaType)
+        if err != nil {
+                return nil, err
+        }
+
+        for _, upgrader := range r.StateUpgraders {
+                if stateSchemaVersion != upgrader.Version {
+                        continue
+                }
+
+                jsonState, err = upgrader.Upgrade(jsonState, meta)
+                if err != nil {
+                        return nil, err
+                }
+                stateSchemaVersion++
+        }
+
+        // now we need to re-flatmap the new state
+        stateVal, err = JSONMapToStateValue(jsonState, r.CoreConfigSchema())
+        if err != nil {
+                return nil, err
+        }
+
+        return r.ShimInstanceStateFromValue(stateVal)
+}
+
 // InternalValidate should be called to validate the structure
 // of the resource.
 //
@@ -437,6 +653,31 @@ func (r *Resource) InternalValidate(topSchemaMap schemaMap, writable bool) error
                 }
         }
 
+        lastVersion := -1
+        for _, u := range r.StateUpgraders {
+                if lastVersion >= 0 && u.Version-lastVersion > 1 {
+                        return fmt.Errorf("missing schema version between %d and %d", lastVersion, u.Version)
+                }
+
+                if u.Version >= r.SchemaVersion {
+                        return fmt.Errorf("StateUpgrader version %d is >= current version %d", u.Version, r.SchemaVersion)
+                }
+
+                if !u.Type.IsObjectType() {
+                        return fmt.Errorf("StateUpgrader %d type is not cty.Object", u.Version)
+                }
+
+                if u.Upgrade == nil {
+                        return fmt.Errorf("StateUpgrader %d missing StateUpgradeFunc", u.Version)
+                }
+
+                lastVersion = u.Version
+        }
+
+        if lastVersion >= 0 && lastVersion != r.SchemaVersion-1 {
+                return fmt.Errorf("missing StateUpgrader between %d and %d", lastVersion, r.SchemaVersion)
+        }
+
         // Data source
         if r.isTopLevel() && !writable {
                 tsm = schemaMap(r.Schema)
@@ -513,6 +754,13 @@ func (r *Resource) TestResourceData() *ResourceData {
         }
 }
 
+// SchemasForFlatmapPath tries its best to find a sequence of schemas that
+// the given dot-delimited attribute path traverses through in the schema
+// of the receiving Resource.
+func (r *Resource) SchemasForFlatmapPath(path string) []*Schema {
+        return SchemasForFlatmapPath(path, r.Schema)
+}
+
 // Returns true if the resource is "top level" i.e. not a sub-resource.
 func (r *Resource) isTopLevel() bool {
         // TODO: This is a heuristic; replace with a definitive attribute?
@@ -538,7 +786,15 @@ func (r *Resource) checkSchemaVersion(is *terraform.InstanceState) (bool, int) {
         }
 
         stateSchemaVersion, _ := strconv.Atoi(rawString)
-        return stateSchemaVersion < r.SchemaVersion, stateSchemaVersion
+
+        // Don't run MigrateState if the version is handled by a StateUpgrader,
+        // since StateMigrateFuncs are not required to handle unknown versions
+        maxVersion := r.SchemaVersion
+        if len(r.StateUpgraders) > 0 {
+                maxVersion = r.StateUpgraders[0].Version
+        }
+
+        return stateSchemaVersion < maxVersion, stateSchemaVersion
 }
 
 func (r *Resource) recordCurrentSchemaVersion(
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
index 6cc01ee..1c39070 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
@@ -52,6 +52,8 @@ type getResult struct {
 // UnsafeSetFieldRaw allows setting arbitrary values in state to arbitrary
 // values, bypassing schema. This MUST NOT be used in normal circumstances -
 // it exists only to support the remote_state data source.
+//
+// Deprecated: Fully define schema attributes and use Set() instead.
 func (d *ResourceData) UnsafeSetFieldRaw(key string, value string) {
         d.once.Do(d.init)
 
@@ -219,10 +221,16 @@ func (d *ResourceData) Id() string {
 
         if d.state != nil {
                 result = d.state.ID
+                if result == "" {
+                        result = d.state.Attributes["id"]
+                }
         }
 
         if d.newState != nil {
                 result = d.newState.ID
+                if result == "" {
+                        result = d.newState.Attributes["id"]
+                }
         }
 
         return result
@@ -246,6 +254,18 @@ func (d *ResourceData) ConnInfo() map[string]string {
 func (d *ResourceData) SetId(v string) {
         d.once.Do(d.init)
         d.newState.ID = v
+
+        // once we transition away from the legacy state types, "id" will no longer
+        // be a special field, and will become a normal attribute.
+        // set the attribute normally
+        d.setWriter.unsafeWriteField("id", v)
+
+        // Make sure the newState is also set, otherwise the old value
+        // may get precedence.
+        if d.newState.Attributes == nil {
+                d.newState.Attributes = map[string]string{}
+        }
+        d.newState.Attributes["id"] = v
 }
 
 // SetConnInfo sets the connection info for a resource.
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
index 7db3dec..47b5481 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
@@ -367,7 +367,7 @@ func (d *ResourceDiff) Get(key string) interface{} {
 }
 
 // GetChange gets the change between the state and diff, checking first to see
-// if a overridden diff exists.
+// if an overridden diff exists.
 //
 // This implementation differs from ResourceData's in the way that we first get
 // results from the exact levels for the new diff, then from state and diff as
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go
index 445819f..9e422c1 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go
@@ -5,6 +5,7 @@ import (
         "log"
         "time"
 
+        "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/terraform"
         "github.com/mitchellh/copystructure"
 )
@@ -62,55 +63,70 @@ func (t *ResourceTimeout) ConfigDecode(s *Resource, c *terraform.ResourceConfig)
         }
 
         if raw, ok := c.Config[TimeoutsConfigKey]; ok {
-                if configTimeouts, ok := raw.([]map[string]interface{}); ok {
-                        for _, timeoutValues := range configTimeouts {
-                                // loop through each Timeout given in the configuration and validate they
-                                // the Timeout defined in the resource
-                                for timeKey, timeValue := range timeoutValues {
-                                        // validate that we're dealing with the normal CRUD actions
-                                        var found bool
-                                        for _, key := range timeoutKeys() {
-                                                if timeKey == key {
-                                                        found = true
-                                                        break
-                                                }
-                                        }
+                var rawTimeouts []map[string]interface{}
+                switch raw := raw.(type) {
+                case map[string]interface{}:
+                        rawTimeouts = append(rawTimeouts, raw)
+                case []map[string]interface{}:
+                        rawTimeouts = raw
+                case string:
+                        if raw == config.UnknownVariableValue {
+                                // Timeout is not defined in the config
+                                // Defaults will be used instead
+                                return nil
+                        } else {
+                                log.Printf("[ERROR] Invalid timeout value: %q", raw)
+                                return fmt.Errorf("Invalid Timeout value found")
+                        }
+                default:
+                        log.Printf("[ERROR] Invalid timeout structure: %#v", raw)
+                        return fmt.Errorf("Invalid Timeout structure found")
+                }
 
-                                        if !found {
-                                                return fmt.Errorf("Unsupported Timeout configuration key found (%s)", timeKey)
+                for _, timeoutValues := range rawTimeouts {
+                        for timeKey, timeValue := range timeoutValues {
+                                // validate that we're dealing with the normal CRUD actions
+                                var found bool
+                                for _, key := range timeoutKeys() {
+                                        if timeKey == key {
+                                                found = true
+                                                break
                                         }
+                                }
 
-                                        // Get timeout
-                                        rt, err := time.ParseDuration(timeValue.(string))
-                                        if err != nil {
-                                                return fmt.Errorf("Error parsing Timeout for (%s): %s", timeKey, err)
-                                        }
+                                if !found {
+                                        return fmt.Errorf("Unsupported Timeout configuration key found (%s)", timeKey)
+                                }
 
-                                        var timeout *time.Duration
-                                        switch timeKey {
-                                        case TimeoutCreate:
-                                                timeout = t.Create
-                                        case TimeoutUpdate:
-                                                timeout = t.Update
-                                        case TimeoutRead:
-                                                timeout = t.Read
-                                        case TimeoutDelete:
-                                                timeout = t.Delete
-                                        case TimeoutDefault:
-                                                timeout = t.Default
-                                        }
+                                // Get timeout
+                                rt, err := time.ParseDuration(timeValue.(string))
+                                if err != nil {
+                                        return fmt.Errorf("Error parsing %q timeout: %s", timeKey, err)
+                                }
 
-                                        // If the resource has not delcared this in the definition, then error
-                                        // with an unsupported message
-                                        if timeout == nil {
-                                                return unsupportedTimeoutKeyError(timeKey)
-                                        }
+                                var timeout *time.Duration
+                                switch timeKey {
+                                case TimeoutCreate:
+                                        timeout = t.Create
+                                case TimeoutUpdate:
+                                        timeout = t.Update
+                                case TimeoutRead:
+                                        timeout = t.Read
+                                case TimeoutDelete:
+                                        timeout = t.Delete
+                                case TimeoutDefault:
+                                        timeout = t.Default
+                                }
 
-                                        *timeout = rt
+                                // If the resource has not delcared this in the definition, then error
+                                // with an unsupported message
+                                if timeout == nil {
+                                        return unsupportedTimeoutKeyError(timeKey)
                                 }
+
+                                *timeout = rt
                         }
-                } else {
-                        log.Printf("[WARN] Invalid Timeout structure found, skipping timeouts")
+                        return nil
                 }
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
index 0ea5aad..6a3c15a 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
@@ -12,6 +12,7 @@
 package schema
 
 import (
+        "context"
         "fmt"
         "os"
         "reflect"
@@ -19,7 +20,9 @@ import (
         "sort"
         "strconv"
         "strings"
+        "sync"
 
+        "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/terraform"
         "github.com/mitchellh/copystructure"
         "github.com/mitchellh/mapstructure"
@@ -31,6 +34,27 @@ const PanicOnErr = "TF_SCHEMA_PANIC_ON_ERROR"
 // type used for schema package context keys
 type contextKey string
 
+var (
+        protoVersionMu sync.Mutex
+        protoVersion5  = false
+)
+
+func isProto5() bool {
+        protoVersionMu.Lock()
+        defer protoVersionMu.Unlock()
+        return protoVersion5
+
+}
+
+// SetProto5 enables a feature flag for any internal changes required required
+// to work with the new plugin protocol.  This should not be called by
+// provider.
+func SetProto5() {
+        protoVersionMu.Lock()
+        defer protoVersionMu.Unlock()
+        protoVersion5 = true
+}
+
 // Schema is used to describe the structure of a value.
 //
 // Read the documentation of the struct elements for important details.
@@ -51,6 +75,26 @@ type Schema struct {
         //
         Type ValueType
 
+        // ConfigMode allows for overriding the default behaviors for mapping
+        // schema entries onto configuration constructs.
+        //
+        // By default, the Elem field is used to choose whether a particular
+        // schema is represented in configuration as an attribute or as a nested
+        // block; if Elem is a *schema.Resource then it's a block and it's an
+        // attribute otherwise.
+        //
+        // If Elem is *schema.Resource then setting ConfigMode to
+        // SchemaConfigModeAttr will force it to be represented in configuration
+        // as an attribute, which means that the Computed flag can be used to
+        // provide default elements when the argument isn't set at all, while still
+        // allowing the user to force zero elements by explicitly assigning an
+        // empty list.
+        //
+        // When Computed is set without Optional, the attribute is not settable
+        // in configuration at all and so SchemaConfigModeAttr is the automatic
+        // behavior, and SchemaConfigModeBlock is not permitted.
+        ConfigMode SchemaConfigMode
+
         // If one of these is set, then this item can come from the configuration.
         // Both cannot be set. If Optional is set, the value is optional. If
         // Required is set, the value is required.
@@ -123,7 +167,8 @@ type Schema struct {
         // The following fields are only set for a TypeList, TypeSet, or TypeMap.
         //
         // Elem represents the element type. For a TypeMap, it must be a *Schema
-        // with a Type of TypeString, otherwise it may be either a *Schema or a
+        // with a Type that is one of the primitives: TypeString, TypeBool,
+        // TypeInt, or TypeFloat. Otherwise it may be either a *Schema or a
         // *Resource. If it is *Schema, the element type is just a simple value.
         // If it is *Resource, the element type is a complex structure,
         // potentially with its own lifecycle.
@@ -141,13 +186,17 @@ type Schema struct {
         // used to wrap a complex structure, however less than one instance would
         // cause instability.
         //
-        // PromoteSingle, if true, will allow single elements to be standalone
-        // and promote them to a list. For example "foo" would be promoted to
-        // ["foo"] automatically. This is primarily for legacy reasons and the
-        // ambiguity is not recommended for new usage. Promotion is only allowed
-        // for primitive element types.
-        MaxItems      int
-        MinItems      int
+        // If the field Optional is set to true then MinItems is ignored and thus
+        // effectively zero.
+        MaxItems int
+        MinItems int
+
+        // PromoteSingle originally allowed for a single element to be assigned
+        // where a primitive list was expected, but this no longer works from
+        // Terraform v0.12 onwards (Terraform Core will require a list to be set
+        // regardless of what this is set to) and so only applies to Terraform v0.11
+        // and earlier, and so should be used only to retain this functionality
+        // for those still using v0.11 with a provider that formerly used this.
         PromoteSingle bool
 
         // The following fields are only valid for a TypeSet type.
@@ -189,7 +238,8 @@ type Schema struct {
         // guaranteed to be of the proper Schema type, and it can yield warnings or
         // errors based on inspection of that value.
         //
-        // ValidateFunc currently only works for primitive types.
+        // ValidateFunc is honored only when the schema's Type is set to TypeInt,
+        // TypeFloat, TypeString, TypeBool, or TypeMap. It is ignored for all other types.
         ValidateFunc SchemaValidateFunc
 
         // Sensitive ensures that the attribute's value does not get displayed in
@@ -199,6 +249,17 @@ type Schema struct {
         Sensitive bool
 }
 
+// SchemaConfigMode is used to influence how a schema item is mapped into a
+// corresponding configuration construct, using the ConfigMode field of
+// Schema.
+type SchemaConfigMode int
+
+const (
+        SchemaConfigModeAuto SchemaConfigMode = iota
+        SchemaConfigModeAttr
+        SchemaConfigModeBlock
+)
+
 // SchemaDiffSuppressFunc is a function which can be used to determine
 // whether a detected diff on a schema element is "valid" or not, and
 // suppress it from the plan if necessary.
@@ -364,6 +425,11 @@ func (s *Schema) finalizeDiff(d *terraform.ResourceAttrDiff, customized bool) *t
         return d
 }
 
+// InternalMap is used to aid in the transition to the new schema types and
+// protocol. The name is not meant to convey any usefulness, as this is not to
+// be used directly by any providers.
+type InternalMap = schemaMap
+
 // schemaMap is a wrapper that adds nice functions on top of schemas.
 type schemaMap map[string]*Schema
 
@@ -404,7 +470,8 @@ func (m schemaMap) Diff(
         s *terraform.InstanceState,
         c *terraform.ResourceConfig,
         customizeDiff CustomizeDiffFunc,
-        meta interface{}) (*terraform.InstanceDiff, error) {
+        meta interface{},
+        handleRequiresNew bool) (*terraform.InstanceDiff, error) {
         result := new(terraform.InstanceDiff)
         result.Attributes = make(map[string]*terraform.ResourceAttrDiff)
 
@@ -450,82 +517,85 @@ func (m schemaMap) Diff(
                 }
         }
 
-        // If the diff requires a new resource, then we recompute the diff
-        // so we have the complete new resource diff, and preserve the
-        // RequiresNew fields where necessary so the user knows exactly what
-        // caused that.
-        if result.RequiresNew() {
-                // Create the new diff
-                result2 := new(terraform.InstanceDiff)
-                result2.Attributes = make(map[string]*terraform.ResourceAttrDiff)
-
-                // Preserve the DestroyTainted flag
-                result2.DestroyTainted = result.DestroyTainted
+        if handleRequiresNew {
+                // If the diff requires a new resource, then we recompute the diff
+                // so we have the complete new resource diff, and preserve the
+                // RequiresNew fields where necessary so the user knows exactly what
+                // caused that.
+                if result.RequiresNew() {
+                        // Create the new diff
+                        result2 := new(terraform.InstanceDiff)
+                        result2.Attributes = make(map[string]*terraform.ResourceAttrDiff)
 
-                // Reset the data to not contain state. We have to call init()
-                // again in order to reset the FieldReaders.
-                d.state = nil
-                d.init()
+                        // Preserve the DestroyTainted flag
+                        result2.DestroyTainted = result.DestroyTainted
 
-                // Perform the diff again
-                for k, schema := range m {
-                        err := m.diff(k, schema, result2, d, false)
-                        if err != nil {
-                                return nil, err
-                        }
-                }
+                        // Reset the data to not contain state. We have to call init()
+                        // again in order to reset the FieldReaders.
+                        d.state = nil
+                        d.init()
 
-                // Re-run customization
-                if !result2.DestroyTainted && customizeDiff != nil {
-                        mc := m.DeepCopy()
-                        rd := newResourceDiff(mc, c, d.state, result2)
-                        if err := customizeDiff(rd, meta); err != nil {
-                                return nil, err
-                        }
-                        for _, k := range rd.UpdatedKeys() {
-                                err := m.diff(k, mc[k], result2, rd, false)
+                        // Perform the diff again
+                        for k, schema := range m {
+                                err := m.diff(k, schema, result2, d, false)
                                 if err != nil {
                                         return nil, err
                                 }
                         }
-                }
 
-                // Force all the fields to not force a new since we know what we
-                // want to force new.
-                for k, attr := range result2.Attributes {
-                        if attr == nil {
-                                continue
+                        // Re-run customization
+                        if !result2.DestroyTainted && customizeDiff != nil {
+                                mc := m.DeepCopy()
+                                rd := newResourceDiff(mc, c, d.state, result2)
+                                if err := customizeDiff(rd, meta); err != nil {
+                                        return nil, err
+                                }
+                                for _, k := range rd.UpdatedKeys() {
+                                        err := m.diff(k, mc[k], result2, rd, false)
+                                        if err != nil {
+                                                return nil, err
+                                        }
+                                }
                         }
 
-                        if attr.RequiresNew {
-                                attr.RequiresNew = false
-                        }
+                        // Force all the fields to not force a new since we know what we
+                        // want to force new.
+                        for k, attr := range result2.Attributes {
+                                if attr == nil {
+                                        continue
+                                }
 
-                        if s != nil {
-                                attr.Old = s.Attributes[k]
-                        }
-                }
+                                if attr.RequiresNew {
+                                        attr.RequiresNew = false
+                                }
 
-                // Now copy in all the requires new diffs...
-                for k, attr := range result.Attributes {
-                        if attr == nil {
-                                continue
+                                if s != nil {
+                                        attr.Old = s.Attributes[k]
+                                }
                         }
 
-                        newAttr, ok := result2.Attributes[k]
-                        if !ok {
-                                newAttr = attr
-                        }
+                        // Now copy in all the requires new diffs...
+                        for k, attr := range result.Attributes {
+                                if attr == nil {
+                                        continue
+                                }
 
-                        if attr.RequiresNew {
-                                newAttr.RequiresNew = true
+                                newAttr, ok := result2.Attributes[k]
+                                if !ok {
+                                        newAttr = attr
+                                }
+
+                                if attr.RequiresNew {
+                                        newAttr.RequiresNew = true
+                                }
+
+                                result2.Attributes[k] = newAttr
                         }
 
-                        result2.Attributes[k] = newAttr
+                        // And set the diff!
+                        result = result2
                 }
 
-                // And set the diff!
-                result = result2
         }
 
         // Go through and detect all of the ComputedWhens now that we've
@@ -611,6 +681,10 @@ func (m schemaMap) Validate(c *terraform.ResourceConfig) ([]string, []error) {
 // from a unit test (and not in user-path code) to verify that a schema
 // is properly built.
 func (m schemaMap) InternalValidate(topSchemaMap schemaMap) error {
+        return m.internalValidate(topSchemaMap, false)
+}
+
+func (m schemaMap) internalValidate(topSchemaMap schemaMap, attrsOnly bool) error {
         if topSchemaMap == nil {
                 topSchemaMap = m
         }
@@ -631,6 +705,34 @@ func (m schemaMap) InternalValidate(topSchemaMap schemaMap) error {
                         return fmt.Errorf("%s: One of optional, required, or computed must be set", k)
                 }
 
+                computedOnly := v.Computed && !v.Optional
+
+                switch v.ConfigMode {
+                case SchemaConfigModeBlock:
+                        if _, ok := v.Elem.(*Resource); !ok {
+                                return fmt.Errorf("%s: ConfigMode of block is allowed only when Elem is *schema.Resource", k)
+                        }
+                        if attrsOnly {
+                                return fmt.Errorf("%s: ConfigMode of block cannot be used in child of schema with ConfigMode of attribute", k)
+                        }
+                        if computedOnly {
+                                return fmt.Errorf("%s: ConfigMode of block cannot be used for computed schema", k)
+                        }
+                case SchemaConfigModeAttr:
+                        // anything goes
+                case SchemaConfigModeAuto:
+                        // Since "Auto" for Elem: *Resource would create a nested block,
+                        // and that's impossible inside an attribute, we require it to be
+                        // explicitly overridden as mode "Attr" for clarity.
+                        if _, ok := v.Elem.(*Resource); ok {
+                                if attrsOnly {
+                                        return fmt.Errorf("%s: in *schema.Resource with ConfigMode of attribute, so must also have ConfigMode of attribute", k)
+                                }
+                        }
+                default:
+                        return fmt.Errorf("%s: invalid ConfigMode value", k)
+                }
+
                 if v.Computed && v.Default != nil {
                         return fmt.Errorf("%s: Default must be nil if computed", k)
                 }
@@ -695,7 +797,9 @@ func (m schemaMap) InternalValidate(topSchemaMap schemaMap) error {
 
                         switch t := v.Elem.(type) {
                         case *Resource:
-                                if err := t.InternalValidate(topSchemaMap, true); err != nil {
+                                attrsOnly := attrsOnly || v.ConfigMode == SchemaConfigModeAttr
+
+                                if err := schemaMap(t.Schema).internalValidate(topSchemaMap, attrsOnly); err != nil {
                                         return err
                                 }
                         case *Schema:
@@ -785,10 +889,19 @@ func (m schemaMap) diff(
         for attrK, attrV := range unsupressedDiff.Attributes {
                 switch rd := d.(type) {
                 case *ResourceData:
-                        if schema.DiffSuppressFunc != nil &&
-                                attrV != nil &&
+                        if schema.DiffSuppressFunc != nil && attrV != nil &&
                                 schema.DiffSuppressFunc(attrK, attrV.Old, attrV.New, rd) {
-                                continue
+                                // If this attr diff is suppressed, we may still need it in the
+                                // overall diff if it's contained within a set. Rather than
+                                // dropping the diff, make it a NOOP.
+                                if !all {
+                                        continue
+                                }
+
+                                attrV = &terraform.ResourceAttrDiff{
+                                        Old: attrV.Old,
+                                        New: attrV.Old,
+                                }
                         }
                 }
                 diff.Attributes[attrK] = attrV
@@ -1171,7 +1284,7 @@ func (m schemaMap) diffString(
                 return fmt.Errorf("%s: %s", k, err)
         }
 
-        if os == ns && !all {
+        if os == ns && !all && !computed {
                 // They're the same value. If there old value is not blank or we
                 // have an ID, then return right away since we're already setup.
                 if os != "" || d.Id() != "" {
@@ -1179,7 +1292,7 @@ func (m schemaMap) diffString(
                 }
 
                 // Otherwise, only continue if we're computed
-                if !schema.Computed && !computed {
+                if !schema.Computed {
                         return nil
                 }
         }
@@ -1210,7 +1323,7 @@ func (m schemaMap) inputString(
         input terraform.UIInput,
         k string,
         schema *Schema) (interface{}, error) {
-        result, err := input.Input(&terraform.InputOpts{
+        result, err := input.Input(context.Background(), &terraform.InputOpts{
                 Id:          k,
                 Query:       k,
                 Description: schema.Description,
@@ -1252,6 +1365,13 @@ func (m schemaMap) validate(
                         "%q: this field cannot be set", k)}
         }
 
+        if raw == config.UnknownVariableValue {
+                // If the value is unknown then we can't validate it yet.
+                // In particular, this avoids spurious type errors where downstream
+                // validation code sees UnknownVariableValue as being just a string.
+                return nil, nil
+        }
+
         err := m.validateConflictingAttributes(k, schema, c)
         if err != nil {
                 return nil, []error{err}
@@ -1269,10 +1389,15 @@ func (m schemaMap) validateConflictingAttributes(
                 return nil
         }
 
-        for _, conflicting_key := range schema.ConflictsWith {
-                if _, ok := c.Get(conflicting_key); ok {
+        for _, conflictingKey := range schema.ConflictsWith {
+                if raw, ok := c.Get(conflictingKey); ok {
+                        if raw == config.UnknownVariableValue {
+                                // An unknown value might become unset (null) once known, so
+                                // we must defer validation until it's known.
+                                continue
+                        }
                         return fmt.Errorf(
-                                "%q: conflicts with %s", k, conflicting_key)
+                                "%q: conflicts with %s", k, conflictingKey)
                 }
         }
 
@@ -1284,6 +1409,13 @@ func (m schemaMap) validateList(
         raw interface{},
         schema *Schema,
         c *terraform.ResourceConfig) ([]string, []error) {
+        // first check if the list is wholly unknown
+        if s, ok := raw.(string); ok {
+                if s == config.UnknownVariableValue {
+                        return nil, nil
+                }
+        }
+
         // We use reflection to verify the slice because you can't
         // case to []interface{} unless the slice is exactly that type.
         rawV := reflect.ValueOf(raw)
@@ -1355,6 +1487,13 @@ func (m schemaMap) validateMap(
         raw interface{},
         schema *Schema,
         c *terraform.ResourceConfig) ([]string, []error) {
+        // first check if the list is wholly unknown
+        if s, ok := raw.(string); ok {
+                if s == config.UnknownVariableValue {
+                        return nil, nil
+                }
+        }
+
         // We use reflection to verify the slice because you can't
         // case to []interface{} unless the slice is exactly that type.
         rawV := reflect.ValueOf(raw)
@@ -1556,12 +1695,25 @@ func (m schemaMap) validatePrimitive(
                 }
                 decoded = n
         case TypeInt:
-                // Verify that we can parse this as an int
-                var n int
-                if err := mapstructure.WeakDecode(raw, &n); err != nil {
-                        return nil, []error{fmt.Errorf("%s: %s", k, err)}
+                switch {
+                case isProto5():
+                        // We need to verify the type precisely, because WeakDecode will
+                        // decode a float as an integer.
+
+                        // the config shims only use int for integral number values
+                        if v, ok := raw.(int); ok {
+                                decoded = v
+                        } else {
+                                return nil, []error{fmt.Errorf("%s: must be a whole number, got %v", k, raw)}
+                        }
+                default:
+                        // Verify that we can parse this as an int
+                        var n int
+                        if err := mapstructure.WeakDecode(raw, &n); err != nil {
+                                return nil, []error{fmt.Errorf("%s: %s", k, err)}
+                        }
+                        decoded = n
                 }
-                decoded = n
         case TypeFloat:
                 // Verify that we can parse this as an int
                 var n float64
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/set.go b/vendor/github.com/hashicorp/terraform/helper/schema/set.go
index cba2890..8ee89e4 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/set.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/set.go
@@ -198,6 +198,16 @@ func (s *Set) add(item interface{}, computed bool) string {
         code := s.hash(item)
         if computed {
                 code = "~" + code
+
+                if isProto5() {
+                        tmpCode := code
+                        count := 0
+                        for _, exists := s.m[tmpCode]; exists; _, exists = s.m[tmpCode] {
+                                count++
+                                tmpCode = fmt.Sprintf("%s%d", code, count)
+                        }
+                        code = tmpCode
+                }
         }
 
         if _, ok := s.m[code]; !ok {
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/shims.go b/vendor/github.com/hashicorp/terraform/helper/schema/shims.go
new file mode 100644
index 0000000..203d017
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/shims.go
@@ -0,0 +1,115 @@
+package schema
+
+import (
+        "encoding/json"
+
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/terraform"
+)
+
+// DiffFromValues takes the current state and desired state as cty.Values and
+// derives a terraform.InstanceDiff to give to the legacy providers. This is
+// used to take the states provided by the new ApplyResourceChange method and
+// convert them to a state+diff required for the legacy Apply method.
+func DiffFromValues(prior, planned cty.Value, res *Resource) (*terraform.InstanceDiff, error) {
+        return diffFromValues(prior, planned, res, nil)
+}
+
+// diffFromValues takes an additional CustomizeDiffFunc, so we can generate our
+// test fixtures from the legacy tests. In the new provider protocol the diff
+// only needs to be created for the apply operation, and any customizations
+// have already been done.
+func diffFromValues(prior, planned cty.Value, res *Resource, cust CustomizeDiffFunc) (*terraform.InstanceDiff, error) {
+        instanceState, err := res.ShimInstanceStateFromValue(prior)
+        if err != nil {
+                return nil, err
+        }
+
+        configSchema := res.CoreConfigSchema()
+
+        cfg := terraform.NewResourceConfigShimmed(planned, configSchema)
+        removeConfigUnknowns(cfg.Config)
+        removeConfigUnknowns(cfg.Raw)
+
+        diff, err := schemaMap(res.Schema).Diff(instanceState, cfg, cust, nil, false)
+        if err != nil {
+                return nil, err
+        }
+
+        return diff, err
+}
+
+// During apply the only unknown values are those which are to be computed by
+// the resource itself. These may have been marked as unknown config values, and
+// need to be removed to prevent the UnknownVariableValue from appearing the diff.
+func removeConfigUnknowns(cfg map[string]interface{}) {
+        for k, v := range cfg {
+                switch v := v.(type) {
+                case string:
+                        if v == config.UnknownVariableValue {
+                                delete(cfg, k)
+                        }
+                case []interface{}:
+                        for _, i := range v {
+                                if m, ok := i.(map[string]interface{}); ok {
+                                        removeConfigUnknowns(m)
+                                }
+                        }
+                case map[string]interface{}:
+                        removeConfigUnknowns(v)
+                }
+        }
+}
+
+// ApplyDiff takes a cty.Value state and applies a terraform.InstanceDiff to
+// get a new cty.Value state. This is used to convert the diff returned from
+// the legacy provider Diff method to the state required for the new
+// PlanResourceChange method.
+func ApplyDiff(base cty.Value, d *terraform.InstanceDiff, schema *configschema.Block) (cty.Value, error) {
+        return d.ApplyToValue(base, schema)
+}
+
+// StateValueToJSONMap converts a cty.Value to generic JSON map via the cty JSON
+// encoding.
+func StateValueToJSONMap(val cty.Value, ty cty.Type) (map[string]interface{}, error) {
+        js, err := ctyjson.Marshal(val, ty)
+        if err != nil {
+                return nil, err
+        }
+
+        var m map[string]interface{}
+        if err := json.Unmarshal(js, &m); err != nil {
+                return nil, err
+        }
+
+        return m, nil
+}
+
+// JSONMapToStateValue takes a generic json map[string]interface{} and converts it
+// to the specific type, ensuring that the values conform to the schema.
+func JSONMapToStateValue(m map[string]interface{}, block *configschema.Block) (cty.Value, error) {
+        var val cty.Value
+
+        js, err := json.Marshal(m)
+        if err != nil {
+                return val, err
+        }
+
+        val, err = ctyjson.Unmarshal(js, block.ImpliedType())
+        if err != nil {
+                return val, err
+        }
+
+        return block.CoerceValue(val)
+}
+
+// StateValueFromInstanceState converts a terraform.InstanceState to a
+// cty.Value as described by the provided cty.Type, and maintains the resource
+// ID as the "id" attribute.
+func StateValueFromInstanceState(is *terraform.InstanceState, ty cty.Type) (cty.Value, error) {
+        return is.AttrsAsObjectValue(ty)
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/testing.go b/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
index da754ac..a367a1f 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
@@ -18,7 +18,7 @@ func TestResourceDataRaw(
         }
 
         sm := schemaMap(schema)
-        diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil)
+        diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil, true)
         if err != nil {
                 t.Fatalf("err: %s", err)
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go b/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
index 3bc3ac4..914ca32 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
@@ -4,6 +4,21 @@ package schema
 
 import "strconv"
 
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[TypeInvalid-0]
+        _ = x[TypeBool-1]
+        _ = x[TypeInt-2]
+        _ = x[TypeFloat-3]
+        _ = x[TypeString-4]
+        _ = x[TypeList-5]
+        _ = x[TypeMap-6]
+        _ = x[TypeSet-7]
+        _ = x[typeObject-8]
+}
+
 const _ValueType_name = "TypeInvalidTypeBoolTypeIntTypeFloatTypeStringTypeListTypeMapTypeSettypeObject"
 
 var _ValueType_index = [...]uint8{0, 11, 19, 26, 35, 45, 53, 60, 67, 77}
diff --git a/vendor/github.com/hashicorp/terraform/internal/earlyconfig/config.go b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/config.go
new file mode 100644
index 0000000..a9b8f98
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/config.go
@@ -0,0 +1,123 @@
+package earlyconfig
+
+import (
+        "fmt"
+        "sort"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/moduledeps"
+        "github.com/hashicorp/terraform/plugin/discovery"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// A Config is a node in the tree of modules within a configuration.
+//
+// The module tree is constructed by following ModuleCall instances recursively
+// through the root module transitively into descendent modules.
+type Config struct {
+        // RootModule points to the Config for the root module within the same
+        // module tree as this module. If this module _is_ the root module then
+        // this is self-referential.
+        Root *Config
+
+        // ParentModule points to the Config for the module that directly calls
+        // this module. If this is the root module then this field is nil.
+        Parent *Config
+
+        // Path is a sequence of module logical names that traverse from the root
+        // module to this config. Path is empty for the root module.
+        //
+        // This should only be used to display paths to the end-user in rare cases
+        // where we are talking about the static module tree, before module calls
+        // have been resolved. In most cases, an addrs.ModuleInstance describing
+        // a node in the dynamic module tree is better, since it will then include
+        // any keys resulting from evaluating "count" and "for_each" arguments.
+        Path addrs.Module
+
+        // ChildModules points to the Config for each of the direct child modules
+        // called from this module. The keys in this map match the keys in
+        // Module.ModuleCalls.
+        Children map[string]*Config
+
+        // Module points to the object describing the configuration for the
+        // various elements (variables, resources, etc) defined by this module.
+        Module *tfconfig.Module
+
+        // CallPos is the source position for the header of the module block that
+        // requested this module.
+        //
+        // This field is meaningless for the root module, where its contents are undefined.
+        CallPos tfconfig.SourcePos
+
+        // SourceAddr is the source address that the referenced module was requested
+        // from, as specified in configuration.
+        //
+        // This field is meaningless for the root module, where its contents are undefined.
+        SourceAddr string
+
+        // Version is the specific version that was selected for this module,
+        // based on version constraints given in configuration.
+        //
+        // This field is nil if the module was loaded from a non-registry source,
+        // since versions are not supported for other sources.
+        //
+        // This field is meaningless for the root module, where it will always
+        // be nil.
+        Version *version.Version
+}
+
+// ProviderDependencies returns the provider dependencies for the recieving
+// config, including all of its descendent modules.
+func (c *Config) ProviderDependencies() (*moduledeps.Module, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        var name string
+        if len(c.Path) > 0 {
+                name = c.Path[len(c.Path)-1]
+        }
+
+        ret := &moduledeps.Module{
+                Name: name,
+        }
+
+        providers := make(moduledeps.Providers)
+        for name, reqs := range c.Module.RequiredProviders {
+                inst := moduledeps.ProviderInstance(name)
+                var constraints version.Constraints
+                for _, reqStr := range reqs {
+                        if reqStr != "" {
+                                constraint, err := version.NewConstraint(reqStr)
+                                if err != nil {
+                                        diags = diags.Append(wrapDiagnostic(tfconfig.Diagnostic{
+                                                Severity: tfconfig.DiagError,
+                                                Summary:  "Invalid provider version constraint",
+                                                Detail:   fmt.Sprintf("Invalid version constraint %q for provider %s.", reqStr, name),
+                                        }))
+                                        continue
+                                }
+                                constraints = append(constraints, constraint...)
+                        }
+                }
+                providers[inst] = moduledeps.ProviderDependency{
+                        Constraints: discovery.NewConstraints(constraints),
+                        Reason:      moduledeps.ProviderDependencyExplicit,
+                }
+        }
+        ret.Providers = providers
+
+        childNames := make([]string, 0, len(c.Children))
+        for name := range c.Children {
+                childNames = append(childNames, name)
+        }
+        sort.Strings(childNames)
+
+        for _, name := range childNames {
+                child, childDiags := c.Children[name].ProviderDependencies()
+                ret.Children = append(ret.Children, child)
+                diags = diags.Append(childDiags)
+        }
+
+        return ret, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/earlyconfig/config_build.go b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/config_build.go
new file mode 100644
index 0000000..770d5df
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/config_build.go
@@ -0,0 +1,144 @@
+package earlyconfig
+
+import (
+        "fmt"
+        "sort"
+        "strings"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// BuildConfig constructs a Config from a root module by loading all of its
+// descendent modules via the given ModuleWalker.
+func BuildConfig(root *tfconfig.Module, walker ModuleWalker) (*Config, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        cfg := &Config{
+                Module: root,
+        }
+        cfg.Root = cfg // Root module is self-referential.
+        cfg.Children, diags = buildChildModules(cfg, walker)
+        return cfg, diags
+}
+
+func buildChildModules(parent *Config, walker ModuleWalker) (map[string]*Config, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        ret := map[string]*Config{}
+        calls := parent.Module.ModuleCalls
+
+        // We'll sort the calls by their local names so that they'll appear in a
+        // predictable order in any logging that's produced during the walk.
+        callNames := make([]string, 0, len(calls))
+        for k := range calls {
+                callNames = append(callNames, k)
+        }
+        sort.Strings(callNames)
+
+        for _, callName := range callNames {
+                call := calls[callName]
+                path := make([]string, len(parent.Path)+1)
+                copy(path, parent.Path)
+                path[len(path)-1] = call.Name
+
+                var vc version.Constraints
+                if strings.TrimSpace(call.Version) != "" {
+                        var err error
+                        vc, err = version.NewConstraint(call.Version)
+                        if err != nil {
+                                diags = diags.Append(wrapDiagnostic(tfconfig.Diagnostic{
+                                        Severity: tfconfig.DiagError,
+                                        Summary:  "Invalid version constraint",
+                                        Detail:   fmt.Sprintf("Module %q (declared at %s line %d) has invalid version constraint %q: %s.", callName, call.Pos.Filename, call.Pos.Line, call.Version, err),
+                                }))
+                                continue
+                        }
+                }
+
+                req := ModuleRequest{
+                        Name:               call.Name,
+                        Path:               path,
+                        SourceAddr:         call.Source,
+                        VersionConstraints: vc,
+                        Parent:             parent,
+                        CallPos:            call.Pos,
+                }
+
+                mod, ver, modDiags := walker.LoadModule(&req)
+                diags = append(diags, modDiags...)
+                if mod == nil {
+                        // nil can be returned if the source address was invalid and so
+                        // nothing could be loaded whatsoever. LoadModule should've
+                        // returned at least one error diagnostic in that case.
+                        continue
+                }
+
+                child := &Config{
+                        Parent:     parent,
+                        Root:       parent.Root,
+                        Path:       path,
+                        Module:     mod,
+                        CallPos:    call.Pos,
+                        SourceAddr: call.Source,
+                        Version:    ver,
+                }
+
+                child.Children, modDiags = buildChildModules(child, walker)
+                diags = diags.Append(modDiags)
+
+                ret[call.Name] = child
+        }
+
+        return ret, diags
+}
+
+// ModuleRequest is used as part of the ModuleWalker interface used with
+// function BuildConfig.
+type ModuleRequest struct {
+        // Name is the "logical name" of the module call within configuration.
+        // This is provided in case the name is used as part of a storage key
+        // for the module, but implementations must otherwise treat it as an
+        // opaque string. It is guaranteed to have already been validated as an
+        // HCL identifier and UTF-8 encoded.
+        Name string
+
+        // Path is a list of logical names that traverse from the root module to
+        // this module. This can be used, for example, to form a lookup key for
+        // each distinct module call in a configuration, allowing for multiple
+        // calls with the same name at different points in the tree.
+        Path addrs.Module
+
+        // SourceAddr is the source address string provided by the user in
+        // configuration.
+        SourceAddr string
+
+        // VersionConstraint is the version constraint applied to the module in
+        // configuration.
+        VersionConstraints version.Constraints
+
+        // Parent is the partially-constructed module tree node that the loaded
+        // module will be added to. Callers may refer to any field of this
+        // structure except Children, which is still under construction when
+        // ModuleRequest objects are created and thus has undefined content.
+        // The main reason this is provided is so that full module paths can
+        // be constructed for uniqueness.
+        Parent *Config
+
+        // CallRange is the source position for the header of the "module" block
+        // in configuration that prompted this request.
+        CallPos tfconfig.SourcePos
+}
+
+// ModuleWalker is an interface used with BuildConfig.
+type ModuleWalker interface {
+        LoadModule(req *ModuleRequest) (*tfconfig.Module, *version.Version, tfdiags.Diagnostics)
+}
+
+// ModuleWalkerFunc is an implementation of ModuleWalker that directly wraps
+// a callback function, for more convenient use of that interface.
+type ModuleWalkerFunc func(req *ModuleRequest) (*tfconfig.Module, *version.Version, tfdiags.Diagnostics)
+
+func (f ModuleWalkerFunc) LoadModule(req *ModuleRequest) (*tfconfig.Module, *version.Version, tfdiags.Diagnostics) {
+        return f(req)
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/earlyconfig/diagnostics.go b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/diagnostics.go
new file mode 100644
index 0000000..9b2fd7f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/diagnostics.go
@@ -0,0 +1,78 @@
+package earlyconfig
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func wrapDiagnostics(diags tfconfig.Diagnostics) tfdiags.Diagnostics {
+        ret := make(tfdiags.Diagnostics, len(diags))
+        for i, diag := range diags {
+                ret[i] = wrapDiagnostic(diag)
+        }
+        return ret
+}
+
+func wrapDiagnostic(diag tfconfig.Diagnostic) tfdiags.Diagnostic {
+        return wrappedDiagnostic{
+                d: diag,
+        }
+}
+
+type wrappedDiagnostic struct {
+        d tfconfig.Diagnostic
+}
+
+func (d wrappedDiagnostic) Severity() tfdiags.Severity {
+        switch d.d.Severity {
+        case tfconfig.DiagError:
+                return tfdiags.Error
+        case tfconfig.DiagWarning:
+                return tfdiags.Warning
+        default:
+                // Should never happen since there are no other severities
+                return 0
+        }
+}
+
+func (d wrappedDiagnostic) Description() tfdiags.Description {
+        // Since the inspect library doesn't produce precise source locations,
+        // we include the position information as part of the error message text.
+        // See the comment inside method "Source" for more information.
+        switch {
+        case d.d.Pos == nil:
+                return tfdiags.Description{
+                        Summary: d.d.Summary,
+                        Detail:  d.d.Detail,
+                }
+        case d.d.Detail != "":
+                return tfdiags.Description{
+                        Summary: d.d.Summary,
+                        Detail:  fmt.Sprintf("On %s line %d: %s", d.d.Pos.Filename, d.d.Pos.Line, d.d.Detail),
+                }
+        default:
+                return tfdiags.Description{
+                        Summary: fmt.Sprintf("%s (on %s line %d)", d.d.Summary, d.d.Pos.Filename, d.d.Pos.Line),
+                }
+        }
+}
+
+func (d wrappedDiagnostic) Source() tfdiags.Source {
+        // Since the inspect library is constrained by the lowest common denominator
+        // between legacy HCL and modern HCL, it only returns ranges at whole-line
+        // granularity, and that isn't sufficient to populate a tfdiags.Source
+        // and so we'll just omit ranges altogether and include the line number in
+        // the Description text.
+        //
+        // Callers that want to return nicer errors should consider reacting to
+        // earlyconfig errors by attempting a follow-up parse with the normal
+        // config loader, which can produce more precise source location
+        // information.
+        return tfdiags.Source{}
+}
+
+func (d wrappedDiagnostic) FromExpr() *tfdiags.FromExpr {
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/earlyconfig/doc.go b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/doc.go
new file mode 100644
index 0000000..a9cf10f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/doc.go
@@ -0,0 +1,20 @@
+// Package earlyconfig is a specialized alternative to the top-level "configs"
+// package that does only shallow processing of configuration and is therefore
+// able to be much more liberal than the full config loader in what it accepts.
+//
+// In particular, it can accept both current and legacy HCL syntax, and it
+// ignores top-level blocks that it doesn't recognize. These two characteristics
+// make this package ideal for dependency-checking use-cases so that we are
+// more likely to be able to return an error message about an explicit
+// incompatibility than to return a less-actionable message about a construct
+// not being supported.
+//
+// However, its liberal approach also means it should be used sparingly. It
+// exists primarily for "terraform init", so that it is able to detect
+// incompatibilities more robustly when installing dependencies. For most
+// other use-cases, use the "configs" and "configs/configload" packages.
+//
+// Package earlyconfig is a wrapper around the terraform-config-inspect
+// codebase, adding to it just some helper functionality for Terraform's own
+// use-cases.
+package earlyconfig
diff --git a/vendor/github.com/hashicorp/terraform/internal/earlyconfig/module.go b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/module.go
new file mode 100644
index 0000000..d2d6287
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/earlyconfig/module.go
@@ -0,0 +1,13 @@
+package earlyconfig
+
+import (
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// LoadModule loads some top-level metadata for the module in the given
+// directory.
+func LoadModule(dir string) (*tfconfig.Module, tfdiags.Diagnostics) {
+        mod, diags := tfconfig.LoadModule(dir)
+        return mod, wrapDiagnostics(diags)
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/copy_dir.go b/vendor/github.com/hashicorp/terraform/internal/initwd/copy_dir.go
new file mode 100644
index 0000000..7096ff7
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/copy_dir.go
@@ -0,0 +1,125 @@
+package initwd
+
+import (
+        "io"
+        "os"
+        "path/filepath"
+        "strings"
+)
+
+// copyDir copies the src directory contents into dst. Both directories
+// should already exist.
+func copyDir(dst, src string) error {
+        src, err := filepath.EvalSymlinks(src)
+        if err != nil {
+                return err
+        }
+
+        walkFn := func(path string, info os.FileInfo, err error) error {
+                if err != nil {
+                        return err
+                }
+
+                if path == src {
+                        return nil
+                }
+
+                if strings.HasPrefix(filepath.Base(path), ".") {
+                        // Skip any dot files
+                        if info.IsDir() {
+                                return filepath.SkipDir
+                        } else {
+                                return nil
+                        }
+                }
+
+                // The "path" has the src prefixed to it. We need to join our
+                // destination with the path without the src on it.
+                dstPath := filepath.Join(dst, path[len(src):])
+
+                // we don't want to try and copy the same file over itself.
+                if eq, err := sameFile(path, dstPath); eq {
+                        return nil
+                } else if err != nil {
+                        return err
+                }
+
+                // If we have a directory, make that subdirectory, then continue
+                // the walk.
+                if info.IsDir() {
+                        if path == filepath.Join(src, dst) {
+                                // dst is in src; don't walk it.
+                                return nil
+                        }
+
+                        if err := os.MkdirAll(dstPath, 0755); err != nil {
+                                return err
+                        }
+
+                        return nil
+                }
+
+                // If the current path is a symlink, recreate the symlink relative to
+                // the dst directory
+                if info.Mode()&os.ModeSymlink == os.ModeSymlink {
+                        target, err := os.Readlink(path)
+                        if err != nil {
+                                return err
+                        }
+
+                        return os.Symlink(target, dstPath)
+                }
+
+                // If we have a file, copy the contents.
+                srcF, err := os.Open(path)
+                if err != nil {
+                        return err
+                }
+                defer srcF.Close()
+
+                dstF, err := os.Create(dstPath)
+                if err != nil {
+                        return err
+                }
+                defer dstF.Close()
+
+                if _, err := io.Copy(dstF, srcF); err != nil {
+                        return err
+                }
+
+                // Chmod it
+                return os.Chmod(dstPath, info.Mode())
+        }
+
+        return filepath.Walk(src, walkFn)
+}
+
+// sameFile tried to determine if to paths are the same file.
+// If the paths don't match, we lookup the inode on supported systems.
+func sameFile(a, b string) (bool, error) {
+        if a == b {
+                return true, nil
+        }
+
+        aIno, err := inode(a)
+        if err != nil {
+                if os.IsNotExist(err) {
+                        return false, nil
+                }
+                return false, err
+        }
+
+        bIno, err := inode(b)
+        if err != nil {
+                if os.IsNotExist(err) {
+                        return false, nil
+                }
+                return false, err
+        }
+
+        if aIno > 0 && aIno == bIno {
+                return true, nil
+        }
+
+        return false, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/doc.go b/vendor/github.com/hashicorp/terraform/internal/initwd/doc.go
new file mode 100644
index 0000000..b9d938d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/doc.go
@@ -0,0 +1,7 @@
+// Package initwd contains various helper functions used by the "terraform init"
+// command to initialize a working directory.
+//
+// These functions may also be used from testing code to simulate the behaviors
+// of "terraform init" against test fixtures, but should not be used elsewhere
+// in the main code.
+package initwd
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/from_module.go b/vendor/github.com/hashicorp/terraform/internal/initwd/from_module.go
new file mode 100644
index 0000000..6b40d08
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/from_module.go
@@ -0,0 +1,363 @@
+package initwd
+
+import (
+        "fmt"
+        "github.com/hashicorp/terraform/internal/earlyconfig"
+        "io/ioutil"
+        "log"
+        "os"
+        "path/filepath"
+        "sort"
+        "strings"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/internal/modsdir"
+        "github.com/hashicorp/terraform/registry"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+const initFromModuleRootCallName = "root"
+const initFromModuleRootKeyPrefix = initFromModuleRootCallName + "."
+
+// DirFromModule populates the given directory (which must exist and be
+// empty) with the contents of the module at the given source address.
+//
+// It does this by installing the given module and all of its descendent
+// modules in a temporary root directory and then copying the installed
+// files into suitable locations. As a consequence, any diagnostics it
+// generates will reveal the location of this temporary directory to the
+// user.
+//
+// This rather roundabout installation approach is taken to ensure that
+// installation proceeds in a manner identical to normal module installation.
+//
+// If the given source address specifies a sub-directory of the given
+// package then only the sub-directory and its descendents will be copied
+// into the given root directory, which will cause any relative module
+// references using ../ from that module to be unresolvable. Error diagnostics
+// are produced in that case, to prompt the user to rewrite the source strings
+// to be absolute references to the original remote module.
+func DirFromModule(rootDir, modulesDir, sourceAddr string, reg *registry.Client, hooks ModuleInstallHooks) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        // The way this function works is pretty ugly, but we accept it because
+        // -from-module is a less important case than normal module installation
+        // and so it's better to keep this ugly complexity out here rather than
+        // adding even more complexity to the normal module installer.
+
+        // The target directory must exist but be empty.
+        {
+                entries, err := ioutil.ReadDir(rootDir)
+                if err != nil {
+                        if os.IsNotExist(err) {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Target directory does not exist",
+                                        fmt.Sprintf("Cannot initialize non-existent directory %s.", rootDir),
+                                ))
+                        } else {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Failed to read target directory",
+                                        fmt.Sprintf("Error reading %s to ensure it is empty: %s.", rootDir, err),
+                                ))
+                        }
+                        return diags
+                }
+                haveEntries := false
+                for _, entry := range entries {
+                        if entry.Name() == "." || entry.Name() == ".." || entry.Name() == ".terraform" {
+                                continue
+                        }
+                        haveEntries = true
+                }
+                if haveEntries {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Can't populate non-empty directory",
+                                fmt.Sprintf("The target directory %s is not empty, so it cannot be initialized with the -from-module=... option.", rootDir),
+                        ))
+                        return diags
+                }
+        }
+
+        instDir := filepath.Join(rootDir, ".terraform/init-from-module")
+        inst := NewModuleInstaller(instDir, reg)
+        log.Printf("[DEBUG] installing modules in %s to initialize working directory from %q", instDir, sourceAddr)
+        os.RemoveAll(instDir) // if this fails then we'll fail on MkdirAll below too
+        err := os.MkdirAll(instDir, os.ModePerm)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to create temporary directory",
+                        fmt.Sprintf("Failed to create temporary directory %s: %s.", instDir, err),
+                ))
+                return diags
+        }
+
+        instManifest := make(modsdir.Manifest)
+        retManifest := make(modsdir.Manifest)
+
+        fakeFilename := fmt.Sprintf("-from-module=%q", sourceAddr)
+        fakePos := tfconfig.SourcePos{
+                Filename: fakeFilename,
+                Line:     1,
+        }
+
+        // -from-module allows relative paths but it's different than a normal
+        // module address where it'd be resolved relative to the module call
+        // (which is synthetic, here.) To address this, we'll just patch up any
+        // relative paths to be absolute paths before we run, ensuring we'll
+        // get the right result. This also, as an important side-effect, ensures
+        // that the result will be "downloaded" with go-getter (copied from the
+        // source location), rather than just recorded as a relative path.
+        {
+                maybePath := filepath.ToSlash(sourceAddr)
+                if maybePath == "." || strings.HasPrefix(maybePath, "./") || strings.HasPrefix(maybePath, "../") {
+                        if wd, err := os.Getwd(); err == nil {
+                                sourceAddr = filepath.Join(wd, sourceAddr)
+                                log.Printf("[TRACE] -from-module relative path rewritten to absolute path %s", sourceAddr)
+                        }
+                }
+        }
+
+        // Now we need to create an artificial root module that will seed our
+        // installation process.
+        fakeRootModule := &tfconfig.Module{
+                ModuleCalls: map[string]*tfconfig.ModuleCall{
+                        initFromModuleRootCallName: {
+                                Name:   initFromModuleRootCallName,
+                                Source: sourceAddr,
+                                Pos:    fakePos,
+                        },
+                },
+        }
+
+        // wrapHooks filters hook notifications to only include Download calls
+        // and to trim off the initFromModuleRootCallName prefix. We'll produce
+        // our own Install notifications directly below.
+        wrapHooks := installHooksInitDir{
+                Wrapped: hooks,
+        }
+        getter := reusingGetter{}
+        _, instDiags := inst.installDescendentModules(fakeRootModule, rootDir, instManifest, true, wrapHooks, getter)
+        diags = append(diags, instDiags...)
+        if instDiags.HasErrors() {
+                return diags
+        }
+
+        // If all of that succeeded then we'll now migrate what was installed
+        // into the final directory structure.
+        err = os.MkdirAll(modulesDir, os.ModePerm)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to create local modules directory",
+                        fmt.Sprintf("Failed to create modules directory %s: %s.", modulesDir, err),
+                ))
+                return diags
+        }
+
+        recordKeys := make([]string, 0, len(instManifest))
+        for k := range instManifest {
+                recordKeys = append(recordKeys, k)
+        }
+        sort.Strings(recordKeys)
+
+        for _, recordKey := range recordKeys {
+                record := instManifest[recordKey]
+
+                if record.Key == initFromModuleRootCallName {
+                        // We've found the module the user requested, which we must
+                        // now copy into rootDir so it can be used directly.
+                        log.Printf("[TRACE] copying new root module from %s to %s", record.Dir, rootDir)
+                        err := copyDir(rootDir, record.Dir)
+                        if err != nil {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Failed to copy root module",
+                                        fmt.Sprintf("Error copying root module %q from %s to %s: %s.", sourceAddr, record.Dir, rootDir, err),
+                                ))
+                                continue
+                        }
+
+                        // We'll try to load the newly-copied module here just so we can
+                        // sniff for any module calls that ../ out of the root directory
+                        // and must thus be rewritten to be absolute addresses again.
+                        // For now we can't do this rewriting automatically, but we'll
+                        // generate an error to help the user do it manually.
+                        mod, _ := earlyconfig.LoadModule(rootDir) // ignore diagnostics since we're just doing value-add here anyway
+                        if mod != nil {
+                                for _, mc := range mod.ModuleCalls {
+                                        if pathTraversesUp(mc.Source) {
+                                                packageAddr, givenSubdir := splitAddrSubdir(sourceAddr)
+                                                newSubdir := filepath.Join(givenSubdir, mc.Source)
+                                                if pathTraversesUp(newSubdir) {
+                                                        // This should never happen in any reasonable
+                                                        // configuration since this suggests a path that
+                                                        // traverses up out of the package root. We'll just
+                                                        // ignore this, since we'll fail soon enough anyway
+                                                        // trying to resolve this path when this module is
+                                                        // loaded.
+                                                        continue
+                                                }
+
+                                                var newAddr = packageAddr
+                                                if newSubdir != "" {
+                                                        newAddr = fmt.Sprintf("%s//%s", newAddr, filepath.ToSlash(newSubdir))
+                                                }
+                                                diags = diags.Append(tfdiags.Sourceless(
+                                                        tfdiags.Error,
+                                                        "Root module references parent directory",
+                                                        fmt.Sprintf("The requested module %q refers to a module via its parent directory. To use this as a new root module this source string must be rewritten as a remote source address, such as %q.", sourceAddr, newAddr),
+                                                ))
+                                                continue
+                                        }
+                                }
+                        }
+
+                        retManifest[""] = modsdir.Record{
+                                Key: "",
+                                Dir: rootDir,
+                        }
+                        continue
+                }
+
+                if !strings.HasPrefix(record.Key, initFromModuleRootKeyPrefix) {
+                        // Ignore the *real* root module, whose key is empty, since
+                        // we're only interested in the module named "root" and its
+                        // descendents.
+                        continue
+                }
+
+                newKey := record.Key[len(initFromModuleRootKeyPrefix):]
+                instPath := filepath.Join(modulesDir, newKey)
+                tempPath := filepath.Join(instDir, record.Key)
+
+                // tempPath won't be present for a module that was installed from
+                // a relative path, so in that case we just record the installation
+                // directory and assume it was already copied into place as part
+                // of its parent.
+                if _, err := os.Stat(tempPath); err != nil {
+                        if !os.IsNotExist(err) {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Failed to stat temporary module install directory",
+                                        fmt.Sprintf("Error from stat %s for module %s: %s.", instPath, newKey, err),
+                                ))
+                                continue
+                        }
+
+                        var parentKey string
+                        if lastDot := strings.LastIndexByte(newKey, '.'); lastDot != -1 {
+                                parentKey = newKey[:lastDot]
+                        } else {
+                                parentKey = "" // parent is the root module
+                        }
+
+                        parentOld := instManifest[initFromModuleRootKeyPrefix+parentKey]
+                        parentNew := retManifest[parentKey]
+
+                        // We need to figure out which portion of our directory is the
+                        // parent package path and which portion is the subdirectory
+                        // under that.
+                        baseDirRel, err := filepath.Rel(parentOld.Dir, record.Dir)
+                        if err != nil {
+                                // Should never happen, because we constructed both directories
+                                // from the same base and so they must have a common prefix.
+                                panic(err)
+                        }
+
+                        newDir := filepath.Join(parentNew.Dir, baseDirRel)
+                        log.Printf("[TRACE] relative reference for %s rewritten from %s to %s", newKey, record.Dir, newDir)
+                        newRecord := record // shallow copy
+                        newRecord.Dir = newDir
+                        newRecord.Key = newKey
+                        retManifest[newKey] = newRecord
+                        hooks.Install(newRecord.Key, newRecord.Version, newRecord.Dir)
+                        continue
+                }
+
+                err = os.MkdirAll(instPath, os.ModePerm)
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to create module install directory",
+                                fmt.Sprintf("Error creating directory %s for module %s: %s.", instPath, newKey, err),
+                        ))
+                        continue
+                }
+
+                // We copy rather than "rename" here because renaming between directories
+                // can be tricky in edge-cases like network filesystems, etc.
+                log.Printf("[TRACE] copying new module %s from %s to %s", newKey, record.Dir, instPath)
+                err := copyDir(instPath, tempPath)
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to copy descendent module",
+                                fmt.Sprintf("Error copying module %q from %s to %s: %s.", newKey, tempPath, rootDir, err),
+                        ))
+                        continue
+                }
+
+                subDir, err := filepath.Rel(tempPath, record.Dir)
+                if err != nil {
+                        // Should never happen, because we constructed both directories
+                        // from the same base and so they must have a common prefix.
+                        panic(err)
+                }
+
+                newRecord := record // shallow copy
+                newRecord.Dir = filepath.Join(instPath, subDir)
+                newRecord.Key = newKey
+                retManifest[newKey] = newRecord
+                hooks.Install(newRecord.Key, newRecord.Version, newRecord.Dir)
+        }
+
+        retManifest.WriteSnapshotToDir(modulesDir)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to write module manifest",
+                        fmt.Sprintf("Error writing module manifest: %s.", err),
+                ))
+        }
+
+        if !diags.HasErrors() {
+                // Try to clean up our temporary directory, but don't worry if we don't
+                // succeed since it shouldn't hurt anything.
+                os.RemoveAll(instDir)
+        }
+
+        return diags
+}
+
+func pathTraversesUp(path string) bool {
+        return strings.HasPrefix(filepath.ToSlash(path), "../")
+}
+
+// installHooksInitDir is an adapter wrapper for an InstallHooks that
+// does some fakery to make downloads look like they are happening in their
+// final locations, rather than in the temporary loader we use.
+//
+// It also suppresses "Install" calls entirely, since InitDirFromModule
+// does its own installation steps after the initial installation pass
+// has completed.
+type installHooksInitDir struct {
+        Wrapped ModuleInstallHooks
+        ModuleInstallHooksImpl
+}
+
+func (h installHooksInitDir) Download(moduleAddr, packageAddr string, version *version.Version) {
+        if !strings.HasPrefix(moduleAddr, initFromModuleRootKeyPrefix) {
+                // We won't announce the root module, since hook implementations
+                // don't expect to see that and the caller will usually have produced
+                // its own user-facing notification about what it's doing anyway.
+                return
+        }
+
+        trimAddr := moduleAddr[len(initFromModuleRootKeyPrefix):]
+        h.Wrapped.Download(trimAddr, packageAddr, version)
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/getter.go b/vendor/github.com/hashicorp/terraform/internal/initwd/getter.go
new file mode 100644
index 0000000..50e2572
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/getter.go
@@ -0,0 +1,210 @@
+package initwd
+
+import (
+        "fmt"
+        "log"
+        "os"
+        "path/filepath"
+        "strings"
+
+        cleanhttp "github.com/hashicorp/go-cleanhttp"
+        getter "github.com/hashicorp/go-getter"
+        "github.com/hashicorp/terraform/registry/regsrc"
+)
+
+// We configure our own go-getter detector and getter sets here, because
+// the set of sources we support is part of Terraform's documentation and
+// so we don't want any new sources introduced in go-getter to sneak in here
+// and work even though they aren't documented. This also insulates us from
+// any meddling that might be done by other go-getter callers linked into our
+// executable.
+
+var goGetterDetectors = []getter.Detector{
+        new(getter.GitHubDetector),
+        new(getter.BitBucketDetector),
+        new(getter.S3Detector),
+        new(getter.FileDetector),
+}
+
+var goGetterNoDetectors = []getter.Detector{}
+
+var goGetterDecompressors = map[string]getter.Decompressor{
+        "bz2": new(getter.Bzip2Decompressor),
+        "gz":  new(getter.GzipDecompressor),
+        "xz":  new(getter.XzDecompressor),
+        "zip": new(getter.ZipDecompressor),
+
+        "tar.bz2":  new(getter.TarBzip2Decompressor),
+        "tar.tbz2": new(getter.TarBzip2Decompressor),
+
+        "tar.gz": new(getter.TarGzipDecompressor),
+        "tgz":    new(getter.TarGzipDecompressor),
+
+        "tar.xz": new(getter.TarXzDecompressor),
+        "txz":    new(getter.TarXzDecompressor),
+}
+
+var goGetterGetters = map[string]getter.Getter{
+        "file":  new(getter.FileGetter),
+        "git":   new(getter.GitGetter),
+        "hg":    new(getter.HgGetter),
+        "s3":    new(getter.S3Getter),
+        "http":  getterHTTPGetter,
+        "https": getterHTTPGetter,
+}
+
+var getterHTTPClient = cleanhttp.DefaultClient()
+
+var getterHTTPGetter = &getter.HttpGetter{
+        Client: getterHTTPClient,
+        Netrc:  true,
+}
+
+// A reusingGetter is a helper for the module installer that remembers
+// the final resolved addresses of all of the sources it has already been
+// asked to install, and will copy from a prior installation directory if
+// it has the same resolved source address.
+//
+// The keys in a reusingGetter are resolved and trimmed source addresses
+// (with a scheme always present, and without any "subdir" component),
+// and the values are the paths where each source was previously installed.
+type reusingGetter map[string]string
+
+// getWithGoGetter retrieves the package referenced in the given address
+// into the installation path and then returns the full path to any subdir
+// indicated in the address.
+//
+// The errors returned by this function are those surfaced by the underlying
+// go-getter library, which have very inconsistent quality as
+// end-user-actionable error messages. At this time we do not have any
+// reasonable way to improve these error messages at this layer because
+// the underlying errors are not separately recognizable.
+func (g reusingGetter) getWithGoGetter(instPath, addr string) (string, error) {
+        packageAddr, subDir := splitAddrSubdir(addr)
+
+        log.Printf("[DEBUG] will download %q to %s", packageAddr, instPath)
+
+        realAddr, err := getter.Detect(packageAddr, instPath, getter.Detectors)
+        if err != nil {
+                return "", err
+        }
+
+        if isMaybeRelativeLocalPath(realAddr) {
+                return "", &MaybeRelativePathErr{addr}
+        }
+
+        var realSubDir string
+        realAddr, realSubDir = splitAddrSubdir(realAddr)
+        if realSubDir != "" {
+                subDir = filepath.Join(realSubDir, subDir)
+        }
+
+        if realAddr != packageAddr {
+                log.Printf("[TRACE] go-getter detectors rewrote %q to %q", packageAddr, realAddr)
+        }
+
+        if prevDir, exists := g[realAddr]; exists {
+                log.Printf("[TRACE] copying previous install %s to %s", prevDir, instPath)
+                err := os.Mkdir(instPath, os.ModePerm)
+                if err != nil {
+                        return "", fmt.Errorf("failed to create directory %s: %s", instPath, err)
+                }
+                err = copyDir(instPath, prevDir)
+                if err != nil {
+                        return "", fmt.Errorf("failed to copy from %s to %s: %s", prevDir, instPath, err)
+                }
+        } else {
+                log.Printf("[TRACE] fetching %q to %q", realAddr, instPath)
+                client := getter.Client{
+                        Src: realAddr,
+                        Dst: instPath,
+                        Pwd: instPath,
+
+                        Mode: getter.ClientModeDir,
+
+                        Detectors:     goGetterNoDetectors, // we already did detection above
+                        Decompressors: goGetterDecompressors,
+                        Getters:       goGetterGetters,
+                }
+                err = client.Get()
+                if err != nil {
+                        return "", err
+                }
+                // Remember where we installed this so we might reuse this directory
+                // on subsequent calls to avoid re-downloading.
+                g[realAddr] = instPath
+        }
+
+        // Our subDir string can contain wildcards until this point, so that
+        // e.g. a subDir of * can expand to one top-level directory in a .tar.gz
+        // archive. Now that we've expanded the archive successfully we must
+        // resolve that into a concrete path.
+        var finalDir string
+        if subDir != "" {
+                finalDir, err = getter.SubdirGlob(instPath, subDir)
+                log.Printf("[TRACE] expanded %q to %q", subDir, finalDir)
+                if err != nil {
+                        return "", err
+                }
+        } else {
+                finalDir = instPath
+        }
+
+        // If we got this far then we have apparently succeeded in downloading
+        // the requested object!
+        return filepath.Clean(finalDir), nil
+}
+
+// splitAddrSubdir splits the given address (which is assumed to be a
+// registry address or go-getter-style address) into a package portion
+// and a sub-directory portion.
+//
+// The package portion defines what should be downloaded and then the
+// sub-directory portion, if present, specifies a sub-directory within
+// the downloaded object (an archive, VCS repository, etc) that contains
+// the module's configuration files.
+//
+// The subDir portion will be returned as empty if no subdir separator
+// ("//") is present in the address.
+func splitAddrSubdir(addr string) (packageAddr, subDir string) {
+        return getter.SourceDirSubdir(addr)
+}
+
+var localSourcePrefixes = []string{
+        "./",
+        "../",
+        ".\\",
+        "..\\",
+}
+
+func isLocalSourceAddr(addr string) bool {
+        for _, prefix := range localSourcePrefixes {
+                if strings.HasPrefix(addr, prefix) {
+                        return true
+                }
+        }
+        return false
+}
+
+func isRegistrySourceAddr(addr string) bool {
+        _, err := regsrc.ParseModuleSource(addr)
+        return err == nil
+}
+
+type MaybeRelativePathErr struct {
+        Addr string
+}
+
+func (e *MaybeRelativePathErr) Error() string {
+        return fmt.Sprintf("Terraform cannot determine the module source for %s", e.Addr)
+}
+
+func isMaybeRelativeLocalPath(addr string) bool {
+        if strings.HasPrefix(addr, "file://") {
+                _, err := os.Stat(addr[7:])
+                if err != nil {
+                        return true
+                }
+        }
+        return false
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/inode.go b/vendor/github.com/hashicorp/terraform/internal/initwd/inode.go
new file mode 100644
index 0000000..1150b09
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/inode.go
@@ -0,0 +1,21 @@
+// +build linux darwin openbsd netbsd solaris dragonfly
+
+package initwd
+
+import (
+        "fmt"
+        "os"
+        "syscall"
+)
+
+// lookup the inode of a file on posix systems
+func inode(path string) (uint64, error) {
+        stat, err := os.Stat(path)
+        if err != nil {
+                return 0, err
+        }
+        if st, ok := stat.Sys().(*syscall.Stat_t); ok {
+                return st.Ino, nil
+        }
+        return 0, fmt.Errorf("could not determine file inode")
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/inode_freebsd.go b/vendor/github.com/hashicorp/terraform/internal/initwd/inode_freebsd.go
new file mode 100644
index 0000000..30532f5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/inode_freebsd.go
@@ -0,0 +1,21 @@
+// +build freebsd
+
+package initwd
+
+import (
+        "fmt"
+        "os"
+        "syscall"
+)
+
+// lookup the inode of a file on posix systems
+func inode(path string) (uint64, error) {
+        stat, err := os.Stat(path)
+        if err != nil {
+                return 0, err
+        }
+        if st, ok := stat.Sys().(*syscall.Stat_t); ok {
+                return uint64(st.Ino), nil
+        }
+        return 0, fmt.Errorf("could not determine file inode")
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/inode_windows.go b/vendor/github.com/hashicorp/terraform/internal/initwd/inode_windows.go
new file mode 100644
index 0000000..3ed58e4
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/inode_windows.go
@@ -0,0 +1,8 @@
+// +build windows
+
+package initwd
+
+// no syscall.Stat_t on windows, return 0 for inodes
+func inode(path string) (uint64, error) {
+        return 0, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/load_config.go b/vendor/github.com/hashicorp/terraform/internal/initwd/load_config.go
new file mode 100644
index 0000000..6f77dcd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/load_config.go
@@ -0,0 +1,56 @@
+package initwd
+
+import (
+        "fmt"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/internal/earlyconfig"
+        "github.com/hashicorp/terraform/internal/modsdir"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// LoadConfig loads a full configuration tree that has previously had all of
+// its dependent modules installed to the given modulesDir using a
+// ModuleInstaller.
+//
+// This uses the early configuration loader and thus only reads top-level
+// metadata from the modules in the configuration. Most callers should use
+// the configs/configload package to fully load a configuration.
+func LoadConfig(rootDir, modulesDir string) (*earlyconfig.Config, tfdiags.Diagnostics) {
+        rootMod, diags := earlyconfig.LoadModule(rootDir)
+        if rootMod == nil {
+                return nil, diags
+        }
+
+        manifest, err := modsdir.ReadManifestSnapshotForDir(modulesDir)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to read module manifest",
+                        fmt.Sprintf("Terraform failed to read its manifest of locally-cached modules: %s.", err),
+                ))
+                return nil, diags
+        }
+
+        return earlyconfig.BuildConfig(rootMod, earlyconfig.ModuleWalkerFunc(
+                func(req *earlyconfig.ModuleRequest) (*tfconfig.Module, *version.Version, tfdiags.Diagnostics) {
+                        var diags tfdiags.Diagnostics
+
+                        key := manifest.ModuleKey(req.Path)
+                        record, exists := manifest[key]
+                        if !exists {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Module not installed",
+                                        fmt.Sprintf("Module %s is not yet installed. Run \"terraform init\" to install all modules required by this configuration.", req.Path.String()),
+                                ))
+                                return nil, nil, diags
+                        }
+
+                        mod, mDiags := earlyconfig.LoadModule(record.Dir)
+                        diags = diags.Append(mDiags)
+                        return mod, record.Version, diags
+                },
+        ))
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/module_install.go b/vendor/github.com/hashicorp/terraform/internal/initwd/module_install.go
new file mode 100644
index 0000000..531310a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/module_install.go
@@ -0,0 +1,558 @@
+package initwd
+
+import (
+        "fmt"
+        "log"
+        "os"
+        "path/filepath"
+        "strings"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform-config-inspect/tfconfig"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/internal/earlyconfig"
+        "github.com/hashicorp/terraform/internal/modsdir"
+        "github.com/hashicorp/terraform/registry"
+        "github.com/hashicorp/terraform/registry/regsrc"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+type ModuleInstaller struct {
+        modsDir string
+        reg     *registry.Client
+}
+
+func NewModuleInstaller(modsDir string, reg *registry.Client) *ModuleInstaller {
+        return &ModuleInstaller{
+                modsDir: modsDir,
+                reg:     reg,
+        }
+}
+
+// InstallModules analyses the root module in the given directory and installs
+// all of its direct and transitive dependencies into the given modules
+// directory, which must already exist.
+//
+// Since InstallModules makes possibly-time-consuming calls to remote services,
+// a hook interface is supported to allow the caller to be notified when
+// each module is installed and, for remote modules, when downloading begins.
+// LoadConfig guarantees that two hook calls will not happen concurrently but
+// it does not guarantee any particular ordering of hook calls. This mechanism
+// is for UI feedback only and does not give the caller any control over the
+// process.
+//
+// If modules are already installed in the target directory, they will be
+// skipped unless their source address or version have changed or unless
+// the upgrade flag is set.
+//
+// InstallModules never deletes any directory, except in the case where it
+// needs to replace a directory that is already present with a newly-extracted
+// package.
+//
+// If the returned diagnostics contains errors then the module installation
+// may have wholly or partially completed. Modules must be loaded in order
+// to find their dependencies, so this function does many of the same checks
+// as LoadConfig as a side-effect.
+//
+// If successful (the returned diagnostics contains no errors) then the
+// first return value is the early configuration tree that was constructed by
+// the installation process.
+func (i *ModuleInstaller) InstallModules(rootDir string, upgrade bool, hooks ModuleInstallHooks) (*earlyconfig.Config, tfdiags.Diagnostics) {
+        log.Printf("[TRACE] ModuleInstaller: installing child modules for %s into %s", rootDir, i.modsDir)
+
+        rootMod, diags := earlyconfig.LoadModule(rootDir)
+        if rootMod == nil {
+                return nil, diags
+        }
+
+        manifest, err := modsdir.ReadManifestSnapshotForDir(i.modsDir)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to read modules manifest file",
+                        fmt.Sprintf("Error reading manifest for %s: %s.", i.modsDir, err),
+                ))
+                return nil, diags
+        }
+
+        getter := reusingGetter{}
+        cfg, instDiags := i.installDescendentModules(rootMod, rootDir, manifest, upgrade, hooks, getter)
+        diags = append(diags, instDiags...)
+
+        return cfg, diags
+}
+
+func (i *ModuleInstaller) installDescendentModules(rootMod *tfconfig.Module, rootDir string, manifest modsdir.Manifest, upgrade bool, hooks ModuleInstallHooks, getter reusingGetter) (*earlyconfig.Config, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        if hooks == nil {
+                // Use our no-op implementation as a placeholder
+                hooks = ModuleInstallHooksImpl{}
+        }
+
+        // Create a manifest record for the root module. This will be used if
+        // there are any relative-pathed modules in the root.
+        manifest[""] = modsdir.Record{
+                Key: "",
+                Dir: rootDir,
+        }
+
+        cfg, cDiags := earlyconfig.BuildConfig(rootMod, earlyconfig.ModuleWalkerFunc(
+                func(req *earlyconfig.ModuleRequest) (*tfconfig.Module, *version.Version, tfdiags.Diagnostics) {
+
+                        key := manifest.ModuleKey(req.Path)
+                        instPath := i.packageInstallPath(req.Path)
+
+                        log.Printf("[DEBUG] Module installer: begin %s", key)
+
+                        // First we'll check if we need to upgrade/replace an existing
+                        // installed module, and delete it out of the way if so.
+                        replace := upgrade
+                        if !replace {
+                                record, recorded := manifest[key]
+                                switch {
+                                case !recorded:
+                                        log.Printf("[TRACE] ModuleInstaller: %s is not yet installed", key)
+                                        replace = true
+                                case record.SourceAddr != req.SourceAddr:
+                                        log.Printf("[TRACE] ModuleInstaller: %s source address has changed from %q to %q", key, record.SourceAddr, req.SourceAddr)
+                                        replace = true
+                                case record.Version != nil && !req.VersionConstraints.Check(record.Version):
+                                        log.Printf("[TRACE] ModuleInstaller: %s version %s no longer compatible with constraints %s", key, record.Version, req.VersionConstraints)
+                                        replace = true
+                                }
+                        }
+
+                        // If we _are_ planning to replace this module, then we'll remove
+                        // it now so our installation code below won't conflict with any
+                        // existing remnants.
+                        if replace {
+                                if _, recorded := manifest[key]; recorded {
+                                        log.Printf("[TRACE] ModuleInstaller: discarding previous record of %s prior to reinstall", key)
+                                }
+                                delete(manifest, key)
+                                // Deleting a module invalidates all of its descendent modules too.
+                                keyPrefix := key + "."
+                                for subKey := range manifest {
+                                        if strings.HasPrefix(subKey, keyPrefix) {
+                                                if _, recorded := manifest[subKey]; recorded {
+                                                        log.Printf("[TRACE] ModuleInstaller: also discarding downstream %s", subKey)
+                                                }
+                                                delete(manifest, subKey)
+                                        }
+                                }
+                        }
+
+                        record, recorded := manifest[key]
+                        if !recorded {
+                                // Clean up any stale cache directory that might be present.
+                                // If this is a local (relative) source then the dir will
+                                // not exist, but we'll ignore that.
+                                log.Printf("[TRACE] ModuleInstaller: cleaning directory %s prior to install of %s", instPath, key)
+                                err := os.RemoveAll(instPath)
+                                if err != nil && !os.IsNotExist(err) {
+                                        log.Printf("[TRACE] ModuleInstaller: failed to remove %s: %s", key, err)
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Failed to remove local module cache",
+                                                fmt.Sprintf(
+                                                        "Terraform tried to remove %s in order to reinstall this module, but encountered an error: %s",
+                                                        instPath, err,
+                                                ),
+                                        ))
+                                        return nil, nil, diags
+                                }
+                        } else {
+                                // If this module is already recorded and its root directory
+                                // exists then we will just load what's already there and
+                                // keep our existing record.
+                                info, err := os.Stat(record.Dir)
+                                if err == nil && info.IsDir() {
+                                        mod, mDiags := earlyconfig.LoadModule(record.Dir)
+                                        diags = diags.Append(mDiags)
+
+                                        log.Printf("[TRACE] ModuleInstaller: Module installer: %s %s already installed in %s", key, record.Version, record.Dir)
+                                        return mod, record.Version, diags
+                                }
+                        }
+
+                        // If we get down here then it's finally time to actually install
+                        // the module. There are some variants to this process depending
+                        // on what type of module source address we have.
+                        switch {
+
+                        case isLocalSourceAddr(req.SourceAddr):
+                                log.Printf("[TRACE] ModuleInstaller: %s has local path %q", key, req.SourceAddr)
+                                mod, mDiags := i.installLocalModule(req, key, manifest, hooks)
+                                diags = append(diags, mDiags...)
+                                return mod, nil, diags
+
+                        case isRegistrySourceAddr(req.SourceAddr):
+                                addr, err := regsrc.ParseModuleSource(req.SourceAddr)
+                                if err != nil {
+                                        // Should never happen because isRegistrySourceAddr already validated
+                                        panic(err)
+                                }
+                                log.Printf("[TRACE] ModuleInstaller: %s is a registry module at %s", key, addr)
+
+                                mod, v, mDiags := i.installRegistryModule(req, key, instPath, addr, manifest, hooks, getter)
+                                diags = append(diags, mDiags...)
+                                return mod, v, diags
+
+                        default:
+                                log.Printf("[TRACE] ModuleInstaller: %s address %q will be handled by go-getter", key, req.SourceAddr)
+
+                                mod, mDiags := i.installGoGetterModule(req, key, instPath, manifest, hooks, getter)
+                                diags = append(diags, mDiags...)
+                                return mod, nil, diags
+                        }
+
+                },
+        ))
+        diags = append(diags, cDiags...)
+
+        err := manifest.WriteSnapshotToDir(i.modsDir)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to update module manifest",
+                        fmt.Sprintf("Unable to write the module manifest file: %s", err),
+                ))
+        }
+
+        return cfg, diags
+}
+
+func (i *ModuleInstaller) installLocalModule(req *earlyconfig.ModuleRequest, key string, manifest modsdir.Manifest, hooks ModuleInstallHooks) (*tfconfig.Module, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        parentKey := manifest.ModuleKey(req.Parent.Path)
+        parentRecord, recorded := manifest[parentKey]
+        if !recorded {
+                // This is indicative of a bug rather than a user-actionable error
+                panic(fmt.Errorf("missing manifest record for parent module %s", parentKey))
+        }
+
+        if len(req.VersionConstraints) != 0 {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Invalid version constraint",
+                        fmt.Sprintf("Cannot apply a version constraint to module %q (at %s:%d) because it has a relative local path.", req.Name, req.CallPos.Filename, req.CallPos.Line),
+                ))
+        }
+
+        // For local sources we don't actually need to modify the
+        // filesystem at all because the parent already wrote
+        // the files we need, and so we just load up what's already here.
+        newDir := filepath.Join(parentRecord.Dir, req.SourceAddr)
+
+        log.Printf("[TRACE] ModuleInstaller: %s uses directory from parent: %s", key, newDir)
+        // it is possible that the local directory is a symlink
+        newDir, err := filepath.EvalSymlinks(newDir)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Unreadable module directory",
+                        fmt.Sprintf("Unable to evaluate directory symlink: %s", err.Error()),
+                ))
+        }
+
+        mod, mDiags := earlyconfig.LoadModule(newDir)
+        if mod == nil {
+                // nil indicates missing or unreadable directory, so we'll
+                // discard the returned diags and return a more specific
+                // error message here.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Unreadable module directory",
+                        fmt.Sprintf("The directory %s could not be read for module %q at %s:%d.", newDir, req.Name, req.CallPos.Filename, req.CallPos.Line),
+                ))
+        } else {
+                diags = diags.Append(mDiags)
+        }
+
+        // Note the local location in our manifest.
+        manifest[key] = modsdir.Record{
+                Key:        key,
+                Dir:        newDir,
+                SourceAddr: req.SourceAddr,
+        }
+        log.Printf("[DEBUG] Module installer: %s installed at %s", key, newDir)
+        hooks.Install(key, nil, newDir)
+
+        return mod, diags
+}
+
+func (i *ModuleInstaller) installRegistryModule(req *earlyconfig.ModuleRequest, key string, instPath string, addr *regsrc.Module, manifest modsdir.Manifest, hooks ModuleInstallHooks, getter reusingGetter) (*tfconfig.Module, *version.Version, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        hostname, err := addr.SvcHost()
+        if err != nil {
+                // If it looks like the user was trying to use punycode then we'll generate
+                // a specialized error for that case. We require the unicode form of
+                // hostname so that hostnames are always human-readable in configuration
+                // and punycode can't be used to hide a malicious module hostname.
+                if strings.HasPrefix(addr.RawHost.Raw, "xn--") {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid module registry hostname",
+                                fmt.Sprintf("The hostname portion of the module %q source address (at %s:%d) is not an acceptable hostname. Internationalized domain names must be given in unicode form rather than ASCII (\"punycode\") form.", req.Name, req.CallPos.Filename, req.CallPos.Line),
+                        ))
+                } else {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid module registry hostname",
+                                fmt.Sprintf("The hostname portion of the module %q source address (at %s:%d) is not a valid hostname.", req.Name, req.CallPos.Filename, req.CallPos.Line),
+                        ))
+                }
+                return nil, nil, diags
+        }
+
+        reg := i.reg
+
+        log.Printf("[DEBUG] %s listing available versions of %s at %s", key, addr, hostname)
+        resp, err := reg.ModuleVersions(addr)
+        if err != nil {
+                if registry.IsModuleNotFound(err) {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Module not found",
+                                fmt.Sprintf("Module %q (from %s:%d) cannot be found in the module registry at %s.", req.Name, req.CallPos.Filename, req.CallPos.Line, hostname),
+                        ))
+                } else {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Error accessing remote module registry",
+                                fmt.Sprintf("Failed to retrieve available versions for module %q (%s:%d) from %s: %s.", req.Name, req.CallPos.Filename, req.CallPos.Line, hostname, err),
+                        ))
+                }
+                return nil, nil, diags
+        }
+
+        // The response might contain information about dependencies to allow us
+        // to potentially optimize future requests, but we don't currently do that
+        // and so for now we'll just take the first item which is guaranteed to
+        // be the address we requested.
+        if len(resp.Modules) < 1 {
+                // Should never happen, but since this is a remote service that may
+                // be implemented by third-parties we will handle it gracefully.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Invalid response from remote module registry",
+                        fmt.Sprintf("The registry at %s returned an invalid response when Terraform requested available versions for module %q (%s:%d).", hostname, req.Name, req.CallPos.Filename, req.CallPos.Line),
+                ))
+                return nil, nil, diags
+        }
+
+        modMeta := resp.Modules[0]
+
+        var latestMatch *version.Version
+        var latestVersion *version.Version
+        for _, mv := range modMeta.Versions {
+                v, err := version.NewVersion(mv.Version)
+                if err != nil {
+                        // Should never happen if the registry server is compliant with
+                        // the protocol, but we'll warn if not to assist someone who
+                        // might be developing a module registry server.
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Warning,
+                                "Invalid response from remote module registry",
+                                fmt.Sprintf("The registry at %s returned an invalid version string %q for module %q (%s:%d), which Terraform ignored.", hostname, mv.Version, req.Name, req.CallPos.Filename, req.CallPos.Line),
+                        ))
+                        continue
+                }
+
+                // If we've found a pre-release version then we'll ignore it unless
+                // it was exactly requested.
+                if v.Prerelease() != "" && req.VersionConstraints.String() != v.String() {
+                        log.Printf("[TRACE] ModuleInstaller: %s ignoring %s because it is a pre-release and was not requested exactly", key, v)
+                        continue
+                }
+
+                if latestVersion == nil || v.GreaterThan(latestVersion) {
+                        latestVersion = v
+                }
+
+                if req.VersionConstraints.Check(v) {
+                        if latestMatch == nil || v.GreaterThan(latestMatch) {
+                                latestMatch = v
+                        }
+                }
+        }
+
+        if latestVersion == nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Module has no versions",
+                        fmt.Sprintf("Module %q (%s:%d) has no versions available on %s.", addr, req.CallPos.Filename, req.CallPos.Line, hostname),
+                ))
+                return nil, nil, diags
+        }
+
+        if latestMatch == nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Unresolvable module version constraint",
+                        fmt.Sprintf("There is no available version of module %q (%s:%d) which matches the given version constraint. The newest available version is %s.", addr, req.CallPos.Filename, req.CallPos.Line, latestVersion),
+                ))
+                return nil, nil, diags
+        }
+
+        // Report up to the caller that we're about to start downloading.
+        packageAddr, _ := splitAddrSubdir(req.SourceAddr)
+        hooks.Download(key, packageAddr, latestMatch)
+
+        // If we manage to get down here then we've found a suitable version to
+        // install, so we need to ask the registry where we should download it from.
+        // The response to this is a go-getter-style address string.
+        dlAddr, err := reg.ModuleLocation(addr, latestMatch.String())
+        if err != nil {
+                log.Printf("[ERROR] %s from %s %s: %s", key, addr, latestMatch, err)
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Invalid response from remote module registry",
+                        fmt.Sprintf("The remote registry at %s failed to return a download URL for %s %s.", hostname, addr, latestMatch),
+                ))
+                return nil, nil, diags
+        }
+
+        log.Printf("[TRACE] ModuleInstaller: %s %s %s is available at %q", key, addr, latestMatch, dlAddr)
+
+        modDir, err := getter.getWithGoGetter(instPath, dlAddr)
+        if err != nil {
+                // Errors returned by go-getter have very inconsistent quality as
+                // end-user error messages, but for now we're accepting that because
+                // we have no way to recognize any specific errors to improve them
+                // and masking the error entirely would hide valuable diagnostic
+                // information from the user.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to download module",
+                        fmt.Sprintf("Could not download module %q (%s:%d) source code from %q: %s.", req.Name, req.CallPos.Filename, req.CallPos.Line, dlAddr, err),
+                ))
+                return nil, nil, diags
+        }
+
+        log.Printf("[TRACE] ModuleInstaller: %s %q was downloaded to %s", key, dlAddr, modDir)
+
+        if addr.RawSubmodule != "" {
+                // Append the user's requested subdirectory to any subdirectory that
+                // was implied by any of the nested layers we expanded within go-getter.
+                modDir = filepath.Join(modDir, addr.RawSubmodule)
+        }
+
+        log.Printf("[TRACE] ModuleInstaller: %s should now be at %s", key, modDir)
+
+        // Finally we are ready to try actually loading the module.
+        mod, mDiags := earlyconfig.LoadModule(modDir)
+        if mod == nil {
+                // nil indicates missing or unreadable directory, so we'll
+                // discard the returned diags and return a more specific
+                // error message here. For registry modules this actually
+                // indicates a bug in the code above, since it's not the
+                // user's responsibility to create the directory in this case.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Unreadable module directory",
+                        fmt.Sprintf("The directory %s could not be read. This is a bug in Terraform and should be reported.", modDir),
+                ))
+        } else {
+                diags = append(diags, mDiags...)
+        }
+
+        // Note the local location in our manifest.
+        manifest[key] = modsdir.Record{
+                Key:        key,
+                Version:    latestMatch,
+                Dir:        modDir,
+                SourceAddr: req.SourceAddr,
+        }
+        log.Printf("[DEBUG] Module installer: %s installed at %s", key, modDir)
+        hooks.Install(key, latestMatch, modDir)
+
+        return mod, latestMatch, diags
+}
+
+func (i *ModuleInstaller) installGoGetterModule(req *earlyconfig.ModuleRequest, key string, instPath string, manifest modsdir.Manifest, hooks ModuleInstallHooks, getter reusingGetter) (*tfconfig.Module, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // Report up to the caller that we're about to start downloading.
+        packageAddr, _ := splitAddrSubdir(req.SourceAddr)
+        hooks.Download(key, packageAddr, nil)
+
+        if len(req.VersionConstraints) != 0 {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Invalid version constraint",
+                        fmt.Sprintf("Cannot apply a version constraint to module %q (at %s:%d) because it has a non Registry URL.", req.Name, req.CallPos.Filename, req.CallPos.Line),
+                ))
+                return nil, diags
+        }
+
+        modDir, err := getter.getWithGoGetter(instPath, req.SourceAddr)
+        if err != nil {
+                if _, ok := err.(*MaybeRelativePathErr); ok {
+                        log.Printf(
+                                "[TRACE] ModuleInstaller: %s looks like a local path but is missing ./ or ../",
+                                req.SourceAddr,
+                        )
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Module not found",
+                                fmt.Sprintf(
+                                        "The module address %q could not be resolved.\n\n"+
+                                                "If you intended this as a path relative to the current "+
+                                                "module, use \"./%s\" instead. The \"./\" prefix "+
+                                                "indicates that the address is a relative filesystem path.",
+                                        req.SourceAddr, req.SourceAddr,
+                                ),
+                        ))
+                } else {
+                        // Errors returned by go-getter have very inconsistent quality as
+                        // end-user error messages, but for now we're accepting that because
+                        // we have no way to recognize any specific errors to improve them
+                        // and masking the error entirely would hide valuable diagnostic
+                        // information from the user.
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to download module",
+                                fmt.Sprintf("Could not download module %q (%s:%d) source code from %q: %s", req.Name, req.CallPos.Filename, req.CallPos.Line, packageAddr, err),
+                        ))
+                }
+                return nil, diags
+
+        }
+
+        log.Printf("[TRACE] ModuleInstaller: %s %q was downloaded to %s", key, req.SourceAddr, modDir)
+
+        mod, mDiags := earlyconfig.LoadModule(modDir)
+        if mod == nil {
+                // nil indicates missing or unreadable directory, so we'll
+                // discard the returned diags and return a more specific
+                // error message here. For go-getter modules this actually
+                // indicates a bug in the code above, since it's not the
+                // user's responsibility to create the directory in this case.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Unreadable module directory",
+                        fmt.Sprintf("The directory %s could not be read. This is a bug in Terraform and should be reported.", modDir),
+                ))
+        } else {
+                diags = append(diags, mDiags...)
+        }
+
+        // Note the local location in our manifest.
+        manifest[key] = modsdir.Record{
+                Key:        key,
+                Dir:        modDir,
+                SourceAddr: req.SourceAddr,
+        }
+        log.Printf("[DEBUG] Module installer: %s installed at %s", key, modDir)
+        hooks.Install(key, nil, modDir)
+
+        return mod, diags
+}
+
+func (i *ModuleInstaller) packageInstallPath(modulePath addrs.Module) string {
+        return filepath.Join(i.modsDir, strings.Join(modulePath, "."))
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/module_install_hooks.go b/vendor/github.com/hashicorp/terraform/internal/initwd/module_install_hooks.go
new file mode 100644
index 0000000..817a6dc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/module_install_hooks.go
@@ -0,0 +1,36 @@
+package initwd
+
+import (
+        version "github.com/hashicorp/go-version"
+)
+
+// ModuleInstallHooks is an interface used to provide notifications about the
+// installation process being orchestrated by InstallModules.
+//
+// This interface may have new methods added in future, so implementers should
+// embed InstallHooksImpl to get no-op implementations of any unimplemented
+// methods.
+type ModuleInstallHooks interface {
+        // Download is called for modules that are retrieved from a remote source
+        // before that download begins, to allow a caller to give feedback
+        // on progress through a possibly-long sequence of downloads.
+        Download(moduleAddr, packageAddr string, version *version.Version)
+
+        // Install is called for each module that is installed, even if it did
+        // not need to be downloaded from a remote source.
+        Install(moduleAddr string, version *version.Version, localPath string)
+}
+
+// ModuleInstallHooksImpl is a do-nothing implementation of InstallHooks that
+// can be embedded in another implementation struct to allow only partial
+// implementation of the interface.
+type ModuleInstallHooksImpl struct {
+}
+
+func (h ModuleInstallHooksImpl) Download(moduleAddr, packageAddr string, version *version.Version) {
+}
+
+func (h ModuleInstallHooksImpl) Install(moduleAddr string, version *version.Version, localPath string) {
+}
+
+var _ ModuleInstallHooks = ModuleInstallHooksImpl{}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/testing.go b/vendor/github.com/hashicorp/terraform/internal/initwd/testing.go
new file mode 100644
index 0000000..8cef80a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/testing.go
@@ -0,0 +1,73 @@
+package initwd
+
+import (
+        "github.com/hashicorp/terraform/registry"
+        "testing"
+
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configload"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// LoadConfigForTests is a convenience wrapper around configload.NewLoaderForTests,
+// ModuleInstaller.InstallModules and configload.Loader.LoadConfig that allows
+// a test configuration to be loaded in a single step.
+//
+// If module installation fails, t.Fatal (or similar) is called to halt
+// execution of the test, under the assumption that installation failures are
+// not expected. If installation failures _are_ expected then use
+// NewLoaderForTests and work with the loader object directly. If module
+// installation succeeds but generates warnings, these warnings are discarded.
+//
+// If installation succeeds but errors are detected during loading then a
+// possibly-incomplete config is returned along with error diagnostics. The
+// test run is not aborted in this case, so that the caller can make assertions
+// against the returned diagnostics.
+//
+// As with NewLoaderForTests, a cleanup function is returned which must be
+// called before the test completes in order to remove the temporary
+// modules directory.
+func LoadConfigForTests(t *testing.T, rootDir string) (*configs.Config, *configload.Loader, func(), tfdiags.Diagnostics) {
+        t.Helper()
+
+        var diags tfdiags.Diagnostics
+
+        loader, cleanup := configload.NewLoaderForTests(t)
+        inst := NewModuleInstaller(loader.ModulesDir(), registry.NewClient(nil, nil))
+
+        _, moreDiags := inst.InstallModules(rootDir, true, ModuleInstallHooksImpl{})
+        diags = diags.Append(moreDiags)
+        if diags.HasErrors() {
+                cleanup()
+                t.Fatal(diags.Err())
+                return nil, nil, func() {}, diags
+        }
+
+        // Since module installer has modified the module manifest on disk, we need
+        // to refresh the cache of it in the loader.
+        if err := loader.RefreshModules(); err != nil {
+                t.Fatalf("failed to refresh modules after installation: %s", err)
+        }
+
+        config, hclDiags := loader.LoadConfig(rootDir)
+        diags = diags.Append(hclDiags)
+        return config, loader, cleanup, diags
+}
+
+// MustLoadConfigForTests is a variant of LoadConfigForTests which calls
+// t.Fatal (or similar) if there are any errors during loading, and thus
+// does not return diagnostics at all.
+//
+// This is useful for concisely writing tests that don't expect errors at
+// all. For tests that expect errors and need to assert against them, use
+// LoadConfigForTests instead.
+func MustLoadConfigForTests(t *testing.T, rootDir string) (*configs.Config, *configload.Loader, func()) {
+        t.Helper()
+
+        config, loader, cleanup, diags := LoadConfigForTests(t, rootDir)
+        if diags.HasErrors() {
+                cleanup()
+                t.Fatal(diags.Err())
+        }
+        return config, loader, cleanup
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/initwd/version_required.go b/vendor/github.com/hashicorp/terraform/internal/initwd/version_required.go
new file mode 100644
index 0000000..104840b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/initwd/version_required.go
@@ -0,0 +1,83 @@
+package initwd
+
+import (
+        "fmt"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform/internal/earlyconfig"
+        "github.com/hashicorp/terraform/tfdiags"
+        tfversion "github.com/hashicorp/terraform/version"
+)
+
+// CheckCoreVersionRequirements visits each of the modules in the given
+// early configuration tree and verifies that any given Core version constraints
+// match with the version of Terraform Core that is being used.
+//
+// The returned diagnostics will contain errors if any constraints do not match.
+// The returned diagnostics might also return warnings, which should be
+// displayed to the user.
+func CheckCoreVersionRequirements(earlyConfig *earlyconfig.Config) tfdiags.Diagnostics {
+        if earlyConfig == nil {
+                return nil
+        }
+
+        var diags tfdiags.Diagnostics
+        module := earlyConfig.Module
+
+        var constraints version.Constraints
+        for _, constraintStr := range module.RequiredCore {
+                constraint, err := version.NewConstraint(constraintStr)
+                if err != nil {
+                        // Unfortunately the early config parser doesn't preserve a source
+                        // location for this, so we're unable to indicate a specific
+                        // location where this constraint came from, but we can at least
+                        // say which module set it.
+                        switch {
+                        case len(earlyConfig.Path) == 0:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid provider version constraint",
+                                        fmt.Sprintf("Invalid version core constraint %q in the root module.", constraintStr),
+                                ))
+                        default:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid provider version constraint",
+                                        fmt.Sprintf("Invalid version core constraint %q in %s.", constraintStr, earlyConfig.Path),
+                                ))
+                        }
+                        continue
+                }
+                constraints = append(constraints, constraint...)
+        }
+
+        if !constraints.Check(tfversion.SemVer) {
+                switch {
+                case len(earlyConfig.Path) == 0:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Unsupported Terraform Core version",
+                                fmt.Sprintf(
+                                        "This configuration does not support Terraform version %s. To proceed, either choose another supported Terraform version or update the root module's version constraint. Version constraints are normally set for good reason, so updating the constraint may lead to other errors or unexpected behavior.",
+                                        tfversion.String(),
+                                ),
+                        ))
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Unsupported Terraform Core version",
+                                fmt.Sprintf(
+                                        "Module %s (from %q) does not support Terraform version %s. To proceed, either choose another supported Terraform version or update the module's version constraint. Version constraints are normally set for good reason, so updating the constraint may lead to other errors or unexpected behavior.",
+                                        earlyConfig.Path, earlyConfig.SourceAddr, tfversion.String(),
+                                ),
+                        ))
+                }
+        }
+
+        for _, c := range earlyConfig.Children {
+                childDiags := CheckCoreVersionRequirements(c)
+                diags = diags.Append(childDiags)
+        }
+
+        return diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/modsdir/doc.go b/vendor/github.com/hashicorp/terraform/internal/modsdir/doc.go
new file mode 100644
index 0000000..0d7d664
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/modsdir/doc.go
@@ -0,0 +1,3 @@
+// Package modsdir is an internal package containing the model types used to
+// represent the manifest of modules in a local modules cache directory.
+package modsdir
diff --git a/vendor/github.com/hashicorp/terraform/internal/modsdir/manifest.go b/vendor/github.com/hashicorp/terraform/internal/modsdir/manifest.go
new file mode 100644
index 0000000..36f6c03
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/modsdir/manifest.go
@@ -0,0 +1,138 @@
+package modsdir
+
+import (
+        "encoding/json"
+        "fmt"
+        "io"
+        "io/ioutil"
+        "log"
+        "os"
+        "path/filepath"
+
+        version "github.com/hashicorp/go-version"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Record represents some metadata about an installed module, as part
+// of a ModuleManifest.
+type Record struct {
+        // Key is a unique identifier for this particular module, based on its
+        // position within the static module tree.
+        Key string `json:"Key"`
+
+        // SourceAddr is the source address given for this module in configuration.
+        // This is used only to detect if the source was changed in configuration
+        // since the module was last installed, which means that the installer
+        // must re-install it.
+        SourceAddr string `json:"Source"`
+
+        // Version is the exact version of the module, which results from parsing
+        // VersionStr. nil for un-versioned modules.
+        Version *version.Version `json:"-"`
+
+        // VersionStr is the version specifier string. This is used only for
+        // serialization in snapshots and should not be accessed or updated
+        // by any other codepaths; use "Version" instead.
+        VersionStr string `json:"Version,omitempty"`
+
+        // Dir is the path to the local directory where the module is installed.
+        Dir string `json:"Dir"`
+}
+
+// Manifest is a map used to keep track of the filesystem locations
+// and other metadata about installed modules.
+//
+// The configuration loader refers to this, while the module installer updates
+// it to reflect any changes to the installed modules.
+type Manifest map[string]Record
+
+func (m Manifest) ModuleKey(path addrs.Module) string {
+        return path.String()
+}
+
+// manifestSnapshotFile is an internal struct used only to assist in our JSON
+// serialization of manifest snapshots. It should not be used for any other
+// purpose.
+type manifestSnapshotFile struct {
+        Records []Record `json:"Modules"`
+}
+
+func ReadManifestSnapshot(r io.Reader) (Manifest, error) {
+        src, err := ioutil.ReadAll(r)
+        if err != nil {
+                return nil, err
+        }
+
+        if len(src) == 0 {
+                // This should never happen, but we'll tolerate it as if it were
+                // a valid empty JSON object.
+                return make(Manifest), nil
+        }
+
+        var read manifestSnapshotFile
+        err = json.Unmarshal(src, &read)
+
+        new := make(Manifest)
+        for _, record := range read.Records {
+                if record.VersionStr != "" {
+                        record.Version, err = version.NewVersion(record.VersionStr)
+                        if err != nil {
+                                return nil, fmt.Errorf("invalid version %q for %s: %s", record.VersionStr, record.Key, err)
+                        }
+                }
+                if _, exists := new[record.Key]; exists {
+                        // This should never happen in any valid file, so we'll catch it
+                        // and report it to avoid confusing/undefined behavior if the
+                        // snapshot file was edited incorrectly outside of Terraform.
+                        return nil, fmt.Errorf("snapshot file contains two records for path %s", record.Key)
+                }
+                new[record.Key] = record
+        }
+        return new, nil
+}
+
+func ReadManifestSnapshotForDir(dir string) (Manifest, error) {
+        fn := filepath.Join(dir, ManifestSnapshotFilename)
+        r, err := os.Open(fn)
+        if err != nil {
+                if os.IsNotExist(err) {
+                        return make(Manifest), nil // missing file is okay and treated as empty
+                }
+                return nil, err
+        }
+        return ReadManifestSnapshot(r)
+}
+
+func (m Manifest) WriteSnapshot(w io.Writer) error {
+        var write manifestSnapshotFile
+
+        for _, record := range m {
+                // Make sure VersionStr is in sync with Version, since we encourage
+                // callers to manipulate Version and ignore VersionStr.
+                if record.Version != nil {
+                        record.VersionStr = record.Version.String()
+                } else {
+                        record.VersionStr = ""
+                }
+                write.Records = append(write.Records, record)
+        }
+
+        src, err := json.Marshal(write)
+        if err != nil {
+                return err
+        }
+
+        _, err = w.Write(src)
+        return err
+}
+
+func (m Manifest) WriteSnapshotToDir(dir string) error {
+        fn := filepath.Join(dir, ManifestSnapshotFilename)
+        log.Printf("[TRACE] modsdir: writing modules manifest to %s", fn)
+        w, err := os.Create(fn)
+        if err != nil {
+                return err
+        }
+        return m.WriteSnapshot(w)
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/modsdir/paths.go b/vendor/github.com/hashicorp/terraform/internal/modsdir/paths.go
new file mode 100644
index 0000000..9ebb524
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/modsdir/paths.go
@@ -0,0 +1,3 @@
+package modsdir
+
+const ManifestSnapshotFilename = "modules.json"
diff --git a/vendor/github.com/hashicorp/terraform/internal/tfplugin5/generate.sh b/vendor/github.com/hashicorp/terraform/internal/tfplugin5/generate.sh
new file mode 100644
index 0000000..de1d693
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/tfplugin5/generate.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+# We do not run protoc under go:generate because we want to ensure that all
+# dependencies of go:generate are "go get"-able for general dev environment
+# usability. To compile all protobuf files in this repository, run
+# "make protobuf" at the top-level.
+
+set -eu
+
+SOURCE="${BASH_SOURCE[0]}"
+while [ -h "$SOURCE" ] ; do SOURCE="$(readlink "$SOURCE")"; done
+DIR="$( cd -P "$( dirname "$SOURCE" )" && pwd )"
+
+cd "$DIR"
+
+protoc -I ./ tfplugin5.proto --go_out=plugins=grpc:./
diff --git a/vendor/github.com/hashicorp/terraform/internal/tfplugin5/tfplugin5.pb.go b/vendor/github.com/hashicorp/terraform/internal/tfplugin5/tfplugin5.pb.go
new file mode 100644
index 0000000..87a6bec
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/tfplugin5/tfplugin5.pb.go
@@ -0,0 +1,3455 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// source: tfplugin5.proto
+
+package tfplugin5
+
+import proto "github.com/golang/protobuf/proto"
+import fmt "fmt"
+import math "math"
+
+import (
+        context "golang.org/x/net/context"
+        grpc "google.golang.org/grpc"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
+
+type Diagnostic_Severity int32
+
+const (
+        Diagnostic_INVALID Diagnostic_Severity = 0
+        Diagnostic_ERROR   Diagnostic_Severity = 1
+        Diagnostic_WARNING Diagnostic_Severity = 2
+)
+
+var Diagnostic_Severity_name = map[int32]string{
+        0: "INVALID",
+        1: "ERROR",
+        2: "WARNING",
+}
+var Diagnostic_Severity_value = map[string]int32{
+        "INVALID": 0,
+        "ERROR":   1,
+        "WARNING": 2,
+}
+
+func (x Diagnostic_Severity) String() string {
+        return proto.EnumName(Diagnostic_Severity_name, int32(x))
+}
+func (Diagnostic_Severity) EnumDescriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{1, 0}
+}
+
+type Schema_NestedBlock_NestingMode int32
+
+const (
+        Schema_NestedBlock_INVALID Schema_NestedBlock_NestingMode = 0
+        Schema_NestedBlock_SINGLE  Schema_NestedBlock_NestingMode = 1
+        Schema_NestedBlock_LIST    Schema_NestedBlock_NestingMode = 2
+        Schema_NestedBlock_SET     Schema_NestedBlock_NestingMode = 3
+        Schema_NestedBlock_MAP     Schema_NestedBlock_NestingMode = 4
+        Schema_NestedBlock_GROUP   Schema_NestedBlock_NestingMode = 5
+)
+
+var Schema_NestedBlock_NestingMode_name = map[int32]string{
+        0: "INVALID",
+        1: "SINGLE",
+        2: "LIST",
+        3: "SET",
+        4: "MAP",
+        5: "GROUP",
+}
+var Schema_NestedBlock_NestingMode_value = map[string]int32{
+        "INVALID": 0,
+        "SINGLE":  1,
+        "LIST":    2,
+        "SET":     3,
+        "MAP":     4,
+        "GROUP":   5,
+}
+
+func (x Schema_NestedBlock_NestingMode) String() string {
+        return proto.EnumName(Schema_NestedBlock_NestingMode_name, int32(x))
+}
+func (Schema_NestedBlock_NestingMode) EnumDescriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{5, 2, 0}
+}
+
+// DynamicValue is an opaque encoding of terraform data, with the field name
+// indicating the encoding scheme used.
+type DynamicValue struct {
+        Msgpack              []byte   `protobuf:"bytes,1,opt,name=msgpack,proto3" json:"msgpack,omitempty"`
+        Json                 []byte   `protobuf:"bytes,2,opt,name=json,proto3" json:"json,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *DynamicValue) Reset()         { *m = DynamicValue{} }
+func (m *DynamicValue) String() string { return proto.CompactTextString(m) }
+func (*DynamicValue) ProtoMessage()    {}
+func (*DynamicValue) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{0}
+}
+func (m *DynamicValue) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_DynamicValue.Unmarshal(m, b)
+}
+func (m *DynamicValue) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_DynamicValue.Marshal(b, m, deterministic)
+}
+func (dst *DynamicValue) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_DynamicValue.Merge(dst, src)
+}
+func (m *DynamicValue) XXX_Size() int {
+        return xxx_messageInfo_DynamicValue.Size(m)
+}
+func (m *DynamicValue) XXX_DiscardUnknown() {
+        xxx_messageInfo_DynamicValue.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_DynamicValue proto.InternalMessageInfo
+
+func (m *DynamicValue) GetMsgpack() []byte {
+        if m != nil {
+                return m.Msgpack
+        }
+        return nil
+}
+
+func (m *DynamicValue) GetJson() []byte {
+        if m != nil {
+                return m.Json
+        }
+        return nil
+}
+
+type Diagnostic struct {
+        Severity             Diagnostic_Severity `protobuf:"varint,1,opt,name=severity,proto3,enum=tfplugin5.Diagnostic_Severity" json:"severity,omitempty"`
+        Summary              string              `protobuf:"bytes,2,opt,name=summary,proto3" json:"summary,omitempty"`
+        Detail               string              `protobuf:"bytes,3,opt,name=detail,proto3" json:"detail,omitempty"`
+        Attribute            *AttributePath      `protobuf:"bytes,4,opt,name=attribute,proto3" json:"attribute,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}            `json:"-"`
+        XXX_unrecognized     []byte              `json:"-"`
+        XXX_sizecache        int32               `json:"-"`
+}
+
+func (m *Diagnostic) Reset()         { *m = Diagnostic{} }
+func (m *Diagnostic) String() string { return proto.CompactTextString(m) }
+func (*Diagnostic) ProtoMessage()    {}
+func (*Diagnostic) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{1}
+}
+func (m *Diagnostic) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Diagnostic.Unmarshal(m, b)
+}
+func (m *Diagnostic) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Diagnostic.Marshal(b, m, deterministic)
+}
+func (dst *Diagnostic) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Diagnostic.Merge(dst, src)
+}
+func (m *Diagnostic) XXX_Size() int {
+        return xxx_messageInfo_Diagnostic.Size(m)
+}
+func (m *Diagnostic) XXX_DiscardUnknown() {
+        xxx_messageInfo_Diagnostic.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Diagnostic proto.InternalMessageInfo
+
+func (m *Diagnostic) GetSeverity() Diagnostic_Severity {
+        if m != nil {
+                return m.Severity
+        }
+        return Diagnostic_INVALID
+}
+
+func (m *Diagnostic) GetSummary() string {
+        if m != nil {
+                return m.Summary
+        }
+        return ""
+}
+
+func (m *Diagnostic) GetDetail() string {
+        if m != nil {
+                return m.Detail
+        }
+        return ""
+}
+
+func (m *Diagnostic) GetAttribute() *AttributePath {
+        if m != nil {
+                return m.Attribute
+        }
+        return nil
+}
+
+type AttributePath struct {
+        Steps                []*AttributePath_Step `protobuf:"bytes,1,rep,name=steps,proto3" json:"steps,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}              `json:"-"`
+        XXX_unrecognized     []byte                `json:"-"`
+        XXX_sizecache        int32                 `json:"-"`
+}
+
+func (m *AttributePath) Reset()         { *m = AttributePath{} }
+func (m *AttributePath) String() string { return proto.CompactTextString(m) }
+func (*AttributePath) ProtoMessage()    {}
+func (*AttributePath) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{2}
+}
+func (m *AttributePath) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_AttributePath.Unmarshal(m, b)
+}
+func (m *AttributePath) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_AttributePath.Marshal(b, m, deterministic)
+}
+func (dst *AttributePath) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_AttributePath.Merge(dst, src)
+}
+func (m *AttributePath) XXX_Size() int {
+        return xxx_messageInfo_AttributePath.Size(m)
+}
+func (m *AttributePath) XXX_DiscardUnknown() {
+        xxx_messageInfo_AttributePath.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_AttributePath proto.InternalMessageInfo
+
+func (m *AttributePath) GetSteps() []*AttributePath_Step {
+        if m != nil {
+                return m.Steps
+        }
+        return nil
+}
+
+type AttributePath_Step struct {
+        // Types that are valid to be assigned to Selector:
+        //      *AttributePath_Step_AttributeName
+        //      *AttributePath_Step_ElementKeyString
+        //      *AttributePath_Step_ElementKeyInt
+        Selector             isAttributePath_Step_Selector `protobuf_oneof:"selector"`
+        XXX_NoUnkeyedLiteral struct{}                      `json:"-"`
+        XXX_unrecognized     []byte                        `json:"-"`
+        XXX_sizecache        int32                         `json:"-"`
+}
+
+func (m *AttributePath_Step) Reset()         { *m = AttributePath_Step{} }
+func (m *AttributePath_Step) String() string { return proto.CompactTextString(m) }
+func (*AttributePath_Step) ProtoMessage()    {}
+func (*AttributePath_Step) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{2, 0}
+}
+func (m *AttributePath_Step) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_AttributePath_Step.Unmarshal(m, b)
+}
+func (m *AttributePath_Step) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_AttributePath_Step.Marshal(b, m, deterministic)
+}
+func (dst *AttributePath_Step) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_AttributePath_Step.Merge(dst, src)
+}
+func (m *AttributePath_Step) XXX_Size() int {
+        return xxx_messageInfo_AttributePath_Step.Size(m)
+}
+func (m *AttributePath_Step) XXX_DiscardUnknown() {
+        xxx_messageInfo_AttributePath_Step.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_AttributePath_Step proto.InternalMessageInfo
+
+type isAttributePath_Step_Selector interface {
+        isAttributePath_Step_Selector()
+}
+
+type AttributePath_Step_AttributeName struct {
+        AttributeName string `protobuf:"bytes,1,opt,name=attribute_name,json=attributeName,proto3,oneof"`
+}
+
+type AttributePath_Step_ElementKeyString struct {
+        ElementKeyString string `protobuf:"bytes,2,opt,name=element_key_string,json=elementKeyString,proto3,oneof"`
+}
+
+type AttributePath_Step_ElementKeyInt struct {
+        ElementKeyInt int64 `protobuf:"varint,3,opt,name=element_key_int,json=elementKeyInt,proto3,oneof"`
+}
+
+func (*AttributePath_Step_AttributeName) isAttributePath_Step_Selector() {}
+
+func (*AttributePath_Step_ElementKeyString) isAttributePath_Step_Selector() {}
+
+func (*AttributePath_Step_ElementKeyInt) isAttributePath_Step_Selector() {}
+
+func (m *AttributePath_Step) GetSelector() isAttributePath_Step_Selector {
+        if m != nil {
+                return m.Selector
+        }
+        return nil
+}
+
+func (m *AttributePath_Step) GetAttributeName() string {
+        if x, ok := m.GetSelector().(*AttributePath_Step_AttributeName); ok {
+                return x.AttributeName
+        }
+        return ""
+}
+
+func (m *AttributePath_Step) GetElementKeyString() string {
+        if x, ok := m.GetSelector().(*AttributePath_Step_ElementKeyString); ok {
+                return x.ElementKeyString
+        }
+        return ""
+}
+
+func (m *AttributePath_Step) GetElementKeyInt() int64 {
+        if x, ok := m.GetSelector().(*AttributePath_Step_ElementKeyInt); ok {
+                return x.ElementKeyInt
+        }
+        return 0
+}
+
+// XXX_OneofFuncs is for the internal use of the proto package.
+func (*AttributePath_Step) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
+        return _AttributePath_Step_OneofMarshaler, _AttributePath_Step_OneofUnmarshaler, _AttributePath_Step_OneofSizer, []interface{}{
+                (*AttributePath_Step_AttributeName)(nil),
+                (*AttributePath_Step_ElementKeyString)(nil),
+                (*AttributePath_Step_ElementKeyInt)(nil),
+        }
+}
+
+func _AttributePath_Step_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
+        m := msg.(*AttributePath_Step)
+        // selector
+        switch x := m.Selector.(type) {
+        case *AttributePath_Step_AttributeName:
+                b.EncodeVarint(1<<3 | proto.WireBytes)
+                b.EncodeStringBytes(x.AttributeName)
+        case *AttributePath_Step_ElementKeyString:
+                b.EncodeVarint(2<<3 | proto.WireBytes)
+                b.EncodeStringBytes(x.ElementKeyString)
+        case *AttributePath_Step_ElementKeyInt:
+                b.EncodeVarint(3<<3 | proto.WireVarint)
+                b.EncodeVarint(uint64(x.ElementKeyInt))
+        case nil:
+        default:
+                return fmt.Errorf("AttributePath_Step.Selector has unexpected type %T", x)
+        }
+        return nil
+}
+
+func _AttributePath_Step_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
+        m := msg.(*AttributePath_Step)
+        switch tag {
+        case 1: // selector.attribute_name
+                if wire != proto.WireBytes {
+                        return true, proto.ErrInternalBadWireType
+                }
+                x, err := b.DecodeStringBytes()
+                m.Selector = &AttributePath_Step_AttributeName{x}
+                return true, err
+        case 2: // selector.element_key_string
+                if wire != proto.WireBytes {
+                        return true, proto.ErrInternalBadWireType
+                }
+                x, err := b.DecodeStringBytes()
+                m.Selector = &AttributePath_Step_ElementKeyString{x}
+                return true, err
+        case 3: // selector.element_key_int
+                if wire != proto.WireVarint {
+                        return true, proto.ErrInternalBadWireType
+                }
+                x, err := b.DecodeVarint()
+                m.Selector = &AttributePath_Step_ElementKeyInt{int64(x)}
+                return true, err
+        default:
+                return false, nil
+        }
+}
+
+func _AttributePath_Step_OneofSizer(msg proto.Message) (n int) {
+        m := msg.(*AttributePath_Step)
+        // selector
+        switch x := m.Selector.(type) {
+        case *AttributePath_Step_AttributeName:
+                n += 1 // tag and wire
+                n += proto.SizeVarint(uint64(len(x.AttributeName)))
+                n += len(x.AttributeName)
+        case *AttributePath_Step_ElementKeyString:
+                n += 1 // tag and wire
+                n += proto.SizeVarint(uint64(len(x.ElementKeyString)))
+                n += len(x.ElementKeyString)
+        case *AttributePath_Step_ElementKeyInt:
+                n += 1 // tag and wire
+                n += proto.SizeVarint(uint64(x.ElementKeyInt))
+        case nil:
+        default:
+                panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
+        }
+        return n
+}
+
+type Stop struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Stop) Reset()         { *m = Stop{} }
+func (m *Stop) String() string { return proto.CompactTextString(m) }
+func (*Stop) ProtoMessage()    {}
+func (*Stop) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{3}
+}
+func (m *Stop) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Stop.Unmarshal(m, b)
+}
+func (m *Stop) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Stop.Marshal(b, m, deterministic)
+}
+func (dst *Stop) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Stop.Merge(dst, src)
+}
+func (m *Stop) XXX_Size() int {
+        return xxx_messageInfo_Stop.Size(m)
+}
+func (m *Stop) XXX_DiscardUnknown() {
+        xxx_messageInfo_Stop.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Stop proto.InternalMessageInfo
+
+type Stop_Request struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Stop_Request) Reset()         { *m = Stop_Request{} }
+func (m *Stop_Request) String() string { return proto.CompactTextString(m) }
+func (*Stop_Request) ProtoMessage()    {}
+func (*Stop_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{3, 0}
+}
+func (m *Stop_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Stop_Request.Unmarshal(m, b)
+}
+func (m *Stop_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Stop_Request.Marshal(b, m, deterministic)
+}
+func (dst *Stop_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Stop_Request.Merge(dst, src)
+}
+func (m *Stop_Request) XXX_Size() int {
+        return xxx_messageInfo_Stop_Request.Size(m)
+}
+func (m *Stop_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_Stop_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Stop_Request proto.InternalMessageInfo
+
+type Stop_Response struct {
+        Error                string   `protobuf:"bytes,1,opt,name=Error,proto3" json:"Error,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Stop_Response) Reset()         { *m = Stop_Response{} }
+func (m *Stop_Response) String() string { return proto.CompactTextString(m) }
+func (*Stop_Response) ProtoMessage()    {}
+func (*Stop_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{3, 1}
+}
+func (m *Stop_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Stop_Response.Unmarshal(m, b)
+}
+func (m *Stop_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Stop_Response.Marshal(b, m, deterministic)
+}
+func (dst *Stop_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Stop_Response.Merge(dst, src)
+}
+func (m *Stop_Response) XXX_Size() int {
+        return xxx_messageInfo_Stop_Response.Size(m)
+}
+func (m *Stop_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_Stop_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Stop_Response proto.InternalMessageInfo
+
+func (m *Stop_Response) GetError() string {
+        if m != nil {
+                return m.Error
+        }
+        return ""
+}
+
+// RawState holds the stored state for a resource to be upgraded by the
+// provider. It can be in one of two formats, the current json encoded format
+// in bytes, or the legacy flatmap format as a map of strings.
+type RawState struct {
+        Json                 []byte            `protobuf:"bytes,1,opt,name=json,proto3" json:"json,omitempty"`
+        Flatmap              map[string]string `protobuf:"bytes,2,rep,name=flatmap,proto3" json:"flatmap,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+        XXX_NoUnkeyedLiteral struct{}          `json:"-"`
+        XXX_unrecognized     []byte            `json:"-"`
+        XXX_sizecache        int32             `json:"-"`
+}
+
+func (m *RawState) Reset()         { *m = RawState{} }
+func (m *RawState) String() string { return proto.CompactTextString(m) }
+func (*RawState) ProtoMessage()    {}
+func (*RawState) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{4}
+}
+func (m *RawState) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_RawState.Unmarshal(m, b)
+}
+func (m *RawState) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_RawState.Marshal(b, m, deterministic)
+}
+func (dst *RawState) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_RawState.Merge(dst, src)
+}
+func (m *RawState) XXX_Size() int {
+        return xxx_messageInfo_RawState.Size(m)
+}
+func (m *RawState) XXX_DiscardUnknown() {
+        xxx_messageInfo_RawState.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_RawState proto.InternalMessageInfo
+
+func (m *RawState) GetJson() []byte {
+        if m != nil {
+                return m.Json
+        }
+        return nil
+}
+
+func (m *RawState) GetFlatmap() map[string]string {
+        if m != nil {
+                return m.Flatmap
+        }
+        return nil
+}
+
+// Schema is the configuration schema for a Resource, Provider, or Provisioner.
+type Schema struct {
+        // The version of the schema.
+        // Schemas are versioned, so that providers can upgrade a saved resource
+        // state when the schema is changed.
+        Version int64 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
+        // Block is the top level configuration block for this schema.
+        Block                *Schema_Block `protobuf:"bytes,2,opt,name=block,proto3" json:"block,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *Schema) Reset()         { *m = Schema{} }
+func (m *Schema) String() string { return proto.CompactTextString(m) }
+func (*Schema) ProtoMessage()    {}
+func (*Schema) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{5}
+}
+func (m *Schema) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Schema.Unmarshal(m, b)
+}
+func (m *Schema) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Schema.Marshal(b, m, deterministic)
+}
+func (dst *Schema) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Schema.Merge(dst, src)
+}
+func (m *Schema) XXX_Size() int {
+        return xxx_messageInfo_Schema.Size(m)
+}
+func (m *Schema) XXX_DiscardUnknown() {
+        xxx_messageInfo_Schema.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Schema proto.InternalMessageInfo
+
+func (m *Schema) GetVersion() int64 {
+        if m != nil {
+                return m.Version
+        }
+        return 0
+}
+
+func (m *Schema) GetBlock() *Schema_Block {
+        if m != nil {
+                return m.Block
+        }
+        return nil
+}
+
+type Schema_Block struct {
+        Version              int64                 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
+        Attributes           []*Schema_Attribute   `protobuf:"bytes,2,rep,name=attributes,proto3" json:"attributes,omitempty"`
+        BlockTypes           []*Schema_NestedBlock `protobuf:"bytes,3,rep,name=block_types,json=blockTypes,proto3" json:"block_types,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}              `json:"-"`
+        XXX_unrecognized     []byte                `json:"-"`
+        XXX_sizecache        int32                 `json:"-"`
+}
+
+func (m *Schema_Block) Reset()         { *m = Schema_Block{} }
+func (m *Schema_Block) String() string { return proto.CompactTextString(m) }
+func (*Schema_Block) ProtoMessage()    {}
+func (*Schema_Block) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{5, 0}
+}
+func (m *Schema_Block) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Schema_Block.Unmarshal(m, b)
+}
+func (m *Schema_Block) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Schema_Block.Marshal(b, m, deterministic)
+}
+func (dst *Schema_Block) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Schema_Block.Merge(dst, src)
+}
+func (m *Schema_Block) XXX_Size() int {
+        return xxx_messageInfo_Schema_Block.Size(m)
+}
+func (m *Schema_Block) XXX_DiscardUnknown() {
+        xxx_messageInfo_Schema_Block.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Schema_Block proto.InternalMessageInfo
+
+func (m *Schema_Block) GetVersion() int64 {
+        if m != nil {
+                return m.Version
+        }
+        return 0
+}
+
+func (m *Schema_Block) GetAttributes() []*Schema_Attribute {
+        if m != nil {
+                return m.Attributes
+        }
+        return nil
+}
+
+func (m *Schema_Block) GetBlockTypes() []*Schema_NestedBlock {
+        if m != nil {
+                return m.BlockTypes
+        }
+        return nil
+}
+
+type Schema_Attribute struct {
+        Name                 string   `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+        Type                 []byte   `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"`
+        Description          string   `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
+        Required             bool     `protobuf:"varint,4,opt,name=required,proto3" json:"required,omitempty"`
+        Optional             bool     `protobuf:"varint,5,opt,name=optional,proto3" json:"optional,omitempty"`
+        Computed             bool     `protobuf:"varint,6,opt,name=computed,proto3" json:"computed,omitempty"`
+        Sensitive            bool     `protobuf:"varint,7,opt,name=sensitive,proto3" json:"sensitive,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Schema_Attribute) Reset()         { *m = Schema_Attribute{} }
+func (m *Schema_Attribute) String() string { return proto.CompactTextString(m) }
+func (*Schema_Attribute) ProtoMessage()    {}
+func (*Schema_Attribute) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{5, 1}
+}
+func (m *Schema_Attribute) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Schema_Attribute.Unmarshal(m, b)
+}
+func (m *Schema_Attribute) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Schema_Attribute.Marshal(b, m, deterministic)
+}
+func (dst *Schema_Attribute) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Schema_Attribute.Merge(dst, src)
+}
+func (m *Schema_Attribute) XXX_Size() int {
+        return xxx_messageInfo_Schema_Attribute.Size(m)
+}
+func (m *Schema_Attribute) XXX_DiscardUnknown() {
+        xxx_messageInfo_Schema_Attribute.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Schema_Attribute proto.InternalMessageInfo
+
+func (m *Schema_Attribute) GetName() string {
+        if m != nil {
+                return m.Name
+        }
+        return ""
+}
+
+func (m *Schema_Attribute) GetType() []byte {
+        if m != nil {
+                return m.Type
+        }
+        return nil
+}
+
+func (m *Schema_Attribute) GetDescription() string {
+        if m != nil {
+                return m.Description
+        }
+        return ""
+}
+
+func (m *Schema_Attribute) GetRequired() bool {
+        if m != nil {
+                return m.Required
+        }
+        return false
+}
+
+func (m *Schema_Attribute) GetOptional() bool {
+        if m != nil {
+                return m.Optional
+        }
+        return false
+}
+
+func (m *Schema_Attribute) GetComputed() bool {
+        if m != nil {
+                return m.Computed
+        }
+        return false
+}
+
+func (m *Schema_Attribute) GetSensitive() bool {
+        if m != nil {
+                return m.Sensitive
+        }
+        return false
+}
+
+type Schema_NestedBlock struct {
+        TypeName             string                         `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        Block                *Schema_Block                  `protobuf:"bytes,2,opt,name=block,proto3" json:"block,omitempty"`
+        Nesting              Schema_NestedBlock_NestingMode `protobuf:"varint,3,opt,name=nesting,proto3,enum=tfplugin5.Schema_NestedBlock_NestingMode" json:"nesting,omitempty"`
+        MinItems             int64                          `protobuf:"varint,4,opt,name=min_items,json=minItems,proto3" json:"min_items,omitempty"`
+        MaxItems             int64                          `protobuf:"varint,5,opt,name=max_items,json=maxItems,proto3" json:"max_items,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}                       `json:"-"`
+        XXX_unrecognized     []byte                         `json:"-"`
+        XXX_sizecache        int32                          `json:"-"`
+}
+
+func (m *Schema_NestedBlock) Reset()         { *m = Schema_NestedBlock{} }
+func (m *Schema_NestedBlock) String() string { return proto.CompactTextString(m) }
+func (*Schema_NestedBlock) ProtoMessage()    {}
+func (*Schema_NestedBlock) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{5, 2}
+}
+func (m *Schema_NestedBlock) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Schema_NestedBlock.Unmarshal(m, b)
+}
+func (m *Schema_NestedBlock) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Schema_NestedBlock.Marshal(b, m, deterministic)
+}
+func (dst *Schema_NestedBlock) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Schema_NestedBlock.Merge(dst, src)
+}
+func (m *Schema_NestedBlock) XXX_Size() int {
+        return xxx_messageInfo_Schema_NestedBlock.Size(m)
+}
+func (m *Schema_NestedBlock) XXX_DiscardUnknown() {
+        xxx_messageInfo_Schema_NestedBlock.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Schema_NestedBlock proto.InternalMessageInfo
+
+func (m *Schema_NestedBlock) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *Schema_NestedBlock) GetBlock() *Schema_Block {
+        if m != nil {
+                return m.Block
+        }
+        return nil
+}
+
+func (m *Schema_NestedBlock) GetNesting() Schema_NestedBlock_NestingMode {
+        if m != nil {
+                return m.Nesting
+        }
+        return Schema_NestedBlock_INVALID
+}
+
+func (m *Schema_NestedBlock) GetMinItems() int64 {
+        if m != nil {
+                return m.MinItems
+        }
+        return 0
+}
+
+func (m *Schema_NestedBlock) GetMaxItems() int64 {
+        if m != nil {
+                return m.MaxItems
+        }
+        return 0
+}
+
+type GetProviderSchema struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *GetProviderSchema) Reset()         { *m = GetProviderSchema{} }
+func (m *GetProviderSchema) String() string { return proto.CompactTextString(m) }
+func (*GetProviderSchema) ProtoMessage()    {}
+func (*GetProviderSchema) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{6}
+}
+func (m *GetProviderSchema) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_GetProviderSchema.Unmarshal(m, b)
+}
+func (m *GetProviderSchema) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_GetProviderSchema.Marshal(b, m, deterministic)
+}
+func (dst *GetProviderSchema) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_GetProviderSchema.Merge(dst, src)
+}
+func (m *GetProviderSchema) XXX_Size() int {
+        return xxx_messageInfo_GetProviderSchema.Size(m)
+}
+func (m *GetProviderSchema) XXX_DiscardUnknown() {
+        xxx_messageInfo_GetProviderSchema.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GetProviderSchema proto.InternalMessageInfo
+
+type GetProviderSchema_Request struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *GetProviderSchema_Request) Reset()         { *m = GetProviderSchema_Request{} }
+func (m *GetProviderSchema_Request) String() string { return proto.CompactTextString(m) }
+func (*GetProviderSchema_Request) ProtoMessage()    {}
+func (*GetProviderSchema_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{6, 0}
+}
+func (m *GetProviderSchema_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_GetProviderSchema_Request.Unmarshal(m, b)
+}
+func (m *GetProviderSchema_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_GetProviderSchema_Request.Marshal(b, m, deterministic)
+}
+func (dst *GetProviderSchema_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_GetProviderSchema_Request.Merge(dst, src)
+}
+func (m *GetProviderSchema_Request) XXX_Size() int {
+        return xxx_messageInfo_GetProviderSchema_Request.Size(m)
+}
+func (m *GetProviderSchema_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_GetProviderSchema_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GetProviderSchema_Request proto.InternalMessageInfo
+
+type GetProviderSchema_Response struct {
+        Provider             *Schema            `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
+        ResourceSchemas      map[string]*Schema `protobuf:"bytes,2,rep,name=resource_schemas,json=resourceSchemas,proto3" json:"resource_schemas,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+        DataSourceSchemas    map[string]*Schema `protobuf:"bytes,3,rep,name=data_source_schemas,json=dataSourceSchemas,proto3" json:"data_source_schemas,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+        Diagnostics          []*Diagnostic      `protobuf:"bytes,4,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}           `json:"-"`
+        XXX_unrecognized     []byte             `json:"-"`
+        XXX_sizecache        int32              `json:"-"`
+}
+
+func (m *GetProviderSchema_Response) Reset()         { *m = GetProviderSchema_Response{} }
+func (m *GetProviderSchema_Response) String() string { return proto.CompactTextString(m) }
+func (*GetProviderSchema_Response) ProtoMessage()    {}
+func (*GetProviderSchema_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{6, 1}
+}
+func (m *GetProviderSchema_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_GetProviderSchema_Response.Unmarshal(m, b)
+}
+func (m *GetProviderSchema_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_GetProviderSchema_Response.Marshal(b, m, deterministic)
+}
+func (dst *GetProviderSchema_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_GetProviderSchema_Response.Merge(dst, src)
+}
+func (m *GetProviderSchema_Response) XXX_Size() int {
+        return xxx_messageInfo_GetProviderSchema_Response.Size(m)
+}
+func (m *GetProviderSchema_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_GetProviderSchema_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GetProviderSchema_Response proto.InternalMessageInfo
+
+func (m *GetProviderSchema_Response) GetProvider() *Schema {
+        if m != nil {
+                return m.Provider
+        }
+        return nil
+}
+
+func (m *GetProviderSchema_Response) GetResourceSchemas() map[string]*Schema {
+        if m != nil {
+                return m.ResourceSchemas
+        }
+        return nil
+}
+
+func (m *GetProviderSchema_Response) GetDataSourceSchemas() map[string]*Schema {
+        if m != nil {
+                return m.DataSourceSchemas
+        }
+        return nil
+}
+
+func (m *GetProviderSchema_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type PrepareProviderConfig struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *PrepareProviderConfig) Reset()         { *m = PrepareProviderConfig{} }
+func (m *PrepareProviderConfig) String() string { return proto.CompactTextString(m) }
+func (*PrepareProviderConfig) ProtoMessage()    {}
+func (*PrepareProviderConfig) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{7}
+}
+func (m *PrepareProviderConfig) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_PrepareProviderConfig.Unmarshal(m, b)
+}
+func (m *PrepareProviderConfig) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_PrepareProviderConfig.Marshal(b, m, deterministic)
+}
+func (dst *PrepareProviderConfig) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_PrepareProviderConfig.Merge(dst, src)
+}
+func (m *PrepareProviderConfig) XXX_Size() int {
+        return xxx_messageInfo_PrepareProviderConfig.Size(m)
+}
+func (m *PrepareProviderConfig) XXX_DiscardUnknown() {
+        xxx_messageInfo_PrepareProviderConfig.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PrepareProviderConfig proto.InternalMessageInfo
+
+type PrepareProviderConfig_Request struct {
+        Config               *DynamicValue `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *PrepareProviderConfig_Request) Reset()         { *m = PrepareProviderConfig_Request{} }
+func (m *PrepareProviderConfig_Request) String() string { return proto.CompactTextString(m) }
+func (*PrepareProviderConfig_Request) ProtoMessage()    {}
+func (*PrepareProviderConfig_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{7, 0}
+}
+func (m *PrepareProviderConfig_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_PrepareProviderConfig_Request.Unmarshal(m, b)
+}
+func (m *PrepareProviderConfig_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_PrepareProviderConfig_Request.Marshal(b, m, deterministic)
+}
+func (dst *PrepareProviderConfig_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_PrepareProviderConfig_Request.Merge(dst, src)
+}
+func (m *PrepareProviderConfig_Request) XXX_Size() int {
+        return xxx_messageInfo_PrepareProviderConfig_Request.Size(m)
+}
+func (m *PrepareProviderConfig_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_PrepareProviderConfig_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PrepareProviderConfig_Request proto.InternalMessageInfo
+
+func (m *PrepareProviderConfig_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+type PrepareProviderConfig_Response struct {
+        PreparedConfig       *DynamicValue `protobuf:"bytes,1,opt,name=prepared_config,json=preparedConfig,proto3" json:"prepared_config,omitempty"`
+        Diagnostics          []*Diagnostic `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *PrepareProviderConfig_Response) Reset()         { *m = PrepareProviderConfig_Response{} }
+func (m *PrepareProviderConfig_Response) String() string { return proto.CompactTextString(m) }
+func (*PrepareProviderConfig_Response) ProtoMessage()    {}
+func (*PrepareProviderConfig_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{7, 1}
+}
+func (m *PrepareProviderConfig_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_PrepareProviderConfig_Response.Unmarshal(m, b)
+}
+func (m *PrepareProviderConfig_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_PrepareProviderConfig_Response.Marshal(b, m, deterministic)
+}
+func (dst *PrepareProviderConfig_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_PrepareProviderConfig_Response.Merge(dst, src)
+}
+func (m *PrepareProviderConfig_Response) XXX_Size() int {
+        return xxx_messageInfo_PrepareProviderConfig_Response.Size(m)
+}
+func (m *PrepareProviderConfig_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_PrepareProviderConfig_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PrepareProviderConfig_Response proto.InternalMessageInfo
+
+func (m *PrepareProviderConfig_Response) GetPreparedConfig() *DynamicValue {
+        if m != nil {
+                return m.PreparedConfig
+        }
+        return nil
+}
+
+func (m *PrepareProviderConfig_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type UpgradeResourceState struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *UpgradeResourceState) Reset()         { *m = UpgradeResourceState{} }
+func (m *UpgradeResourceState) String() string { return proto.CompactTextString(m) }
+func (*UpgradeResourceState) ProtoMessage()    {}
+func (*UpgradeResourceState) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{8}
+}
+func (m *UpgradeResourceState) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_UpgradeResourceState.Unmarshal(m, b)
+}
+func (m *UpgradeResourceState) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_UpgradeResourceState.Marshal(b, m, deterministic)
+}
+func (dst *UpgradeResourceState) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_UpgradeResourceState.Merge(dst, src)
+}
+func (m *UpgradeResourceState) XXX_Size() int {
+        return xxx_messageInfo_UpgradeResourceState.Size(m)
+}
+func (m *UpgradeResourceState) XXX_DiscardUnknown() {
+        xxx_messageInfo_UpgradeResourceState.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_UpgradeResourceState proto.InternalMessageInfo
+
+type UpgradeResourceState_Request struct {
+        TypeName string `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        // version is the schema_version number recorded in the state file
+        Version int64 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
+        // raw_state is the raw states as stored for the resource.  Core does
+        // not have access to the schema of prior_version, so it's the
+        // provider's responsibility to interpret this value using the
+        // appropriate older schema. The raw_state will be the json encoded
+        // state, or a legacy flat-mapped format.
+        RawState             *RawState `protobuf:"bytes,3,opt,name=raw_state,json=rawState,proto3" json:"raw_state,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}  `json:"-"`
+        XXX_unrecognized     []byte    `json:"-"`
+        XXX_sizecache        int32     `json:"-"`
+}
+
+func (m *UpgradeResourceState_Request) Reset()         { *m = UpgradeResourceState_Request{} }
+func (m *UpgradeResourceState_Request) String() string { return proto.CompactTextString(m) }
+func (*UpgradeResourceState_Request) ProtoMessage()    {}
+func (*UpgradeResourceState_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{8, 0}
+}
+func (m *UpgradeResourceState_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_UpgradeResourceState_Request.Unmarshal(m, b)
+}
+func (m *UpgradeResourceState_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_UpgradeResourceState_Request.Marshal(b, m, deterministic)
+}
+func (dst *UpgradeResourceState_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_UpgradeResourceState_Request.Merge(dst, src)
+}
+func (m *UpgradeResourceState_Request) XXX_Size() int {
+        return xxx_messageInfo_UpgradeResourceState_Request.Size(m)
+}
+func (m *UpgradeResourceState_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_UpgradeResourceState_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_UpgradeResourceState_Request proto.InternalMessageInfo
+
+func (m *UpgradeResourceState_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *UpgradeResourceState_Request) GetVersion() int64 {
+        if m != nil {
+                return m.Version
+        }
+        return 0
+}
+
+func (m *UpgradeResourceState_Request) GetRawState() *RawState {
+        if m != nil {
+                return m.RawState
+        }
+        return nil
+}
+
+type UpgradeResourceState_Response struct {
+        // new_state is a msgpack-encoded data structure that, when interpreted with
+        // the _current_ schema for this resource type, is functionally equivalent to
+        // that which was given in prior_state_raw.
+        UpgradedState *DynamicValue `protobuf:"bytes,1,opt,name=upgraded_state,json=upgradedState,proto3" json:"upgraded_state,omitempty"`
+        // diagnostics describes any errors encountered during migration that could not
+        // be safely resolved, and warnings about any possibly-risky assumptions made
+        // in the upgrade process.
+        Diagnostics          []*Diagnostic `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *UpgradeResourceState_Response) Reset()         { *m = UpgradeResourceState_Response{} }
+func (m *UpgradeResourceState_Response) String() string { return proto.CompactTextString(m) }
+func (*UpgradeResourceState_Response) ProtoMessage()    {}
+func (*UpgradeResourceState_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{8, 1}
+}
+func (m *UpgradeResourceState_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_UpgradeResourceState_Response.Unmarshal(m, b)
+}
+func (m *UpgradeResourceState_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_UpgradeResourceState_Response.Marshal(b, m, deterministic)
+}
+func (dst *UpgradeResourceState_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_UpgradeResourceState_Response.Merge(dst, src)
+}
+func (m *UpgradeResourceState_Response) XXX_Size() int {
+        return xxx_messageInfo_UpgradeResourceState_Response.Size(m)
+}
+func (m *UpgradeResourceState_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_UpgradeResourceState_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_UpgradeResourceState_Response proto.InternalMessageInfo
+
+func (m *UpgradeResourceState_Response) GetUpgradedState() *DynamicValue {
+        if m != nil {
+                return m.UpgradedState
+        }
+        return nil
+}
+
+func (m *UpgradeResourceState_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type ValidateResourceTypeConfig struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ValidateResourceTypeConfig) Reset()         { *m = ValidateResourceTypeConfig{} }
+func (m *ValidateResourceTypeConfig) String() string { return proto.CompactTextString(m) }
+func (*ValidateResourceTypeConfig) ProtoMessage()    {}
+func (*ValidateResourceTypeConfig) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{9}
+}
+func (m *ValidateResourceTypeConfig) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateResourceTypeConfig.Unmarshal(m, b)
+}
+func (m *ValidateResourceTypeConfig) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateResourceTypeConfig.Marshal(b, m, deterministic)
+}
+func (dst *ValidateResourceTypeConfig) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateResourceTypeConfig.Merge(dst, src)
+}
+func (m *ValidateResourceTypeConfig) XXX_Size() int {
+        return xxx_messageInfo_ValidateResourceTypeConfig.Size(m)
+}
+func (m *ValidateResourceTypeConfig) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateResourceTypeConfig.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateResourceTypeConfig proto.InternalMessageInfo
+
+type ValidateResourceTypeConfig_Request struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        Config               *DynamicValue `protobuf:"bytes,2,opt,name=config,proto3" json:"config,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ValidateResourceTypeConfig_Request) Reset()         { *m = ValidateResourceTypeConfig_Request{} }
+func (m *ValidateResourceTypeConfig_Request) String() string { return proto.CompactTextString(m) }
+func (*ValidateResourceTypeConfig_Request) ProtoMessage()    {}
+func (*ValidateResourceTypeConfig_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{9, 0}
+}
+func (m *ValidateResourceTypeConfig_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateResourceTypeConfig_Request.Unmarshal(m, b)
+}
+func (m *ValidateResourceTypeConfig_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateResourceTypeConfig_Request.Marshal(b, m, deterministic)
+}
+func (dst *ValidateResourceTypeConfig_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateResourceTypeConfig_Request.Merge(dst, src)
+}
+func (m *ValidateResourceTypeConfig_Request) XXX_Size() int {
+        return xxx_messageInfo_ValidateResourceTypeConfig_Request.Size(m)
+}
+func (m *ValidateResourceTypeConfig_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateResourceTypeConfig_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateResourceTypeConfig_Request proto.InternalMessageInfo
+
+func (m *ValidateResourceTypeConfig_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ValidateResourceTypeConfig_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+type ValidateResourceTypeConfig_Response struct {
+        Diagnostics          []*Diagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ValidateResourceTypeConfig_Response) Reset()         { *m = ValidateResourceTypeConfig_Response{} }
+func (m *ValidateResourceTypeConfig_Response) String() string { return proto.CompactTextString(m) }
+func (*ValidateResourceTypeConfig_Response) ProtoMessage()    {}
+func (*ValidateResourceTypeConfig_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{9, 1}
+}
+func (m *ValidateResourceTypeConfig_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateResourceTypeConfig_Response.Unmarshal(m, b)
+}
+func (m *ValidateResourceTypeConfig_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateResourceTypeConfig_Response.Marshal(b, m, deterministic)
+}
+func (dst *ValidateResourceTypeConfig_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateResourceTypeConfig_Response.Merge(dst, src)
+}
+func (m *ValidateResourceTypeConfig_Response) XXX_Size() int {
+        return xxx_messageInfo_ValidateResourceTypeConfig_Response.Size(m)
+}
+func (m *ValidateResourceTypeConfig_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateResourceTypeConfig_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateResourceTypeConfig_Response proto.InternalMessageInfo
+
+func (m *ValidateResourceTypeConfig_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type ValidateDataSourceConfig struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ValidateDataSourceConfig) Reset()         { *m = ValidateDataSourceConfig{} }
+func (m *ValidateDataSourceConfig) String() string { return proto.CompactTextString(m) }
+func (*ValidateDataSourceConfig) ProtoMessage()    {}
+func (*ValidateDataSourceConfig) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{10}
+}
+func (m *ValidateDataSourceConfig) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateDataSourceConfig.Unmarshal(m, b)
+}
+func (m *ValidateDataSourceConfig) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateDataSourceConfig.Marshal(b, m, deterministic)
+}
+func (dst *ValidateDataSourceConfig) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateDataSourceConfig.Merge(dst, src)
+}
+func (m *ValidateDataSourceConfig) XXX_Size() int {
+        return xxx_messageInfo_ValidateDataSourceConfig.Size(m)
+}
+func (m *ValidateDataSourceConfig) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateDataSourceConfig.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateDataSourceConfig proto.InternalMessageInfo
+
+type ValidateDataSourceConfig_Request struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        Config               *DynamicValue `protobuf:"bytes,2,opt,name=config,proto3" json:"config,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ValidateDataSourceConfig_Request) Reset()         { *m = ValidateDataSourceConfig_Request{} }
+func (m *ValidateDataSourceConfig_Request) String() string { return proto.CompactTextString(m) }
+func (*ValidateDataSourceConfig_Request) ProtoMessage()    {}
+func (*ValidateDataSourceConfig_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{10, 0}
+}
+func (m *ValidateDataSourceConfig_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateDataSourceConfig_Request.Unmarshal(m, b)
+}
+func (m *ValidateDataSourceConfig_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateDataSourceConfig_Request.Marshal(b, m, deterministic)
+}
+func (dst *ValidateDataSourceConfig_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateDataSourceConfig_Request.Merge(dst, src)
+}
+func (m *ValidateDataSourceConfig_Request) XXX_Size() int {
+        return xxx_messageInfo_ValidateDataSourceConfig_Request.Size(m)
+}
+func (m *ValidateDataSourceConfig_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateDataSourceConfig_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateDataSourceConfig_Request proto.InternalMessageInfo
+
+func (m *ValidateDataSourceConfig_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ValidateDataSourceConfig_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+type ValidateDataSourceConfig_Response struct {
+        Diagnostics          []*Diagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ValidateDataSourceConfig_Response) Reset()         { *m = ValidateDataSourceConfig_Response{} }
+func (m *ValidateDataSourceConfig_Response) String() string { return proto.CompactTextString(m) }
+func (*ValidateDataSourceConfig_Response) ProtoMessage()    {}
+func (*ValidateDataSourceConfig_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{10, 1}
+}
+func (m *ValidateDataSourceConfig_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateDataSourceConfig_Response.Unmarshal(m, b)
+}
+func (m *ValidateDataSourceConfig_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateDataSourceConfig_Response.Marshal(b, m, deterministic)
+}
+func (dst *ValidateDataSourceConfig_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateDataSourceConfig_Response.Merge(dst, src)
+}
+func (m *ValidateDataSourceConfig_Response) XXX_Size() int {
+        return xxx_messageInfo_ValidateDataSourceConfig_Response.Size(m)
+}
+func (m *ValidateDataSourceConfig_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateDataSourceConfig_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateDataSourceConfig_Response proto.InternalMessageInfo
+
+func (m *ValidateDataSourceConfig_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type Configure struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Configure) Reset()         { *m = Configure{} }
+func (m *Configure) String() string { return proto.CompactTextString(m) }
+func (*Configure) ProtoMessage()    {}
+func (*Configure) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{11}
+}
+func (m *Configure) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Configure.Unmarshal(m, b)
+}
+func (m *Configure) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Configure.Marshal(b, m, deterministic)
+}
+func (dst *Configure) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Configure.Merge(dst, src)
+}
+func (m *Configure) XXX_Size() int {
+        return xxx_messageInfo_Configure.Size(m)
+}
+func (m *Configure) XXX_DiscardUnknown() {
+        xxx_messageInfo_Configure.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Configure proto.InternalMessageInfo
+
+type Configure_Request struct {
+        TerraformVersion     string        `protobuf:"bytes,1,opt,name=terraform_version,json=terraformVersion,proto3" json:"terraform_version,omitempty"`
+        Config               *DynamicValue `protobuf:"bytes,2,opt,name=config,proto3" json:"config,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *Configure_Request) Reset()         { *m = Configure_Request{} }
+func (m *Configure_Request) String() string { return proto.CompactTextString(m) }
+func (*Configure_Request) ProtoMessage()    {}
+func (*Configure_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{11, 0}
+}
+func (m *Configure_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Configure_Request.Unmarshal(m, b)
+}
+func (m *Configure_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Configure_Request.Marshal(b, m, deterministic)
+}
+func (dst *Configure_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Configure_Request.Merge(dst, src)
+}
+func (m *Configure_Request) XXX_Size() int {
+        return xxx_messageInfo_Configure_Request.Size(m)
+}
+func (m *Configure_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_Configure_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Configure_Request proto.InternalMessageInfo
+
+func (m *Configure_Request) GetTerraformVersion() string {
+        if m != nil {
+                return m.TerraformVersion
+        }
+        return ""
+}
+
+func (m *Configure_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+type Configure_Response struct {
+        Diagnostics          []*Diagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *Configure_Response) Reset()         { *m = Configure_Response{} }
+func (m *Configure_Response) String() string { return proto.CompactTextString(m) }
+func (*Configure_Response) ProtoMessage()    {}
+func (*Configure_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{11, 1}
+}
+func (m *Configure_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_Configure_Response.Unmarshal(m, b)
+}
+func (m *Configure_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_Configure_Response.Marshal(b, m, deterministic)
+}
+func (dst *Configure_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_Configure_Response.Merge(dst, src)
+}
+func (m *Configure_Response) XXX_Size() int {
+        return xxx_messageInfo_Configure_Response.Size(m)
+}
+func (m *Configure_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_Configure_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Configure_Response proto.InternalMessageInfo
+
+func (m *Configure_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type ReadResource struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ReadResource) Reset()         { *m = ReadResource{} }
+func (m *ReadResource) String() string { return proto.CompactTextString(m) }
+func (*ReadResource) ProtoMessage()    {}
+func (*ReadResource) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{12}
+}
+func (m *ReadResource) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ReadResource.Unmarshal(m, b)
+}
+func (m *ReadResource) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ReadResource.Marshal(b, m, deterministic)
+}
+func (dst *ReadResource) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ReadResource.Merge(dst, src)
+}
+func (m *ReadResource) XXX_Size() int {
+        return xxx_messageInfo_ReadResource.Size(m)
+}
+func (m *ReadResource) XXX_DiscardUnknown() {
+        xxx_messageInfo_ReadResource.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ReadResource proto.InternalMessageInfo
+
+type ReadResource_Request struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        CurrentState         *DynamicValue `protobuf:"bytes,2,opt,name=current_state,json=currentState,proto3" json:"current_state,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ReadResource_Request) Reset()         { *m = ReadResource_Request{} }
+func (m *ReadResource_Request) String() string { return proto.CompactTextString(m) }
+func (*ReadResource_Request) ProtoMessage()    {}
+func (*ReadResource_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{12, 0}
+}
+func (m *ReadResource_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ReadResource_Request.Unmarshal(m, b)
+}
+func (m *ReadResource_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ReadResource_Request.Marshal(b, m, deterministic)
+}
+func (dst *ReadResource_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ReadResource_Request.Merge(dst, src)
+}
+func (m *ReadResource_Request) XXX_Size() int {
+        return xxx_messageInfo_ReadResource_Request.Size(m)
+}
+func (m *ReadResource_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ReadResource_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ReadResource_Request proto.InternalMessageInfo
+
+func (m *ReadResource_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ReadResource_Request) GetCurrentState() *DynamicValue {
+        if m != nil {
+                return m.CurrentState
+        }
+        return nil
+}
+
+type ReadResource_Response struct {
+        NewState             *DynamicValue `protobuf:"bytes,1,opt,name=new_state,json=newState,proto3" json:"new_state,omitempty"`
+        Diagnostics          []*Diagnostic `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ReadResource_Response) Reset()         { *m = ReadResource_Response{} }
+func (m *ReadResource_Response) String() string { return proto.CompactTextString(m) }
+func (*ReadResource_Response) ProtoMessage()    {}
+func (*ReadResource_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{12, 1}
+}
+func (m *ReadResource_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ReadResource_Response.Unmarshal(m, b)
+}
+func (m *ReadResource_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ReadResource_Response.Marshal(b, m, deterministic)
+}
+func (dst *ReadResource_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ReadResource_Response.Merge(dst, src)
+}
+func (m *ReadResource_Response) XXX_Size() int {
+        return xxx_messageInfo_ReadResource_Response.Size(m)
+}
+func (m *ReadResource_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ReadResource_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ReadResource_Response proto.InternalMessageInfo
+
+func (m *ReadResource_Response) GetNewState() *DynamicValue {
+        if m != nil {
+                return m.NewState
+        }
+        return nil
+}
+
+func (m *ReadResource_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type PlanResourceChange struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *PlanResourceChange) Reset()         { *m = PlanResourceChange{} }
+func (m *PlanResourceChange) String() string { return proto.CompactTextString(m) }
+func (*PlanResourceChange) ProtoMessage()    {}
+func (*PlanResourceChange) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{13}
+}
+func (m *PlanResourceChange) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_PlanResourceChange.Unmarshal(m, b)
+}
+func (m *PlanResourceChange) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_PlanResourceChange.Marshal(b, m, deterministic)
+}
+func (dst *PlanResourceChange) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_PlanResourceChange.Merge(dst, src)
+}
+func (m *PlanResourceChange) XXX_Size() int {
+        return xxx_messageInfo_PlanResourceChange.Size(m)
+}
+func (m *PlanResourceChange) XXX_DiscardUnknown() {
+        xxx_messageInfo_PlanResourceChange.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PlanResourceChange proto.InternalMessageInfo
+
+type PlanResourceChange_Request struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        PriorState           *DynamicValue `protobuf:"bytes,2,opt,name=prior_state,json=priorState,proto3" json:"prior_state,omitempty"`
+        ProposedNewState     *DynamicValue `protobuf:"bytes,3,opt,name=proposed_new_state,json=proposedNewState,proto3" json:"proposed_new_state,omitempty"`
+        Config               *DynamicValue `protobuf:"bytes,4,opt,name=config,proto3" json:"config,omitempty"`
+        PriorPrivate         []byte        `protobuf:"bytes,5,opt,name=prior_private,json=priorPrivate,proto3" json:"prior_private,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *PlanResourceChange_Request) Reset()         { *m = PlanResourceChange_Request{} }
+func (m *PlanResourceChange_Request) String() string { return proto.CompactTextString(m) }
+func (*PlanResourceChange_Request) ProtoMessage()    {}
+func (*PlanResourceChange_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{13, 0}
+}
+func (m *PlanResourceChange_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_PlanResourceChange_Request.Unmarshal(m, b)
+}
+func (m *PlanResourceChange_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_PlanResourceChange_Request.Marshal(b, m, deterministic)
+}
+func (dst *PlanResourceChange_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_PlanResourceChange_Request.Merge(dst, src)
+}
+func (m *PlanResourceChange_Request) XXX_Size() int {
+        return xxx_messageInfo_PlanResourceChange_Request.Size(m)
+}
+func (m *PlanResourceChange_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_PlanResourceChange_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PlanResourceChange_Request proto.InternalMessageInfo
+
+func (m *PlanResourceChange_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *PlanResourceChange_Request) GetPriorState() *DynamicValue {
+        if m != nil {
+                return m.PriorState
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Request) GetProposedNewState() *DynamicValue {
+        if m != nil {
+                return m.ProposedNewState
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Request) GetPriorPrivate() []byte {
+        if m != nil {
+                return m.PriorPrivate
+        }
+        return nil
+}
+
+type PlanResourceChange_Response struct {
+        PlannedState    *DynamicValue    `protobuf:"bytes,1,opt,name=planned_state,json=plannedState,proto3" json:"planned_state,omitempty"`
+        RequiresReplace []*AttributePath `protobuf:"bytes,2,rep,name=requires_replace,json=requiresReplace,proto3" json:"requires_replace,omitempty"`
+        PlannedPrivate  []byte           `protobuf:"bytes,3,opt,name=planned_private,json=plannedPrivate,proto3" json:"planned_private,omitempty"`
+        Diagnostics     []*Diagnostic    `protobuf:"bytes,4,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        // This may be set only by the helper/schema "SDK" in the main Terraform
+        // repository, to request that Terraform Core >=0.12 permit additional
+        // inconsistencies that can result from the legacy SDK type system
+        // and its imprecise mapping to the >=0.12 type system.
+        // The change in behavior implied by this flag makes sense only for the
+        // specific details of the legacy SDK type system, and are not a general
+        // mechanism to avoid proper type handling in providers.
+        //
+        //     ====              DO NOT USE THIS              ====
+        //     ==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
+        //     ====              DO NOT USE THIS              ====
+        LegacyTypeSystem     bool     `protobuf:"varint,5,opt,name=legacy_type_system,json=legacyTypeSystem,proto3" json:"legacy_type_system,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *PlanResourceChange_Response) Reset()         { *m = PlanResourceChange_Response{} }
+func (m *PlanResourceChange_Response) String() string { return proto.CompactTextString(m) }
+func (*PlanResourceChange_Response) ProtoMessage()    {}
+func (*PlanResourceChange_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{13, 1}
+}
+func (m *PlanResourceChange_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_PlanResourceChange_Response.Unmarshal(m, b)
+}
+func (m *PlanResourceChange_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_PlanResourceChange_Response.Marshal(b, m, deterministic)
+}
+func (dst *PlanResourceChange_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_PlanResourceChange_Response.Merge(dst, src)
+}
+func (m *PlanResourceChange_Response) XXX_Size() int {
+        return xxx_messageInfo_PlanResourceChange_Response.Size(m)
+}
+func (m *PlanResourceChange_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_PlanResourceChange_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_PlanResourceChange_Response proto.InternalMessageInfo
+
+func (m *PlanResourceChange_Response) GetPlannedState() *DynamicValue {
+        if m != nil {
+                return m.PlannedState
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Response) GetRequiresReplace() []*AttributePath {
+        if m != nil {
+                return m.RequiresReplace
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Response) GetPlannedPrivate() []byte {
+        if m != nil {
+                return m.PlannedPrivate
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+func (m *PlanResourceChange_Response) GetLegacyTypeSystem() bool {
+        if m != nil {
+                return m.LegacyTypeSystem
+        }
+        return false
+}
+
+type ApplyResourceChange struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ApplyResourceChange) Reset()         { *m = ApplyResourceChange{} }
+func (m *ApplyResourceChange) String() string { return proto.CompactTextString(m) }
+func (*ApplyResourceChange) ProtoMessage()    {}
+func (*ApplyResourceChange) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{14}
+}
+func (m *ApplyResourceChange) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ApplyResourceChange.Unmarshal(m, b)
+}
+func (m *ApplyResourceChange) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ApplyResourceChange.Marshal(b, m, deterministic)
+}
+func (dst *ApplyResourceChange) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ApplyResourceChange.Merge(dst, src)
+}
+func (m *ApplyResourceChange) XXX_Size() int {
+        return xxx_messageInfo_ApplyResourceChange.Size(m)
+}
+func (m *ApplyResourceChange) XXX_DiscardUnknown() {
+        xxx_messageInfo_ApplyResourceChange.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ApplyResourceChange proto.InternalMessageInfo
+
+type ApplyResourceChange_Request struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        PriorState           *DynamicValue `protobuf:"bytes,2,opt,name=prior_state,json=priorState,proto3" json:"prior_state,omitempty"`
+        PlannedState         *DynamicValue `protobuf:"bytes,3,opt,name=planned_state,json=plannedState,proto3" json:"planned_state,omitempty"`
+        Config               *DynamicValue `protobuf:"bytes,4,opt,name=config,proto3" json:"config,omitempty"`
+        PlannedPrivate       []byte        `protobuf:"bytes,5,opt,name=planned_private,json=plannedPrivate,proto3" json:"planned_private,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ApplyResourceChange_Request) Reset()         { *m = ApplyResourceChange_Request{} }
+func (m *ApplyResourceChange_Request) String() string { return proto.CompactTextString(m) }
+func (*ApplyResourceChange_Request) ProtoMessage()    {}
+func (*ApplyResourceChange_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{14, 0}
+}
+func (m *ApplyResourceChange_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ApplyResourceChange_Request.Unmarshal(m, b)
+}
+func (m *ApplyResourceChange_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ApplyResourceChange_Request.Marshal(b, m, deterministic)
+}
+func (dst *ApplyResourceChange_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ApplyResourceChange_Request.Merge(dst, src)
+}
+func (m *ApplyResourceChange_Request) XXX_Size() int {
+        return xxx_messageInfo_ApplyResourceChange_Request.Size(m)
+}
+func (m *ApplyResourceChange_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ApplyResourceChange_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ApplyResourceChange_Request proto.InternalMessageInfo
+
+func (m *ApplyResourceChange_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ApplyResourceChange_Request) GetPriorState() *DynamicValue {
+        if m != nil {
+                return m.PriorState
+        }
+        return nil
+}
+
+func (m *ApplyResourceChange_Request) GetPlannedState() *DynamicValue {
+        if m != nil {
+                return m.PlannedState
+        }
+        return nil
+}
+
+func (m *ApplyResourceChange_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+func (m *ApplyResourceChange_Request) GetPlannedPrivate() []byte {
+        if m != nil {
+                return m.PlannedPrivate
+        }
+        return nil
+}
+
+type ApplyResourceChange_Response struct {
+        NewState    *DynamicValue `protobuf:"bytes,1,opt,name=new_state,json=newState,proto3" json:"new_state,omitempty"`
+        Private     []byte        `protobuf:"bytes,2,opt,name=private,proto3" json:"private,omitempty"`
+        Diagnostics []*Diagnostic `protobuf:"bytes,3,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        // This may be set only by the helper/schema "SDK" in the main Terraform
+        // repository, to request that Terraform Core >=0.12 permit additional
+        // inconsistencies that can result from the legacy SDK type system
+        // and its imprecise mapping to the >=0.12 type system.
+        // The change in behavior implied by this flag makes sense only for the
+        // specific details of the legacy SDK type system, and are not a general
+        // mechanism to avoid proper type handling in providers.
+        //
+        //     ====              DO NOT USE THIS              ====
+        //     ==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
+        //     ====              DO NOT USE THIS              ====
+        LegacyTypeSystem     bool     `protobuf:"varint,4,opt,name=legacy_type_system,json=legacyTypeSystem,proto3" json:"legacy_type_system,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ApplyResourceChange_Response) Reset()         { *m = ApplyResourceChange_Response{} }
+func (m *ApplyResourceChange_Response) String() string { return proto.CompactTextString(m) }
+func (*ApplyResourceChange_Response) ProtoMessage()    {}
+func (*ApplyResourceChange_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{14, 1}
+}
+func (m *ApplyResourceChange_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ApplyResourceChange_Response.Unmarshal(m, b)
+}
+func (m *ApplyResourceChange_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ApplyResourceChange_Response.Marshal(b, m, deterministic)
+}
+func (dst *ApplyResourceChange_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ApplyResourceChange_Response.Merge(dst, src)
+}
+func (m *ApplyResourceChange_Response) XXX_Size() int {
+        return xxx_messageInfo_ApplyResourceChange_Response.Size(m)
+}
+func (m *ApplyResourceChange_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ApplyResourceChange_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ApplyResourceChange_Response proto.InternalMessageInfo
+
+func (m *ApplyResourceChange_Response) GetNewState() *DynamicValue {
+        if m != nil {
+                return m.NewState
+        }
+        return nil
+}
+
+func (m *ApplyResourceChange_Response) GetPrivate() []byte {
+        if m != nil {
+                return m.Private
+        }
+        return nil
+}
+
+func (m *ApplyResourceChange_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+func (m *ApplyResourceChange_Response) GetLegacyTypeSystem() bool {
+        if m != nil {
+                return m.LegacyTypeSystem
+        }
+        return false
+}
+
+type ImportResourceState struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ImportResourceState) Reset()         { *m = ImportResourceState{} }
+func (m *ImportResourceState) String() string { return proto.CompactTextString(m) }
+func (*ImportResourceState) ProtoMessage()    {}
+func (*ImportResourceState) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{15}
+}
+func (m *ImportResourceState) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ImportResourceState.Unmarshal(m, b)
+}
+func (m *ImportResourceState) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ImportResourceState.Marshal(b, m, deterministic)
+}
+func (dst *ImportResourceState) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ImportResourceState.Merge(dst, src)
+}
+func (m *ImportResourceState) XXX_Size() int {
+        return xxx_messageInfo_ImportResourceState.Size(m)
+}
+func (m *ImportResourceState) XXX_DiscardUnknown() {
+        xxx_messageInfo_ImportResourceState.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ImportResourceState proto.InternalMessageInfo
+
+type ImportResourceState_Request struct {
+        TypeName             string   `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        Id                   string   `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ImportResourceState_Request) Reset()         { *m = ImportResourceState_Request{} }
+func (m *ImportResourceState_Request) String() string { return proto.CompactTextString(m) }
+func (*ImportResourceState_Request) ProtoMessage()    {}
+func (*ImportResourceState_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{15, 0}
+}
+func (m *ImportResourceState_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ImportResourceState_Request.Unmarshal(m, b)
+}
+func (m *ImportResourceState_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ImportResourceState_Request.Marshal(b, m, deterministic)
+}
+func (dst *ImportResourceState_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ImportResourceState_Request.Merge(dst, src)
+}
+func (m *ImportResourceState_Request) XXX_Size() int {
+        return xxx_messageInfo_ImportResourceState_Request.Size(m)
+}
+func (m *ImportResourceState_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ImportResourceState_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ImportResourceState_Request proto.InternalMessageInfo
+
+func (m *ImportResourceState_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ImportResourceState_Request) GetId() string {
+        if m != nil {
+                return m.Id
+        }
+        return ""
+}
+
+type ImportResourceState_ImportedResource struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        State                *DynamicValue `protobuf:"bytes,2,opt,name=state,proto3" json:"state,omitempty"`
+        Private              []byte        `protobuf:"bytes,3,opt,name=private,proto3" json:"private,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ImportResourceState_ImportedResource) Reset()         { *m = ImportResourceState_ImportedResource{} }
+func (m *ImportResourceState_ImportedResource) String() string { return proto.CompactTextString(m) }
+func (*ImportResourceState_ImportedResource) ProtoMessage()    {}
+func (*ImportResourceState_ImportedResource) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{15, 1}
+}
+func (m *ImportResourceState_ImportedResource) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ImportResourceState_ImportedResource.Unmarshal(m, b)
+}
+func (m *ImportResourceState_ImportedResource) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ImportResourceState_ImportedResource.Marshal(b, m, deterministic)
+}
+func (dst *ImportResourceState_ImportedResource) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ImportResourceState_ImportedResource.Merge(dst, src)
+}
+func (m *ImportResourceState_ImportedResource) XXX_Size() int {
+        return xxx_messageInfo_ImportResourceState_ImportedResource.Size(m)
+}
+func (m *ImportResourceState_ImportedResource) XXX_DiscardUnknown() {
+        xxx_messageInfo_ImportResourceState_ImportedResource.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ImportResourceState_ImportedResource proto.InternalMessageInfo
+
+func (m *ImportResourceState_ImportedResource) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ImportResourceState_ImportedResource) GetState() *DynamicValue {
+        if m != nil {
+                return m.State
+        }
+        return nil
+}
+
+func (m *ImportResourceState_ImportedResource) GetPrivate() []byte {
+        if m != nil {
+                return m.Private
+        }
+        return nil
+}
+
+type ImportResourceState_Response struct {
+        ImportedResources    []*ImportResourceState_ImportedResource `protobuf:"bytes,1,rep,name=imported_resources,json=importedResources,proto3" json:"imported_resources,omitempty"`
+        Diagnostics          []*Diagnostic                           `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}                                `json:"-"`
+        XXX_unrecognized     []byte                                  `json:"-"`
+        XXX_sizecache        int32                                   `json:"-"`
+}
+
+func (m *ImportResourceState_Response) Reset()         { *m = ImportResourceState_Response{} }
+func (m *ImportResourceState_Response) String() string { return proto.CompactTextString(m) }
+func (*ImportResourceState_Response) ProtoMessage()    {}
+func (*ImportResourceState_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{15, 2}
+}
+func (m *ImportResourceState_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ImportResourceState_Response.Unmarshal(m, b)
+}
+func (m *ImportResourceState_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ImportResourceState_Response.Marshal(b, m, deterministic)
+}
+func (dst *ImportResourceState_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ImportResourceState_Response.Merge(dst, src)
+}
+func (m *ImportResourceState_Response) XXX_Size() int {
+        return xxx_messageInfo_ImportResourceState_Response.Size(m)
+}
+func (m *ImportResourceState_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ImportResourceState_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ImportResourceState_Response proto.InternalMessageInfo
+
+func (m *ImportResourceState_Response) GetImportedResources() []*ImportResourceState_ImportedResource {
+        if m != nil {
+                return m.ImportedResources
+        }
+        return nil
+}
+
+func (m *ImportResourceState_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type ReadDataSource struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ReadDataSource) Reset()         { *m = ReadDataSource{} }
+func (m *ReadDataSource) String() string { return proto.CompactTextString(m) }
+func (*ReadDataSource) ProtoMessage()    {}
+func (*ReadDataSource) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{16}
+}
+func (m *ReadDataSource) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ReadDataSource.Unmarshal(m, b)
+}
+func (m *ReadDataSource) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ReadDataSource.Marshal(b, m, deterministic)
+}
+func (dst *ReadDataSource) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ReadDataSource.Merge(dst, src)
+}
+func (m *ReadDataSource) XXX_Size() int {
+        return xxx_messageInfo_ReadDataSource.Size(m)
+}
+func (m *ReadDataSource) XXX_DiscardUnknown() {
+        xxx_messageInfo_ReadDataSource.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ReadDataSource proto.InternalMessageInfo
+
+type ReadDataSource_Request struct {
+        TypeName             string        `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+        Config               *DynamicValue `protobuf:"bytes,2,opt,name=config,proto3" json:"config,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ReadDataSource_Request) Reset()         { *m = ReadDataSource_Request{} }
+func (m *ReadDataSource_Request) String() string { return proto.CompactTextString(m) }
+func (*ReadDataSource_Request) ProtoMessage()    {}
+func (*ReadDataSource_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{16, 0}
+}
+func (m *ReadDataSource_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ReadDataSource_Request.Unmarshal(m, b)
+}
+func (m *ReadDataSource_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ReadDataSource_Request.Marshal(b, m, deterministic)
+}
+func (dst *ReadDataSource_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ReadDataSource_Request.Merge(dst, src)
+}
+func (m *ReadDataSource_Request) XXX_Size() int {
+        return xxx_messageInfo_ReadDataSource_Request.Size(m)
+}
+func (m *ReadDataSource_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ReadDataSource_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ReadDataSource_Request proto.InternalMessageInfo
+
+func (m *ReadDataSource_Request) GetTypeName() string {
+        if m != nil {
+                return m.TypeName
+        }
+        return ""
+}
+
+func (m *ReadDataSource_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+type ReadDataSource_Response struct {
+        State                *DynamicValue `protobuf:"bytes,1,opt,name=state,proto3" json:"state,omitempty"`
+        Diagnostics          []*Diagnostic `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ReadDataSource_Response) Reset()         { *m = ReadDataSource_Response{} }
+func (m *ReadDataSource_Response) String() string { return proto.CompactTextString(m) }
+func (*ReadDataSource_Response) ProtoMessage()    {}
+func (*ReadDataSource_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{16, 1}
+}
+func (m *ReadDataSource_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ReadDataSource_Response.Unmarshal(m, b)
+}
+func (m *ReadDataSource_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ReadDataSource_Response.Marshal(b, m, deterministic)
+}
+func (dst *ReadDataSource_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ReadDataSource_Response.Merge(dst, src)
+}
+func (m *ReadDataSource_Response) XXX_Size() int {
+        return xxx_messageInfo_ReadDataSource_Response.Size(m)
+}
+func (m *ReadDataSource_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ReadDataSource_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ReadDataSource_Response proto.InternalMessageInfo
+
+func (m *ReadDataSource_Response) GetState() *DynamicValue {
+        if m != nil {
+                return m.State
+        }
+        return nil
+}
+
+func (m *ReadDataSource_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type GetProvisionerSchema struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *GetProvisionerSchema) Reset()         { *m = GetProvisionerSchema{} }
+func (m *GetProvisionerSchema) String() string { return proto.CompactTextString(m) }
+func (*GetProvisionerSchema) ProtoMessage()    {}
+func (*GetProvisionerSchema) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{17}
+}
+func (m *GetProvisionerSchema) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_GetProvisionerSchema.Unmarshal(m, b)
+}
+func (m *GetProvisionerSchema) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_GetProvisionerSchema.Marshal(b, m, deterministic)
+}
+func (dst *GetProvisionerSchema) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_GetProvisionerSchema.Merge(dst, src)
+}
+func (m *GetProvisionerSchema) XXX_Size() int {
+        return xxx_messageInfo_GetProvisionerSchema.Size(m)
+}
+func (m *GetProvisionerSchema) XXX_DiscardUnknown() {
+        xxx_messageInfo_GetProvisionerSchema.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GetProvisionerSchema proto.InternalMessageInfo
+
+type GetProvisionerSchema_Request struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *GetProvisionerSchema_Request) Reset()         { *m = GetProvisionerSchema_Request{} }
+func (m *GetProvisionerSchema_Request) String() string { return proto.CompactTextString(m) }
+func (*GetProvisionerSchema_Request) ProtoMessage()    {}
+func (*GetProvisionerSchema_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{17, 0}
+}
+func (m *GetProvisionerSchema_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_GetProvisionerSchema_Request.Unmarshal(m, b)
+}
+func (m *GetProvisionerSchema_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_GetProvisionerSchema_Request.Marshal(b, m, deterministic)
+}
+func (dst *GetProvisionerSchema_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_GetProvisionerSchema_Request.Merge(dst, src)
+}
+func (m *GetProvisionerSchema_Request) XXX_Size() int {
+        return xxx_messageInfo_GetProvisionerSchema_Request.Size(m)
+}
+func (m *GetProvisionerSchema_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_GetProvisionerSchema_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GetProvisionerSchema_Request proto.InternalMessageInfo
+
+type GetProvisionerSchema_Response struct {
+        Provisioner          *Schema       `protobuf:"bytes,1,opt,name=provisioner,proto3" json:"provisioner,omitempty"`
+        Diagnostics          []*Diagnostic `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *GetProvisionerSchema_Response) Reset()         { *m = GetProvisionerSchema_Response{} }
+func (m *GetProvisionerSchema_Response) String() string { return proto.CompactTextString(m) }
+func (*GetProvisionerSchema_Response) ProtoMessage()    {}
+func (*GetProvisionerSchema_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{17, 1}
+}
+func (m *GetProvisionerSchema_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_GetProvisionerSchema_Response.Unmarshal(m, b)
+}
+func (m *GetProvisionerSchema_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_GetProvisionerSchema_Response.Marshal(b, m, deterministic)
+}
+func (dst *GetProvisionerSchema_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_GetProvisionerSchema_Response.Merge(dst, src)
+}
+func (m *GetProvisionerSchema_Response) XXX_Size() int {
+        return xxx_messageInfo_GetProvisionerSchema_Response.Size(m)
+}
+func (m *GetProvisionerSchema_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_GetProvisionerSchema_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GetProvisionerSchema_Response proto.InternalMessageInfo
+
+func (m *GetProvisionerSchema_Response) GetProvisioner() *Schema {
+        if m != nil {
+                return m.Provisioner
+        }
+        return nil
+}
+
+func (m *GetProvisionerSchema_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type ValidateProvisionerConfig struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ValidateProvisionerConfig) Reset()         { *m = ValidateProvisionerConfig{} }
+func (m *ValidateProvisionerConfig) String() string { return proto.CompactTextString(m) }
+func (*ValidateProvisionerConfig) ProtoMessage()    {}
+func (*ValidateProvisionerConfig) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{18}
+}
+func (m *ValidateProvisionerConfig) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateProvisionerConfig.Unmarshal(m, b)
+}
+func (m *ValidateProvisionerConfig) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateProvisionerConfig.Marshal(b, m, deterministic)
+}
+func (dst *ValidateProvisionerConfig) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateProvisionerConfig.Merge(dst, src)
+}
+func (m *ValidateProvisionerConfig) XXX_Size() int {
+        return xxx_messageInfo_ValidateProvisionerConfig.Size(m)
+}
+func (m *ValidateProvisionerConfig) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateProvisionerConfig.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateProvisionerConfig proto.InternalMessageInfo
+
+type ValidateProvisionerConfig_Request struct {
+        Config               *DynamicValue `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ValidateProvisionerConfig_Request) Reset()         { *m = ValidateProvisionerConfig_Request{} }
+func (m *ValidateProvisionerConfig_Request) String() string { return proto.CompactTextString(m) }
+func (*ValidateProvisionerConfig_Request) ProtoMessage()    {}
+func (*ValidateProvisionerConfig_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{18, 0}
+}
+func (m *ValidateProvisionerConfig_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateProvisionerConfig_Request.Unmarshal(m, b)
+}
+func (m *ValidateProvisionerConfig_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateProvisionerConfig_Request.Marshal(b, m, deterministic)
+}
+func (dst *ValidateProvisionerConfig_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateProvisionerConfig_Request.Merge(dst, src)
+}
+func (m *ValidateProvisionerConfig_Request) XXX_Size() int {
+        return xxx_messageInfo_ValidateProvisionerConfig_Request.Size(m)
+}
+func (m *ValidateProvisionerConfig_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateProvisionerConfig_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateProvisionerConfig_Request proto.InternalMessageInfo
+
+func (m *ValidateProvisionerConfig_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+type ValidateProvisionerConfig_Response struct {
+        Diagnostics          []*Diagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ValidateProvisionerConfig_Response) Reset()         { *m = ValidateProvisionerConfig_Response{} }
+func (m *ValidateProvisionerConfig_Response) String() string { return proto.CompactTextString(m) }
+func (*ValidateProvisionerConfig_Response) ProtoMessage()    {}
+func (*ValidateProvisionerConfig_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{18, 1}
+}
+func (m *ValidateProvisionerConfig_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ValidateProvisionerConfig_Response.Unmarshal(m, b)
+}
+func (m *ValidateProvisionerConfig_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ValidateProvisionerConfig_Response.Marshal(b, m, deterministic)
+}
+func (dst *ValidateProvisionerConfig_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ValidateProvisionerConfig_Response.Merge(dst, src)
+}
+func (m *ValidateProvisionerConfig_Response) XXX_Size() int {
+        return xxx_messageInfo_ValidateProvisionerConfig_Response.Size(m)
+}
+func (m *ValidateProvisionerConfig_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ValidateProvisionerConfig_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ValidateProvisionerConfig_Response proto.InternalMessageInfo
+
+func (m *ValidateProvisionerConfig_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+type ProvisionResource struct {
+        XXX_NoUnkeyedLiteral struct{} `json:"-"`
+        XXX_unrecognized     []byte   `json:"-"`
+        XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ProvisionResource) Reset()         { *m = ProvisionResource{} }
+func (m *ProvisionResource) String() string { return proto.CompactTextString(m) }
+func (*ProvisionResource) ProtoMessage()    {}
+func (*ProvisionResource) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{19}
+}
+func (m *ProvisionResource) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ProvisionResource.Unmarshal(m, b)
+}
+func (m *ProvisionResource) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ProvisionResource.Marshal(b, m, deterministic)
+}
+func (dst *ProvisionResource) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ProvisionResource.Merge(dst, src)
+}
+func (m *ProvisionResource) XXX_Size() int {
+        return xxx_messageInfo_ProvisionResource.Size(m)
+}
+func (m *ProvisionResource) XXX_DiscardUnknown() {
+        xxx_messageInfo_ProvisionResource.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ProvisionResource proto.InternalMessageInfo
+
+type ProvisionResource_Request struct {
+        Config               *DynamicValue `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
+        Connection           *DynamicValue `protobuf:"bytes,2,opt,name=connection,proto3" json:"connection,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ProvisionResource_Request) Reset()         { *m = ProvisionResource_Request{} }
+func (m *ProvisionResource_Request) String() string { return proto.CompactTextString(m) }
+func (*ProvisionResource_Request) ProtoMessage()    {}
+func (*ProvisionResource_Request) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{19, 0}
+}
+func (m *ProvisionResource_Request) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ProvisionResource_Request.Unmarshal(m, b)
+}
+func (m *ProvisionResource_Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ProvisionResource_Request.Marshal(b, m, deterministic)
+}
+func (dst *ProvisionResource_Request) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ProvisionResource_Request.Merge(dst, src)
+}
+func (m *ProvisionResource_Request) XXX_Size() int {
+        return xxx_messageInfo_ProvisionResource_Request.Size(m)
+}
+func (m *ProvisionResource_Request) XXX_DiscardUnknown() {
+        xxx_messageInfo_ProvisionResource_Request.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ProvisionResource_Request proto.InternalMessageInfo
+
+func (m *ProvisionResource_Request) GetConfig() *DynamicValue {
+        if m != nil {
+                return m.Config
+        }
+        return nil
+}
+
+func (m *ProvisionResource_Request) GetConnection() *DynamicValue {
+        if m != nil {
+                return m.Connection
+        }
+        return nil
+}
+
+type ProvisionResource_Response struct {
+        Output               string        `protobuf:"bytes,1,opt,name=output,proto3" json:"output,omitempty"`
+        Diagnostics          []*Diagnostic `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+        XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+        XXX_unrecognized     []byte        `json:"-"`
+        XXX_sizecache        int32         `json:"-"`
+}
+
+func (m *ProvisionResource_Response) Reset()         { *m = ProvisionResource_Response{} }
+func (m *ProvisionResource_Response) String() string { return proto.CompactTextString(m) }
+func (*ProvisionResource_Response) ProtoMessage()    {}
+func (*ProvisionResource_Response) Descriptor() ([]byte, []int) {
+        return fileDescriptor_tfplugin5_56820f4fb67360c5, []int{19, 1}
+}
+func (m *ProvisionResource_Response) XXX_Unmarshal(b []byte) error {
+        return xxx_messageInfo_ProvisionResource_Response.Unmarshal(m, b)
+}
+func (m *ProvisionResource_Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+        return xxx_messageInfo_ProvisionResource_Response.Marshal(b, m, deterministic)
+}
+func (dst *ProvisionResource_Response) XXX_Merge(src proto.Message) {
+        xxx_messageInfo_ProvisionResource_Response.Merge(dst, src)
+}
+func (m *ProvisionResource_Response) XXX_Size() int {
+        return xxx_messageInfo_ProvisionResource_Response.Size(m)
+}
+func (m *ProvisionResource_Response) XXX_DiscardUnknown() {
+        xxx_messageInfo_ProvisionResource_Response.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ProvisionResource_Response proto.InternalMessageInfo
+
+func (m *ProvisionResource_Response) GetOutput() string {
+        if m != nil {
+                return m.Output
+        }
+        return ""
+}
+
+func (m *ProvisionResource_Response) GetDiagnostics() []*Diagnostic {
+        if m != nil {
+                return m.Diagnostics
+        }
+        return nil
+}
+
+func init() {
+        proto.RegisterType((*DynamicValue)(nil), "tfplugin5.DynamicValue")
+        proto.RegisterType((*Diagnostic)(nil), "tfplugin5.Diagnostic")
+        proto.RegisterType((*AttributePath)(nil), "tfplugin5.AttributePath")
+        proto.RegisterType((*AttributePath_Step)(nil), "tfplugin5.AttributePath.Step")
+        proto.RegisterType((*Stop)(nil), "tfplugin5.Stop")
+        proto.RegisterType((*Stop_Request)(nil), "tfplugin5.Stop.Request")
+        proto.RegisterType((*Stop_Response)(nil), "tfplugin5.Stop.Response")
+        proto.RegisterType((*RawState)(nil), "tfplugin5.RawState")
+        proto.RegisterMapType((map[string]string)(nil), "tfplugin5.RawState.FlatmapEntry")
+        proto.RegisterType((*Schema)(nil), "tfplugin5.Schema")
+        proto.RegisterType((*Schema_Block)(nil), "tfplugin5.Schema.Block")
+        proto.RegisterType((*Schema_Attribute)(nil), "tfplugin5.Schema.Attribute")
+        proto.RegisterType((*Schema_NestedBlock)(nil), "tfplugin5.Schema.NestedBlock")
+        proto.RegisterType((*GetProviderSchema)(nil), "tfplugin5.GetProviderSchema")
+        proto.RegisterType((*GetProviderSchema_Request)(nil), "tfplugin5.GetProviderSchema.Request")
+        proto.RegisterType((*GetProviderSchema_Response)(nil), "tfplugin5.GetProviderSchema.Response")
+        proto.RegisterMapType((map[string]*Schema)(nil), "tfplugin5.GetProviderSchema.Response.DataSourceSchemasEntry")
+        proto.RegisterMapType((map[string]*Schema)(nil), "tfplugin5.GetProviderSchema.Response.ResourceSchemasEntry")
+        proto.RegisterType((*PrepareProviderConfig)(nil), "tfplugin5.PrepareProviderConfig")
+        proto.RegisterType((*PrepareProviderConfig_Request)(nil), "tfplugin5.PrepareProviderConfig.Request")
+        proto.RegisterType((*PrepareProviderConfig_Response)(nil), "tfplugin5.PrepareProviderConfig.Response")
+        proto.RegisterType((*UpgradeResourceState)(nil), "tfplugin5.UpgradeResourceState")
+        proto.RegisterType((*UpgradeResourceState_Request)(nil), "tfplugin5.UpgradeResourceState.Request")
+        proto.RegisterType((*UpgradeResourceState_Response)(nil), "tfplugin5.UpgradeResourceState.Response")
+        proto.RegisterType((*ValidateResourceTypeConfig)(nil), "tfplugin5.ValidateResourceTypeConfig")
+        proto.RegisterType((*ValidateResourceTypeConfig_Request)(nil), "tfplugin5.ValidateResourceTypeConfig.Request")
+        proto.RegisterType((*ValidateResourceTypeConfig_Response)(nil), "tfplugin5.ValidateResourceTypeConfig.Response")
+        proto.RegisterType((*ValidateDataSourceConfig)(nil), "tfplugin5.ValidateDataSourceConfig")
+        proto.RegisterType((*ValidateDataSourceConfig_Request)(nil), "tfplugin5.ValidateDataSourceConfig.Request")
+        proto.RegisterType((*ValidateDataSourceConfig_Response)(nil), "tfplugin5.ValidateDataSourceConfig.Response")
+        proto.RegisterType((*Configure)(nil), "tfplugin5.Configure")
+        proto.RegisterType((*Configure_Request)(nil), "tfplugin5.Configure.Request")
+        proto.RegisterType((*Configure_Response)(nil), "tfplugin5.Configure.Response")
+        proto.RegisterType((*ReadResource)(nil), "tfplugin5.ReadResource")
+        proto.RegisterType((*ReadResource_Request)(nil), "tfplugin5.ReadResource.Request")
+        proto.RegisterType((*ReadResource_Response)(nil), "tfplugin5.ReadResource.Response")
+        proto.RegisterType((*PlanResourceChange)(nil), "tfplugin5.PlanResourceChange")
+        proto.RegisterType((*PlanResourceChange_Request)(nil), "tfplugin5.PlanResourceChange.Request")
+        proto.RegisterType((*PlanResourceChange_Response)(nil), "tfplugin5.PlanResourceChange.Response")
+        proto.RegisterType((*ApplyResourceChange)(nil), "tfplugin5.ApplyResourceChange")
+        proto.RegisterType((*ApplyResourceChange_Request)(nil), "tfplugin5.ApplyResourceChange.Request")
+        proto.RegisterType((*ApplyResourceChange_Response)(nil), "tfplugin5.ApplyResourceChange.Response")
+        proto.RegisterType((*ImportResourceState)(nil), "tfplugin5.ImportResourceState")
+        proto.RegisterType((*ImportResourceState_Request)(nil), "tfplugin5.ImportResourceState.Request")
+        proto.RegisterType((*ImportResourceState_ImportedResource)(nil), "tfplugin5.ImportResourceState.ImportedResource")
+        proto.RegisterType((*ImportResourceState_Response)(nil), "tfplugin5.ImportResourceState.Response")
+        proto.RegisterType((*ReadDataSource)(nil), "tfplugin5.ReadDataSource")
+        proto.RegisterType((*ReadDataSource_Request)(nil), "tfplugin5.ReadDataSource.Request")
+        proto.RegisterType((*ReadDataSource_Response)(nil), "tfplugin5.ReadDataSource.Response")
+        proto.RegisterType((*GetProvisionerSchema)(nil), "tfplugin5.GetProvisionerSchema")
+        proto.RegisterType((*GetProvisionerSchema_Request)(nil), "tfplugin5.GetProvisionerSchema.Request")
+        proto.RegisterType((*GetProvisionerSchema_Response)(nil), "tfplugin5.GetProvisionerSchema.Response")
+        proto.RegisterType((*ValidateProvisionerConfig)(nil), "tfplugin5.ValidateProvisionerConfig")
+        proto.RegisterType((*ValidateProvisionerConfig_Request)(nil), "tfplugin5.ValidateProvisionerConfig.Request")
+        proto.RegisterType((*ValidateProvisionerConfig_Response)(nil), "tfplugin5.ValidateProvisionerConfig.Response")
+        proto.RegisterType((*ProvisionResource)(nil), "tfplugin5.ProvisionResource")
+        proto.RegisterType((*ProvisionResource_Request)(nil), "tfplugin5.ProvisionResource.Request")
+        proto.RegisterType((*ProvisionResource_Response)(nil), "tfplugin5.ProvisionResource.Response")
+        proto.RegisterEnum("tfplugin5.Diagnostic_Severity", Diagnostic_Severity_name, Diagnostic_Severity_value)
+        proto.RegisterEnum("tfplugin5.Schema_NestedBlock_NestingMode", Schema_NestedBlock_NestingMode_name, Schema_NestedBlock_NestingMode_value)
+}
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ context.Context
+var _ grpc.ClientConn
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+const _ = grpc.SupportPackageIsVersion4
+
+// ProviderClient is the client API for Provider service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
+type ProviderClient interface {
+        // ////// Information about what a provider supports/expects
+        GetSchema(ctx context.Context, in *GetProviderSchema_Request, opts ...grpc.CallOption) (*GetProviderSchema_Response, error)
+        PrepareProviderConfig(ctx context.Context, in *PrepareProviderConfig_Request, opts ...grpc.CallOption) (*PrepareProviderConfig_Response, error)
+        ValidateResourceTypeConfig(ctx context.Context, in *ValidateResourceTypeConfig_Request, opts ...grpc.CallOption) (*ValidateResourceTypeConfig_Response, error)
+        ValidateDataSourceConfig(ctx context.Context, in *ValidateDataSourceConfig_Request, opts ...grpc.CallOption) (*ValidateDataSourceConfig_Response, error)
+        UpgradeResourceState(ctx context.Context, in *UpgradeResourceState_Request, opts ...grpc.CallOption) (*UpgradeResourceState_Response, error)
+        // ////// One-time initialization, called before other functions below
+        Configure(ctx context.Context, in *Configure_Request, opts ...grpc.CallOption) (*Configure_Response, error)
+        // ////// Managed Resource Lifecycle
+        ReadResource(ctx context.Context, in *ReadResource_Request, opts ...grpc.CallOption) (*ReadResource_Response, error)
+        PlanResourceChange(ctx context.Context, in *PlanResourceChange_Request, opts ...grpc.CallOption) (*PlanResourceChange_Response, error)
+        ApplyResourceChange(ctx context.Context, in *ApplyResourceChange_Request, opts ...grpc.CallOption) (*ApplyResourceChange_Response, error)
+        ImportResourceState(ctx context.Context, in *ImportResourceState_Request, opts ...grpc.CallOption) (*ImportResourceState_Response, error)
+        ReadDataSource(ctx context.Context, in *ReadDataSource_Request, opts ...grpc.CallOption) (*ReadDataSource_Response, error)
+        // ////// Graceful Shutdown
+        Stop(ctx context.Context, in *Stop_Request, opts ...grpc.CallOption) (*Stop_Response, error)
+}
+
+type providerClient struct {
+        cc *grpc.ClientConn
+}
+
+func NewProviderClient(cc *grpc.ClientConn) ProviderClient {
+        return &providerClient{cc}
+}
+
+func (c *providerClient) GetSchema(ctx context.Context, in *GetProviderSchema_Request, opts ...grpc.CallOption) (*GetProviderSchema_Response, error) {
+        out := new(GetProviderSchema_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/GetSchema", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) PrepareProviderConfig(ctx context.Context, in *PrepareProviderConfig_Request, opts ...grpc.CallOption) (*PrepareProviderConfig_Response, error) {
+        out := new(PrepareProviderConfig_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/PrepareProviderConfig", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) ValidateResourceTypeConfig(ctx context.Context, in *ValidateResourceTypeConfig_Request, opts ...grpc.CallOption) (*ValidateResourceTypeConfig_Response, error) {
+        out := new(ValidateResourceTypeConfig_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ValidateResourceTypeConfig", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) ValidateDataSourceConfig(ctx context.Context, in *ValidateDataSourceConfig_Request, opts ...grpc.CallOption) (*ValidateDataSourceConfig_Response, error) {
+        out := new(ValidateDataSourceConfig_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ValidateDataSourceConfig", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) UpgradeResourceState(ctx context.Context, in *UpgradeResourceState_Request, opts ...grpc.CallOption) (*UpgradeResourceState_Response, error) {
+        out := new(UpgradeResourceState_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/UpgradeResourceState", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) Configure(ctx context.Context, in *Configure_Request, opts ...grpc.CallOption) (*Configure_Response, error) {
+        out := new(Configure_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/Configure", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) ReadResource(ctx context.Context, in *ReadResource_Request, opts ...grpc.CallOption) (*ReadResource_Response, error) {
+        out := new(ReadResource_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ReadResource", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) PlanResourceChange(ctx context.Context, in *PlanResourceChange_Request, opts ...grpc.CallOption) (*PlanResourceChange_Response, error) {
+        out := new(PlanResourceChange_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/PlanResourceChange", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) ApplyResourceChange(ctx context.Context, in *ApplyResourceChange_Request, opts ...grpc.CallOption) (*ApplyResourceChange_Response, error) {
+        out := new(ApplyResourceChange_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ApplyResourceChange", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) ImportResourceState(ctx context.Context, in *ImportResourceState_Request, opts ...grpc.CallOption) (*ImportResourceState_Response, error) {
+        out := new(ImportResourceState_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ImportResourceState", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) ReadDataSource(ctx context.Context, in *ReadDataSource_Request, opts ...grpc.CallOption) (*ReadDataSource_Response, error) {
+        out := new(ReadDataSource_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ReadDataSource", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *providerClient) Stop(ctx context.Context, in *Stop_Request, opts ...grpc.CallOption) (*Stop_Response, error) {
+        out := new(Stop_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provider/Stop", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+// ProviderServer is the server API for Provider service.
+type ProviderServer interface {
+        // ////// Information about what a provider supports/expects
+        GetSchema(context.Context, *GetProviderSchema_Request) (*GetProviderSchema_Response, error)
+        PrepareProviderConfig(context.Context, *PrepareProviderConfig_Request) (*PrepareProviderConfig_Response, error)
+        ValidateResourceTypeConfig(context.Context, *ValidateResourceTypeConfig_Request) (*ValidateResourceTypeConfig_Response, error)
+        ValidateDataSourceConfig(context.Context, *ValidateDataSourceConfig_Request) (*ValidateDataSourceConfig_Response, error)
+        UpgradeResourceState(context.Context, *UpgradeResourceState_Request) (*UpgradeResourceState_Response, error)
+        // ////// One-time initialization, called before other functions below
+        Configure(context.Context, *Configure_Request) (*Configure_Response, error)
+        // ////// Managed Resource Lifecycle
+        ReadResource(context.Context, *ReadResource_Request) (*ReadResource_Response, error)
+        PlanResourceChange(context.Context, *PlanResourceChange_Request) (*PlanResourceChange_Response, error)
+        ApplyResourceChange(context.Context, *ApplyResourceChange_Request) (*ApplyResourceChange_Response, error)
+        ImportResourceState(context.Context, *ImportResourceState_Request) (*ImportResourceState_Response, error)
+        ReadDataSource(context.Context, *ReadDataSource_Request) (*ReadDataSource_Response, error)
+        // ////// Graceful Shutdown
+        Stop(context.Context, *Stop_Request) (*Stop_Response, error)
+}
+
+func RegisterProviderServer(s *grpc.Server, srv ProviderServer) {
+        s.RegisterService(&_Provider_serviceDesc, srv)
+}
+
+func _Provider_GetSchema_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(GetProviderSchema_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).GetSchema(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/GetSchema",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).GetSchema(ctx, req.(*GetProviderSchema_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_PrepareProviderConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(PrepareProviderConfig_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).PrepareProviderConfig(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/PrepareProviderConfig",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).PrepareProviderConfig(ctx, req.(*PrepareProviderConfig_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_ValidateResourceTypeConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ValidateResourceTypeConfig_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).ValidateResourceTypeConfig(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/ValidateResourceTypeConfig",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).ValidateResourceTypeConfig(ctx, req.(*ValidateResourceTypeConfig_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_ValidateDataSourceConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ValidateDataSourceConfig_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).ValidateDataSourceConfig(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/ValidateDataSourceConfig",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).ValidateDataSourceConfig(ctx, req.(*ValidateDataSourceConfig_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_UpgradeResourceState_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(UpgradeResourceState_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).UpgradeResourceState(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/UpgradeResourceState",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).UpgradeResourceState(ctx, req.(*UpgradeResourceState_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_Configure_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(Configure_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).Configure(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/Configure",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).Configure(ctx, req.(*Configure_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_ReadResource_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ReadResource_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).ReadResource(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/ReadResource",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).ReadResource(ctx, req.(*ReadResource_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_PlanResourceChange_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(PlanResourceChange_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).PlanResourceChange(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/PlanResourceChange",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).PlanResourceChange(ctx, req.(*PlanResourceChange_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_ApplyResourceChange_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ApplyResourceChange_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).ApplyResourceChange(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/ApplyResourceChange",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).ApplyResourceChange(ctx, req.(*ApplyResourceChange_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_ImportResourceState_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ImportResourceState_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).ImportResourceState(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/ImportResourceState",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).ImportResourceState(ctx, req.(*ImportResourceState_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_ReadDataSource_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ReadDataSource_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).ReadDataSource(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/ReadDataSource",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).ReadDataSource(ctx, req.(*ReadDataSource_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provider_Stop_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(Stop_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProviderServer).Stop(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provider/Stop",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProviderServer).Stop(ctx, req.(*Stop_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+var _Provider_serviceDesc = grpc.ServiceDesc{
+        ServiceName: "tfplugin5.Provider",
+        HandlerType: (*ProviderServer)(nil),
+        Methods: []grpc.MethodDesc{
+                {
+                        MethodName: "GetSchema",
+                        Handler:    _Provider_GetSchema_Handler,
+                },
+                {
+                        MethodName: "PrepareProviderConfig",
+                        Handler:    _Provider_PrepareProviderConfig_Handler,
+                },
+                {
+                        MethodName: "ValidateResourceTypeConfig",
+                        Handler:    _Provider_ValidateResourceTypeConfig_Handler,
+                },
+                {
+                        MethodName: "ValidateDataSourceConfig",
+                        Handler:    _Provider_ValidateDataSourceConfig_Handler,
+                },
+                {
+                        MethodName: "UpgradeResourceState",
+                        Handler:    _Provider_UpgradeResourceState_Handler,
+                },
+                {
+                        MethodName: "Configure",
+                        Handler:    _Provider_Configure_Handler,
+                },
+                {
+                        MethodName: "ReadResource",
+                        Handler:    _Provider_ReadResource_Handler,
+                },
+                {
+                        MethodName: "PlanResourceChange",
+                        Handler:    _Provider_PlanResourceChange_Handler,
+                },
+                {
+                        MethodName: "ApplyResourceChange",
+                        Handler:    _Provider_ApplyResourceChange_Handler,
+                },
+                {
+                        MethodName: "ImportResourceState",
+                        Handler:    _Provider_ImportResourceState_Handler,
+                },
+                {
+                        MethodName: "ReadDataSource",
+                        Handler:    _Provider_ReadDataSource_Handler,
+                },
+                {
+                        MethodName: "Stop",
+                        Handler:    _Provider_Stop_Handler,
+                },
+        },
+        Streams:  []grpc.StreamDesc{},
+        Metadata: "tfplugin5.proto",
+}
+
+// ProvisionerClient is the client API for Provisioner service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
+type ProvisionerClient interface {
+        GetSchema(ctx context.Context, in *GetProvisionerSchema_Request, opts ...grpc.CallOption) (*GetProvisionerSchema_Response, error)
+        ValidateProvisionerConfig(ctx context.Context, in *ValidateProvisionerConfig_Request, opts ...grpc.CallOption) (*ValidateProvisionerConfig_Response, error)
+        ProvisionResource(ctx context.Context, in *ProvisionResource_Request, opts ...grpc.CallOption) (Provisioner_ProvisionResourceClient, error)
+        Stop(ctx context.Context, in *Stop_Request, opts ...grpc.CallOption) (*Stop_Response, error)
+}
+
+type provisionerClient struct {
+        cc *grpc.ClientConn
+}
+
+func NewProvisionerClient(cc *grpc.ClientConn) ProvisionerClient {
+        return &provisionerClient{cc}
+}
+
+func (c *provisionerClient) GetSchema(ctx context.Context, in *GetProvisionerSchema_Request, opts ...grpc.CallOption) (*GetProvisionerSchema_Response, error) {
+        out := new(GetProvisionerSchema_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provisioner/GetSchema", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *provisionerClient) ValidateProvisionerConfig(ctx context.Context, in *ValidateProvisionerConfig_Request, opts ...grpc.CallOption) (*ValidateProvisionerConfig_Response, error) {
+        out := new(ValidateProvisionerConfig_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provisioner/ValidateProvisionerConfig", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (c *provisionerClient) ProvisionResource(ctx context.Context, in *ProvisionResource_Request, opts ...grpc.CallOption) (Provisioner_ProvisionResourceClient, error) {
+        stream, err := c.cc.NewStream(ctx, &_Provisioner_serviceDesc.Streams[0], "/tfplugin5.Provisioner/ProvisionResource", opts...)
+        if err != nil {
+                return nil, err
+        }
+        x := &provisionerProvisionResourceClient{stream}
+        if err := x.ClientStream.SendMsg(in); err != nil {
+                return nil, err
+        }
+        if err := x.ClientStream.CloseSend(); err != nil {
+                return nil, err
+        }
+        return x, nil
+}
+
+type Provisioner_ProvisionResourceClient interface {
+        Recv() (*ProvisionResource_Response, error)
+        grpc.ClientStream
+}
+
+type provisionerProvisionResourceClient struct {
+        grpc.ClientStream
+}
+
+func (x *provisionerProvisionResourceClient) Recv() (*ProvisionResource_Response, error) {
+        m := new(ProvisionResource_Response)
+        if err := x.ClientStream.RecvMsg(m); err != nil {
+                return nil, err
+        }
+        return m, nil
+}
+
+func (c *provisionerClient) Stop(ctx context.Context, in *Stop_Request, opts ...grpc.CallOption) (*Stop_Response, error) {
+        out := new(Stop_Response)
+        err := c.cc.Invoke(ctx, "/tfplugin5.Provisioner/Stop", in, out, opts...)
+        if err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+// ProvisionerServer is the server API for Provisioner service.
+type ProvisionerServer interface {
+        GetSchema(context.Context, *GetProvisionerSchema_Request) (*GetProvisionerSchema_Response, error)
+        ValidateProvisionerConfig(context.Context, *ValidateProvisionerConfig_Request) (*ValidateProvisionerConfig_Response, error)
+        ProvisionResource(*ProvisionResource_Request, Provisioner_ProvisionResourceServer) error
+        Stop(context.Context, *Stop_Request) (*Stop_Response, error)
+}
+
+func RegisterProvisionerServer(s *grpc.Server, srv ProvisionerServer) {
+        s.RegisterService(&_Provisioner_serviceDesc, srv)
+}
+
+func _Provisioner_GetSchema_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(GetProvisionerSchema_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProvisionerServer).GetSchema(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provisioner/GetSchema",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProvisionerServer).GetSchema(ctx, req.(*GetProvisionerSchema_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provisioner_ValidateProvisionerConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(ValidateProvisionerConfig_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProvisionerServer).ValidateProvisionerConfig(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provisioner/ValidateProvisionerConfig",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProvisionerServer).ValidateProvisionerConfig(ctx, req.(*ValidateProvisionerConfig_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+func _Provisioner_ProvisionResource_Handler(srv interface{}, stream grpc.ServerStream) error {
+        m := new(ProvisionResource_Request)
+        if err := stream.RecvMsg(m); err != nil {
+                return err
+        }
+        return srv.(ProvisionerServer).ProvisionResource(m, &provisionerProvisionResourceServer{stream})
+}
+
+type Provisioner_ProvisionResourceServer interface {
+        Send(*ProvisionResource_Response) error
+        grpc.ServerStream
+}
+
+type provisionerProvisionResourceServer struct {
+        grpc.ServerStream
+}
+
+func (x *provisionerProvisionResourceServer) Send(m *ProvisionResource_Response) error {
+        return x.ServerStream.SendMsg(m)
+}
+
+func _Provisioner_Stop_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+        in := new(Stop_Request)
+        if err := dec(in); err != nil {
+                return nil, err
+        }
+        if interceptor == nil {
+                return srv.(ProvisionerServer).Stop(ctx, in)
+        }
+        info := &grpc.UnaryServerInfo{
+                Server:     srv,
+                FullMethod: "/tfplugin5.Provisioner/Stop",
+        }
+        handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+                return srv.(ProvisionerServer).Stop(ctx, req.(*Stop_Request))
+        }
+        return interceptor(ctx, in, info, handler)
+}
+
+var _Provisioner_serviceDesc = grpc.ServiceDesc{
+        ServiceName: "tfplugin5.Provisioner",
+        HandlerType: (*ProvisionerServer)(nil),
+        Methods: []grpc.MethodDesc{
+                {
+                        MethodName: "GetSchema",
+                        Handler:    _Provisioner_GetSchema_Handler,
+                },
+                {
+                        MethodName: "ValidateProvisionerConfig",
+                        Handler:    _Provisioner_ValidateProvisionerConfig_Handler,
+                },
+                {
+                        MethodName: "Stop",
+                        Handler:    _Provisioner_Stop_Handler,
+                },
+        },
+        Streams: []grpc.StreamDesc{
+                {
+                        StreamName:    "ProvisionResource",
+                        Handler:       _Provisioner_ProvisionResource_Handler,
+                        ServerStreams: true,
+                },
+        },
+        Metadata: "tfplugin5.proto",
+}
+
+func init() { proto.RegisterFile("tfplugin5.proto", fileDescriptor_tfplugin5_56820f4fb67360c5) }
+
+var fileDescriptor_tfplugin5_56820f4fb67360c5 = []byte{
+        // 1876 bytes of a gzipped FileDescriptorProto
+        0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xd4, 0x59, 0xcd, 0x6f, 0x23, 0x49,
+        0x15, 0x9f, 0x76, 0xdb, 0x89, 0xfd, 0x9c, 0x0f, 0xa7, 0x66, 0x76, 0x30, 0xbd, 0xbb, 0x10, 0xcc,
+        0x47, 0xb2, 0xda, 0x1d, 0xcf, 0x2a, 0x03, 0xbb, 0x4b, 0x18, 0xad, 0xc8, 0x66, 0x42, 0x26, 0x62,
+        0x26, 0x1b, 0xca, 0xf3, 0x81, 0x84, 0xb4, 0x56, 0x8d, 0xbb, 0xe2, 0x69, 0xc6, 0xee, 0xee, 0xad,
+        0x2e, 0x67, 0x62, 0x71, 0x44, 0x70, 0xe6, 0xc2, 0x87, 0xc4, 0xc7, 0x85, 0x03, 0xff, 0x00, 0x07,
+        0xe0, 0xc6, 0x89, 0x7f, 0x80, 0x1b, 0x70, 0x42, 0x70, 0x43, 0x1c, 0xe1, 0x82, 0x84, 0xea, 0xab,
+        0xbb, 0x6c, 0xb7, 0x93, 0x9e, 0x64, 0x57, 0x88, 0x5b, 0x57, 0xbd, 0x5f, 0xbd, 0xf7, 0xab, 0xf7,
+        0x5e, 0xbd, 0x57, 0x65, 0xc3, 0x2a, 0x3f, 0x8e, 0x07, 0xa3, 0x7e, 0x10, 0x7e, 0xa9, 0x1d, 0xb3,
+        0x88, 0x47, 0xa8, 0x96, 0x4e, 0xb4, 0x6e, 0xc3, 0xd2, 0x9d, 0x71, 0x48, 0x86, 0x41, 0xef, 0x11,
+        0x19, 0x8c, 0x28, 0x6a, 0xc2, 0xe2, 0x30, 0xe9, 0xc7, 0xa4, 0xf7, 0xac, 0xe9, 0xac, 0x3b, 0x9b,
+        0x4b, 0xd8, 0x0c, 0x11, 0x82, 0xf2, 0xb7, 0x93, 0x28, 0x6c, 0x96, 0xe4, 0xb4, 0xfc, 0x6e, 0xfd,
+        0xd5, 0x01, 0xb8, 0x13, 0x90, 0x7e, 0x18, 0x25, 0x3c, 0xe8, 0xa1, 0x6d, 0xa8, 0x26, 0xf4, 0x84,
+        0xb2, 0x80, 0x8f, 0xe5, 0xea, 0x95, 0xad, 0x4f, 0xb5, 0x33, 0xdb, 0x19, 0xb0, 0xdd, 0xd1, 0x28,
+        0x9c, 0xe2, 0x85, 0xe1, 0x64, 0x34, 0x1c, 0x12, 0x36, 0x96, 0x16, 0x6a, 0xd8, 0x0c, 0xd1, 0x75,
+        0x58, 0xf0, 0x29, 0x27, 0xc1, 0xa0, 0xe9, 0x4a, 0x81, 0x1e, 0xa1, 0xb7, 0xa0, 0x46, 0x38, 0x67,
+        0xc1, 0x93, 0x11, 0xa7, 0xcd, 0xf2, 0xba, 0xb3, 0x59, 0xdf, 0x6a, 0x5a, 0xe6, 0x76, 0x8c, 0xec,
+        0x88, 0xf0, 0xa7, 0x38, 0x83, 0xb6, 0x6e, 0x42, 0xd5, 0xd8, 0x47, 0x75, 0x58, 0x3c, 0x38, 0x7c,
+        0xb4, 0x73, 0xef, 0xe0, 0x4e, 0xe3, 0x0a, 0xaa, 0x41, 0x65, 0x0f, 0xe3, 0xf7, 0x71, 0xc3, 0x11,
+        0xf3, 0x8f, 0x77, 0xf0, 0xe1, 0xc1, 0xe1, 0x7e, 0xa3, 0xd4, 0xfa, 0xb3, 0x03, 0xcb, 0x13, 0xda,
+        0xd0, 0x2d, 0xa8, 0x24, 0x9c, 0xc6, 0x49, 0xd3, 0x59, 0x77, 0x37, 0xeb, 0x5b, 0xaf, 0xce, 0x33,
+        0xdb, 0xee, 0x70, 0x1a, 0x63, 0x85, 0xf5, 0x7e, 0xe8, 0x40, 0x59, 0x8c, 0xd1, 0x06, 0xac, 0xa4,
+        0x6c, 0xba, 0x21, 0x19, 0x52, 0xe9, 0xac, 0xda, 0xdd, 0x2b, 0x78, 0x39, 0x9d, 0x3f, 0x24, 0x43,
+        0x8a, 0xda, 0x80, 0xe8, 0x80, 0x0e, 0x69, 0xc8, 0xbb, 0xcf, 0xe8, 0xb8, 0x9b, 0x70, 0x16, 0x84,
+        0x7d, 0xe5, 0x9e, 0xbb, 0x57, 0x70, 0x43, 0xcb, 0xbe, 0x4e, 0xc7, 0x1d, 0x29, 0x41, 0x9b, 0xb0,
+        0x6a, 0xe3, 0x83, 0x90, 0x4b, 0x97, 0xb9, 0x42, 0x73, 0x06, 0x3e, 0x08, 0xf9, 0x7b, 0x20, 0x22,
+        0x35, 0xa0, 0x3d, 0x1e, 0xb1, 0xd6, 0x2d, 0x41, 0x2b, 0x8a, 0xbd, 0x1a, 0x2c, 0x62, 0xfa, 0xe1,
+        0x88, 0x26, 0xdc, 0x5b, 0x87, 0x2a, 0xa6, 0x49, 0x1c, 0x85, 0x09, 0x45, 0xd7, 0xa0, 0xb2, 0xc7,
+        0x58, 0xc4, 0x14, 0x49, 0xac, 0x06, 0xad, 0x1f, 0x39, 0x50, 0xc5, 0xe4, 0x79, 0x87, 0x13, 0x4e,
+        0xd3, 0xd4, 0x70, 0xb2, 0xd4, 0x40, 0xdb, 0xb0, 0x78, 0x3c, 0x20, 0x7c, 0x48, 0xe2, 0x66, 0x49,
+        0x3a, 0x69, 0xdd, 0x72, 0x92, 0x59, 0xd9, 0xfe, 0x9a, 0x82, 0xec, 0x85, 0x9c, 0x8d, 0xb1, 0x59,
+        0xe0, 0x6d, 0xc3, 0x92, 0x2d, 0x40, 0x0d, 0x70, 0x9f, 0xd1, 0xb1, 0x26, 0x20, 0x3e, 0x05, 0xa9,
+        0x13, 0x91, 0xaf, 0x3a, 0x57, 0xd4, 0x60, 0xbb, 0xf4, 0x8e, 0xd3, 0xfa, 0x7b, 0x05, 0x16, 0x3a,
+        0xbd, 0xa7, 0x74, 0x48, 0x44, 0x4a, 0x9d, 0x50, 0x96, 0x04, 0x9a, 0x99, 0x8b, 0xcd, 0x10, 0xdd,
+        0x80, 0xca, 0x93, 0x41, 0xd4, 0x7b, 0x26, 0x97, 0xd7, 0xb7, 0x3e, 0x61, 0x51, 0x53, 0x6b, 0xdb,
+        0xef, 0x09, 0x31, 0x56, 0x28, 0xef, 0x17, 0x0e, 0x54, 0xe4, 0xc4, 0x19, 0x2a, 0xbf, 0x02, 0x90,
+        0x06, 0x2f, 0xd1, 0x5b, 0x7e, 0x79, 0x56, 0x6f, 0x9a, 0x1e, 0xd8, 0x82, 0xa3, 0x77, 0xa1, 0x2e,
+        0x2d, 0x75, 0xf9, 0x38, 0xa6, 0x49, 0xd3, 0x9d, 0xc9, 0x2a, 0xbd, 0xfa, 0x90, 0x26, 0x9c, 0xfa,
+        0x8a, 0x1b, 0xc8, 0x15, 0x0f, 0xc4, 0x02, 0xef, 0x0f, 0x0e, 0xd4, 0x52, 0xcd, 0x22, 0x1c, 0x59,
+        0x56, 0x61, 0xf9, 0x2d, 0xe6, 0x84, 0x6e, 0x73, 0x7a, 0xc5, 0x37, 0x5a, 0x87, 0xba, 0x4f, 0x93,
+        0x1e, 0x0b, 0x62, 0x2e, 0x36, 0xa4, 0x4e, 0x97, 0x3d, 0x85, 0x3c, 0xa8, 0x32, 0xfa, 0xe1, 0x28,
+        0x60, 0xd4, 0x97, 0x27, 0xac, 0x8a, 0xd3, 0xb1, 0x90, 0x45, 0x12, 0x45, 0x06, 0xcd, 0x8a, 0x92,
+        0x99, 0xb1, 0x90, 0xf5, 0xa2, 0x61, 0x3c, 0xe2, 0xd4, 0x6f, 0x2e, 0x28, 0x99, 0x19, 0xa3, 0x57,
+        0xa0, 0x96, 0xd0, 0x30, 0x09, 0x78, 0x70, 0x42, 0x9b, 0x8b, 0x52, 0x98, 0x4d, 0x78, 0xbf, 0x2a,
+        0x41, 0xdd, 0xda, 0x25, 0x7a, 0x19, 0x6a, 0x82, 0xab, 0x75, 0x4c, 0x70, 0x55, 0x4c, 0xc8, 0xf3,
+        0xf1, 0x62, 0x61, 0x44, 0xbb, 0xb0, 0x18, 0xd2, 0x84, 0x8b, 0x33, 0xe4, 0xca, 0xea, 0xf4, 0xda,
+        0x99, 0x1e, 0x96, 0xdf, 0x41, 0xd8, 0xbf, 0x1f, 0xf9, 0x14, 0x9b, 0x95, 0x82, 0xd0, 0x30, 0x08,
+        0xbb, 0x01, 0xa7, 0xc3, 0x44, 0xfa, 0xc4, 0xc5, 0xd5, 0x61, 0x10, 0x1e, 0x88, 0xb1, 0x14, 0x92,
+        0x53, 0x2d, 0xac, 0x68, 0x21, 0x39, 0x95, 0xc2, 0xd6, 0x7d, 0xb5, 0x33, 0xad, 0x71, 0xb2, 0xf4,
+        0x00, 0x2c, 0x74, 0x0e, 0x0e, 0xf7, 0xef, 0xed, 0x35, 0x1c, 0x54, 0x85, 0xf2, 0xbd, 0x83, 0xce,
+        0x83, 0x46, 0x09, 0x2d, 0x82, 0xdb, 0xd9, 0x7b, 0xd0, 0x70, 0xc5, 0xc7, 0xfd, 0x9d, 0xa3, 0x46,
+        0x59, 0x94, 0xa8, 0x7d, 0xfc, 0xfe, 0xc3, 0xa3, 0x46, 0xa5, 0xf5, 0x93, 0x32, 0xac, 0xed, 0x53,
+        0x7e, 0xc4, 0xa2, 0x93, 0xc0, 0xa7, 0x4c, 0xf1, 0xb7, 0x0f, 0xf1, 0xbf, 0x5c, 0xeb, 0x14, 0xdf,
+        0x80, 0x6a, 0xac, 0x91, 0xd2, 0x8d, 0xf5, 0xad, 0xb5, 0x99, 0xcd, 0xe3, 0x14, 0x82, 0x28, 0x34,
+        0x18, 0x4d, 0xa2, 0x11, 0xeb, 0xd1, 0x6e, 0x22, 0x85, 0x26, 0xa7, 0xb7, 0xad, 0x65, 0x33, 0xe6,
+        0xdb, 0xc6, 0x9e, 0xf8, 0x90, 0xab, 0xd5, 0x7c, 0xa2, 0x0e, 0xf8, 0x2a, 0x9b, 0x9c, 0x45, 0x03,
+        0xb8, 0xea, 0x13, 0x4e, 0xba, 0x53, 0x96, 0x54, 0xfe, 0xdf, 0x2e, 0x66, 0xe9, 0x0e, 0xe1, 0xa4,
+        0x33, 0x6b, 0x6b, 0xcd, 0x9f, 0x9e, 0x47, 0x6f, 0x43, 0xdd, 0x4f, 0x7b, 0x90, 0x08, 0x9e, 0xb0,
+        0xf2, 0x52, 0x6e, 0x87, 0xc2, 0x36, 0xd2, 0x7b, 0x08, 0xd7, 0xf2, 0xf6, 0x93, 0x53, 0x97, 0x36,
+        0xec, 0xba, 0x94, 0xeb, 0xe3, 0xac, 0x54, 0x79, 0x8f, 0xe1, 0x7a, 0x3e, 0xf9, 0x4b, 0x2a, 0x6e,
+        0xfd, 0xc9, 0x81, 0x97, 0x8e, 0x18, 0x8d, 0x09, 0xa3, 0xc6, 0x6b, 0xbb, 0x51, 0x78, 0x1c, 0xf4,
+        0xbd, 0xed, 0x34, 0x3d, 0xd0, 0x4d, 0x58, 0xe8, 0xc9, 0x49, 0x9d, 0x0f, 0xf6, 0xe9, 0xb1, 0xaf,
+        0x04, 0x58, 0xc3, 0xbc, 0xef, 0x39, 0x56, 0x3e, 0x7d, 0x15, 0x56, 0x63, 0x65, 0xc1, 0xef, 0x16,
+        0x53, 0xb3, 0x62, 0xf0, 0x8a, 0xca, 0x74, 0x34, 0x4a, 0x45, 0xa3, 0xd1, 0xfa, 0x41, 0x09, 0xae,
+        0x3d, 0x8c, 0xfb, 0x8c, 0xf8, 0x34, 0x8d, 0x8a, 0x68, 0x26, 0x1e, 0xcb, 0x36, 0x77, 0x66, 0xd9,
+        0xb0, 0x8a, 0x78, 0x69, 0xb2, 0x88, 0xbf, 0x09, 0x35, 0x46, 0x9e, 0x77, 0x13, 0xa1, 0x4e, 0xd6,
+        0x88, 0xfa, 0xd6, 0xd5, 0x9c, 0xb6, 0x85, 0xab, 0x4c, 0x7f, 0x79, 0xdf, 0xb5, 0x9d, 0xf2, 0x2e,
+        0xac, 0x8c, 0x14, 0x31, 0x5f, 0xeb, 0x38, 0xc7, 0x27, 0xcb, 0x06, 0xae, 0xfa, 0xe8, 0x85, 0x5d,
+        0xf2, 0x3b, 0x07, 0xbc, 0x47, 0x64, 0x10, 0xf8, 0x82, 0x9c, 0xf6, 0x89, 0xe8, 0x0c, 0x3a, 0xea,
+        0x8f, 0x0b, 0x3a, 0x26, 0x4b, 0x89, 0x52, 0xb1, 0x94, 0xd8, 0xb5, 0x36, 0x3f, 0x45, 0xde, 0x29,
+        0x4c, 0xfe, 0x37, 0x0e, 0x34, 0x0d, 0xf9, 0xec, 0x3c, 0xfc, 0x5f, 0x50, 0xff, 0xad, 0x03, 0x35,
+        0x45, 0x74, 0xc4, 0xa8, 0xd7, 0xcf, 0xb8, 0xbe, 0x0e, 0x6b, 0x9c, 0x32, 0x46, 0x8e, 0x23, 0x36,
+        0xec, 0xda, 0x37, 0x86, 0x1a, 0x6e, 0xa4, 0x82, 0x47, 0x3a, 0xeb, 0xfe, 0x37, 0xdc, 0xff, 0xe9,
+        0xc0, 0x12, 0xa6, 0xc4, 0x37, 0xf9, 0xe2, 0xf9, 0x05, 0x5d, 0x7d, 0x1b, 0x96, 0x7b, 0x23, 0xc6,
+        0xc4, 0x2d, 0x53, 0x25, 0xf9, 0x39, 0xac, 0x97, 0x34, 0x5a, 0x1d, 0x98, 0xb1, 0xc5, 0xfd, 0x8b,
+        0x50, 0x0b, 0xe9, 0xf3, 0x62, 0x47, 0xa5, 0x1a, 0xd2, 0xe7, 0x97, 0x3c, 0x25, 0xbf, 0x2e, 0x03,
+        0x3a, 0x1a, 0x90, 0xd0, 0xec, 0x78, 0xf7, 0x29, 0x09, 0xfb, 0xd4, 0xfb, 0x8f, 0x53, 0x70, 0xe3,
+        0xef, 0x40, 0x3d, 0x66, 0x41, 0xc4, 0x8a, 0x6d, 0x1b, 0x24, 0x56, 0x51, 0xde, 0x03, 0x14, 0xb3,
+        0x28, 0x8e, 0x12, 0xea, 0x77, 0xb3, 0x1d, 0xbb, 0x67, 0x2b, 0x68, 0x98, 0x25, 0x87, 0x66, 0xe7,
+        0x59, 0xa2, 0x94, 0x0b, 0x25, 0x0a, 0xfa, 0x2c, 0x2c, 0x2b, 0xc6, 0x31, 0x0b, 0x4e, 0x84, 0xc9,
+        0x8a, 0xbc, 0xfe, 0x2d, 0xc9, 0xc9, 0x23, 0x35, 0xe7, 0xfd, 0xbc, 0x64, 0x85, 0xe4, 0x36, 0x2c,
+        0xc7, 0x03, 0x12, 0x86, 0x45, 0x2b, 0xd8, 0x92, 0x46, 0x2b, 0x82, 0xbb, 0xe2, 0xda, 0x20, 0xef,
+        0x87, 0x49, 0x97, 0xd1, 0x78, 0x40, 0x7a, 0x54, 0xc7, 0x67, 0xfe, 0xcb, 0x6c, 0xd5, 0xac, 0xc0,
+        0x6a, 0x01, 0xda, 0x80, 0x55, 0x43, 0xc1, 0xd0, 0x76, 0x25, 0xed, 0x15, 0x3d, 0xad, 0x89, 0x5f,
+        0xb8, 0x9f, 0xa3, 0x37, 0x00, 0x0d, 0x68, 0x9f, 0xf4, 0xc6, 0xf2, 0xbe, 0xdd, 0x4d, 0xc6, 0x09,
+        0xa7, 0x43, 0x7d, 0x89, 0x6d, 0x28, 0x89, 0xa8, 0x9e, 0x1d, 0x39, 0xdf, 0xfa, 0xa3, 0x0b, 0x57,
+        0x77, 0xe2, 0x78, 0x30, 0x9e, 0xca, 0x9b, 0x7f, 0x7f, 0xfc, 0x79, 0x33, 0x13, 0x0d, 0xf7, 0x45,
+        0xa2, 0xf1, 0xc2, 0xe9, 0x92, 0xe3, 0xf9, 0x4a, 0x9e, 0xe7, 0xbd, 0xdf, 0x3b, 0x97, 0x3e, 0xc5,
+        0x4d, 0x58, 0x34, 0x36, 0xd4, 0x9b, 0xc4, 0x0c, 0xa7, 0xc3, 0xea, 0x5e, 0x32, 0xac, 0xe5, 0x39,
+        0x61, 0xfd, 0x47, 0x09, 0xae, 0x1e, 0x0c, 0xe3, 0x88, 0xf1, 0xc9, 0x5b, 0xc4, 0x5b, 0x05, 0xa3,
+        0xba, 0x02, 0xa5, 0xc0, 0xd7, 0xef, 0xcf, 0x52, 0xe0, 0x7b, 0xa7, 0xd0, 0x50, 0xea, 0x68, 0x5a,
+        0x52, 0xcf, 0x7d, 0xbd, 0x14, 0x4a, 0x08, 0x85, 0xb2, 0x1d, 0xe6, 0x4e, 0x38, 0xcc, 0xfb, 0xa5,
+        0x1d, 0x8d, 0x0f, 0x00, 0x05, 0x9a, 0x46, 0xd7, 0x5c, 0xb7, 0x4d, 0x5b, 0xb8, 0x69, 0x99, 0xc8,
+        0xd9, 0x7a, 0x7b, 0x9a, 0x3f, 0x5e, 0x0b, 0xa6, 0x66, 0x92, 0x8b, 0x57, 0xdf, 0xbf, 0x38, 0xb0,
+        0x22, 0xfa, 0x4d, 0xd6, 0xe2, 0x3f, 0xbe, 0xe6, 0xce, 0x26, 0x5e, 0x3e, 0x95, 0x42, 0xa9, 0xa9,
+        0xdd, 0x7c, 0xe1, 0xfd, 0xfd, 0xd4, 0x81, 0x6b, 0xe6, 0x99, 0x22, 0xda, 0x7a, 0xde, 0x93, 0xec,
+        0xd4, 0xe2, 0x75, 0x4b, 0x54, 0x85, 0x14, 0x3b, 0xff, 0x51, 0x66, 0xa3, 0x2e, 0xce, 0xee, 0x67,
+        0x0e, 0x7c, 0xd2, 0x5c, 0xb2, 0x2c, 0x8a, 0x1f, 0xc1, 0xb3, 0xe0, 0x23, 0xb9, 0x8c, 0xfc, 0xcd,
+        0x81, 0xb5, 0x94, 0x56, 0x7a, 0x23, 0x49, 0x2e, 0x4e, 0x0b, 0xbd, 0x0d, 0xd0, 0x8b, 0xc2, 0x90,
+        0xf6, 0xb8, 0xb9, 0xe7, 0x9f, 0x55, 0x73, 0x33, 0xa8, 0xf7, 0x2d, 0x6b, 0x3f, 0xd7, 0x61, 0x21,
+        0x1a, 0xf1, 0x78, 0xc4, 0x75, 0x4a, 0xea, 0xd1, 0x85, 0xc3, 0xb0, 0xf5, 0xe3, 0x1a, 0x54, 0xcd,
+        0x93, 0x0c, 0x7d, 0x13, 0x6a, 0xfb, 0x94, 0xeb, 0x1f, 0xab, 0x3e, 0x77, 0xce, 0x6b, 0x57, 0x25,
+        0xd0, 0xe7, 0x0b, 0xbd, 0x89, 0xd1, 0x60, 0xce, 0xfb, 0x0f, 0x6d, 0x5a, 0xeb, 0x73, 0x11, 0xa9,
+        0xa5, 0xd7, 0x0a, 0x20, 0xb5, 0xb5, 0xef, 0x9c, 0xf5, 0xf8, 0x40, 0x37, 0x2c, 0x45, 0xf3, 0x61,
+        0xa9, 0xdd, 0x76, 0x51, 0xb8, 0x36, 0x3e, 0x9a, 0xff, 0x78, 0x40, 0xaf, 0xe7, 0xe8, 0x9a, 0x06,
+        0xa5, 0x86, 0xdf, 0x28, 0x06, 0xd6, 0x66, 0x83, 0xfc, 0x37, 0x28, 0xda, 0xb0, 0xb4, 0xe4, 0x01,
+        0x52, 0x73, 0x9b, 0xe7, 0x03, 0xb5, 0xa9, 0xbb, 0xd6, 0x1b, 0x03, 0xbd, 0x62, 0x2d, 0x4b, 0x67,
+        0x53, 0xa5, 0xaf, 0xce, 0x91, 0x6a, 0x4d, 0xdf, 0x98, 0xbc, 0xf1, 0xa3, 0x4f, 0xdb, 0x6f, 0x5b,
+        0x4b, 0x90, 0xea, 0x5b, 0x9f, 0x0f, 0xd0, 0x2a, 0x7b, 0x79, 0x57, 0x6a, 0x64, 0xa7, 0xe9, 0xac,
+        0x38, 0x55, 0xff, 0x85, 0xf3, 0x60, 0xda, 0xc8, 0x71, 0xee, 0x05, 0x0c, 0xd9, 0xcb, 0x73, 0xe4,
+        0xa9, 0x99, 0x8d, 0x73, 0x71, 0x99, 0x9d, 0x9c, 0xb6, 0x38, 0x61, 0x27, 0xaf, 0x6d, 0xe6, 0xd9,
+        0xc9, 0xc7, 0x69, 0x3b, 0x8f, 0xa7, 0x3b, 0x21, 0xfa, 0xcc, 0x94, 0xa3, 0x33, 0x51, 0xaa, 0xbd,
+        0x75, 0x16, 0x44, 0x2b, 0xfe, 0xb2, 0xfa, 0x29, 0x1f, 0x4d, 0xfc, 0x12, 0xca, 0xa3, 0x38, 0x55,
+        0xd2, 0x9c, 0x15, 0xa8, 0xa5, 0x5b, 0xdf, 0x77, 0xa1, 0x6e, 0x35, 0x06, 0xf4, 0x81, 0x5d, 0x9c,
+        0x36, 0x72, 0xca, 0x8e, 0xdd, 0xe3, 0x72, 0xb3, 0x7a, 0x0e, 0x50, 0x53, 0x3d, 0x3d, 0xa3, 0x1f,
+        0xa1, 0xbc, 0xb3, 0x38, 0x83, 0x4a, 0x8d, 0xde, 0x28, 0x88, 0xd6, 0x96, 0x9f, 0xe4, 0xb4, 0x9a,
+        0x89, 0xf2, 0x3b, 0x23, 0xcd, 0x2d, 0xbf, 0x79, 0x28, 0x65, 0xe1, 0x4d, 0xe7, 0x12, 0x81, 0x78,
+        0xb2, 0x20, 0xff, 0xa3, 0xbb, 0xf5, 0xdf, 0x00, 0x00, 0x00, 0xff, 0xff, 0xc8, 0x16, 0x0b, 0x32,
+        0xb6, 0x1b, 0x00, 0x00,
+}
diff --git a/vendor/github.com/hashicorp/terraform/internal/tfplugin5/tfplugin5.proto b/vendor/github.com/hashicorp/terraform/internal/tfplugin5/tfplugin5.proto
new file mode 100644
index 0000000..370faf7
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/internal/tfplugin5/tfplugin5.proto
@@ -0,0 +1,351 @@
+// Terraform Plugin RPC protocol version 5.0
+//
+// This file defines version 5.0 of the RPC protocol. To implement a plugin
+// against this protocol, copy this definition into your own codebase and
+// use protoc to generate stubs for your target language.
+//
+// This file will be updated in-place in the source Terraform repository for
+// any minor versions of protocol 5, but later minor versions will always be
+// backwards compatible. Breaking changes, if any are required, will come
+// in a subsequent major version with its own separate proto definition.
+//
+// Note that only the proto files included in a release tag of Terraform are
+// official protocol releases. Proto files taken from other commits may include
+// incomplete changes or features that did not make it into a final release.
+// In all reasonable cases, plugin developers should take the proto file from
+// the tag of the most recent release of Terraform, and not from the master
+// branch or any other development branch.
+//
+syntax = "proto3";
+
+package tfplugin5;
+
+// DynamicValue is an opaque encoding of terraform data, with the field name
+// indicating the encoding scheme used.
+message DynamicValue {
+    bytes msgpack = 1;
+    bytes json = 2;
+}
+
+message Diagnostic {
+    enum Severity {
+        INVALID = 0;
+        ERROR = 1;
+        WARNING = 2;
+    }
+    Severity severity = 1;
+    string summary = 2;
+    string detail = 3;
+    AttributePath attribute = 4;
+}
+
+message AttributePath {
+    message Step {
+        oneof selector {
+            // Set "attribute_name" to represent looking up an attribute
+            // in the current object value.
+            string attribute_name = 1;
+            // Set "element_key_*" to represent looking up an element in
+            // an indexable collection type.
+            string element_key_string = 2;
+            int64 element_key_int = 3;
+        }
+    }
+    repeated Step steps = 1;
+}
+
+message Stop {
+    message Request {
+    }
+    message Response {
+                string Error = 1;
+    }
+}
+
+// RawState holds the stored state for a resource to be upgraded by the
+// provider. It can be in one of two formats, the current json encoded format
+// in bytes, or the legacy flatmap format as a map of strings.
+message RawState {
+    bytes json = 1;
+    map<string, string> flatmap = 2;
+}
+
+// Schema is the configuration schema for a Resource, Provider, or Provisioner.
+message Schema {
+    message Block {
+        int64 version = 1;
+        repeated Attribute attributes = 2;
+        repeated NestedBlock block_types = 3;
+    }
+
+    message Attribute {
+        string name = 1;
+        bytes type = 2;
+        string description = 3;
+        bool required = 4;
+        bool optional = 5;
+        bool computed = 6;
+        bool sensitive = 7;
+    }
+
+    message NestedBlock {
+        enum NestingMode {
+            INVALID = 0;
+            SINGLE = 1;
+            LIST = 2;
+            SET = 3;
+            MAP = 4;
+            GROUP = 5;
+        }
+
+        string type_name = 1;
+        Block block = 2;
+        NestingMode nesting = 3;
+        int64 min_items = 4;
+        int64 max_items = 5;
+    }
+
+    // The version of the schema.
+    // Schemas are versioned, so that providers can upgrade a saved resource
+    // state when the schema is changed. 
+    int64 version = 1;
+
+    // Block is the top level configuration block for this schema.
+    Block block = 2;
+}
+
+service Provider {
+    //////// Information about what a provider supports/expects
+    rpc GetSchema(GetProviderSchema.Request) returns (GetProviderSchema.Response);
+    rpc PrepareProviderConfig(PrepareProviderConfig.Request) returns (PrepareProviderConfig.Response);
+    rpc ValidateResourceTypeConfig(ValidateResourceTypeConfig.Request) returns (ValidateResourceTypeConfig.Response);
+    rpc ValidateDataSourceConfig(ValidateDataSourceConfig.Request) returns (ValidateDataSourceConfig.Response);
+    rpc UpgradeResourceState(UpgradeResourceState.Request) returns (UpgradeResourceState.Response);
+
+    //////// One-time initialization, called before other functions below
+    rpc Configure(Configure.Request) returns (Configure.Response);
+
+    //////// Managed Resource Lifecycle
+    rpc ReadResource(ReadResource.Request) returns (ReadResource.Response);
+    rpc PlanResourceChange(PlanResourceChange.Request) returns (PlanResourceChange.Response);
+    rpc ApplyResourceChange(ApplyResourceChange.Request) returns (ApplyResourceChange.Response);
+    rpc ImportResourceState(ImportResourceState.Request) returns (ImportResourceState.Response);
+
+    rpc ReadDataSource(ReadDataSource.Request) returns (ReadDataSource.Response);
+
+    //////// Graceful Shutdown
+    rpc Stop(Stop.Request) returns (Stop.Response);
+}
+
+message GetProviderSchema {
+    message Request {
+    }
+    message Response {
+        Schema provider = 1;
+        map<string, Schema> resource_schemas = 2;
+        map<string, Schema> data_source_schemas = 3;
+        repeated Diagnostic diagnostics = 4;
+    }
+}
+
+message PrepareProviderConfig {
+    message Request {
+        DynamicValue config = 1;
+    }
+    message Response {
+        DynamicValue prepared_config = 1;
+        repeated Diagnostic diagnostics = 2;
+    }
+}
+
+message UpgradeResourceState {
+    message Request {
+        string type_name = 1;
+
+        // version is the schema_version number recorded in the state file
+        int64 version = 2;
+
+        // raw_state is the raw states as stored for the resource.  Core does
+        // not have access to the schema of prior_version, so it's the
+        // provider's responsibility to interpret this value using the
+        // appropriate older schema. The raw_state will be the json encoded
+        // state, or a legacy flat-mapped format.
+        RawState raw_state = 3;
+    }
+    message Response {
+        // new_state is a msgpack-encoded data structure that, when interpreted with
+        // the _current_ schema for this resource type, is functionally equivalent to
+        // that which was given in prior_state_raw.
+        DynamicValue upgraded_state = 1;
+
+        // diagnostics describes any errors encountered during migration that could not
+        // be safely resolved, and warnings about any possibly-risky assumptions made
+        // in the upgrade process.
+        repeated Diagnostic diagnostics = 2;
+    }
+}
+
+message ValidateResourceTypeConfig {
+    message Request {
+        string type_name = 1;
+        DynamicValue config = 2;
+    }
+    message Response {
+        repeated Diagnostic diagnostics = 1;
+    }
+}
+
+message ValidateDataSourceConfig {
+    message Request {
+        string type_name = 1;
+        DynamicValue config = 2;
+    }
+    message Response {
+        repeated Diagnostic diagnostics = 1;
+    }
+}
+
+message Configure {
+    message Request {
+        string terraform_version = 1;
+        DynamicValue config = 2;
+    }
+    message Response {
+        repeated Diagnostic diagnostics = 1;
+    }
+}
+
+message ReadResource {
+    message Request {
+        string type_name = 1;
+        DynamicValue current_state = 2;
+    }
+    message Response {
+        DynamicValue new_state = 1;
+        repeated Diagnostic diagnostics = 2;
+    }
+}
+
+message PlanResourceChange {
+    message Request {
+        string type_name = 1;
+        DynamicValue prior_state = 2;
+        DynamicValue proposed_new_state = 3;
+        DynamicValue config = 4;
+        bytes prior_private = 5; 
+    }
+
+    message Response {
+        DynamicValue planned_state = 1;
+        repeated AttributePath requires_replace = 2;
+        bytes planned_private = 3; 
+        repeated Diagnostic diagnostics = 4;
+
+
+        // This may be set only by the helper/schema "SDK" in the main Terraform
+        // repository, to request that Terraform Core >=0.12 permit additional
+        // inconsistencies that can result from the legacy SDK type system
+        // and its imprecise mapping to the >=0.12 type system.
+        // The change in behavior implied by this flag makes sense only for the
+        // specific details of the legacy SDK type system, and are not a general
+        // mechanism to avoid proper type handling in providers.
+        //
+        //     ====              DO NOT USE THIS              ====
+        //     ==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
+        //     ====              DO NOT USE THIS              ====
+        bool legacy_type_system = 5;
+    }
+}
+
+message ApplyResourceChange {
+    message Request {
+        string type_name = 1;
+        DynamicValue prior_state = 2;
+        DynamicValue planned_state = 3;
+        DynamicValue config = 4;
+        bytes planned_private = 5; 
+    }
+    message Response {
+        DynamicValue new_state = 1;
+        bytes private = 2; 
+        repeated Diagnostic diagnostics = 3;
+
+        // This may be set only by the helper/schema "SDK" in the main Terraform
+        // repository, to request that Terraform Core >=0.12 permit additional
+        // inconsistencies that can result from the legacy SDK type system
+        // and its imprecise mapping to the >=0.12 type system.
+        // The change in behavior implied by this flag makes sense only for the
+        // specific details of the legacy SDK type system, and are not a general
+        // mechanism to avoid proper type handling in providers.
+        //
+        //     ====              DO NOT USE THIS              ====
+        //     ==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
+        //     ====              DO NOT USE THIS              ====
+        bool legacy_type_system = 4;
+    }
+}
+
+message ImportResourceState {
+    message Request {
+        string type_name = 1;
+        string id = 2;
+    }
+
+    message ImportedResource {
+        string type_name = 1;
+        DynamicValue state = 2;
+        bytes private = 3;
+    }
+
+    message Response {
+        repeated ImportedResource imported_resources = 1;
+        repeated Diagnostic diagnostics = 2;
+    }
+}
+
+message ReadDataSource {
+    message Request {
+        string type_name = 1;
+        DynamicValue config = 2;
+    }
+    message Response {
+        DynamicValue state = 1;
+        repeated Diagnostic diagnostics = 2;
+    }
+}
+
+service Provisioner {
+    rpc GetSchema(GetProvisionerSchema.Request) returns (GetProvisionerSchema.Response);
+    rpc ValidateProvisionerConfig(ValidateProvisionerConfig.Request) returns (ValidateProvisionerConfig.Response);
+    rpc ProvisionResource(ProvisionResource.Request) returns (stream ProvisionResource.Response);
+    rpc Stop(Stop.Request) returns (Stop.Response);
+}
+
+message GetProvisionerSchema {
+    message Request {
+    }
+    message Response {
+        Schema provisioner = 1;
+        repeated Diagnostic diagnostics = 2;
+    }
+}
+
+message ValidateProvisionerConfig {
+    message Request {
+        DynamicValue config = 1;
+    }
+    message Response {
+        repeated Diagnostic diagnostics = 1;
+    }
+}
+
+message ProvisionResource {
+    message Request {
+        DynamicValue config = 1;
+        DynamicValue connection = 2;
+    }
+    message Response {
+        string output  = 1;
+        repeated Diagnostic diagnostics = 2;
+    }   
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/blocktoattr/doc.go b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/doc.go
new file mode 100644
index 0000000..8f89909
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/doc.go
@@ -0,0 +1,5 @@
+// Package blocktoattr includes some helper functions that can perform
+// preprocessing on a HCL body where a configschema.Block schema is available
+// in order to allow list and set attributes defined in the schema to be
+// optionally written by the user as block syntax.
+package blocktoattr
diff --git a/vendor/github.com/hashicorp/terraform/lang/blocktoattr/fixup.go b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/fixup.go
new file mode 100644
index 0000000..d8c2e77
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/fixup.go
@@ -0,0 +1,187 @@
+package blocktoattr
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// FixUpBlockAttrs takes a raw HCL body and adds some additional normalization
+// functionality to allow attributes that are specified as having list or set
+// type in the schema to be written with HCL block syntax as multiple nested
+// blocks with the attribute name as the block type.
+//
+// This partially restores some of the block/attribute confusion from HCL 1
+// so that existing patterns that depended on that confusion can continue to
+// be used in the short term while we settle on a longer-term strategy.
+//
+// Most of the fixup work is actually done when the returned body is
+// subsequently decoded, so while FixUpBlockAttrs always succeeds, the eventual
+// decode of the body might not, if the content of the body is so ambiguous
+// that there's no safe way to map it to the schema.
+func FixUpBlockAttrs(body hcl.Body, schema *configschema.Block) hcl.Body {
+        // The schema should never be nil, but in practice it seems to be sometimes
+        // in the presence of poorly-configured test mocks, so we'll be robust
+        // by synthesizing an empty one.
+        if schema == nil {
+                schema = &configschema.Block{}
+        }
+
+        return &fixupBody{
+                original: body,
+                schema:   schema,
+                names:    ambiguousNames(schema),
+        }
+}
+
+type fixupBody struct {
+        original hcl.Body
+        schema   *configschema.Block
+        names    map[string]struct{}
+}
+
+// Content decodes content from the body. The given schema must be the lower-level
+// representation of the same schema that was previously passed to FixUpBlockAttrs,
+// or else the result is undefined.
+func (b *fixupBody) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) {
+        schema = b.effectiveSchema(schema)
+        content, diags := b.original.Content(schema)
+        return b.fixupContent(content), diags
+}
+
+func (b *fixupBody) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) {
+        schema = b.effectiveSchema(schema)
+        content, remain, diags := b.original.PartialContent(schema)
+        remain = &fixupBody{
+                original: remain,
+                schema:   b.schema,
+                names:    b.names,
+        }
+        return b.fixupContent(content), remain, diags
+}
+
+func (b *fixupBody) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
+        // FixUpBlockAttrs is not intended to be used in situations where we'd use
+        // JustAttributes, so we just pass this through verbatim to complete our
+        // implementation of hcl.Body.
+        return b.original.JustAttributes()
+}
+
+func (b *fixupBody) MissingItemRange() hcl.Range {
+        return b.original.MissingItemRange()
+}
+
+// effectiveSchema produces a derived *hcl.BodySchema by sniffing the body's
+// content to determine whether the author has used attribute or block syntax
+// for each of the ambigious attributes where both are permitted.
+//
+// The resulting schema will always contain all of the same names that are
+// in the given schema, but some attribute schemas may instead be replaced by
+// block header schemas.
+func (b *fixupBody) effectiveSchema(given *hcl.BodySchema) *hcl.BodySchema {
+        return effectiveSchema(given, b.original, b.names, true)
+}
+
+func (b *fixupBody) fixupContent(content *hcl.BodyContent) *hcl.BodyContent {
+        var ret hcl.BodyContent
+        ret.Attributes = make(hcl.Attributes)
+        for name, attr := range content.Attributes {
+                ret.Attributes[name] = attr
+        }
+        blockAttrVals := make(map[string][]*hcl.Block)
+        for _, block := range content.Blocks {
+                if _, exists := b.names[block.Type]; exists {
+                        // If we get here then we've found a block type whose instances need
+                        // to be re-interpreted as a list-of-objects attribute. We'll gather
+                        // those up and fix them up below.
+                        blockAttrVals[block.Type] = append(blockAttrVals[block.Type], block)
+                        continue
+                }
+
+                // We need to now re-wrap our inner body so it will be subject to the
+                // same attribute-as-block fixup when recursively decoded.
+                retBlock := *block // shallow copy
+                if blockS, ok := b.schema.BlockTypes[block.Type]; ok {
+                        // Would be weird if not ok, but we'll allow it for robustness; body just won't be fixed up, then
+                        retBlock.Body = FixUpBlockAttrs(retBlock.Body, &blockS.Block)
+                }
+
+                ret.Blocks = append(ret.Blocks, &retBlock)
+        }
+        // No we'll install synthetic attributes for each of our fixups. We can't
+        // do this exactly because HCL's information model expects an attribute
+        // to be a single decl but we have multiple separate blocks. We'll
+        // approximate things, then, by using only our first block for the source
+        // location information. (We are guaranteed at least one by the above logic.)
+        for name, blocks := range blockAttrVals {
+                ret.Attributes[name] = &hcl.Attribute{
+                        Name: name,
+                        Expr: &fixupBlocksExpr{
+                                blocks: blocks,
+                                ety:    b.schema.Attributes[name].Type.ElementType(),
+                        },
+
+                        Range:     blocks[0].DefRange,
+                        NameRange: blocks[0].TypeRange,
+                }
+        }
+        return &ret
+}
+
+type fixupBlocksExpr struct {
+        blocks hcl.Blocks
+        ety    cty.Type
+}
+
+func (e *fixupBlocksExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        // In order to produce a suitable value for our expression we need to
+        // now decode the whole descendent block structure under each of our block
+        // bodies.
+        //
+        // That requires us to do something rather strange: we must construct a
+        // synthetic block type schema derived from the element type of the
+        // attribute, thus inverting our usual direction of lowering a schema
+        // into an implied type. Because a type is less detailed than a schema,
+        // the result is imprecise and in particular will just consider all
+        // the attributes to be optional and let the provider eventually decide
+        // whether to return errors if they turn out to be null when required.
+        schema := SchemaForCtyElementType(e.ety) // this schema's ImpliedType will match e.ety
+        spec := schema.DecoderSpec()
+
+        vals := make([]cty.Value, len(e.blocks))
+        var diags hcl.Diagnostics
+        for i, block := range e.blocks {
+                body := FixUpBlockAttrs(block.Body, schema)
+                val, blockDiags := hcldec.Decode(body, spec, ctx)
+                diags = append(diags, blockDiags...)
+                if val == cty.NilVal {
+                        val = cty.UnknownVal(e.ety)
+                }
+                vals[i] = val
+        }
+        if len(vals) == 0 {
+                return cty.ListValEmpty(e.ety), diags
+        }
+        return cty.ListVal(vals), diags
+}
+
+func (e *fixupBlocksExpr) Variables() []hcl.Traversal {
+        var ret []hcl.Traversal
+        schema := SchemaForCtyElementType(e.ety)
+        spec := schema.DecoderSpec()
+        for _, block := range e.blocks {
+                ret = append(ret, hcldec.Variables(block.Body, spec)...)
+        }
+        return ret
+}
+
+func (e *fixupBlocksExpr) Range() hcl.Range {
+        // This is not really an appropriate range for the expression but it's
+        // the best we can do from here.
+        return e.blocks[0].DefRange
+}
+
+func (e *fixupBlocksExpr) StartRange() hcl.Range {
+        return e.blocks[0].DefRange
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/blocktoattr/schema.go b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/schema.go
new file mode 100644
index 0000000..2f2463a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/schema.go
@@ -0,0 +1,145 @@
+package blocktoattr
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+func ambiguousNames(schema *configschema.Block) map[string]struct{} {
+        if schema == nil {
+                return nil
+        }
+        ambiguousNames := make(map[string]struct{})
+        for name, attrS := range schema.Attributes {
+                aty := attrS.Type
+                if (aty.IsListType() || aty.IsSetType()) && aty.ElementType().IsObjectType() {
+                        ambiguousNames[name] = struct{}{}
+                }
+        }
+        return ambiguousNames
+}
+
+func effectiveSchema(given *hcl.BodySchema, body hcl.Body, ambiguousNames map[string]struct{}, dynamicExpanded bool) *hcl.BodySchema {
+        ret := &hcl.BodySchema{}
+
+        appearsAsBlock := make(map[string]struct{})
+        {
+                // We'll construct some throwaway schemas here just to probe for
+                // whether each of our ambiguous names seems to be being used as
+                // an attribute or a block. We need to check both because in JSON
+                // syntax we rely on the schema to decide between attribute or block
+                // interpretation and so JSON will always answer yes to both of
+                // these questions and we want to prefer the attribute interpretation
+                // in that case.
+                var probeSchema hcl.BodySchema
+
+                for name := range ambiguousNames {
+                        probeSchema = hcl.BodySchema{
+                                Attributes: []hcl.AttributeSchema{
+                                        {
+                                                Name: name,
+                                        },
+                                },
+                        }
+                        content, _, _ := body.PartialContent(&probeSchema)
+                        if _, exists := content.Attributes[name]; exists {
+                                // Can decode as an attribute, so we'll go with that.
+                                continue
+                        }
+                        probeSchema = hcl.BodySchema{
+                                Blocks: []hcl.BlockHeaderSchema{
+                                        {
+                                                Type: name,
+                                        },
+                                },
+                        }
+                        content, _, _ = body.PartialContent(&probeSchema)
+                        if len(content.Blocks) > 0 {
+                                // No attribute present and at least one block present, so
+                                // we'll need to rewrite this one as a block for a successful
+                                // result.
+                                appearsAsBlock[name] = struct{}{}
+                        }
+                }
+                if !dynamicExpanded {
+                        // If we're deciding for a context where dynamic blocks haven't
+                        // been expanded yet then we need to probe for those too.
+                        probeSchema = hcl.BodySchema{
+                                Blocks: []hcl.BlockHeaderSchema{
+                                        {
+                                                Type:       "dynamic",
+                                                LabelNames: []string{"type"},
+                                        },
+                                },
+                        }
+                        content, _, _ := body.PartialContent(&probeSchema)
+                        for _, block := range content.Blocks {
+                                if _, exists := ambiguousNames[block.Labels[0]]; exists {
+                                        appearsAsBlock[block.Labels[0]] = struct{}{}
+                                }
+                        }
+                }
+        }
+
+        for _, attrS := range given.Attributes {
+                if _, exists := appearsAsBlock[attrS.Name]; exists {
+                        ret.Blocks = append(ret.Blocks, hcl.BlockHeaderSchema{
+                                Type: attrS.Name,
+                        })
+                } else {
+                        ret.Attributes = append(ret.Attributes, attrS)
+                }
+        }
+
+        // Anything that is specified as a block type in the input schema remains
+        // that way by just passing through verbatim.
+        ret.Blocks = append(ret.Blocks, given.Blocks...)
+
+        return ret
+}
+
+// SchemaForCtyElementType converts a cty object type into an
+// approximately-equivalent configschema.Block representing the element of
+// a list or set. If the given type is not an object type then this
+// function will panic.
+func SchemaForCtyElementType(ty cty.Type) *configschema.Block {
+        atys := ty.AttributeTypes()
+        ret := &configschema.Block{
+                Attributes: make(map[string]*configschema.Attribute, len(atys)),
+        }
+        for name, aty := range atys {
+                ret.Attributes[name] = &configschema.Attribute{
+                        Type:     aty,
+                        Optional: true,
+                }
+        }
+        return ret
+}
+
+// SchemaForCtyContainerType converts a cty list-of-object or set-of-object type
+// into an approximately-equivalent configschema.NestedBlock. If the given type
+// is not of the expected kind then this function will panic.
+func SchemaForCtyContainerType(ty cty.Type) *configschema.NestedBlock {
+        var nesting configschema.NestingMode
+        switch {
+        case ty.IsListType():
+                nesting = configschema.NestingList
+        case ty.IsSetType():
+                nesting = configschema.NestingSet
+        default:
+                panic("unsuitable type")
+        }
+        nested := SchemaForCtyElementType(ty.ElementType())
+        return &configschema.NestedBlock{
+                Nesting: nesting,
+                Block:   *nested,
+        }
+}
+
+// TypeCanBeBlocks returns true if the given type is a list-of-object or
+// set-of-object type, and would thus be subject to the blocktoattr fixup
+// if used as an attribute type.
+func TypeCanBeBlocks(ty cty.Type) bool {
+        return (ty.IsListType() || ty.IsSetType()) && ty.ElementType().IsObjectType()
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/blocktoattr/variables.go b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/variables.go
new file mode 100644
index 0000000..e123b8a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/blocktoattr/variables.go
@@ -0,0 +1,43 @@
+package blocktoattr
+
+import (
+        "github.com/hashicorp/hcl2/ext/dynblock"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/hashicorp/terraform/configs/configschema"
+)
+
+// ExpandedVariables finds all of the global variables referenced in the
+// given body with the given schema while taking into account the possibilities
+// both of "dynamic" blocks being expanded and the possibility of certain
+// attributes being written instead as nested blocks as allowed by the
+// FixUpBlockAttrs function.
+//
+// This function exists to allow variables to be analyzed prior to dynamic
+// block expansion while also dealing with the fact that dynamic block expansion
+// might in turn produce nested blocks that are subject to FixUpBlockAttrs.
+//
+// This is intended as a drop-in replacement for dynblock.VariablesHCLDec,
+// which is itself a drop-in replacement for hcldec.Variables.
+func ExpandedVariables(body hcl.Body, schema *configschema.Block) []hcl.Traversal {
+        rootNode := dynblock.WalkVariables(body)
+        return walkVariables(rootNode, body, schema)
+}
+
+func walkVariables(node dynblock.WalkVariablesNode, body hcl.Body, schema *configschema.Block) []hcl.Traversal {
+        givenRawSchema := hcldec.ImpliedSchema(schema.DecoderSpec())
+        ambiguousNames := ambiguousNames(schema)
+        effectiveRawSchema := effectiveSchema(givenRawSchema, body, ambiguousNames, false)
+        vars, children := node.Visit(effectiveRawSchema)
+
+        for _, child := range children {
+                if blockS, exists := schema.BlockTypes[child.BlockTypeName]; exists {
+                        vars = append(vars, walkVariables(child.Node, child.Body(), &blockS.Block)...)
+                } else if attrS, exists := schema.Attributes[child.BlockTypeName]; exists {
+                        synthSchema := SchemaForCtyElementType(attrS.Type.ElementType())
+                        vars = append(vars, walkVariables(child.Node, child.Body(), synthSchema)...)
+                }
+        }
+
+        return vars
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/data.go b/vendor/github.com/hashicorp/terraform/lang/data.go
new file mode 100644
index 0000000..80313d6
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/data.go
@@ -0,0 +1,33 @@
+package lang
+
+import (
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Data is an interface whose implementations can provide cty.Value
+// representations of objects identified by referenceable addresses from
+// the addrs package.
+//
+// This interface will grow each time a new type of reference is added, and so
+// implementations outside of the Terraform codebases are not advised.
+//
+// Each method returns a suitable value and optionally some diagnostics. If the
+// returned diagnostics contains errors then the type of the returned value is
+// used to construct an unknown value of the same type which is then used in
+// place of the requested object so that type checking can still proceed. In
+// cases where it's not possible to even determine a suitable result type,
+// cty.DynamicVal is returned along with errors describing the problem.
+type Data interface {
+        StaticValidateReferences(refs []*addrs.Reference, self addrs.Referenceable) tfdiags.Diagnostics
+
+        GetCountAttr(addrs.CountAttr, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetResourceInstance(addrs.ResourceInstance, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetLocalValue(addrs.LocalValue, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetModuleInstance(addrs.ModuleCallInstance, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetModuleInstanceOutput(addrs.ModuleCallOutput, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetPathAttr(addrs.PathAttr, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetTerraformAttr(addrs.TerraformAttr, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+        GetInputVariable(addrs.InputVariable, tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics)
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/doc.go b/vendor/github.com/hashicorp/terraform/lang/doc.go
new file mode 100644
index 0000000..af5c5ca
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/doc.go
@@ -0,0 +1,5 @@
+// Package lang deals with the runtime aspects of Terraform's configuration
+// language, with concerns such as expression evaluation. It is closely related
+// to sibling package "configs", which is responsible for configuration
+// parsing and static validation.
+package lang
diff --git a/vendor/github.com/hashicorp/terraform/lang/eval.go b/vendor/github.com/hashicorp/terraform/lang/eval.go
new file mode 100644
index 0000000..a3fb363
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/eval.go
@@ -0,0 +1,477 @@
+package lang
+
+import (
+        "fmt"
+        "log"
+        "strconv"
+
+        "github.com/hashicorp/hcl2/ext/dynblock"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang/blocktoattr"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+)
+
+// ExpandBlock expands any "dynamic" blocks present in the given body. The
+// result is a body with those blocks expanded, ready to be evaluated with
+// EvalBlock.
+//
+// If the returned diagnostics contains errors then the result may be
+// incomplete or invalid.
+func (s *Scope) ExpandBlock(body hcl.Body, schema *configschema.Block) (hcl.Body, tfdiags.Diagnostics) {
+        spec := schema.DecoderSpec()
+
+        traversals := dynblock.ExpandVariablesHCLDec(body, spec)
+        refs, diags := References(traversals)
+
+        ctx, ctxDiags := s.EvalContext(refs)
+        diags = diags.Append(ctxDiags)
+
+        return dynblock.Expand(body, ctx), diags
+}
+
+// EvalBlock evaluates the given body using the given block schema and returns
+// a cty object value representing its contents. The type of the result conforms
+// to the implied type of the given schema.
+//
+// This function does not automatically expand "dynamic" blocks within the
+// body. If that is desired, first call the ExpandBlock method to obtain
+// an expanded body to pass to this method.
+//
+// If the returned diagnostics contains errors then the result may be
+// incomplete or invalid.
+func (s *Scope) EvalBlock(body hcl.Body, schema *configschema.Block) (cty.Value, tfdiags.Diagnostics) {
+        spec := schema.DecoderSpec()
+
+        refs, diags := ReferencesInBlock(body, schema)
+
+        ctx, ctxDiags := s.EvalContext(refs)
+        diags = diags.Append(ctxDiags)
+        if diags.HasErrors() {
+                // We'll stop early if we found problems in the references, because
+                // it's likely evaluation will produce redundant copies of the same errors.
+                return cty.UnknownVal(schema.ImpliedType()), diags
+        }
+
+        // HACK: In order to remain compatible with some assumptions made in
+        // Terraform v0.11 and earlier about the approximate equivalence of
+        // attribute vs. block syntax, we do a just-in-time fixup here to allow
+        // any attribute in the schema that has a list-of-objects or set-of-objects
+        // kind to potentially be populated instead by one or more nested blocks
+        // whose type is the attribute name.
+        body = blocktoattr.FixUpBlockAttrs(body, schema)
+
+        val, evalDiags := hcldec.Decode(body, spec, ctx)
+        diags = diags.Append(evalDiags)
+
+        return val, diags
+}
+
+// EvalExpr evaluates a single expression in the receiving context and returns
+// the resulting value. The value will be converted to the given type before
+// it is returned if possible, or else an error diagnostic will be produced
+// describing the conversion error.
+//
+// Pass an expected type of cty.DynamicPseudoType to skip automatic conversion
+// and just obtain the returned value directly.
+//
+// If the returned diagnostics contains errors then the result may be
+// incomplete, but will always be of the requested type.
+func (s *Scope) EvalExpr(expr hcl.Expression, wantType cty.Type) (cty.Value, tfdiags.Diagnostics) {
+        refs, diags := ReferencesInExpr(expr)
+
+        ctx, ctxDiags := s.EvalContext(refs)
+        diags = diags.Append(ctxDiags)
+        if diags.HasErrors() {
+                // We'll stop early if we found problems in the references, because
+                // it's likely evaluation will produce redundant copies of the same errors.
+                return cty.UnknownVal(wantType), diags
+        }
+
+        val, evalDiags := expr.Value(ctx)
+        diags = diags.Append(evalDiags)
+
+        if wantType != cty.DynamicPseudoType {
+                var convErr error
+                val, convErr = convert.Convert(val, wantType)
+                if convErr != nil {
+                        val = cty.UnknownVal(wantType)
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Incorrect value type",
+                                Detail:   fmt.Sprintf("Invalid expression value: %s.", tfdiags.FormatError(convErr)),
+                                Subject:  expr.Range().Ptr(),
+                        })
+                }
+        }
+
+        return val, diags
+}
+
+// EvalReference evaluates the given reference in the receiving scope and
+// returns the resulting value. The value will be converted to the given type before
+// it is returned if possible, or else an error diagnostic will be produced
+// describing the conversion error.
+//
+// Pass an expected type of cty.DynamicPseudoType to skip automatic conversion
+// and just obtain the returned value directly.
+//
+// If the returned diagnostics contains errors then the result may be
+// incomplete, but will always be of the requested type.
+func (s *Scope) EvalReference(ref *addrs.Reference, wantType cty.Type) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // We cheat a bit here and just build an EvalContext for our requested
+        // reference with the "self" address overridden, and then pull the "self"
+        // result out of it to return.
+        ctx, ctxDiags := s.evalContext([]*addrs.Reference{ref}, ref.Subject)
+        diags = diags.Append(ctxDiags)
+        val := ctx.Variables["self"]
+        if val == cty.NilVal {
+                val = cty.DynamicVal
+        }
+
+        var convErr error
+        val, convErr = convert.Convert(val, wantType)
+        if convErr != nil {
+                val = cty.UnknownVal(wantType)
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Incorrect value type",
+                        Detail:   fmt.Sprintf("Invalid expression value: %s.", tfdiags.FormatError(convErr)),
+                        Subject:  ref.SourceRange.ToHCL().Ptr(),
+                })
+        }
+
+        return val, diags
+}
+
+// EvalContext constructs a HCL expression evaluation context whose variable
+// scope contains sufficient values to satisfy the given set of references.
+//
+// Most callers should prefer to use the evaluation helper methods that
+// this type offers, but this is here for less common situations where the
+// caller will handle the evaluation calls itself.
+func (s *Scope) EvalContext(refs []*addrs.Reference) (*hcl.EvalContext, tfdiags.Diagnostics) {
+        return s.evalContext(refs, s.SelfAddr)
+}
+
+func (s *Scope) evalContext(refs []*addrs.Reference, selfAddr addrs.Referenceable) (*hcl.EvalContext, tfdiags.Diagnostics) {
+        if s == nil {
+                panic("attempt to construct EvalContext for nil Scope")
+        }
+
+        var diags tfdiags.Diagnostics
+        vals := make(map[string]cty.Value)
+        funcs := s.Functions()
+        ctx := &hcl.EvalContext{
+                Variables: vals,
+                Functions: funcs,
+        }
+
+        if len(refs) == 0 {
+                // Easy path for common case where there are no references at all.
+                return ctx, diags
+        }
+
+        // First we'll do static validation of the references. This catches things
+        // early that might otherwise not get caught due to unknown values being
+        // present in the scope during planning.
+        if staticDiags := s.Data.StaticValidateReferences(refs, selfAddr); staticDiags.HasErrors() {
+                diags = diags.Append(staticDiags)
+                return ctx, diags
+        }
+
+        // The reference set we are given has not been de-duped, and so there can
+        // be redundant requests in it for two reasons:
+        //  - The same item is referenced multiple times
+        //  - Both an item and that item's container are separately referenced.
+        // We will still visit every reference here and ask our data source for
+        // it, since that allows us to gather a full set of any errors and
+        // warnings, but once we've gathered all the data we'll then skip anything
+        // that's redundant in the process of populating our values map.
+        dataResources := map[string]map[string]map[addrs.InstanceKey]cty.Value{}
+        managedResources := map[string]map[string]map[addrs.InstanceKey]cty.Value{}
+        wholeModules := map[string]map[addrs.InstanceKey]cty.Value{}
+        moduleOutputs := map[string]map[addrs.InstanceKey]map[string]cty.Value{}
+        inputVariables := map[string]cty.Value{}
+        localValues := map[string]cty.Value{}
+        pathAttrs := map[string]cty.Value{}
+        terraformAttrs := map[string]cty.Value{}
+        countAttrs := map[string]cty.Value{}
+        var self cty.Value
+
+        for _, ref := range refs {
+                rng := ref.SourceRange
+                isSelf := false
+
+                rawSubj := ref.Subject
+                if rawSubj == addrs.Self {
+                        if selfAddr == nil {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  `Invalid "self" reference`,
+                                        // This detail message mentions some current practice that
+                                        // this codepath doesn't really "know about". If the "self"
+                                        // object starts being supported in more contexts later then
+                                        // we'll need to adjust this message.
+                                        Detail:  `The "self" object is not available in this context. This object can be used only in resource provisioner and connection blocks.`,
+                                        Subject: ref.SourceRange.ToHCL().Ptr(),
+                                })
+                                continue
+                        }
+
+                        // Treat "self" as an alias for the configured self address.
+                        rawSubj = selfAddr
+                        isSelf = true
+
+                        if rawSubj == addrs.Self {
+                                // Programming error: the self address cannot alias itself.
+                                panic("scope SelfAddr attempting to alias itself")
+                        }
+                }
+
+                // This type switch must cover all of the "Referenceable" implementations
+                // in package addrs.
+                switch subj := rawSubj.(type) {
+
+                case addrs.ResourceInstance:
+                        var into map[string]map[string]map[addrs.InstanceKey]cty.Value
+                        switch subj.Resource.Mode {
+                        case addrs.ManagedResourceMode:
+                                into = managedResources
+                        case addrs.DataResourceMode:
+                                into = dataResources
+                        default:
+                                panic(fmt.Errorf("unsupported ResourceMode %s", subj.Resource.Mode))
+                        }
+
+                        val, valDiags := normalizeRefValue(s.Data.GetResourceInstance(subj, rng))
+                        diags = diags.Append(valDiags)
+
+                        r := subj.Resource
+                        if into[r.Type] == nil {
+                                into[r.Type] = make(map[string]map[addrs.InstanceKey]cty.Value)
+                        }
+                        if into[r.Type][r.Name] == nil {
+                                into[r.Type][r.Name] = make(map[addrs.InstanceKey]cty.Value)
+                        }
+                        into[r.Type][r.Name][subj.Key] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.ModuleCallInstance:
+                        val, valDiags := normalizeRefValue(s.Data.GetModuleInstance(subj, rng))
+                        diags = diags.Append(valDiags)
+
+                        if wholeModules[subj.Call.Name] == nil {
+                                wholeModules[subj.Call.Name] = make(map[addrs.InstanceKey]cty.Value)
+                        }
+                        wholeModules[subj.Call.Name][subj.Key] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.ModuleCallOutput:
+                        val, valDiags := normalizeRefValue(s.Data.GetModuleInstanceOutput(subj, rng))
+                        diags = diags.Append(valDiags)
+
+                        callName := subj.Call.Call.Name
+                        callKey := subj.Call.Key
+                        if moduleOutputs[callName] == nil {
+                                moduleOutputs[callName] = make(map[addrs.InstanceKey]map[string]cty.Value)
+                        }
+                        if moduleOutputs[callName][callKey] == nil {
+                                moduleOutputs[callName][callKey] = make(map[string]cty.Value)
+                        }
+                        moduleOutputs[callName][callKey][subj.Name] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.InputVariable:
+                        val, valDiags := normalizeRefValue(s.Data.GetInputVariable(subj, rng))
+                        diags = diags.Append(valDiags)
+                        inputVariables[subj.Name] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.LocalValue:
+                        val, valDiags := normalizeRefValue(s.Data.GetLocalValue(subj, rng))
+                        diags = diags.Append(valDiags)
+                        localValues[subj.Name] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.PathAttr:
+                        val, valDiags := normalizeRefValue(s.Data.GetPathAttr(subj, rng))
+                        diags = diags.Append(valDiags)
+                        pathAttrs[subj.Name] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.TerraformAttr:
+                        val, valDiags := normalizeRefValue(s.Data.GetTerraformAttr(subj, rng))
+                        diags = diags.Append(valDiags)
+                        terraformAttrs[subj.Name] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                case addrs.CountAttr:
+                        val, valDiags := normalizeRefValue(s.Data.GetCountAttr(subj, rng))
+                        diags = diags.Append(valDiags)
+                        countAttrs[subj.Name] = val
+                        if isSelf {
+                                self = val
+                        }
+
+                default:
+                        // Should never happen
+                        panic(fmt.Errorf("Scope.buildEvalContext cannot handle address type %T", rawSubj))
+                }
+        }
+
+        for k, v := range buildResourceObjects(managedResources) {
+                vals[k] = v
+        }
+        vals["data"] = cty.ObjectVal(buildResourceObjects(dataResources))
+        vals["module"] = cty.ObjectVal(buildModuleObjects(wholeModules, moduleOutputs))
+        vals["var"] = cty.ObjectVal(inputVariables)
+        vals["local"] = cty.ObjectVal(localValues)
+        vals["path"] = cty.ObjectVal(pathAttrs)
+        vals["terraform"] = cty.ObjectVal(terraformAttrs)
+        vals["count"] = cty.ObjectVal(countAttrs)
+        if self != cty.NilVal {
+                vals["self"] = self
+        }
+
+        return ctx, diags
+}
+
+func buildResourceObjects(resources map[string]map[string]map[addrs.InstanceKey]cty.Value) map[string]cty.Value {
+        vals := make(map[string]cty.Value)
+        for typeName, names := range resources {
+                nameVals := make(map[string]cty.Value)
+                for name, keys := range names {
+                        nameVals[name] = buildInstanceObjects(keys)
+                }
+                vals[typeName] = cty.ObjectVal(nameVals)
+        }
+        return vals
+}
+
+func buildModuleObjects(wholeModules map[string]map[addrs.InstanceKey]cty.Value, moduleOutputs map[string]map[addrs.InstanceKey]map[string]cty.Value) map[string]cty.Value {
+        vals := make(map[string]cty.Value)
+
+        for name, keys := range wholeModules {
+                vals[name] = buildInstanceObjects(keys)
+        }
+
+        for name, keys := range moduleOutputs {
+                if _, exists := wholeModules[name]; exists {
+                        // If we also have a whole module value for this name then we'll
+                        // skip this since the individual outputs are embedded in that result.
+                        continue
+                }
+
+                // The shape of this collection isn't compatible with buildInstanceObjects,
+                // but rather than replicating most of the buildInstanceObjects logic
+                // here we'll instead first transform the structure to be what that
+                // function expects and then use it. This is a little wasteful, but
+                // we do not expect this these maps to be large and so the extra work
+                // here should not hurt too much.
+                flattened := make(map[addrs.InstanceKey]cty.Value, len(keys))
+                for k, vals := range keys {
+                        flattened[k] = cty.ObjectVal(vals)
+                }
+                vals[name] = buildInstanceObjects(flattened)
+        }
+
+        return vals
+}
+
+func buildInstanceObjects(keys map[addrs.InstanceKey]cty.Value) cty.Value {
+        if val, exists := keys[addrs.NoKey]; exists {
+                // If present, a "no key" value supersedes all other values,
+                // since they should be embedded inside it.
+                return val
+        }
+
+        // If we only have individual values then we need to construct
+        // either a list or a map, depending on what sort of keys we
+        // have.
+        haveInt := false
+        haveString := false
+        maxInt := 0
+
+        for k := range keys {
+                switch tk := k.(type) {
+                case addrs.IntKey:
+                        haveInt = true
+                        if int(tk) > maxInt {
+                                maxInt = int(tk)
+                        }
+                case addrs.StringKey:
+                        haveString = true
+                }
+        }
+
+        // We should either have ints or strings and not both, but
+        // if we have both then we'll prefer strings and let the
+        // language interpreter try to convert the int keys into
+        // strings in a map.
+        switch {
+        case haveString:
+                vals := make(map[string]cty.Value)
+                for k, v := range keys {
+                        switch tk := k.(type) {
+                        case addrs.StringKey:
+                                vals[string(tk)] = v
+                        case addrs.IntKey:
+                                sk := strconv.Itoa(int(tk))
+                                vals[sk] = v
+                        }
+                }
+                return cty.ObjectVal(vals)
+        case haveInt:
+                // We'll make a tuple that is long enough for our maximum
+                // index value. It doesn't matter if we end up shorter than
+                // the number of instances because if length(...) were
+                // being evaluated we would've got a NoKey reference and
+                // thus not ended up in this codepath at all.
+                vals := make([]cty.Value, maxInt+1)
+                for i := range vals {
+                        if v, exists := keys[addrs.IntKey(i)]; exists {
+                                vals[i] = v
+                        } else {
+                                // Just a placeholder, since nothing will access this anyway
+                                vals[i] = cty.DynamicVal
+                        }
+                }
+                return cty.TupleVal(vals)
+        default:
+                // Should never happen because there are no other key types.
+                log.Printf("[ERROR] strange makeInstanceObjects call with no supported key types")
+                return cty.EmptyObjectVal
+        }
+}
+
+func normalizeRefValue(val cty.Value, diags tfdiags.Diagnostics) (cty.Value, tfdiags.Diagnostics) {
+        if diags.HasErrors() {
+                // If there are errors then we will force an unknown result so that
+                // we can still evaluate and catch type errors but we'll avoid
+                // producing redundant re-statements of the same errors we've already
+                // dealt with here.
+                return cty.UnknownVal(val.Type()), diags
+        }
+        return val, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/cidr.go b/vendor/github.com/hashicorp/terraform/lang/funcs/cidr.go
new file mode 100644
index 0000000..6ce8aa9
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/cidr.go
@@ -0,0 +1,129 @@
+package funcs
+
+import (
+        "fmt"
+        "net"
+
+        "github.com/apparentlymart/go-cidr/cidr"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+// CidrHostFunc contructs a function that calculates a full host IP address
+// within a given IP network address prefix.
+var CidrHostFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "prefix",
+                        Type: cty.String,
+                },
+                {
+                        Name: "hostnum",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var hostNum int
+                if err := gocty.FromCtyValue(args[1], &hostNum); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                _, network, err := net.ParseCIDR(args[0].AsString())
+                if err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("invalid CIDR expression: %s", err)
+                }
+
+                ip, err := cidr.Host(network, hostNum)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                return cty.StringVal(ip.String()), nil
+        },
+})
+
+// CidrNetmaskFunc contructs a function that converts an IPv4 address prefix given
+// in CIDR notation into a subnet mask address.
+var CidrNetmaskFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "prefix",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                _, network, err := net.ParseCIDR(args[0].AsString())
+                if err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("invalid CIDR expression: %s", err)
+                }
+
+                return cty.StringVal(net.IP(network.Mask).String()), nil
+        },
+})
+
+// CidrSubnetFunc contructs a function that calculates a subnet address within
+// a given IP network address prefix.
+var CidrSubnetFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "prefix",
+                        Type: cty.String,
+                },
+                {
+                        Name: "newbits",
+                        Type: cty.Number,
+                },
+                {
+                        Name: "netnum",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var newbits int
+                if err := gocty.FromCtyValue(args[1], &newbits); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                var netnum int
+                if err := gocty.FromCtyValue(args[2], &netnum); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                _, network, err := net.ParseCIDR(args[0].AsString())
+                if err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("invalid CIDR expression: %s", err)
+                }
+
+                // For portability with 32-bit systems where the subnet number
+                // will be a 32-bit int, we only allow extension of 32 bits in
+                // one call even if we're running on a 64-bit machine.
+                // (Of course, this is significant only for IPv6.)
+                if newbits > 32 {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("may not extend prefix by more than 32 bits")
+                }
+
+                newNetwork, err := cidr.Subnet(network, newbits, netnum)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                return cty.StringVal(newNetwork.String()), nil
+        },
+})
+
+// CidrHost calculates a full host IP address within a given IP network address prefix.
+func CidrHost(prefix, hostnum cty.Value) (cty.Value, error) {
+        return CidrHostFunc.Call([]cty.Value{prefix, hostnum})
+}
+
+// CidrNetmask converts an IPv4 address prefix given in CIDR notation into a subnet mask address.
+func CidrNetmask(prefix cty.Value) (cty.Value, error) {
+        return CidrNetmaskFunc.Call([]cty.Value{prefix})
+}
+
+// CidrSubnet calculates a subnet address within a given IP network address prefix.
+func CidrSubnet(prefix, newbits, netnum cty.Value) (cty.Value, error) {
+        return CidrSubnetFunc.Call([]cty.Value{prefix, newbits, netnum})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/collection.go b/vendor/github.com/hashicorp/terraform/lang/funcs/collection.go
new file mode 100644
index 0000000..71b7a84
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/collection.go
@@ -0,0 +1,1511 @@
+package funcs
+
+import (
+        "errors"
+        "fmt"
+        "sort"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/function"
+        "github.com/zclconf/go-cty/cty/function/stdlib"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+var ElementFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.DynamicPseudoType,
+                },
+                {
+                        Name: "index",
+                        Type: cty.Number,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                list := args[0]
+                listTy := list.Type()
+                switch {
+                case listTy.IsListType():
+                        return listTy.ElementType(), nil
+                case listTy.IsTupleType():
+                        if !args[1].IsKnown() {
+                                // If the index isn't known yet then we can't predict the
+                                // result type since each tuple element can have its own type.
+                                return cty.DynamicPseudoType, nil
+                        }
+
+                        etys := listTy.TupleElementTypes()
+                        var index int
+                        err := gocty.FromCtyValue(args[1], &index)
+                        if err != nil {
+                                // e.g. fractional number where whole number is required
+                                return cty.DynamicPseudoType, fmt.Errorf("invalid index: %s", err)
+                        }
+                        if len(etys) == 0 {
+                                return cty.DynamicPseudoType, errors.New("cannot use element function with an empty list")
+                        }
+                        index = index % len(etys)
+                        return etys[index], nil
+                default:
+                        return cty.DynamicPseudoType, fmt.Errorf("cannot read elements from %s", listTy.FriendlyName())
+                }
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                var index int
+                err := gocty.FromCtyValue(args[1], &index)
+                if err != nil {
+                        // can't happen because we checked this in the Type function above
+                        return cty.DynamicVal, fmt.Errorf("invalid index: %s", err)
+                }
+
+                if !args[0].IsKnown() {
+                        return cty.UnknownVal(retType), nil
+                }
+
+                l := args[0].LengthInt()
+                if l == 0 {
+                        return cty.DynamicVal, errors.New("cannot use element function with an empty list")
+                }
+                index = index % l
+
+                // We did all the necessary type checks in the type function above,
+                // so this is guaranteed not to fail.
+                return args[0].Index(cty.NumberIntVal(int64(index))), nil
+        },
+})
+
+var LengthFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name:             "value",
+                        Type:             cty.DynamicPseudoType,
+                        AllowDynamicType: true,
+                        AllowUnknown:     true,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                collTy := args[0].Type()
+                switch {
+                case collTy == cty.String || collTy.IsTupleType() || collTy.IsObjectType() || collTy.IsListType() || collTy.IsMapType() || collTy.IsSetType() || collTy == cty.DynamicPseudoType:
+                        return cty.Number, nil
+                default:
+                        return cty.Number, errors.New("argument must be a string, a collection type, or a structural type")
+                }
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                coll := args[0]
+                collTy := args[0].Type()
+                switch {
+                case collTy == cty.DynamicPseudoType:
+                        return cty.UnknownVal(cty.Number), nil
+                case collTy.IsTupleType():
+                        l := len(collTy.TupleElementTypes())
+                        return cty.NumberIntVal(int64(l)), nil
+                case collTy.IsObjectType():
+                        l := len(collTy.AttributeTypes())
+                        return cty.NumberIntVal(int64(l)), nil
+                case collTy == cty.String:
+                        // We'll delegate to the cty stdlib strlen function here, because
+                        // it deals with all of the complexities of tokenizing unicode
+                        // grapheme clusters.
+                        return stdlib.Strlen(coll)
+                case collTy.IsListType() || collTy.IsSetType() || collTy.IsMapType():
+                        return coll.Length(), nil
+                default:
+                        // Should never happen, because of the checks in our Type func above
+                        return cty.UnknownVal(cty.Number), errors.New("impossible value type for length(...)")
+                }
+        },
+})
+
+// CoalesceFunc constructs a function that takes any number of arguments and
+// returns the first one that isn't empty. This function was copied from go-cty
+// stdlib and modified so that it returns the first *non-empty* non-null element
+// from a sequence, instead of merely the first non-null.
+var CoalesceFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        VarParam: &function.Parameter{
+                Name:             "vals",
+                Type:             cty.DynamicPseudoType,
+                AllowUnknown:     true,
+                AllowDynamicType: true,
+                AllowNull:        true,
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                argTypes := make([]cty.Type, len(args))
+                for i, val := range args {
+                        argTypes[i] = val.Type()
+                }
+                retType, _ := convert.UnifyUnsafe(argTypes)
+                if retType == cty.NilType {
+                        return cty.NilType, errors.New("all arguments must have the same type")
+                }
+                return retType, nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                for _, argVal := range args {
+                        // We already know this will succeed because of the checks in our Type func above
+                        argVal, _ = convert.Convert(argVal, retType)
+                        if !argVal.IsKnown() {
+                                return cty.UnknownVal(retType), nil
+                        }
+                        if argVal.IsNull() {
+                                continue
+                        }
+                        if retType == cty.String && argVal.RawEquals(cty.StringVal("")) {
+                                continue
+                        }
+
+                        return argVal, nil
+                }
+                return cty.NilVal, errors.New("no non-null, non-empty-string arguments")
+        },
+})
+
+// CoalesceListFunc constructs a function that takes any number of list arguments
+// and returns the first one that isn't empty.
+var CoalesceListFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        VarParam: &function.Parameter{
+                Name:             "vals",
+                Type:             cty.DynamicPseudoType,
+                AllowUnknown:     true,
+                AllowDynamicType: true,
+                AllowNull:        true,
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                if len(args) == 0 {
+                        return cty.NilType, errors.New("at least one argument is required")
+                }
+
+                argTypes := make([]cty.Type, len(args))
+
+                for i, arg := range args {
+                        // if any argument is unknown, we can't be certain know which type we will return
+                        if !arg.IsKnown() {
+                                return cty.DynamicPseudoType, nil
+                        }
+                        ty := arg.Type()
+
+                        if !ty.IsListType() && !ty.IsTupleType() {
+                                return cty.NilType, errors.New("coalescelist arguments must be lists or tuples")
+                        }
+
+                        argTypes[i] = arg.Type()
+                }
+
+                last := argTypes[0]
+                // If there are mixed types, we have to return a dynamic type.
+                for _, next := range argTypes[1:] {
+                        if !next.Equals(last) {
+                                return cty.DynamicPseudoType, nil
+                        }
+                }
+
+                return last, nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                for _, arg := range args {
+                        if !arg.IsKnown() {
+                                // If we run into an unknown list at some point, we can't
+                                // predict the final result yet. (If there's a known, non-empty
+                                // arg before this then we won't get here.)
+                                return cty.UnknownVal(retType), nil
+                        }
+
+                        if arg.LengthInt() > 0 {
+                                return arg, nil
+                        }
+                }
+
+                return cty.NilVal, errors.New("no non-null arguments")
+        },
+})
+
+// CompactFunc constructs a function that takes a list of strings and returns a new list
+// with any empty string elements removed.
+var CompactFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.List(cty.String),
+                },
+        },
+        Type: function.StaticReturnType(cty.List(cty.String)),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                listVal := args[0]
+                if !listVal.IsWhollyKnown() {
+                        // If some of the element values aren't known yet then we
+                        // can't yet return a compacted list
+                        return cty.UnknownVal(retType), nil
+                }
+
+                var outputList []cty.Value
+
+                for it := listVal.ElementIterator(); it.Next(); {
+                        _, v := it.Element()
+                        if v.AsString() == "" {
+                                continue
+                        }
+                        outputList = append(outputList, v)
+                }
+
+                if len(outputList) == 0 {
+                        return cty.ListValEmpty(cty.String), nil
+                }
+
+                return cty.ListVal(outputList), nil
+        },
+})
+
+// ContainsFunc constructs a function that determines whether a given list or
+// set contains a given single value as one of its elements.
+var ContainsFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.DynamicPseudoType,
+                },
+                {
+                        Name: "value",
+                        Type: cty.DynamicPseudoType,
+                },
+        },
+        Type: function.StaticReturnType(cty.Bool),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                arg := args[0]
+                ty := arg.Type()
+
+                if !ty.IsListType() && !ty.IsTupleType() && !ty.IsSetType() {
+                        return cty.NilVal, errors.New("argument must be list, tuple, or set")
+                }
+
+                _, err = Index(cty.TupleVal(arg.AsValueSlice()), args[1])
+                if err != nil {
+                        return cty.False, nil
+                }
+
+                return cty.True, nil
+        },
+})
+
+// IndexFunc constructs a function that finds the element index for a given value in a list.
+var IndexFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.DynamicPseudoType,
+                },
+                {
+                        Name: "value",
+                        Type: cty.DynamicPseudoType,
+                },
+        },
+        Type: function.StaticReturnType(cty.Number),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                if !(args[0].Type().IsListType() || args[0].Type().IsTupleType()) {
+                        return cty.NilVal, errors.New("argument must be a list or tuple")
+                }
+
+                if !args[0].IsKnown() {
+                        return cty.UnknownVal(cty.Number), nil
+                }
+
+                if args[0].LengthInt() == 0 { // Easy path
+                        return cty.NilVal, errors.New("cannot search an empty list")
+                }
+
+                for it := args[0].ElementIterator(); it.Next(); {
+                        i, v := it.Element()
+                        eq, err := stdlib.Equal(v, args[1])
+                        if err != nil {
+                                return cty.NilVal, err
+                        }
+                        if !eq.IsKnown() {
+                                return cty.UnknownVal(cty.Number), nil
+                        }
+                        if eq.True() {
+                                return i, nil
+                        }
+                }
+                return cty.NilVal, errors.New("item not found")
+
+        },
+})
+
+// DistinctFunc constructs a function that takes a list and returns a new list
+// with any duplicate elements removed.
+var DistinctFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.List(cty.DynamicPseudoType),
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                return args[0].Type(), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                listVal := args[0]
+
+                if !listVal.IsWhollyKnown() {
+                        return cty.UnknownVal(retType), nil
+                }
+                var list []cty.Value
+
+                for it := listVal.ElementIterator(); it.Next(); {
+                        _, v := it.Element()
+                        list, err = appendIfMissing(list, v)
+                        if err != nil {
+                                return cty.NilVal, err
+                        }
+                }
+
+                return cty.ListVal(list), nil
+        },
+})
+
+// ChunklistFunc constructs a function that splits a single list into fixed-size chunks,
+// returning a list of lists.
+var ChunklistFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.List(cty.DynamicPseudoType),
+                },
+                {
+                        Name: "size",
+                        Type: cty.Number,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                return cty.List(args[0].Type()), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                listVal := args[0]
+                if !listVal.IsKnown() {
+                        return cty.UnknownVal(retType), nil
+                }
+
+                var size int
+                err = gocty.FromCtyValue(args[1], &size)
+                if err != nil {
+                        return cty.NilVal, fmt.Errorf("invalid index: %s", err)
+                }
+
+                if size < 0 {
+                        return cty.NilVal, errors.New("the size argument must be positive")
+                }
+
+                output := make([]cty.Value, 0)
+
+                // if size is 0, returns a list made of the initial list
+                if size == 0 {
+                        output = append(output, listVal)
+                        return cty.ListVal(output), nil
+                }
+
+                chunk := make([]cty.Value, 0)
+
+                l := args[0].LengthInt()
+                i := 0
+
+                for it := listVal.ElementIterator(); it.Next(); {
+                        _, v := it.Element()
+                        chunk = append(chunk, v)
+
+                        // Chunk when index isn't 0, or when reaching the values's length
+                        if (i+1)%size == 0 || (i+1) == l {
+                                output = append(output, cty.ListVal(chunk))
+                                chunk = make([]cty.Value, 0)
+                        }
+                        i++
+                }
+
+                return cty.ListVal(output), nil
+        },
+})
+
+// FlattenFunc constructs a function that takes a list and replaces any elements
+// that are lists with a flattened sequence of the list contents.
+var FlattenFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.DynamicPseudoType,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                if !args[0].IsWhollyKnown() {
+                        return cty.DynamicPseudoType, nil
+                }
+
+                argTy := args[0].Type()
+                if !argTy.IsListType() && !argTy.IsSetType() && !argTy.IsTupleType() {
+                        return cty.NilType, errors.New("can only flatten lists, sets and tuples")
+                }
+
+                retVal, known := flattener(args[0])
+                if !known {
+                        return cty.DynamicPseudoType, nil
+                }
+
+                tys := make([]cty.Type, len(retVal))
+                for i, ty := range retVal {
+                        tys[i] = ty.Type()
+                }
+                return cty.Tuple(tys), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                inputList := args[0]
+                if inputList.LengthInt() == 0 {
+                        return cty.EmptyTupleVal, nil
+                }
+
+                out, known := flattener(inputList)
+                if !known {
+                        return cty.UnknownVal(retType), nil
+                }
+
+                return cty.TupleVal(out), nil
+        },
+})
+
+// Flatten until it's not a cty.List, and return whether the value is known.
+// We can flatten lists with unknown values, as long as they are not
+// lists themselves.
+func flattener(flattenList cty.Value) ([]cty.Value, bool) {
+        out := make([]cty.Value, 0)
+        for it := flattenList.ElementIterator(); it.Next(); {
+                _, val := it.Element()
+                if val.Type().IsListType() || val.Type().IsSetType() || val.Type().IsTupleType() {
+                        if !val.IsKnown() {
+                                return out, false
+                        }
+
+                        res, known := flattener(val)
+                        if !known {
+                                return res, known
+                        }
+                        out = append(out, res...)
+                } else {
+                        out = append(out, val)
+                }
+        }
+        return out, true
+}
+
+// KeysFunc constructs a function that takes a map and returns a sorted list of the map keys.
+var KeysFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name:         "inputMap",
+                        Type:         cty.DynamicPseudoType,
+                        AllowUnknown: true,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                ty := args[0].Type()
+                switch {
+                case ty.IsMapType():
+                        return cty.List(cty.String), nil
+                case ty.IsObjectType():
+                        atys := ty.AttributeTypes()
+                        if len(atys) == 0 {
+                                return cty.EmptyTuple, nil
+                        }
+                        // All of our result elements will be strings, and atys just
+                        // decides how many there are.
+                        etys := make([]cty.Type, len(atys))
+                        for i := range etys {
+                                etys[i] = cty.String
+                        }
+                        return cty.Tuple(etys), nil
+                default:
+                        return cty.DynamicPseudoType, function.NewArgErrorf(0, "must have map or object type")
+                }
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                m := args[0]
+                var keys []cty.Value
+
+                switch {
+                case m.Type().IsObjectType():
+                        // In this case we allow unknown values so we must work only with
+                        // the attribute _types_, not with the value itself.
+                        var names []string
+                        for name := range m.Type().AttributeTypes() {
+                                names = append(names, name)
+                        }
+                        sort.Strings(names) // same ordering guaranteed by cty's ElementIterator
+                        if len(names) == 0 {
+                                return cty.EmptyTupleVal, nil
+                        }
+                        keys = make([]cty.Value, len(names))
+                        for i, name := range names {
+                                keys[i] = cty.StringVal(name)
+                        }
+                        return cty.TupleVal(keys), nil
+                default:
+                        if !m.IsKnown() {
+                                return cty.UnknownVal(retType), nil
+                        }
+
+                        // cty guarantees that ElementIterator will iterate in lexicographical
+                        // order by key.
+                        for it := args[0].ElementIterator(); it.Next(); {
+                                k, _ := it.Element()
+                                keys = append(keys, k)
+                        }
+                        if len(keys) == 0 {
+                                return cty.ListValEmpty(cty.String), nil
+                        }
+                        return cty.ListVal(keys), nil
+                }
+        },
+})
+
+// ListFunc constructs a function that takes an arbitrary number of arguments
+// and returns a list containing those values in the same order.
+//
+// This function is deprecated in Terraform v0.12
+var ListFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        VarParam: &function.Parameter{
+                Name:             "vals",
+                Type:             cty.DynamicPseudoType,
+                AllowUnknown:     true,
+                AllowDynamicType: true,
+                AllowNull:        true,
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                if len(args) == 0 {
+                        return cty.NilType, errors.New("at least one argument is required")
+                }
+
+                argTypes := make([]cty.Type, len(args))
+
+                for i, arg := range args {
+                        argTypes[i] = arg.Type()
+                }
+
+                retType, _ := convert.UnifyUnsafe(argTypes)
+                if retType == cty.NilType {
+                        return cty.NilType, errors.New("all arguments must have the same type")
+                }
+
+                return cty.List(retType), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                newList := make([]cty.Value, 0, len(args))
+
+                for _, arg := range args {
+                        // We already know this will succeed because of the checks in our Type func above
+                        arg, _ = convert.Convert(arg, retType.ElementType())
+                        newList = append(newList, arg)
+                }
+
+                return cty.ListVal(newList), nil
+        },
+})
+
+// LookupFunc constructs a function that performs dynamic lookups of map types.
+var LookupFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "inputMap",
+                        Type: cty.DynamicPseudoType,
+                },
+                {
+                        Name: "key",
+                        Type: cty.String,
+                },
+        },
+        VarParam: &function.Parameter{
+                Name:             "default",
+                Type:             cty.DynamicPseudoType,
+                AllowUnknown:     true,
+                AllowDynamicType: true,
+                AllowNull:        true,
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                if len(args) < 1 || len(args) > 3 {
+                        return cty.NilType, fmt.Errorf("lookup() takes two or three arguments, got %d", len(args))
+                }
+
+                ty := args[0].Type()
+
+                switch {
+                case ty.IsObjectType():
+                        if !args[1].IsKnown() {
+                                return cty.DynamicPseudoType, nil
+                        }
+
+                        key := args[1].AsString()
+                        if ty.HasAttribute(key) {
+                                return args[0].GetAttr(key).Type(), nil
+                        } else if len(args) == 3 {
+                                // if the key isn't found but a default is provided,
+                                // return the default type
+                                return args[2].Type(), nil
+                        }
+                        return cty.DynamicPseudoType, function.NewArgErrorf(0, "the given object has no attribute %q", key)
+                case ty.IsMapType():
+                        return ty.ElementType(), nil
+                default:
+                        return cty.NilType, function.NewArgErrorf(0, "lookup() requires a map as the first argument")
+                }
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var defaultVal cty.Value
+                defaultValueSet := false
+
+                if len(args) == 3 {
+                        defaultVal = args[2]
+                        defaultValueSet = true
+                }
+
+                mapVar := args[0]
+                lookupKey := args[1].AsString()
+
+                if !mapVar.IsWhollyKnown() {
+                        return cty.UnknownVal(retType), nil
+                }
+
+                if mapVar.Type().IsObjectType() {
+                        if mapVar.Type().HasAttribute(lookupKey) {
+                                return mapVar.GetAttr(lookupKey), nil
+                        }
+                } else if mapVar.HasIndex(cty.StringVal(lookupKey)) == cty.True {
+                        v := mapVar.Index(cty.StringVal(lookupKey))
+                        if ty := v.Type(); !ty.Equals(cty.NilType) {
+                                switch {
+                                case ty.Equals(cty.String):
+                                        return cty.StringVal(v.AsString()), nil
+                                case ty.Equals(cty.Number):
+                                        return cty.NumberVal(v.AsBigFloat()), nil
+                                default:
+                                        return cty.NilVal, errors.New("lookup() can only be used with flat lists")
+                                }
+                        }
+                }
+
+                if defaultValueSet {
+                        defaultVal, err = convert.Convert(defaultVal, retType)
+                        if err != nil {
+                                return cty.NilVal, err
+                        }
+                        return defaultVal, nil
+                }
+
+                return cty.UnknownVal(cty.DynamicPseudoType), fmt.Errorf(
+                        "lookup failed to find '%s'", lookupKey)
+        },
+})
+
+// MapFunc constructs a function that takes an even number of arguments and
+// returns a map whose elements are constructed from consecutive pairs of arguments.
+//
+// This function is deprecated in Terraform v0.12
+var MapFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        VarParam: &function.Parameter{
+                Name:             "vals",
+                Type:             cty.DynamicPseudoType,
+                AllowUnknown:     true,
+                AllowDynamicType: true,
+                AllowNull:        true,
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                if len(args) < 2 || len(args)%2 != 0 {
+                        return cty.NilType, fmt.Errorf("map requires an even number of two or more arguments, got %d", len(args))
+                }
+
+                argTypes := make([]cty.Type, len(args)/2)
+                index := 0
+
+                for i := 0; i < len(args); i += 2 {
+                        argTypes[index] = args[i+1].Type()
+                        index++
+                }
+
+                valType, _ := convert.UnifyUnsafe(argTypes)
+                if valType == cty.NilType {
+                        return cty.NilType, errors.New("all arguments must have the same type")
+                }
+
+                return cty.Map(valType), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                for _, arg := range args {
+                        if !arg.IsWhollyKnown() {
+                                return cty.UnknownVal(retType), nil
+                        }
+                }
+
+                outputMap := make(map[string]cty.Value)
+
+                for i := 0; i < len(args); i += 2 {
+
+                        key := args[i].AsString()
+
+                        err := gocty.FromCtyValue(args[i], &key)
+                        if err != nil {
+                                return cty.NilVal, err
+                        }
+
+                        val := args[i+1]
+
+                        var variable cty.Value
+                        err = gocty.FromCtyValue(val, &variable)
+                        if err != nil {
+                                return cty.NilVal, err
+                        }
+
+                        // We already know this will succeed because of the checks in our Type func above
+                        variable, _ = convert.Convert(variable, retType.ElementType())
+
+                        // Check for duplicate keys
+                        if _, ok := outputMap[key]; ok {
+                                return cty.NilVal, fmt.Errorf("argument %d is a duplicate key: %q", i+1, key)
+                        }
+                        outputMap[key] = variable
+                }
+
+                return cty.MapVal(outputMap), nil
+        },
+})
+
+// MatchkeysFunc constructs a function that constructs a new list by taking a
+// subset of elements from one list whose indexes match the corresponding
+// indexes of values in another list.
+var MatchkeysFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "values",
+                        Type: cty.List(cty.DynamicPseudoType),
+                },
+                {
+                        Name: "keys",
+                        Type: cty.List(cty.DynamicPseudoType),
+                },
+                {
+                        Name: "searchset",
+                        Type: cty.List(cty.DynamicPseudoType),
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                if !args[1].Type().Equals(args[2].Type()) {
+                        return cty.NilType, errors.New("lists must be of the same type")
+                }
+
+                return args[0].Type(), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                if !args[0].IsKnown() {
+                        return cty.UnknownVal(cty.List(retType.ElementType())), nil
+                }
+
+                if args[0].LengthInt() != args[1].LengthInt() {
+                        return cty.ListValEmpty(retType.ElementType()), errors.New("length of keys and values should be equal")
+                }
+
+                output := make([]cty.Value, 0)
+
+                values := args[0]
+                keys := args[1]
+                searchset := args[2]
+
+                // if searchset is empty, return an empty list.
+                if searchset.LengthInt() == 0 {
+                        return cty.ListValEmpty(retType.ElementType()), nil
+                }
+
+                if !values.IsWhollyKnown() || !keys.IsWhollyKnown() {
+                        return cty.UnknownVal(retType), nil
+                }
+
+                i := 0
+                for it := keys.ElementIterator(); it.Next(); {
+                        _, key := it.Element()
+                        for iter := searchset.ElementIterator(); iter.Next(); {
+                                _, search := iter.Element()
+                                eq, err := stdlib.Equal(key, search)
+                                if err != nil {
+                                        return cty.NilVal, err
+                                }
+                                if !eq.IsKnown() {
+                                        return cty.ListValEmpty(retType.ElementType()), nil
+                                }
+                                if eq.True() {
+                                        v := values.Index(cty.NumberIntVal(int64(i)))
+                                        output = append(output, v)
+                                        break
+                                }
+                        }
+                        i++
+                }
+
+                // if we haven't matched any key, then output is an empty list.
+                if len(output) == 0 {
+                        return cty.ListValEmpty(retType.ElementType()), nil
+                }
+                return cty.ListVal(output), nil
+        },
+})
+
+// MergeFunc constructs a function that takes an arbitrary number of maps and
+// returns a single map that contains a merged set of elements from all of the maps.
+//
+// If more than one given map defines the same key then the one that is later in
+// the argument sequence takes precedence.
+var MergeFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        VarParam: &function.Parameter{
+                Name:             "maps",
+                Type:             cty.DynamicPseudoType,
+                AllowDynamicType: true,
+                AllowNull:        true,
+        },
+        Type: function.StaticReturnType(cty.DynamicPseudoType),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                outputMap := make(map[string]cty.Value)
+
+                for _, arg := range args {
+                        if !arg.IsWhollyKnown() {
+                                return cty.UnknownVal(retType), nil
+                        }
+                        if !arg.Type().IsObjectType() && !arg.Type().IsMapType() {
+                                return cty.NilVal, fmt.Errorf("arguments must be maps or objects, got %#v", arg.Type().FriendlyName())
+                        }
+                        for it := arg.ElementIterator(); it.Next(); {
+                                k, v := it.Element()
+                                outputMap[k.AsString()] = v
+                        }
+                }
+                return cty.ObjectVal(outputMap), nil
+        },
+})
+
+// ReverseFunc takes a sequence and produces a new sequence of the same length
+// with all of the same elements as the given sequence but in reverse order.
+var ReverseFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.DynamicPseudoType,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                argTy := args[0].Type()
+                switch {
+                case argTy.IsTupleType():
+                        argTys := argTy.TupleElementTypes()
+                        retTys := make([]cty.Type, len(argTys))
+                        for i, ty := range argTys {
+                                retTys[len(retTys)-i-1] = ty
+                        }
+                        return cty.Tuple(retTys), nil
+                case argTy.IsListType(), argTy.IsSetType(): // We accept sets here to mimic the usual behavior of auto-converting to list
+                        return cty.List(argTy.ElementType()), nil
+                default:
+                        return cty.NilType, function.NewArgErrorf(0, "can only reverse list or tuple values, not %s", argTy.FriendlyName())
+                }
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                in := args[0].AsValueSlice()
+                outVals := make([]cty.Value, len(in))
+                for i, v := range in {
+                        outVals[len(outVals)-i-1] = v
+                }
+                switch {
+                case retType.IsTupleType():
+                        return cty.TupleVal(outVals), nil
+                default:
+                        if len(outVals) == 0 {
+                                return cty.ListValEmpty(retType.ElementType()), nil
+                        }
+                        return cty.ListVal(outVals), nil
+                }
+        },
+})
+
+// SetProductFunc calculates the cartesian product of two or more sets or
+// sequences. If the arguments are all lists then the result is a list of tuples,
+// preserving the ordering of all of the input lists. Otherwise the result is a
+// set of tuples.
+var SetProductFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        VarParam: &function.Parameter{
+                Name: "sets",
+                Type: cty.DynamicPseudoType,
+        },
+        Type: func(args []cty.Value) (retType cty.Type, err error) {
+                if len(args) < 2 {
+                        return cty.NilType, errors.New("at least two arguments are required")
+                }
+
+                listCount := 0
+                elemTys := make([]cty.Type, len(args))
+                for i, arg := range args {
+                        aty := arg.Type()
+                        switch {
+                        case aty.IsSetType():
+                                elemTys[i] = aty.ElementType()
+                        case aty.IsListType():
+                                elemTys[i] = aty.ElementType()
+                                listCount++
+                        case aty.IsTupleType():
+                                // We can accept a tuple type only if there's some common type
+                                // that all of its elements can be converted to.
+                                allEtys := aty.TupleElementTypes()
+                                if len(allEtys) == 0 {
+                                        elemTys[i] = cty.DynamicPseudoType
+                                        listCount++
+                                        break
+                                }
+                                ety, _ := convert.UnifyUnsafe(allEtys)
+                                if ety == cty.NilType {
+                                        return cty.NilType, function.NewArgErrorf(i, "all elements must be of the same type")
+                                }
+                                elemTys[i] = ety
+                                listCount++
+                        default:
+                                return cty.NilType, function.NewArgErrorf(i, "a set or a list is required")
+                        }
+                }
+
+                if listCount == len(args) {
+                        return cty.List(cty.Tuple(elemTys)), nil
+                }
+                return cty.Set(cty.Tuple(elemTys)), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                ety := retType.ElementType()
+
+                total := 1
+                for _, arg := range args {
+                        // Because of our type checking function, we are guaranteed that
+                        // all of the arguments are known, non-null values of types that
+                        // support LengthInt.
+                        total *= arg.LengthInt()
+                }
+
+                if total == 0 {
+                        // If any of the arguments was an empty collection then our result
+                        // is also an empty collection, which we'll short-circuit here.
+                        if retType.IsListType() {
+                                return cty.ListValEmpty(ety), nil
+                        }
+                        return cty.SetValEmpty(ety), nil
+                }
+
+                subEtys := ety.TupleElementTypes()
+                product := make([][]cty.Value, total)
+
+                b := make([]cty.Value, total*len(args))
+                n := make([]int, len(args))
+                s := 0
+                argVals := make([][]cty.Value, len(args))
+                for i, arg := range args {
+                        argVals[i] = arg.AsValueSlice()
+                }
+
+                for i := range product {
+                        e := s + len(args)
+                        pi := b[s:e]
+                        product[i] = pi
+                        s = e
+
+                        for j, n := range n {
+                                val := argVals[j][n]
+                                ty := subEtys[j]
+                                if !val.Type().Equals(ty) {
+                                        var err error
+                                        val, err = convert.Convert(val, ty)
+                                        if err != nil {
+                                                // Should never happen since we checked this in our
+                                                // type-checking function.
+                                                return cty.NilVal, fmt.Errorf("failed to convert argVals[%d][%d] to %s; this is a bug in Terraform", j, n, ty.FriendlyName())
+                                        }
+                                }
+                                pi[j] = val
+                        }
+
+                        for j := len(n) - 1; j >= 0; j-- {
+                                n[j]++
+                                if n[j] < len(argVals[j]) {
+                                        break
+                                }
+                                n[j] = 0
+                        }
+                }
+
+                productVals := make([]cty.Value, total)
+                for i, vals := range product {
+                        productVals[i] = cty.TupleVal(vals)
+                }
+
+                if retType.IsListType() {
+                        return cty.ListVal(productVals), nil
+                }
+                return cty.SetVal(productVals), nil
+        },
+})
+
+// SliceFunc constructs a function that extracts some consecutive elements
+// from within a list.
+var SliceFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.DynamicPseudoType,
+                },
+                {
+                        Name: "start_index",
+                        Type: cty.Number,
+                },
+                {
+                        Name: "end_index",
+                        Type: cty.Number,
+                },
+        },
+        Type: func(args []cty.Value) (cty.Type, error) {
+                arg := args[0]
+                argTy := arg.Type()
+
+                if argTy.IsSetType() {
+                        return cty.NilType, function.NewArgErrorf(0, "cannot slice a set, because its elements do not have indices; use the tolist function to force conversion to list if the ordering of the result is not important")
+                }
+                if !argTy.IsListType() && !argTy.IsTupleType() {
+                        return cty.NilType, function.NewArgErrorf(0, "must be a list or tuple value")
+                }
+
+                startIndex, endIndex, idxsKnown, err := sliceIndexes(args)
+                if err != nil {
+                        return cty.NilType, err
+                }
+
+                if argTy.IsListType() {
+                        return argTy, nil
+                }
+
+                if !idxsKnown {
+                        // If we don't know our start/end indices then we can't predict
+                        // the result type if we're planning to return a tuple.
+                        return cty.DynamicPseudoType, nil
+                }
+                return cty.Tuple(argTy.TupleElementTypes()[startIndex:endIndex]), nil
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                inputList := args[0]
+
+                if retType == cty.DynamicPseudoType {
+                        return cty.DynamicVal, nil
+                }
+
+                // we ignore idxsKnown return value here because the indices are always
+                // known here, or else the call would've short-circuited.
+                startIndex, endIndex, _, err := sliceIndexes(args)
+                if err != nil {
+                        return cty.NilVal, err
+                }
+
+                if endIndex-startIndex == 0 {
+                        if retType.IsTupleType() {
+                                return cty.EmptyTupleVal, nil
+                        }
+                        return cty.ListValEmpty(retType.ElementType()), nil
+                }
+
+                outputList := inputList.AsValueSlice()[startIndex:endIndex]
+
+                if retType.IsTupleType() {
+                        return cty.TupleVal(outputList), nil
+                }
+
+                return cty.ListVal(outputList), nil
+        },
+})
+
+func sliceIndexes(args []cty.Value) (int, int, bool, error) {
+        var startIndex, endIndex, length int
+        var startKnown, endKnown, lengthKnown bool
+
+        if args[0].Type().IsTupleType() || args[0].IsKnown() { // if it's a tuple then we always know the length by the type, but lists must be known
+                length = args[0].LengthInt()
+                lengthKnown = true
+        }
+
+        if args[1].IsKnown() {
+                if err := gocty.FromCtyValue(args[1], &startIndex); err != nil {
+                        return 0, 0, false, function.NewArgErrorf(1, "invalid start index: %s", err)
+                }
+                if startIndex < 0 {
+                        return 0, 0, false, function.NewArgErrorf(1, "start index must not be less than zero")
+                }
+                if lengthKnown && startIndex > length {
+                        return 0, 0, false, function.NewArgErrorf(1, "start index must not be greater than the length of the list")
+                }
+                startKnown = true
+        }
+        if args[2].IsKnown() {
+                if err := gocty.FromCtyValue(args[2], &endIndex); err != nil {
+                        return 0, 0, false, function.NewArgErrorf(2, "invalid end index: %s", err)
+                }
+                if endIndex < 0 {
+                        return 0, 0, false, function.NewArgErrorf(2, "end index must not be less than zero")
+                }
+                if lengthKnown && endIndex > length {
+                        return 0, 0, false, function.NewArgErrorf(2, "end index must not be greater than the length of the list")
+                }
+                endKnown = true
+        }
+        if startKnown && endKnown {
+                if startIndex > endIndex {
+                        return 0, 0, false, function.NewArgErrorf(1, "start index must not be greater than end index")
+                }
+        }
+        return startIndex, endIndex, startKnown && endKnown, nil
+}
+
+// TransposeFunc contructs a function that takes a map of lists of strings and
+// TransposeFunc constructs a function that takes a map of lists of strings and
+// swaps the keys and values to produce a new map of lists of strings.
+var TransposeFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "values",
+                        Type: cty.Map(cty.List(cty.String)),
+                },
+        },
+        Type: function.StaticReturnType(cty.Map(cty.List(cty.String))),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                inputMap := args[0]
+                if !inputMap.IsWhollyKnown() {
+                        return cty.UnknownVal(retType), nil
+                }
+
+                outputMap := make(map[string]cty.Value)
+                tmpMap := make(map[string][]string)
+
+                for it := inputMap.ElementIterator(); it.Next(); {
+                        inKey, inVal := it.Element()
+                        for iter := inVal.ElementIterator(); iter.Next(); {
+                                _, val := iter.Element()
+                                if !val.Type().Equals(cty.String) {
+                                        return cty.MapValEmpty(cty.List(cty.String)), errors.New("input must be a map of lists of strings")
+                                }
+
+                                outKey := val.AsString()
+                                if _, ok := tmpMap[outKey]; !ok {
+                                        tmpMap[outKey] = make([]string, 0)
+                                }
+                                outVal := tmpMap[outKey]
+                                outVal = append(outVal, inKey.AsString())
+                                sort.Strings(outVal)
+                                tmpMap[outKey] = outVal
+                        }
+                }
+
+                for outKey, outVal := range tmpMap {
+                        values := make([]cty.Value, 0)
+                        for _, v := range outVal {
+                                values = append(values, cty.StringVal(v))
+                        }
+                        outputMap[outKey] = cty.ListVal(values)
+                }
+
+                return cty.MapVal(outputMap), nil
+        },
+})
+
+// ValuesFunc constructs a function that returns a list of the map values,
+// in the order of the sorted keys.
+var ValuesFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "values",
+                        Type: cty.DynamicPseudoType,
+                },
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                ty := args[0].Type()
+                if ty.IsMapType() {
+                        return cty.List(ty.ElementType()), nil
+                } else if ty.IsObjectType() {
+                        // The result is a tuple type with all of the same types as our
+                        // object type's attributes, sorted in lexicographical order by the
+                        // keys. (This matches the sort order guaranteed by ElementIterator
+                        // on a cty object value.)
+                        atys := ty.AttributeTypes()
+                        if len(atys) == 0 {
+                                return cty.EmptyTuple, nil
+                        }
+                        attrNames := make([]string, 0, len(atys))
+                        for name := range atys {
+                                attrNames = append(attrNames, name)
+                        }
+                        sort.Strings(attrNames)
+
+                        tys := make([]cty.Type, len(attrNames))
+                        for i, name := range attrNames {
+                                tys[i] = atys[name]
+                        }
+                        return cty.Tuple(tys), nil
+                }
+                return cty.NilType, errors.New("values() requires a map as the first argument")
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                mapVar := args[0]
+
+                // We can just iterate the map/object value here because cty guarantees
+                // that these types always iterate in key lexicographical order.
+                var values []cty.Value
+                for it := mapVar.ElementIterator(); it.Next(); {
+                        _, val := it.Element()
+                        values = append(values, val)
+                }
+
+                if retType.IsTupleType() {
+                        return cty.TupleVal(values), nil
+                }
+                if len(values) == 0 {
+                        return cty.ListValEmpty(retType.ElementType()), nil
+                }
+                return cty.ListVal(values), nil
+        },
+})
+
+// ZipmapFunc constructs a function that constructs a map from a list of keys
+// and a corresponding list of values.
+var ZipmapFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "keys",
+                        Type: cty.List(cty.String),
+                },
+                {
+                        Name: "values",
+                        Type: cty.DynamicPseudoType,
+                },
+        },
+        Type: func(args []cty.Value) (ret cty.Type, err error) {
+                keys := args[0]
+                values := args[1]
+                valuesTy := values.Type()
+
+                switch {
+                case valuesTy.IsListType():
+                        return cty.Map(values.Type().ElementType()), nil
+                case valuesTy.IsTupleType():
+                        if !keys.IsWhollyKnown() {
+                                // Since zipmap with a tuple produces an object, we need to know
+                                // all of the key names before we can predict our result type.
+                                return cty.DynamicPseudoType, nil
+                        }
+
+                        keysRaw := keys.AsValueSlice()
+                        valueTypesRaw := valuesTy.TupleElementTypes()
+                        if len(keysRaw) != len(valueTypesRaw) {
+                                return cty.NilType, fmt.Errorf("number of keys (%d) does not match number of values (%d)", len(keysRaw), len(valueTypesRaw))
+                        }
+                        atys := make(map[string]cty.Type, len(valueTypesRaw))
+                        for i, keyVal := range keysRaw {
+                                if keyVal.IsNull() {
+                                        return cty.NilType, fmt.Errorf("keys list has null value at index %d", i)
+                                }
+                                key := keyVal.AsString()
+                                atys[key] = valueTypesRaw[i]
+                        }
+                        return cty.Object(atys), nil
+
+                default:
+                        return cty.NilType, errors.New("values argument must be a list or tuple value")
+                }
+        },
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                keys := args[0]
+                values := args[1]
+
+                if !keys.IsWhollyKnown() {
+                        // Unknown map keys and object attributes are not supported, so
+                        // our entire result must be unknown in this case.
+                        return cty.UnknownVal(retType), nil
+                }
+
+                // both keys and values are guaranteed to be shallowly-known here,
+                // because our declared params above don't allow unknown or null values.
+                if keys.LengthInt() != values.LengthInt() {
+                        return cty.NilVal, fmt.Errorf("number of keys (%d) does not match number of values (%d)", keys.LengthInt(), values.LengthInt())
+                }
+
+                output := make(map[string]cty.Value)
+
+                i := 0
+                for it := keys.ElementIterator(); it.Next(); {
+                        _, v := it.Element()
+                        val := values.Index(cty.NumberIntVal(int64(i)))
+                        output[v.AsString()] = val
+                        i++
+                }
+
+                switch {
+                case retType.IsMapType():
+                        if len(output) == 0 {
+                                return cty.MapValEmpty(retType.ElementType()), nil
+                        }
+                        return cty.MapVal(output), nil
+                case retType.IsObjectType():
+                        return cty.ObjectVal(output), nil
+                default:
+                        // Should never happen because the type-check function should've
+                        // caught any other case.
+                        return cty.NilVal, fmt.Errorf("internally selected incorrect result type %s (this is a bug)", retType.FriendlyName())
+                }
+        },
+})
+
+// helper function to add an element to a list, if it does not already exist
+func appendIfMissing(slice []cty.Value, element cty.Value) ([]cty.Value, error) {
+        for _, ele := range slice {
+                eq, err := stdlib.Equal(ele, element)
+                if err != nil {
+                        return slice, err
+                }
+                if eq.True() {
+                        return slice, nil
+                }
+        }
+        return append(slice, element), nil
+}
+
+// Element returns a single element from a given list at the given index. If
+// index is greater than the length of the list then it is wrapped modulo
+// the list length.
+func Element(list, index cty.Value) (cty.Value, error) {
+        return ElementFunc.Call([]cty.Value{list, index})
+}
+
+// Length returns the number of elements in the given collection or number of
+// Unicode characters in the given string.
+func Length(collection cty.Value) (cty.Value, error) {
+        return LengthFunc.Call([]cty.Value{collection})
+}
+
+// Coalesce takes any number of arguments and returns the first one that isn't empty.
+func Coalesce(args ...cty.Value) (cty.Value, error) {
+        return CoalesceFunc.Call(args)
+}
+
+// CoalesceList takes any number of list arguments and returns the first one that isn't empty.
+func CoalesceList(args ...cty.Value) (cty.Value, error) {
+        return CoalesceListFunc.Call(args)
+}
+
+// Compact takes a list of strings and returns a new list
+// with any empty string elements removed.
+func Compact(list cty.Value) (cty.Value, error) {
+        return CompactFunc.Call([]cty.Value{list})
+}
+
+// Contains determines whether a given list contains a given single value
+// as one of its elements.
+func Contains(list, value cty.Value) (cty.Value, error) {
+        return ContainsFunc.Call([]cty.Value{list, value})
+}
+
+// Index finds the element index for a given value in a list.
+func Index(list, value cty.Value) (cty.Value, error) {
+        return IndexFunc.Call([]cty.Value{list, value})
+}
+
+// Distinct takes a list and returns a new list with any duplicate elements removed.
+func Distinct(list cty.Value) (cty.Value, error) {
+        return DistinctFunc.Call([]cty.Value{list})
+}
+
+// Chunklist splits a single list into fixed-size chunks, returning a list of lists.
+func Chunklist(list, size cty.Value) (cty.Value, error) {
+        return ChunklistFunc.Call([]cty.Value{list, size})
+}
+
+// Flatten takes a list and replaces any elements that are lists with a flattened
+// sequence of the list contents.
+func Flatten(list cty.Value) (cty.Value, error) {
+        return FlattenFunc.Call([]cty.Value{list})
+}
+
+// Keys takes a map and returns a sorted list of the map keys.
+func Keys(inputMap cty.Value) (cty.Value, error) {
+        return KeysFunc.Call([]cty.Value{inputMap})
+}
+
+// List takes any number of list arguments and returns a list containing those
+//  values in the same order.
+func List(args ...cty.Value) (cty.Value, error) {
+        return ListFunc.Call(args)
+}
+
+// Lookup performs a dynamic lookup into a map.
+// There are two required arguments, map and key, plus an optional default,
+// which is a value to return if no key is found in map.
+func Lookup(args ...cty.Value) (cty.Value, error) {
+        return LookupFunc.Call(args)
+}
+
+// Map takes an even number of arguments and returns a map whose elements are constructed
+// from consecutive pairs of arguments.
+func Map(args ...cty.Value) (cty.Value, error) {
+        return MapFunc.Call(args)
+}
+
+// Matchkeys constructs a new list by taking a subset of elements from one list
+// whose indexes match the corresponding indexes of values in another list.
+func Matchkeys(values, keys, searchset cty.Value) (cty.Value, error) {
+        return MatchkeysFunc.Call([]cty.Value{values, keys, searchset})
+}
+
+// Merge takes an arbitrary number of maps and returns a single map that contains
+// a merged set of elements from all of the maps.
+//
+// If more than one given map defines the same key then the one that is later in
+// the argument sequence takes precedence.
+func Merge(maps ...cty.Value) (cty.Value, error) {
+        return MergeFunc.Call(maps)
+}
+
+// Reverse takes a sequence and produces a new sequence of the same length
+// with all of the same elements as the given sequence but in reverse order.
+func Reverse(list cty.Value) (cty.Value, error) {
+        return ReverseFunc.Call([]cty.Value{list})
+}
+
+// SetProduct computes the cartesian product of sets or sequences.
+func SetProduct(sets ...cty.Value) (cty.Value, error) {
+        return SetProductFunc.Call(sets)
+}
+
+// Slice extracts some consecutive elements from within a list.
+func Slice(list, start, end cty.Value) (cty.Value, error) {
+        return SliceFunc.Call([]cty.Value{list, start, end})
+}
+
+// Transpose takes a map of lists of strings and swaps the keys and values to
+// produce a new map of lists of strings.
+func Transpose(values cty.Value) (cty.Value, error) {
+        return TransposeFunc.Call([]cty.Value{values})
+}
+
+// Values returns a list of the map values, in the order of the sorted keys.
+// This function only works on flat maps.
+func Values(values cty.Value) (cty.Value, error) {
+        return ValuesFunc.Call([]cty.Value{values})
+}
+
+// Zipmap constructs a map from a list of keys and a corresponding list of values.
+func Zipmap(keys, values cty.Value) (cty.Value, error) {
+        return ZipmapFunc.Call([]cty.Value{keys, values})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/conversion.go b/vendor/github.com/hashicorp/terraform/lang/funcs/conversion.go
new file mode 100644
index 0000000..83f8597
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/conversion.go
@@ -0,0 +1,87 @@
+package funcs
+
+import (
+        "strconv"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/function"
+)
+
+// MakeToFunc constructs a "to..." function, like "tostring", which converts
+// its argument to a specific type or type kind.
+//
+// The given type wantTy can be any type constraint that cty's "convert" package
+// would accept. In particular, this means that you can pass
+// cty.List(cty.DynamicPseudoType) to mean "list of any single type", which
+// will then cause cty to attempt to unify all of the element types when given
+// a tuple.
+func MakeToFunc(wantTy cty.Type) function.Function {
+        return function.New(&function.Spec{
+                Params: []function.Parameter{
+                        {
+                                Name: "v",
+                                // We use DynamicPseudoType rather than wantTy here so that
+                                // all values will pass through the function API verbatim and
+                                // we can handle the conversion logic within the Type and
+                                // Impl functions. This allows us to customize the error
+                                // messages to be more appropriate for an explicit type
+                                // conversion, whereas the cty function system produces
+                                // messages aimed at _implicit_ type conversions.
+                                Type:      cty.DynamicPseudoType,
+                                AllowNull: true,
+                        },
+                },
+                Type: func(args []cty.Value) (cty.Type, error) {
+                        gotTy := args[0].Type()
+                        if gotTy.Equals(wantTy) {
+                                return wantTy, nil
+                        }
+                        conv := convert.GetConversionUnsafe(args[0].Type(), wantTy)
+                        if conv == nil {
+                                // We'll use some specialized errors for some trickier cases,
+                                // but most we can handle in a simple way.
+                                switch {
+                                case gotTy.IsTupleType() && wantTy.IsTupleType():
+                                        return cty.NilType, function.NewArgErrorf(0, "incompatible tuple type for conversion: %s", convert.MismatchMessage(gotTy, wantTy))
+                                case gotTy.IsObjectType() && wantTy.IsObjectType():
+                                        return cty.NilType, function.NewArgErrorf(0, "incompatible object type for conversion: %s", convert.MismatchMessage(gotTy, wantTy))
+                                default:
+                                        return cty.NilType, function.NewArgErrorf(0, "cannot convert %s to %s", gotTy.FriendlyName(), wantTy.FriendlyNameForConstraint())
+                                }
+                        }
+                        // If a conversion is available then everything is fine.
+                        return wantTy, nil
+                },
+                Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                        // We didn't set "AllowUnknown" on our argument, so it is guaranteed
+                        // to be known here but may still be null.
+                        ret, err := convert.Convert(args[0], retType)
+                        if err != nil {
+                                // Because we used GetConversionUnsafe above, conversion can
+                                // still potentially fail in here. For example, if the user
+                                // asks to convert the string "a" to bool then we'll
+                                // optimistically permit it during type checking but fail here
+                                // once we note that the value isn't either "true" or "false".
+                                gotTy := args[0].Type()
+                                switch {
+                                case gotTy == cty.String && wantTy == cty.Bool:
+                                        what := "string"
+                                        if !args[0].IsNull() {
+                                                what = strconv.Quote(args[0].AsString())
+                                        }
+                                        return cty.NilVal, function.NewArgErrorf(0, `cannot convert %s to bool; only the strings "true" or "false" are allowed`, what)
+                                case gotTy == cty.String && wantTy == cty.Number:
+                                        what := "string"
+                                        if !args[0].IsNull() {
+                                                what = strconv.Quote(args[0].AsString())
+                                        }
+                                        return cty.NilVal, function.NewArgErrorf(0, `cannot convert %s to number; given string must be a decimal representation of a number`, what)
+                                default:
+                                        return cty.NilVal, function.NewArgErrorf(0, "cannot convert %s to %s", gotTy.FriendlyName(), wantTy.FriendlyNameForConstraint())
+                                }
+                        }
+                        return ret, nil
+                },
+        })
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/crypto.go b/vendor/github.com/hashicorp/terraform/lang/funcs/crypto.go
new file mode 100644
index 0000000..5cb4bc5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/crypto.go
@@ -0,0 +1,285 @@
+package funcs
+
+import (
+        "crypto/md5"
+        "crypto/rsa"
+        "crypto/sha1"
+        "crypto/sha256"
+        "crypto/sha512"
+        "crypto/x509"
+        "encoding/base64"
+        "encoding/hex"
+        "encoding/pem"
+        "fmt"
+        "hash"
+
+        uuid "github.com/hashicorp/go-uuid"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+        "github.com/zclconf/go-cty/cty/gocty"
+        "golang.org/x/crypto/bcrypt"
+)
+
+var UUIDFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        Type:   function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                result, err := uuid.GenerateUUID()
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                return cty.StringVal(result), nil
+        },
+})
+
+// Base64Sha256Func constructs a function that computes the SHA256 hash of a given string
+// and encodes it with Base64.
+var Base64Sha256Func = makeStringHashFunction(sha256.New, base64.StdEncoding.EncodeToString)
+
+// MakeFileBase64Sha256Func constructs a function that is like Base64Sha256Func but reads the
+// contents of a file rather than hashing a given literal string.
+func MakeFileBase64Sha256Func(baseDir string) function.Function {
+        return makeFileHashFunction(baseDir, sha256.New, base64.StdEncoding.EncodeToString)
+}
+
+// Base64Sha512Func constructs a function that computes the SHA256 hash of a given string
+// and encodes it with Base64.
+var Base64Sha512Func = makeStringHashFunction(sha512.New, base64.StdEncoding.EncodeToString)
+
+// MakeFileBase64Sha512Func constructs a function that is like Base64Sha512Func but reads the
+// contents of a file rather than hashing a given literal string.
+func MakeFileBase64Sha512Func(baseDir string) function.Function {
+        return makeFileHashFunction(baseDir, sha512.New, base64.StdEncoding.EncodeToString)
+}
+
+// BcryptFunc constructs a function that computes a hash of the given string using the Blowfish cipher.
+var BcryptFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        VarParam: &function.Parameter{
+                Name: "cost",
+                Type: cty.Number,
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                defaultCost := 10
+
+                if len(args) > 1 {
+                        var val int
+                        if err := gocty.FromCtyValue(args[1], &val); err != nil {
+                                return cty.UnknownVal(cty.String), err
+                        }
+                        defaultCost = val
+                }
+
+                if len(args) > 2 {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("bcrypt() takes no more than two arguments")
+                }
+
+                input := args[0].AsString()
+                out, err := bcrypt.GenerateFromPassword([]byte(input), defaultCost)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("error occured generating password %s", err.Error())
+                }
+
+                return cty.StringVal(string(out)), nil
+        },
+})
+
+// Md5Func constructs a function that computes the MD5 hash of a given string and encodes it with hexadecimal digits.
+var Md5Func = makeStringHashFunction(md5.New, hex.EncodeToString)
+
+// MakeFileMd5Func constructs a function that is like Md5Func but reads the
+// contents of a file rather than hashing a given literal string.
+func MakeFileMd5Func(baseDir string) function.Function {
+        return makeFileHashFunction(baseDir, md5.New, hex.EncodeToString)
+}
+
+// RsaDecryptFunc constructs a function that decrypts an RSA-encrypted ciphertext.
+var RsaDecryptFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "ciphertext",
+                        Type: cty.String,
+                },
+                {
+                        Name: "privatekey",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                s := args[0].AsString()
+                key := args[1].AsString()
+
+                b, err := base64.StdEncoding.DecodeString(s)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("failed to decode input %q: cipher text must be base64-encoded", s)
+                }
+
+                block, _ := pem.Decode([]byte(key))
+                if block == nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("failed to parse key: no key found")
+                }
+                if block.Headers["Proc-Type"] == "4,ENCRYPTED" {
+                        return cty.UnknownVal(cty.String), fmt.Errorf(
+                                "failed to parse key: password protected keys are not supported. Please decrypt the key prior to use",
+                        )
+                }
+
+                x509Key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                out, err := rsa.DecryptPKCS1v15(nil, x509Key, b)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                return cty.StringVal(string(out)), nil
+        },
+})
+
+// Sha1Func contructs a function that computes the SHA1 hash of a given string
+// and encodes it with hexadecimal digits.
+var Sha1Func = makeStringHashFunction(sha1.New, hex.EncodeToString)
+
+// MakeFileSha1Func constructs a function that is like Sha1Func but reads the
+// contents of a file rather than hashing a given literal string.
+func MakeFileSha1Func(baseDir string) function.Function {
+        return makeFileHashFunction(baseDir, sha1.New, hex.EncodeToString)
+}
+
+// Sha256Func contructs a function that computes the SHA256 hash of a given string
+// and encodes it with hexadecimal digits.
+var Sha256Func = makeStringHashFunction(sha256.New, hex.EncodeToString)
+
+// MakeFileSha256Func constructs a function that is like Sha256Func but reads the
+// contents of a file rather than hashing a given literal string.
+func MakeFileSha256Func(baseDir string) function.Function {
+        return makeFileHashFunction(baseDir, sha256.New, hex.EncodeToString)
+}
+
+// Sha512Func contructs a function that computes the SHA512 hash of a given string
+// and encodes it with hexadecimal digits.
+var Sha512Func = makeStringHashFunction(sha512.New, hex.EncodeToString)
+
+// MakeFileSha512Func constructs a function that is like Sha512Func but reads the
+// contents of a file rather than hashing a given literal string.
+func MakeFileSha512Func(baseDir string) function.Function {
+        return makeFileHashFunction(baseDir, sha512.New, hex.EncodeToString)
+}
+
+func makeStringHashFunction(hf func() hash.Hash, enc func([]byte) string) function.Function {
+        return function.New(&function.Spec{
+                Params: []function.Parameter{
+                        {
+                                Name: "str",
+                                Type: cty.String,
+                        },
+                },
+                Type: function.StaticReturnType(cty.String),
+                Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                        s := args[0].AsString()
+                        h := hf()
+                        h.Write([]byte(s))
+                        rv := enc(h.Sum(nil))
+                        return cty.StringVal(rv), nil
+                },
+        })
+}
+
+func makeFileHashFunction(baseDir string, hf func() hash.Hash, enc func([]byte) string) function.Function {
+        return function.New(&function.Spec{
+                Params: []function.Parameter{
+                        {
+                                Name: "path",
+                                Type: cty.String,
+                        },
+                },
+                Type: function.StaticReturnType(cty.String),
+                Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                        path := args[0].AsString()
+                        src, err := readFileBytes(baseDir, path)
+                        if err != nil {
+                                return cty.UnknownVal(cty.String), err
+                        }
+
+                        h := hf()
+                        h.Write(src)
+                        rv := enc(h.Sum(nil))
+                        return cty.StringVal(rv), nil
+                },
+        })
+}
+
+// UUID generates and returns a Type-4 UUID in the standard hexadecimal string
+// format.
+//
+// This is not a pure function: it will generate a different result for each
+// call. It must therefore be registered as an impure function in the function
+// table in the "lang" package.
+func UUID() (cty.Value, error) {
+        return UUIDFunc.Call(nil)
+}
+
+// Base64Sha256 computes the SHA256 hash of a given string and encodes it with
+// Base64.
+//
+// The given string is first encoded as UTF-8 and then the SHA256 algorithm is applied
+// as defined in RFC 4634. The raw hash is then encoded with Base64 before returning.
+// Terraform uses the "standard" Base64 alphabet as defined in RFC 4648 section 4.
+func Base64Sha256(str cty.Value) (cty.Value, error) {
+        return Base64Sha256Func.Call([]cty.Value{str})
+}
+
+// Base64Sha512 computes the SHA512 hash of a given string and encodes it with
+// Base64.
+//
+// The given string is first encoded as UTF-8 and then the SHA256 algorithm is applied
+// as defined in RFC 4634. The raw hash is then encoded with Base64 before returning.
+// Terraform uses the "standard" Base64  alphabet as defined in RFC 4648 section 4
+func Base64Sha512(str cty.Value) (cty.Value, error) {
+        return Base64Sha512Func.Call([]cty.Value{str})
+}
+
+// Bcrypt computes a hash of the given string using the Blowfish cipher,
+// returning a string in the Modular Crypt Format
+// usually expected in the shadow password file on many Unix systems.
+func Bcrypt(str cty.Value, cost ...cty.Value) (cty.Value, error) {
+        args := make([]cty.Value, len(cost)+1)
+        args[0] = str
+        copy(args[1:], cost)
+        return BcryptFunc.Call(args)
+}
+
+// Md5 computes the MD5 hash of a given string and encodes it with hexadecimal digits.
+func Md5(str cty.Value) (cty.Value, error) {
+        return Md5Func.Call([]cty.Value{str})
+}
+
+// RsaDecrypt decrypts an RSA-encrypted ciphertext, returning the corresponding
+// cleartext.
+func RsaDecrypt(ciphertext, privatekey cty.Value) (cty.Value, error) {
+        return RsaDecryptFunc.Call([]cty.Value{ciphertext, privatekey})
+}
+
+// Sha1 computes the SHA1 hash of a given string and encodes it with hexadecimal digits.
+func Sha1(str cty.Value) (cty.Value, error) {
+        return Sha1Func.Call([]cty.Value{str})
+}
+
+// Sha256 computes the SHA256 hash of a given string and encodes it with hexadecimal digits.
+func Sha256(str cty.Value) (cty.Value, error) {
+        return Sha256Func.Call([]cty.Value{str})
+}
+
+// Sha512 computes the SHA512 hash of a given string and encodes it with hexadecimal digits.
+func Sha512(str cty.Value) (cty.Value, error) {
+        return Sha512Func.Call([]cty.Value{str})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/datetime.go b/vendor/github.com/hashicorp/terraform/lang/funcs/datetime.go
new file mode 100644
index 0000000..5dae198
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/datetime.go
@@ -0,0 +1,70 @@
+package funcs
+
+import (
+        "time"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+)
+
+// TimestampFunc constructs a function that returns a string representation of the current date and time.
+var TimestampFunc = function.New(&function.Spec{
+        Params: []function.Parameter{},
+        Type:   function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                return cty.StringVal(time.Now().UTC().Format(time.RFC3339)), nil
+        },
+})
+
+// TimeAddFunc constructs a function that adds a duration to a timestamp, returning a new timestamp.
+var TimeAddFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "timestamp",
+                        Type: cty.String,
+                },
+                {
+                        Name: "duration",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                ts, err := time.Parse(time.RFC3339, args[0].AsString())
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                duration, err := time.ParseDuration(args[1].AsString())
+                if err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                return cty.StringVal(ts.Add(duration).Format(time.RFC3339)), nil
+        },
+})
+
+// Timestamp returns a string representation of the current date and time.
+//
+// In the Terraform language, timestamps are conventionally represented as
+// strings using RFC 3339 "Date and Time format" syntax, and so timestamp
+// returns a string in this format.
+func Timestamp() (cty.Value, error) {
+        return TimestampFunc.Call([]cty.Value{})
+}
+
+// TimeAdd adds a duration to a timestamp, returning a new timestamp.
+//
+// In the Terraform language, timestamps are conventionally represented as
+// strings using RFC 3339 "Date and Time format" syntax. Timeadd requires
+// the timestamp argument to be a string conforming to this syntax.
+//
+// `duration` is a string representation of a time difference, consisting of
+// sequences of number and unit pairs, like `"1.5h"` or `1h30m`. The accepted
+// units are `ns`, `us` (or `µs`), `"ms"`, `"s"`, `"m"`, and `"h"`. The first
+// number may be negative to indicate a negative duration, like `"-2h5m"`.
+//
+// The result is a string, also in RFC 3339 format, representing the result
+// of adding the given direction to the given timestamp.
+func TimeAdd(timestamp cty.Value, duration cty.Value) (cty.Value, error) {
+        return TimeAddFunc.Call([]cty.Value{timestamp, duration})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/encoding.go b/vendor/github.com/hashicorp/terraform/lang/funcs/encoding.go
new file mode 100644
index 0000000..af93f08
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/encoding.go
@@ -0,0 +1,140 @@
+package funcs
+
+import (
+        "bytes"
+        "compress/gzip"
+        "encoding/base64"
+        "fmt"
+        "log"
+        "net/url"
+        "unicode/utf8"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+)
+
+// Base64DecodeFunc constructs a function that decodes a string containing a base64 sequence.
+var Base64DecodeFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                s := args[0].AsString()
+                sDec, err := base64.StdEncoding.DecodeString(s)
+                if err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("failed to decode base64 data '%s'", s)
+                }
+                if !utf8.Valid([]byte(sDec)) {
+                        log.Printf("[DEBUG] the result of decoding the the provided string is not valid UTF-8: %s", sDec)
+                        return cty.UnknownVal(cty.String), fmt.Errorf("the result of decoding the the provided string is not valid UTF-8")
+                }
+                return cty.StringVal(string(sDec)), nil
+        },
+})
+
+// Base64EncodeFunc constructs a function that encodes a string to a base64 sequence.
+var Base64EncodeFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                return cty.StringVal(base64.StdEncoding.EncodeToString([]byte(args[0].AsString()))), nil
+        },
+})
+
+// Base64GzipFunc constructs a function that compresses a string with gzip and then encodes the result in
+// Base64 encoding.
+var Base64GzipFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                s := args[0].AsString()
+
+                var b bytes.Buffer
+                gz := gzip.NewWriter(&b)
+                if _, err := gz.Write([]byte(s)); err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("failed to write gzip raw data: '%s'", s)
+                }
+                if err := gz.Flush(); err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("failed to flush gzip writer: '%s'", s)
+                }
+                if err := gz.Close(); err != nil {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("failed to close gzip writer: '%s'", s)
+                }
+                return cty.StringVal(base64.StdEncoding.EncodeToString(b.Bytes())), nil
+        },
+})
+
+// URLEncodeFunc constructs a function that applies URL encoding to a given string.
+var URLEncodeFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                return cty.StringVal(url.QueryEscape(args[0].AsString())), nil
+        },
+})
+
+// Base64Decode decodes a string containing a base64 sequence.
+//
+// Terraform uses the "standard" Base64 alphabet as defined in RFC 4648 section 4.
+//
+// Strings in the Terraform language are sequences of unicode characters rather
+// than bytes, so this function will also interpret the resulting bytes as
+// UTF-8. If the bytes after Base64 decoding are _not_ valid UTF-8, this function
+// produces an error.
+func Base64Decode(str cty.Value) (cty.Value, error) {
+        return Base64DecodeFunc.Call([]cty.Value{str})
+}
+
+// Base64Encode applies Base64 encoding to a string.
+//
+// Terraform uses the "standard" Base64 alphabet as defined in RFC 4648 section 4.
+//
+// Strings in the Terraform language are sequences of unicode characters rather
+// than bytes, so this function will first encode the characters from the string
+// as UTF-8, and then apply Base64 encoding to the result.
+func Base64Encode(str cty.Value) (cty.Value, error) {
+        return Base64EncodeFunc.Call([]cty.Value{str})
+}
+
+// Base64Gzip compresses a string with gzip and then encodes the result in
+// Base64 encoding.
+//
+// Terraform uses the "standard" Base64 alphabet as defined in RFC 4648 section 4.
+//
+// Strings in the Terraform language are sequences of unicode characters rather
+// than bytes, so this function will first encode the characters from the string
+// as UTF-8, then apply gzip compression, and then finally apply Base64 encoding.
+func Base64Gzip(str cty.Value) (cty.Value, error) {
+        return Base64GzipFunc.Call([]cty.Value{str})
+}
+
+// URLEncode applies URL encoding to a given string.
+//
+// This function identifies characters in the given string that would have a
+// special meaning when included as a query string argument in a URL and
+// escapes them using RFC 3986 "percent encoding".
+//
+// If the given string contains non-ASCII characters, these are first encoded as
+// UTF-8 and then percent encoding is applied separately to each UTF-8 byte.
+func URLEncode(str cty.Value) (cty.Value, error) {
+        return URLEncodeFunc.Call([]cty.Value{str})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/filesystem.go b/vendor/github.com/hashicorp/terraform/lang/funcs/filesystem.go
new file mode 100644
index 0000000..7dfc905
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/filesystem.go
@@ -0,0 +1,345 @@
+package funcs
+
+import (
+        "encoding/base64"
+        "fmt"
+        "io/ioutil"
+        "os"
+        "path/filepath"
+        "unicode/utf8"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        homedir "github.com/mitchellh/go-homedir"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+)
+
+// MakeFileFunc constructs a function that takes a file path and returns the
+// contents of that file, either directly as a string (where valid UTF-8 is
+// required) or as a string containing base64 bytes.
+func MakeFileFunc(baseDir string, encBase64 bool) function.Function {
+        return function.New(&function.Spec{
+                Params: []function.Parameter{
+                        {
+                                Name: "path",
+                                Type: cty.String,
+                        },
+                },
+                Type: function.StaticReturnType(cty.String),
+                Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                        path := args[0].AsString()
+                        src, err := readFileBytes(baseDir, path)
+                        if err != nil {
+                                return cty.UnknownVal(cty.String), err
+                        }
+
+                        switch {
+                        case encBase64:
+                                enc := base64.StdEncoding.EncodeToString(src)
+                                return cty.StringVal(enc), nil
+                        default:
+                                if !utf8.Valid(src) {
+                                        return cty.UnknownVal(cty.String), fmt.Errorf("contents of %s are not valid UTF-8; use the filebase64 function to obtain the Base64 encoded contents or the other file functions (e.g. filemd5, filesha256) to obtain file hashing results instead", path)
+                                }
+                                return cty.StringVal(string(src)), nil
+                        }
+                },
+        })
+}
+
+// MakeTemplateFileFunc constructs a function that takes a file path and
+// an arbitrary object of named values and attempts to render the referenced
+// file as a template using HCL template syntax.
+//
+// The template itself may recursively call other functions so a callback
+// must be provided to get access to those functions. The template cannot,
+// however, access any variables defined in the scope: it is restricted only to
+// those variables provided in the second function argument, to ensure that all
+// dependencies on other graph nodes can be seen before executing this function.
+//
+// As a special exception, a referenced template file may not recursively call
+// the templatefile function, since that would risk the same file being
+// included into itself indefinitely.
+func MakeTemplateFileFunc(baseDir string, funcsCb func() map[string]function.Function) function.Function {
+
+        params := []function.Parameter{
+                {
+                        Name: "path",
+                        Type: cty.String,
+                },
+                {
+                        Name: "vars",
+                        Type: cty.DynamicPseudoType,
+                },
+        }
+
+        loadTmpl := func(fn string) (hcl.Expression, error) {
+                // We re-use File here to ensure the same filename interpretation
+                // as it does, along with its other safety checks.
+                tmplVal, err := File(baseDir, cty.StringVal(fn))
+                if err != nil {
+                        return nil, err
+                }
+
+                expr, diags := hclsyntax.ParseTemplate([]byte(tmplVal.AsString()), fn, hcl.Pos{Line: 1, Column: 1})
+                if diags.HasErrors() {
+                        return nil, diags
+                }
+
+                return expr, nil
+        }
+
+        renderTmpl := func(expr hcl.Expression, varsVal cty.Value) (cty.Value, error) {
+                if varsTy := varsVal.Type(); !(varsTy.IsMapType() || varsTy.IsObjectType()) {
+                        return cty.DynamicVal, function.NewArgErrorf(1, "invalid vars value: must be a map") // or an object, but we don't strongly distinguish these most of the time
+                }
+
+                ctx := &hcl.EvalContext{
+                        Variables: varsVal.AsValueMap(),
+                }
+
+                // We'll pre-check references in the template here so we can give a
+                // more specialized error message than HCL would by default, so it's
+                // clearer that this problem is coming from a templatefile call.
+                for _, traversal := range expr.Variables() {
+                        root := traversal.RootName()
+                        if _, ok := ctx.Variables[root]; !ok {
+                                return cty.DynamicVal, function.NewArgErrorf(1, "vars map does not contain key %q, referenced at %s", root, traversal[0].SourceRange())
+                        }
+                }
+
+                givenFuncs := funcsCb() // this callback indirection is to avoid chicken/egg problems
+                funcs := make(map[string]function.Function, len(givenFuncs))
+                for name, fn := range givenFuncs {
+                        if name == "templatefile" {
+                                // We stub this one out to prevent recursive calls.
+                                funcs[name] = function.New(&function.Spec{
+                                        Params: params,
+                                        Type: func(args []cty.Value) (cty.Type, error) {
+                                                return cty.NilType, fmt.Errorf("cannot recursively call templatefile from inside templatefile call")
+                                        },
+                                })
+                                continue
+                        }
+                        funcs[name] = fn
+                }
+                ctx.Functions = funcs
+
+                val, diags := expr.Value(ctx)
+                if diags.HasErrors() {
+                        return cty.DynamicVal, diags
+                }
+                return val, nil
+        }
+
+        return function.New(&function.Spec{
+                Params: params,
+                Type: func(args []cty.Value) (cty.Type, error) {
+                        if !(args[0].IsKnown() && args[1].IsKnown()) {
+                                return cty.DynamicPseudoType, nil
+                        }
+
+                        // We'll render our template now to see what result type it produces.
+                        // A template consisting only of a single interpolation an potentially
+                        // return any type.
+                        expr, err := loadTmpl(args[0].AsString())
+                        if err != nil {
+                                return cty.DynamicPseudoType, err
+                        }
+
+                        // This is safe even if args[1] contains unknowns because the HCL
+                        // template renderer itself knows how to short-circuit those.
+                        val, err := renderTmpl(expr, args[1])
+                        return val.Type(), err
+                },
+                Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                        expr, err := loadTmpl(args[0].AsString())
+                        if err != nil {
+                                return cty.DynamicVal, err
+                        }
+                        return renderTmpl(expr, args[1])
+                },
+        })
+
+}
+
+// MakeFileExistsFunc constructs a function that takes a path
+// and determines whether a file exists at that path
+func MakeFileExistsFunc(baseDir string) function.Function {
+        return function.New(&function.Spec{
+                Params: []function.Parameter{
+                        {
+                                Name: "path",
+                                Type: cty.String,
+                        },
+                },
+                Type: function.StaticReturnType(cty.Bool),
+                Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                        path := args[0].AsString()
+                        path, err := homedir.Expand(path)
+                        if err != nil {
+                                return cty.UnknownVal(cty.Bool), fmt.Errorf("failed to expand ~: %s", err)
+                        }
+
+                        if !filepath.IsAbs(path) {
+                                path = filepath.Join(baseDir, path)
+                        }
+
+                        // Ensure that the path is canonical for the host OS
+                        path = filepath.Clean(path)
+
+                        fi, err := os.Stat(path)
+                        if err != nil {
+                                if os.IsNotExist(err) {
+                                        return cty.False, nil
+                                }
+                                return cty.UnknownVal(cty.Bool), fmt.Errorf("failed to stat %s", path)
+                        }
+
+                        if fi.Mode().IsRegular() {
+                                return cty.True, nil
+                        }
+
+                        return cty.False, fmt.Errorf("%s is not a regular file, but %q",
+                                path, fi.Mode().String())
+                },
+        })
+}
+
+// BasenameFunc constructs a function that takes a string containing a filesystem path
+// and removes all except the last portion from it.
+var BasenameFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "path",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                return cty.StringVal(filepath.Base(args[0].AsString())), nil
+        },
+})
+
+// DirnameFunc constructs a function that takes a string containing a filesystem path
+// and removes the last portion from it.
+var DirnameFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "path",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                return cty.StringVal(filepath.Dir(args[0].AsString())), nil
+        },
+})
+
+// PathExpandFunc constructs a function that expands a leading ~ character to the current user's home directory.
+var PathExpandFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "path",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+
+                homePath, err := homedir.Expand(args[0].AsString())
+                return cty.StringVal(homePath), err
+        },
+})
+
+func readFileBytes(baseDir, path string) ([]byte, error) {
+        path, err := homedir.Expand(path)
+        if err != nil {
+                return nil, fmt.Errorf("failed to expand ~: %s", err)
+        }
+
+        if !filepath.IsAbs(path) {
+                path = filepath.Join(baseDir, path)
+        }
+
+        // Ensure that the path is canonical for the host OS
+        path = filepath.Clean(path)
+
+        src, err := ioutil.ReadFile(path)
+        if err != nil {
+                // ReadFile does not return Terraform-user-friendly error
+                // messages, so we'll provide our own.
+                if os.IsNotExist(err) {
+                        return nil, fmt.Errorf("no file exists at %s", path)
+                }
+                return nil, fmt.Errorf("failed to read %s", path)
+        }
+
+        return src, nil
+}
+
+// File reads the contents of the file at the given path.
+//
+// The file must contain valid UTF-8 bytes, or this function will return an error.
+//
+// The underlying function implementation works relative to a particular base
+// directory, so this wrapper takes a base directory string and uses it to
+// construct the underlying function before calling it.
+func File(baseDir string, path cty.Value) (cty.Value, error) {
+        fn := MakeFileFunc(baseDir, false)
+        return fn.Call([]cty.Value{path})
+}
+
+// FileExists determines whether a file exists at the given path.
+//
+// The underlying function implementation works relative to a particular base
+// directory, so this wrapper takes a base directory string and uses it to
+// construct the underlying function before calling it.
+func FileExists(baseDir string, path cty.Value) (cty.Value, error) {
+        fn := MakeFileExistsFunc(baseDir)
+        return fn.Call([]cty.Value{path})
+}
+
+// FileBase64 reads the contents of the file at the given path.
+//
+// The bytes from the file are encoded as base64 before returning.
+//
+// The underlying function implementation works relative to a particular base
+// directory, so this wrapper takes a base directory string and uses it to
+// construct the underlying function before calling it.
+func FileBase64(baseDir string, path cty.Value) (cty.Value, error) {
+        fn := MakeFileFunc(baseDir, true)
+        return fn.Call([]cty.Value{path})
+}
+
+// Basename takes a string containing a filesystem path and removes all except the last portion from it.
+//
+// The underlying function implementation works only with the path string and does not access the filesystem itself.
+// It is therefore unable to take into account filesystem features such as symlinks.
+//
+// If the path is empty then the result is ".", representing the current working directory.
+func Basename(path cty.Value) (cty.Value, error) {
+        return BasenameFunc.Call([]cty.Value{path})
+}
+
+// Dirname takes a string containing a filesystem path and removes the last portion from it.
+//
+// The underlying function implementation works only with the path string and does not access the filesystem itself.
+// It is therefore unable to take into account filesystem features such as symlinks.
+//
+// If the path is empty then the result is ".", representing the current working directory.
+func Dirname(path cty.Value) (cty.Value, error) {
+        return DirnameFunc.Call([]cty.Value{path})
+}
+
+// Pathexpand takes a string that might begin with a `~` segment, and if so it replaces that segment with
+// the current user's home directory path.
+//
+// The underlying function implementation works only with the path string and does not access the filesystem itself.
+// It is therefore unable to take into account filesystem features such as symlinks.
+//
+// If the leading segment in the path is not `~` then the given path is returned unmodified.
+func Pathexpand(path cty.Value) (cty.Value, error) {
+        return PathExpandFunc.Call([]cty.Value{path})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/number.go b/vendor/github.com/hashicorp/terraform/lang/funcs/number.go
new file mode 100644
index 0000000..15cfe71
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/number.go
@@ -0,0 +1,155 @@
+package funcs
+
+import (
+        "math"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+// CeilFunc contructs a function that returns the closest whole number greater
+// than or equal to the given value.
+var CeilFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "num",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.Number),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var val float64
+                if err := gocty.FromCtyValue(args[0], &val); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                return cty.NumberIntVal(int64(math.Ceil(val))), nil
+        },
+})
+
+// FloorFunc contructs a function that returns the closest whole number lesser
+// than or equal to the given value.
+var FloorFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "num",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.Number),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var val float64
+                if err := gocty.FromCtyValue(args[0], &val); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                return cty.NumberIntVal(int64(math.Floor(val))), nil
+        },
+})
+
+// LogFunc contructs a function that returns the logarithm of a given number in a given base.
+var LogFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "num",
+                        Type: cty.Number,
+                },
+                {
+                        Name: "base",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.Number),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var num float64
+                if err := gocty.FromCtyValue(args[0], &num); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                var base float64
+                if err := gocty.FromCtyValue(args[1], &base); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                return cty.NumberFloatVal(math.Log(num) / math.Log(base)), nil
+        },
+})
+
+// PowFunc contructs a function that returns the logarithm of a given number in a given base.
+var PowFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "num",
+                        Type: cty.Number,
+                },
+                {
+                        Name: "power",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.Number),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var num float64
+                if err := gocty.FromCtyValue(args[0], &num); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                var power float64
+                if err := gocty.FromCtyValue(args[1], &power); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+
+                return cty.NumberFloatVal(math.Pow(num, power)), nil
+        },
+})
+
+// SignumFunc contructs a function that returns the closest whole number greater
+// than or equal to the given value.
+var SignumFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "num",
+                        Type: cty.Number,
+                },
+        },
+        Type: function.StaticReturnType(cty.Number),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var num int
+                if err := gocty.FromCtyValue(args[0], &num); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                switch {
+                case num < 0:
+                        return cty.NumberIntVal(-1), nil
+                case num > 0:
+                        return cty.NumberIntVal(+1), nil
+                default:
+                        return cty.NumberIntVal(0), nil
+                }
+        },
+})
+
+// Ceil returns the closest whole number greater than or equal to the given value.
+func Ceil(num cty.Value) (cty.Value, error) {
+        return CeilFunc.Call([]cty.Value{num})
+}
+
+// Floor returns the closest whole number lesser than or equal to the given value.
+func Floor(num cty.Value) (cty.Value, error) {
+        return FloorFunc.Call([]cty.Value{num})
+}
+
+// Log returns returns the logarithm of a given number in a given base.
+func Log(num, base cty.Value) (cty.Value, error) {
+        return LogFunc.Call([]cty.Value{num, base})
+}
+
+// Pow returns the logarithm of a given number in a given base.
+func Pow(num, power cty.Value) (cty.Value, error) {
+        return PowFunc.Call([]cty.Value{num, power})
+}
+
+// Signum determines the sign of a number, returning a number between -1 and
+// 1 to represent the sign.
+func Signum(num cty.Value) (cty.Value, error) {
+        return SignumFunc.Call([]cty.Value{num})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/funcs/string.go b/vendor/github.com/hashicorp/terraform/lang/funcs/string.go
new file mode 100644
index 0000000..c9ddf19
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/funcs/string.go
@@ -0,0 +1,280 @@
+package funcs
+
+import (
+        "fmt"
+        "regexp"
+        "sort"
+        "strings"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+var JoinFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "separator",
+                        Type: cty.String,
+                },
+        },
+        VarParam: &function.Parameter{
+                Name: "lists",
+                Type: cty.List(cty.String),
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                sep := args[0].AsString()
+                listVals := args[1:]
+                if len(listVals) < 1 {
+                        return cty.UnknownVal(cty.String), fmt.Errorf("at least one list is required")
+                }
+
+                l := 0
+                for _, list := range listVals {
+                        if !list.IsWhollyKnown() {
+                                return cty.UnknownVal(cty.String), nil
+                        }
+                        l += list.LengthInt()
+                }
+
+                items := make([]string, 0, l)
+                for ai, list := range listVals {
+                        ei := 0
+                        for it := list.ElementIterator(); it.Next(); {
+                                _, val := it.Element()
+                                if val.IsNull() {
+                                        if len(listVals) > 1 {
+                                                return cty.UnknownVal(cty.String), function.NewArgErrorf(ai+1, "element %d of list %d is null; cannot concatenate null values", ei, ai+1)
+                                        }
+                                        return cty.UnknownVal(cty.String), function.NewArgErrorf(ai+1, "element %d is null; cannot concatenate null values", ei)
+                                }
+                                items = append(items, val.AsString())
+                                ei++
+                        }
+                }
+
+                return cty.StringVal(strings.Join(items, sep)), nil
+        },
+})
+
+var SortFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "list",
+                        Type: cty.List(cty.String),
+                },
+        },
+        Type: function.StaticReturnType(cty.List(cty.String)),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                listVal := args[0]
+
+                if !listVal.IsWhollyKnown() {
+                        // If some of the element values aren't known yet then we
+                        // can't yet preduct the order of the result.
+                        return cty.UnknownVal(retType), nil
+                }
+                if listVal.LengthInt() == 0 { // Easy path
+                        return listVal, nil
+                }
+
+                list := make([]string, 0, listVal.LengthInt())
+                for it := listVal.ElementIterator(); it.Next(); {
+                        iv, v := it.Element()
+                        if v.IsNull() {
+                                return cty.UnknownVal(retType), fmt.Errorf("given list element %s is null; a null string cannot be sorted", iv.AsBigFloat().String())
+                        }
+                        list = append(list, v.AsString())
+                }
+
+                sort.Strings(list)
+                retVals := make([]cty.Value, len(list))
+                for i, s := range list {
+                        retVals[i] = cty.StringVal(s)
+                }
+                return cty.ListVal(retVals), nil
+        },
+})
+
+var SplitFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "separator",
+                        Type: cty.String,
+                },
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.List(cty.String)),
+        Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                sep := args[0].AsString()
+                str := args[1].AsString()
+                elems := strings.Split(str, sep)
+                elemVals := make([]cty.Value, len(elems))
+                for i, s := range elems {
+                        elemVals[i] = cty.StringVal(s)
+                }
+                if len(elemVals) == 0 {
+                        return cty.ListValEmpty(cty.String), nil
+                }
+                return cty.ListVal(elemVals), nil
+        },
+})
+
+// ChompFunc constructions a function that removes newline characters at the end of a string.
+var ChompFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                newlines := regexp.MustCompile(`(?:\r\n?|\n)*\z`)
+                return cty.StringVal(newlines.ReplaceAllString(args[0].AsString(), "")), nil
+        },
+})
+
+// IndentFunc constructions a function that adds a given number of spaces to the
+// beginnings of all but the first line in a given multi-line string.
+var IndentFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "spaces",
+                        Type: cty.Number,
+                },
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                var spaces int
+                if err := gocty.FromCtyValue(args[0], &spaces); err != nil {
+                        return cty.UnknownVal(cty.String), err
+                }
+                data := args[1].AsString()
+                pad := strings.Repeat(" ", spaces)
+                return cty.StringVal(strings.Replace(data, "\n", "\n"+pad, -1)), nil
+        },
+})
+
+// ReplaceFunc constructions a function that searches a given string for another
+// given substring, and replaces each occurence with a given replacement string.
+var ReplaceFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+                {
+                        Name: "substr",
+                        Type: cty.String,
+                },
+                {
+                        Name: "replace",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                str := args[0].AsString()
+                substr := args[1].AsString()
+                replace := args[2].AsString()
+
+                // We search/replace using a regexp if the string is surrounded
+                // in forward slashes.
+                if len(substr) > 1 && substr[0] == '/' && substr[len(substr)-1] == '/' {
+                        re, err := regexp.Compile(substr[1 : len(substr)-1])
+                        if err != nil {
+                                return cty.UnknownVal(cty.String), err
+                        }
+
+                        return cty.StringVal(re.ReplaceAllString(str, replace)), nil
+                }
+
+                return cty.StringVal(strings.Replace(str, substr, replace, -1)), nil
+        },
+})
+
+// TitleFunc constructions a function that converts the first letter of each word
+// in the given string to uppercase.
+var TitleFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                return cty.StringVal(strings.Title(args[0].AsString())), nil
+        },
+})
+
+// TrimSpaceFunc constructions a function that removes any space characters from
+// the start and end of the given string.
+var TrimSpaceFunc = function.New(&function.Spec{
+        Params: []function.Parameter{
+                {
+                        Name: "str",
+                        Type: cty.String,
+                },
+        },
+        Type: function.StaticReturnType(cty.String),
+        Impl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {
+                return cty.StringVal(strings.TrimSpace(args[0].AsString())), nil
+        },
+})
+
+// Join concatenates together the string elements of one or more lists with a
+// given separator.
+func Join(sep cty.Value, lists ...cty.Value) (cty.Value, error) {
+        args := make([]cty.Value, len(lists)+1)
+        args[0] = sep
+        copy(args[1:], lists)
+        return JoinFunc.Call(args)
+}
+
+// Sort re-orders the elements of a given list of strings so that they are
+// in ascending lexicographical order.
+func Sort(list cty.Value) (cty.Value, error) {
+        return SortFunc.Call([]cty.Value{list})
+}
+
+// Split divides a given string by a given separator, returning a list of
+// strings containing the characters between the separator sequences.
+func Split(sep, str cty.Value) (cty.Value, error) {
+        return SplitFunc.Call([]cty.Value{sep, str})
+}
+
+// Chomp removes newline characters at the end of a string.
+func Chomp(str cty.Value) (cty.Value, error) {
+        return ChompFunc.Call([]cty.Value{str})
+}
+
+// Indent adds a given number of spaces to the beginnings of all but the first
+// line in a given multi-line string.
+func Indent(spaces, str cty.Value) (cty.Value, error) {
+        return IndentFunc.Call([]cty.Value{spaces, str})
+}
+
+// Replace searches a given string for another given substring,
+// and replaces all occurences with a given replacement string.
+func Replace(str, substr, replace cty.Value) (cty.Value, error) {
+        return ReplaceFunc.Call([]cty.Value{str, substr, replace})
+}
+
+// Title converts the first letter of each word in the given string to uppercase.
+func Title(str cty.Value) (cty.Value, error) {
+        return TitleFunc.Call([]cty.Value{str})
+}
+
+// TrimSpace removes any space characters from the start and end of the given string.
+func TrimSpace(str cty.Value) (cty.Value, error) {
+        return TrimSpaceFunc.Call([]cty.Value{str})
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/functions.go b/vendor/github.com/hashicorp/terraform/lang/functions.go
new file mode 100644
index 0000000..2c7b548
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/functions.go
@@ -0,0 +1,147 @@
+package lang
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+        "github.com/zclconf/go-cty/cty/function/stdlib"
+
+        "github.com/hashicorp/terraform/lang/funcs"
+)
+
+var impureFunctions = []string{
+        "bcrypt",
+        "timestamp",
+        "uuid",
+}
+
+// Functions returns the set of functions that should be used to when evaluating
+// expressions in the receiving scope.
+func (s *Scope) Functions() map[string]function.Function {
+        s.funcsLock.Lock()
+        if s.funcs == nil {
+                // Some of our functions are just directly the cty stdlib functions.
+                // Others are implemented in the subdirectory "funcs" here in this
+                // repository. New functions should generally start out their lives
+                // in the "funcs" directory and potentially graduate to cty stdlib
+                // later if the functionality seems to be something domain-agnostic
+                // that would be useful to all applications using cty functions.
+
+                s.funcs = map[string]function.Function{
+                        "abs":              stdlib.AbsoluteFunc,
+                        "basename":         funcs.BasenameFunc,
+                        "base64decode":     funcs.Base64DecodeFunc,
+                        "base64encode":     funcs.Base64EncodeFunc,
+                        "base64gzip":       funcs.Base64GzipFunc,
+                        "base64sha256":     funcs.Base64Sha256Func,
+                        "base64sha512":     funcs.Base64Sha512Func,
+                        "bcrypt":           funcs.BcryptFunc,
+                        "ceil":             funcs.CeilFunc,
+                        "chomp":            funcs.ChompFunc,
+                        "cidrhost":         funcs.CidrHostFunc,
+                        "cidrnetmask":      funcs.CidrNetmaskFunc,
+                        "cidrsubnet":       funcs.CidrSubnetFunc,
+                        "coalesce":         funcs.CoalesceFunc,
+                        "coalescelist":     funcs.CoalesceListFunc,
+                        "compact":          funcs.CompactFunc,
+                        "concat":           stdlib.ConcatFunc,
+                        "contains":         funcs.ContainsFunc,
+                        "csvdecode":        stdlib.CSVDecodeFunc,
+                        "dirname":          funcs.DirnameFunc,
+                        "distinct":         funcs.DistinctFunc,
+                        "element":          funcs.ElementFunc,
+                        "chunklist":        funcs.ChunklistFunc,
+                        "file":             funcs.MakeFileFunc(s.BaseDir, false),
+                        "fileexists":       funcs.MakeFileExistsFunc(s.BaseDir),
+                        "filebase64":       funcs.MakeFileFunc(s.BaseDir, true),
+                        "filebase64sha256": funcs.MakeFileBase64Sha256Func(s.BaseDir),
+                        "filebase64sha512": funcs.MakeFileBase64Sha512Func(s.BaseDir),
+                        "filemd5":          funcs.MakeFileMd5Func(s.BaseDir),
+                        "filesha1":         funcs.MakeFileSha1Func(s.BaseDir),
+                        "filesha256":       funcs.MakeFileSha256Func(s.BaseDir),
+                        "filesha512":       funcs.MakeFileSha512Func(s.BaseDir),
+                        "flatten":          funcs.FlattenFunc,
+                        "floor":            funcs.FloorFunc,
+                        "format":           stdlib.FormatFunc,
+                        "formatdate":       stdlib.FormatDateFunc,
+                        "formatlist":       stdlib.FormatListFunc,
+                        "indent":           funcs.IndentFunc,
+                        "index":            funcs.IndexFunc,
+                        "join":             funcs.JoinFunc,
+                        "jsondecode":       stdlib.JSONDecodeFunc,
+                        "jsonencode":       stdlib.JSONEncodeFunc,
+                        "keys":             funcs.KeysFunc,
+                        "length":           funcs.LengthFunc,
+                        "list":             funcs.ListFunc,
+                        "log":              funcs.LogFunc,
+                        "lookup":           funcs.LookupFunc,
+                        "lower":            stdlib.LowerFunc,
+                        "map":              funcs.MapFunc,
+                        "matchkeys":        funcs.MatchkeysFunc,
+                        "max":              stdlib.MaxFunc,
+                        "md5":              funcs.Md5Func,
+                        "merge":            funcs.MergeFunc,
+                        "min":              stdlib.MinFunc,
+                        "pathexpand":       funcs.PathExpandFunc,
+                        "pow":              funcs.PowFunc,
+                        "replace":          funcs.ReplaceFunc,
+                        "reverse":          funcs.ReverseFunc,
+                        "rsadecrypt":       funcs.RsaDecryptFunc,
+                        "setintersection":  stdlib.SetIntersectionFunc,
+                        "setproduct":       funcs.SetProductFunc,
+                        "setunion":         stdlib.SetUnionFunc,
+                        "sha1":             funcs.Sha1Func,
+                        "sha256":           funcs.Sha256Func,
+                        "sha512":           funcs.Sha512Func,
+                        "signum":           funcs.SignumFunc,
+                        "slice":            funcs.SliceFunc,
+                        "sort":             funcs.SortFunc,
+                        "split":            funcs.SplitFunc,
+                        "strrev":           stdlib.ReverseFunc,
+                        "substr":           stdlib.SubstrFunc,
+                        "timestamp":        funcs.TimestampFunc,
+                        "timeadd":          funcs.TimeAddFunc,
+                        "title":            funcs.TitleFunc,
+                        "tostring":         funcs.MakeToFunc(cty.String),
+                        "tonumber":         funcs.MakeToFunc(cty.Number),
+                        "tobool":           funcs.MakeToFunc(cty.Bool),
+                        "toset":            funcs.MakeToFunc(cty.Set(cty.DynamicPseudoType)),
+                        "tolist":           funcs.MakeToFunc(cty.List(cty.DynamicPseudoType)),
+                        "tomap":            funcs.MakeToFunc(cty.Map(cty.DynamicPseudoType)),
+                        "transpose":        funcs.TransposeFunc,
+                        "trimspace":        funcs.TrimSpaceFunc,
+                        "upper":            stdlib.UpperFunc,
+                        "urlencode":        funcs.URLEncodeFunc,
+                        "uuid":             funcs.UUIDFunc,
+                        "values":           funcs.ValuesFunc,
+                        "zipmap":           funcs.ZipmapFunc,
+                }
+
+                s.funcs["templatefile"] = funcs.MakeTemplateFileFunc(s.BaseDir, func() map[string]function.Function {
+                        // The templatefile function prevents recursive calls to itself
+                        // by copying this map and overwriting the "templatefile" entry.
+                        return s.funcs
+                })
+
+                if s.PureOnly {
+                        // Force our few impure functions to return unknown so that we
+                        // can defer evaluating them until a later pass.
+                        for _, name := range impureFunctions {
+                                s.funcs[name] = function.Unpredictable(s.funcs[name])
+                        }
+                }
+        }
+        s.funcsLock.Unlock()
+
+        return s.funcs
+}
+
+var unimplFunc = function.New(&function.Spec{
+        Type: func([]cty.Value) (cty.Type, error) {
+                return cty.DynamicPseudoType, fmt.Errorf("function not yet implemented")
+        },
+        Impl: func([]cty.Value, cty.Type) (cty.Value, error) {
+                return cty.DynamicVal, fmt.Errorf("function not yet implemented")
+        },
+})
diff --git a/vendor/github.com/hashicorp/terraform/lang/references.go b/vendor/github.com/hashicorp/terraform/lang/references.go
new file mode 100644
index 0000000..d688477
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/references.go
@@ -0,0 +1,81 @@
+package lang
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang/blocktoattr"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// References finds all of the references in the given set of traversals,
+// returning diagnostics if any of the traversals cannot be interpreted as a
+// reference.
+//
+// This function does not do any de-duplication of references, since references
+// have source location information embedded in them and so any invalid
+// references that are duplicated should have errors reported for each
+// occurence.
+//
+// If the returned diagnostics contains errors then the result may be
+// incomplete or invalid. Otherwise, the returned slice has one reference per
+// given traversal, though it is not guaranteed that the references will
+// appear in the same order as the given traversals.
+func References(traversals []hcl.Traversal) ([]*addrs.Reference, tfdiags.Diagnostics) {
+        if len(traversals) == 0 {
+                return nil, nil
+        }
+
+        var diags tfdiags.Diagnostics
+        refs := make([]*addrs.Reference, 0, len(traversals))
+
+        for _, traversal := range traversals {
+                ref, refDiags := addrs.ParseRef(traversal)
+                diags = diags.Append(refDiags)
+                if ref == nil {
+                        continue
+                }
+                refs = append(refs, ref)
+        }
+
+        return refs, diags
+}
+
+// ReferencesInBlock is a helper wrapper around References that first searches
+// the given body for traversals, before converting those traversals to
+// references.
+//
+// A block schema must be provided so that this function can determine where in
+// the body variables are expected.
+func ReferencesInBlock(body hcl.Body, schema *configschema.Block) ([]*addrs.Reference, tfdiags.Diagnostics) {
+        if body == nil {
+                return nil, nil
+        }
+
+        // We use blocktoattr.ExpandedVariables instead of hcldec.Variables or
+        // dynblock.VariablesHCLDec here because when we evaluate a block we'll
+        // first apply the dynamic block extension and _then_ the blocktoattr
+        // transform, and so blocktoattr.ExpandedVariables takes into account
+        // both of those transforms when it analyzes the body to ensure we find
+        // all of the references as if they'd already moved into their final
+        // locations, even though we can't expand dynamic blocks yet until we
+        // already know which variables are required.
+        //
+        // The set of cases we want to detect here is covered by the tests for
+        // the plan graph builder in the main 'terraform' package, since it's
+        // in a better position to test this due to having mock providers etc
+        // available.
+        traversals := blocktoattr.ExpandedVariables(body, schema)
+        return References(traversals)
+}
+
+// ReferencesInExpr is a helper wrapper around References that first searches
+// the given expression for traversals, before converting those traversals
+// to references.
+func ReferencesInExpr(expr hcl.Expression) ([]*addrs.Reference, tfdiags.Diagnostics) {
+        if expr == nil {
+                return nil, nil
+        }
+        traversals := expr.Variables()
+        return References(traversals)
+}
diff --git a/vendor/github.com/hashicorp/terraform/lang/scope.go b/vendor/github.com/hashicorp/terraform/lang/scope.go
new file mode 100644
index 0000000..98fca6b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/lang/scope.go
@@ -0,0 +1,34 @@
+package lang
+
+import (
+        "sync"
+
+        "github.com/zclconf/go-cty/cty/function"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Scope is the main type in this package, allowing dynamic evaluation of
+// blocks and expressions based on some contextual information that informs
+// which variables and functions will be available.
+type Scope struct {
+        // Data is used to resolve references in expressions.
+        Data Data
+
+        // SelfAddr is the address that the "self" object should be an alias of,
+        // or nil if the "self" object should not be available at all.
+        SelfAddr addrs.Referenceable
+
+        // BaseDir is the base directory used by any interpolation functions that
+        // accept filesystem paths as arguments.
+        BaseDir string
+
+        // PureOnly can be set to true to request that any non-pure functions
+        // produce unknown value results rather than actually executing. This is
+        // important during a plan phase to avoid generating results that could
+        // then differ during apply.
+        PureOnly bool
+
+        funcs     map[string]function.Function
+        funcsLock sync.Mutex
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/action.go b/vendor/github.com/hashicorp/terraform/plans/action.go
new file mode 100644
index 0000000..c3e6a32
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/action.go
@@ -0,0 +1,22 @@
+package plans
+
+type Action rune
+
+const (
+        NoOp             Action = 0
+        Create           Action = '+'
+        Read             Action = '←'
+        Update           Action = '~'
+        DeleteThenCreate Action = '∓'
+        CreateThenDelete Action = '±'
+        Delete           Action = '-'
+)
+
+//go:generate stringer -type Action
+
+// IsReplace returns true if the action is one of the two actions that
+// represents replacing an existing object with a new object:
+// DeleteThenCreate or CreateThenDelete.
+func (a Action) IsReplace() bool {
+        return a == DeleteThenCreate || a == CreateThenDelete
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/action_string.go b/vendor/github.com/hashicorp/terraform/plans/action_string.go
new file mode 100644
index 0000000..be43ab1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/action_string.go
@@ -0,0 +1,49 @@
+// Code generated by "stringer -type Action"; DO NOT EDIT.
+
+package plans
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[NoOp-0]
+        _ = x[Create-43]
+        _ = x[Read-8592]
+        _ = x[Update-126]
+        _ = x[DeleteThenCreate-8723]
+        _ = x[CreateThenDelete-177]
+        _ = x[Delete-45]
+}
+
+const (
+        _Action_name_0 = "NoOp"
+        _Action_name_1 = "Create"
+        _Action_name_2 = "Delete"
+        _Action_name_3 = "Update"
+        _Action_name_4 = "CreateThenDelete"
+        _Action_name_5 = "Read"
+        _Action_name_6 = "DeleteThenCreate"
+)
+
+func (i Action) String() string {
+        switch {
+        case i == 0:
+                return _Action_name_0
+        case i == 43:
+                return _Action_name_1
+        case i == 45:
+                return _Action_name_2
+        case i == 126:
+                return _Action_name_3
+        case i == 177:
+                return _Action_name_4
+        case i == 8592:
+                return _Action_name_5
+        case i == 8723:
+                return _Action_name_6
+        default:
+                return "Action(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/changes.go b/vendor/github.com/hashicorp/terraform/plans/changes.go
new file mode 100644
index 0000000..d7e0dcd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/changes.go
@@ -0,0 +1,308 @@
+package plans
+
+import (
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Changes describes various actions that Terraform will attempt to take if
+// the corresponding plan is applied.
+//
+// A Changes object can be rendered into a visual diff (by the caller, using
+// code in another package) for display to the user.
+type Changes struct {
+        // Resources tracks planned changes to resource instance objects.
+        Resources []*ResourceInstanceChangeSrc
+
+        // Outputs tracks planned changes output values.
+        //
+        // Note that although an in-memory plan contains planned changes for
+        // outputs throughout the configuration, a plan serialized
+        // to disk retains only the root outputs because they are
+        // externally-visible, while other outputs are implementation details and
+        // can be easily re-calculated during the apply phase. Therefore only root
+        // module outputs will survive a round-trip through a plan file.
+        Outputs []*OutputChangeSrc
+}
+
+// NewChanges returns a valid Changes object that describes no changes.
+func NewChanges() *Changes {
+        return &Changes{}
+}
+
+func (c *Changes) Empty() bool {
+        for _, res := range c.Resources {
+                if res.Action != NoOp {
+                        return false
+                }
+        }
+        return true
+}
+
+// ResourceInstance returns the planned change for the current object of the
+// resource instance of the given address, if any. Returns nil if no change is
+// planned.
+func (c *Changes) ResourceInstance(addr addrs.AbsResourceInstance) *ResourceInstanceChangeSrc {
+        addrStr := addr.String()
+        for _, rc := range c.Resources {
+                if rc.Addr.String() == addrStr && rc.DeposedKey == states.NotDeposed {
+                        return rc
+                }
+        }
+
+        return nil
+}
+
+// ResourceInstanceDeposed returns the plan change of a deposed object of
+// the resource instance of the given address, if any. Returns nil if no change
+// is planned.
+func (c *Changes) ResourceInstanceDeposed(addr addrs.AbsResourceInstance, key states.DeposedKey) *ResourceInstanceChangeSrc {
+        addrStr := addr.String()
+        for _, rc := range c.Resources {
+                if rc.Addr.String() == addrStr && rc.DeposedKey == key {
+                        return rc
+                }
+        }
+
+        return nil
+}
+
+// OutputValue returns the planned change for the output value with the
+//  given address, if any. Returns nil if no change is planned.
+func (c *Changes) OutputValue(addr addrs.AbsOutputValue) *OutputChangeSrc {
+        addrStr := addr.String()
+        for _, oc := range c.Outputs {
+                if oc.Addr.String() == addrStr {
+                        return oc
+                }
+        }
+
+        return nil
+}
+
+// SyncWrapper returns a wrapper object around the receiver that can be used
+// to make certain changes to the receiver in a concurrency-safe way, as long
+// as all callers share the same wrapper object.
+func (c *Changes) SyncWrapper() *ChangesSync {
+        return &ChangesSync{
+                changes: c,
+        }
+}
+
+// ResourceInstanceChange describes a change to a particular resource instance
+// object.
+type ResourceInstanceChange struct {
+        // Addr is the absolute address of the resource instance that the change
+        // will apply to.
+        Addr addrs.AbsResourceInstance
+
+        // DeposedKey is the identifier for a deposed object associated with the
+        // given instance, or states.NotDeposed if this change applies to the
+        // current object.
+        //
+        // A Replace change for a resource with create_before_destroy set will
+        // create a new DeposedKey temporarily during replacement. In that case,
+        // DeposedKey in the plan is always states.NotDeposed, representing that
+        // the current object is being replaced with the deposed.
+        DeposedKey states.DeposedKey
+
+        // Provider is the address of the provider configuration that was used
+        // to plan this change, and thus the configuration that must also be
+        // used to apply it.
+        ProviderAddr addrs.AbsProviderConfig
+
+        // Change is an embedded description of the change.
+        Change
+
+        // RequiredReplace is a set of paths that caused the change action to be
+        // Replace rather than Update. Always nil if the change action is not
+        // Replace.
+        //
+        // This is retained only for UI-plan-rendering purposes and so it does not
+        // currently survive a round-trip through a saved plan file.
+        RequiredReplace cty.PathSet
+
+        // Private allows a provider to stash any extra data that is opaque to
+        // Terraform that relates to this change. Terraform will save this
+        // byte-for-byte and return it to the provider in the apply call.
+        Private []byte
+}
+
+// Encode produces a variant of the reciever that has its change values
+// serialized so it can be written to a plan file. Pass the implied type of the
+// corresponding resource type schema for correct operation.
+func (rc *ResourceInstanceChange) Encode(ty cty.Type) (*ResourceInstanceChangeSrc, error) {
+        cs, err := rc.Change.Encode(ty)
+        if err != nil {
+                return nil, err
+        }
+        return &ResourceInstanceChangeSrc{
+                Addr:            rc.Addr,
+                DeposedKey:      rc.DeposedKey,
+                ProviderAddr:    rc.ProviderAddr,
+                ChangeSrc:       *cs,
+                RequiredReplace: rc.RequiredReplace,
+                Private:         rc.Private,
+        }, err
+}
+
+// Simplify will, where possible, produce a change with a simpler action than
+// the receiever given a flag indicating whether the caller is dealing with
+// a normal apply or a destroy. This flag deals with the fact that Terraform
+// Core uses a specialized graph node type for destroying; only that
+// specialized node should set "destroying" to true.
+//
+// The following table shows the simplification behavior:
+//
+//     Action    Destroying?   New Action
+//     --------+-------------+-----------
+//     Create    true          NoOp
+//     Delete    false         NoOp
+//     Replace   true          Delete
+//     Replace   false         Create
+//
+// For any combination not in the above table, the Simplify just returns the
+// receiver as-is.
+func (rc *ResourceInstanceChange) Simplify(destroying bool) *ResourceInstanceChange {
+        if destroying {
+                switch rc.Action {
+                case Delete:
+                        // We'll fall out and just return rc verbatim, then.
+                case CreateThenDelete, DeleteThenCreate:
+                        return &ResourceInstanceChange{
+                                Addr:         rc.Addr,
+                                DeposedKey:   rc.DeposedKey,
+                                Private:      rc.Private,
+                                ProviderAddr: rc.ProviderAddr,
+                                Change: Change{
+                                        Action: Delete,
+                                        Before: rc.Before,
+                                        After:  cty.NullVal(rc.Before.Type()),
+                                },
+                        }
+                default:
+                        return &ResourceInstanceChange{
+                                Addr:         rc.Addr,
+                                DeposedKey:   rc.DeposedKey,
+                                Private:      rc.Private,
+                                ProviderAddr: rc.ProviderAddr,
+                                Change: Change{
+                                        Action: NoOp,
+                                        Before: rc.Before,
+                                        After:  rc.Before,
+                                },
+                        }
+                }
+        } else {
+                switch rc.Action {
+                case Delete:
+                        return &ResourceInstanceChange{
+                                Addr:         rc.Addr,
+                                DeposedKey:   rc.DeposedKey,
+                                Private:      rc.Private,
+                                ProviderAddr: rc.ProviderAddr,
+                                Change: Change{
+                                        Action: NoOp,
+                                        Before: rc.Before,
+                                        After:  rc.Before,
+                                },
+                        }
+                case CreateThenDelete, DeleteThenCreate:
+                        return &ResourceInstanceChange{
+                                Addr:         rc.Addr,
+                                DeposedKey:   rc.DeposedKey,
+                                Private:      rc.Private,
+                                ProviderAddr: rc.ProviderAddr,
+                                Change: Change{
+                                        Action: Create,
+                                        Before: cty.NullVal(rc.After.Type()),
+                                        After:  rc.After,
+                                },
+                        }
+                }
+        }
+
+        // If we fall out here then our change is already simple enough.
+        return rc
+}
+
+// OutputChange describes a change to an output value.
+type OutputChange struct {
+        // Addr is the absolute address of the output value that the change
+        // will apply to.
+        Addr addrs.AbsOutputValue
+
+        // Change is an embedded description of the change.
+        //
+        // For output value changes, the type constraint for the DynamicValue
+        // instances is always cty.DynamicPseudoType.
+        Change
+
+        // Sensitive, if true, indicates that either the old or new value in the
+        // change is sensitive and so a rendered version of the plan in the UI
+        // should elide the actual values while still indicating the action of the
+        // change.
+        Sensitive bool
+}
+
+// Encode produces a variant of the reciever that has its change values
+// serialized so it can be written to a plan file.
+func (oc *OutputChange) Encode() (*OutputChangeSrc, error) {
+        cs, err := oc.Change.Encode(cty.DynamicPseudoType)
+        if err != nil {
+                return nil, err
+        }
+        return &OutputChangeSrc{
+                Addr:      oc.Addr,
+                ChangeSrc: *cs,
+                Sensitive: oc.Sensitive,
+        }, err
+}
+
+// Change describes a single change with a given action.
+type Change struct {
+        // Action defines what kind of change is being made.
+        Action Action
+
+        // Interpretation of Before and After depend on Action:
+        //
+        //     NoOp     Before and After are the same, unchanged value
+        //     Create   Before is nil, and After is the expected value after create.
+        //     Read     Before is any prior value (nil if no prior), and After is the
+        //              value that was or will be read.
+        //     Update   Before is the value prior to update, and After is the expected
+        //              value after update.
+        //     Replace  As with Update.
+        //     Delete   Before is the value prior to delete, and After is always nil.
+        //
+        // Unknown values may appear anywhere within the Before and After values,
+        // either as the values themselves or as nested elements within known
+        // collections/structures.
+        Before, After cty.Value
+}
+
+// Encode produces a variant of the reciever that has its change values
+// serialized so it can be written to a plan file. Pass the type constraint
+// that the values are expected to conform to; to properly decode the values
+// later an identical type constraint must be provided at that time.
+//
+// Where a Change is embedded in some other struct, it's generally better
+// to call the corresponding Encode method of that struct rather than working
+// directly with its embedded Change.
+func (c *Change) Encode(ty cty.Type) (*ChangeSrc, error) {
+        beforeDV, err := NewDynamicValue(c.Before, ty)
+        if err != nil {
+                return nil, err
+        }
+        afterDV, err := NewDynamicValue(c.After, ty)
+        if err != nil {
+                return nil, err
+        }
+
+        return &ChangeSrc{
+                Action: c.Action,
+                Before: beforeDV,
+                After:  afterDV,
+        }, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/changes_src.go b/vendor/github.com/hashicorp/terraform/plans/changes_src.go
new file mode 100644
index 0000000..90153ea
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/changes_src.go
@@ -0,0 +1,190 @@
+package plans
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// ResourceInstanceChangeSrc is a not-yet-decoded ResourceInstanceChange.
+// Pass the associated resource type's schema type to method Decode to
+// obtain a ResourceInstancChange.
+type ResourceInstanceChangeSrc struct {
+        // Addr is the absolute address of the resource instance that the change
+        // will apply to.
+        Addr addrs.AbsResourceInstance
+
+        // DeposedKey is the identifier for a deposed object associated with the
+        // given instance, or states.NotDeposed if this change applies to the
+        // current object.
+        //
+        // A Replace change for a resource with create_before_destroy set will
+        // create a new DeposedKey temporarily during replacement. In that case,
+        // DeposedKey in the plan is always states.NotDeposed, representing that
+        // the current object is being replaced with the deposed.
+        DeposedKey states.DeposedKey
+
+        // Provider is the address of the provider configuration that was used
+        // to plan this change, and thus the configuration that must also be
+        // used to apply it.
+        ProviderAddr addrs.AbsProviderConfig
+
+        // ChangeSrc is an embedded description of the not-yet-decoded change.
+        ChangeSrc
+
+        // RequiredReplace is a set of paths that caused the change action to be
+        // Replace rather than Update. Always nil if the change action is not
+        // Replace.
+        //
+        // This is retained only for UI-plan-rendering purposes and so it does not
+        // currently survive a round-trip through a saved plan file.
+        RequiredReplace cty.PathSet
+
+        // Private allows a provider to stash any extra data that is opaque to
+        // Terraform that relates to this change. Terraform will save this
+        // byte-for-byte and return it to the provider in the apply call.
+        Private []byte
+}
+
+// Decode unmarshals the raw representation of the instance object being
+// changed. Pass the implied type of the corresponding resource type schema
+// for correct operation.
+func (rcs *ResourceInstanceChangeSrc) Decode(ty cty.Type) (*ResourceInstanceChange, error) {
+        change, err := rcs.ChangeSrc.Decode(ty)
+        if err != nil {
+                return nil, err
+        }
+        return &ResourceInstanceChange{
+                Addr:            rcs.Addr,
+                DeposedKey:      rcs.DeposedKey,
+                ProviderAddr:    rcs.ProviderAddr,
+                Change:          *change,
+                RequiredReplace: rcs.RequiredReplace,
+                Private:         rcs.Private,
+        }, nil
+}
+
+// DeepCopy creates a copy of the receiver where any pointers to nested mutable
+// values are also copied, thus ensuring that future mutations of the receiver
+// will not affect the copy.
+//
+// Some types used within a resource change are immutable by convention even
+// though the Go language allows them to be mutated, such as the types from
+// the addrs package. These are _not_ copied by this method, under the
+// assumption that callers will behave themselves.
+func (rcs *ResourceInstanceChangeSrc) DeepCopy() *ResourceInstanceChangeSrc {
+        if rcs == nil {
+                return nil
+        }
+        ret := *rcs
+
+        ret.RequiredReplace = cty.NewPathSet(ret.RequiredReplace.List()...)
+
+        if len(ret.Private) != 0 {
+                private := make([]byte, len(ret.Private))
+                copy(private, ret.Private)
+                ret.Private = private
+        }
+
+        ret.ChangeSrc.Before = ret.ChangeSrc.Before.Copy()
+        ret.ChangeSrc.After = ret.ChangeSrc.After.Copy()
+
+        return &ret
+}
+
+// OutputChangeSrc describes a change to an output value.
+type OutputChangeSrc struct {
+        // Addr is the absolute address of the output value that the change
+        // will apply to.
+        Addr addrs.AbsOutputValue
+
+        // ChangeSrc is an embedded description of the not-yet-decoded change.
+        //
+        // For output value changes, the type constraint for the DynamicValue
+        // instances is always cty.DynamicPseudoType.
+        ChangeSrc
+
+        // Sensitive, if true, indicates that either the old or new value in the
+        // change is sensitive and so a rendered version of the plan in the UI
+        // should elide the actual values while still indicating the action of the
+        // change.
+        Sensitive bool
+}
+
+// Decode unmarshals the raw representation of the output value being
+// changed.
+func (ocs *OutputChangeSrc) Decode() (*OutputChange, error) {
+        change, err := ocs.ChangeSrc.Decode(cty.DynamicPseudoType)
+        if err != nil {
+                return nil, err
+        }
+        return &OutputChange{
+                Addr:      ocs.Addr,
+                Change:    *change,
+                Sensitive: ocs.Sensitive,
+        }, nil
+}
+
+// DeepCopy creates a copy of the receiver where any pointers to nested mutable
+// values are also copied, thus ensuring that future mutations of the receiver
+// will not affect the copy.
+//
+// Some types used within a resource change are immutable by convention even
+// though the Go language allows them to be mutated, such as the types from
+// the addrs package. These are _not_ copied by this method, under the
+// assumption that callers will behave themselves.
+func (ocs *OutputChangeSrc) DeepCopy() *OutputChangeSrc {
+        if ocs == nil {
+                return nil
+        }
+        ret := *ocs
+
+        ret.ChangeSrc.Before = ret.ChangeSrc.Before.Copy()
+        ret.ChangeSrc.After = ret.ChangeSrc.After.Copy()
+
+        return &ret
+}
+
+// ChangeSrc is a not-yet-decoded Change.
+type ChangeSrc struct {
+        // Action defines what kind of change is being made.
+        Action Action
+
+        // Before and After correspond to the fields of the same name in Change,
+        // but have not yet been decoded from the serialized value used for
+        // storage.
+        Before, After DynamicValue
+}
+
+// Decode unmarshals the raw representations of the before and after values
+// to produce a Change object. Pass the type constraint that the result must
+// conform to.
+//
+// Where a ChangeSrc is embedded in some other struct, it's generally better
+// to call the corresponding Decode method of that struct rather than working
+// directly with its embedded Change.
+func (cs *ChangeSrc) Decode(ty cty.Type) (*Change, error) {
+        var err error
+        before := cty.NullVal(ty)
+        after := cty.NullVal(ty)
+
+        if len(cs.Before) > 0 {
+                before, err = cs.Before.Decode(ty)
+                if err != nil {
+                        return nil, fmt.Errorf("error decoding 'before' value: %s", err)
+                }
+        }
+        if len(cs.After) > 0 {
+                after, err = cs.After.Decode(ty)
+                if err != nil {
+                        return nil, fmt.Errorf("error decoding 'after' value: %s", err)
+                }
+        }
+        return &Change{
+                Action: cs.Action,
+                Before: before,
+                After:  after,
+        }, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/changes_state.go b/vendor/github.com/hashicorp/terraform/plans/changes_state.go
new file mode 100644
index 0000000..543e6c2
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/changes_state.go
@@ -0,0 +1,15 @@
+package plans
+
+import (
+        "github.com/hashicorp/terraform/states"
+)
+
+// PlannedState merges the set of changes described by the receiver into the
+// given prior state to produce the planned result state.
+//
+// The result is an approximation of the state as it would exist after
+// applying these changes, omitting any values that cannot be determined until
+// the changes are actually applied.
+func (c *Changes) PlannedState(prior *states.State) (*states.State, error) {
+        panic("Changes.PlannedState not yet implemented")
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/changes_sync.go b/vendor/github.com/hashicorp/terraform/plans/changes_sync.go
new file mode 100644
index 0000000..6b4ff98
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/changes_sync.go
@@ -0,0 +1,144 @@
+package plans
+
+import (
+        "fmt"
+        "sync"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+)
+
+// ChangesSync is a wrapper around a Changes that provides a concurrency-safe
+// interface to insert new changes and retrieve copies of existing changes.
+//
+// Each ChangesSync is independent of all others, so all concurrent writers
+// to a particular Changes must share a single ChangesSync. Behavior is
+// undefined if any other caller makes changes to the underlying Changes
+// object or its nested objects concurrently with any of the methods of a
+// particular ChangesSync.
+type ChangesSync struct {
+        lock    sync.Mutex
+        changes *Changes
+}
+
+// AppendResourceInstanceChange records the given resource instance change in
+// the set of planned resource changes.
+//
+// The caller must ensure that there are no concurrent writes to the given
+// change while this method is running, but it is safe to resume mutating
+// it after this method returns without affecting the saved change.
+func (cs *ChangesSync) AppendResourceInstanceChange(changeSrc *ResourceInstanceChangeSrc) {
+        if cs == nil {
+                panic("AppendResourceInstanceChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        s := changeSrc.DeepCopy()
+        cs.changes.Resources = append(cs.changes.Resources, s)
+}
+
+// GetResourceInstanceChange searches the set of resource instance changes for
+// one matching the given address and generation, returning it if it exists.
+//
+// If no such change exists, nil is returned.
+//
+// The returned object is a deep copy of the change recorded in the plan, so
+// callers may mutate it although it's generally better (less confusing) to
+// treat planned changes as immutable after they've been initially constructed.
+func (cs *ChangesSync) GetResourceInstanceChange(addr addrs.AbsResourceInstance, gen states.Generation) *ResourceInstanceChangeSrc {
+        if cs == nil {
+                panic("GetResourceInstanceChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        if gen == states.CurrentGen {
+                return cs.changes.ResourceInstance(addr).DeepCopy()
+        }
+        if dk, ok := gen.(states.DeposedKey); ok {
+                return cs.changes.ResourceInstanceDeposed(addr, dk).DeepCopy()
+        }
+        panic(fmt.Sprintf("unsupported generation value %#v", gen))
+}
+
+// RemoveResourceInstanceChange searches the set of resource instance changes
+// for one matching the given address and generation, and removes it from the
+// set if it exists.
+func (cs *ChangesSync) RemoveResourceInstanceChange(addr addrs.AbsResourceInstance, gen states.Generation) {
+        if cs == nil {
+                panic("RemoveResourceInstanceChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        dk := states.NotDeposed
+        if realDK, ok := gen.(states.DeposedKey); ok {
+                dk = realDK
+        }
+
+        addrStr := addr.String()
+        for i, r := range cs.changes.Resources {
+                if r.Addr.String() != addrStr || r.DeposedKey != dk {
+                        continue
+                }
+                copy(cs.changes.Resources[i:], cs.changes.Resources[i+1:])
+                cs.changes.Resources = cs.changes.Resources[:len(cs.changes.Resources)-1]
+                return
+        }
+}
+
+// AppendOutputChange records the given output value change in the set of
+// planned value changes.
+//
+// The caller must ensure that there are no concurrent writes to the given
+// change while this method is running, but it is safe to resume mutating
+// it after this method returns without affecting the saved change.
+func (cs *ChangesSync) AppendOutputChange(changeSrc *OutputChangeSrc) {
+        if cs == nil {
+                panic("AppendOutputChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        s := changeSrc.DeepCopy()
+        cs.changes.Outputs = append(cs.changes.Outputs, s)
+}
+
+// GetOutputChange searches the set of output value changes for one matching
+// the given address, returning it if it exists.
+//
+// If no such change exists, nil is returned.
+//
+// The returned object is a deep copy of the change recorded in the plan, so
+// callers may mutate it although it's generally better (less confusing) to
+// treat planned changes as immutable after they've been initially constructed.
+func (cs *ChangesSync) GetOutputChange(addr addrs.AbsOutputValue) *OutputChangeSrc {
+        if cs == nil {
+                panic("GetOutputChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        return cs.changes.OutputValue(addr)
+}
+
+// RemoveOutputChange searches the set of output value changes for one matching
+// the given address, and removes it from the set if it exists.
+func (cs *ChangesSync) RemoveOutputChange(addr addrs.AbsOutputValue) {
+        if cs == nil {
+                panic("RemoveOutputChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        addrStr := addr.String()
+        for i, o := range cs.changes.Outputs {
+                if o.Addr.String() != addrStr {
+                        continue
+                }
+                copy(cs.changes.Outputs[i:], cs.changes.Outputs[i+1:])
+                cs.changes.Outputs = cs.changes.Outputs[:len(cs.changes.Outputs)-1]
+                return
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/doc.go b/vendor/github.com/hashicorp/terraform/plans/doc.go
new file mode 100644
index 0000000..01ca389
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/doc.go
@@ -0,0 +1,5 @@
+// Package plans contains the types that are used to represent Terraform plans.
+//
+// A plan describes a set of changes that Terraform will make to update remote
+// objects to match with changes to the configuration.
+package plans
diff --git a/vendor/github.com/hashicorp/terraform/plans/dynamic_value.go b/vendor/github.com/hashicorp/terraform/plans/dynamic_value.go
new file mode 100644
index 0000000..51fbb24
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/dynamic_value.go
@@ -0,0 +1,96 @@
+package plans
+
+import (
+        "github.com/zclconf/go-cty/cty"
+        ctymsgpack "github.com/zclconf/go-cty/cty/msgpack"
+)
+
+// DynamicValue is the representation in the plan of a value whose type cannot
+// be determined at compile time, such as because it comes from a schema
+// defined in a plugin.
+//
+// This type is used as an indirection so that the overall plan structure can
+// be decoded without schema available, and then the dynamic values accessed
+// at a later time once the appropriate schema has been determined.
+//
+// Internally, DynamicValue is a serialized version of a cty.Value created
+// against a particular type constraint. Callers should not access directly
+// the serialized form, whose format may change in future. Values of this
+// type must always be created by calling NewDynamicValue.
+//
+// The zero value of DynamicValue is nil, and represents the absense of a
+// value within the Go type system. This is distinct from a cty.NullVal
+// result, which represents the absense of a value within the cty type system.
+type DynamicValue []byte
+
+// NewDynamicValue creates a DynamicValue by serializing the given value
+// against the given type constraint. The value must conform to the type
+// constraint, or the result is undefined.
+//
+// If the value to be encoded has no predefined schema (for example, for
+// module output values and input variables), set the type constraint to
+// cty.DynamicPseudoType in order to save type information as part of the
+// value, and then also pass cty.DynamicPseudoType to method Decode to recover
+// the original value.
+//
+// cty.NilVal can be used to represent the absense of a value, but callers
+// must be careful to distinguish values that are absent at the Go layer
+// (cty.NilVal) vs. values that are absent at the cty layer (cty.NullVal
+// results).
+func NewDynamicValue(val cty.Value, ty cty.Type) (DynamicValue, error) {
+        // If we're given cty.NilVal (the zero value of cty.Value, which is
+        // distinct from a typed null value created by cty.NullVal) then we'll
+        // assume the caller is trying to represent the _absense_ of a value,
+        // and so we'll return a nil DynamicValue.
+        if val == cty.NilVal {
+                return DynamicValue(nil), nil
+        }
+
+        // Currently our internal encoding is msgpack, via ctymsgpack.
+        buf, err := ctymsgpack.Marshal(val, ty)
+        if err != nil {
+                return nil, err
+        }
+
+        return DynamicValue(buf), nil
+}
+
+// Decode retrieves the effective value from the receiever by interpreting the
+// serialized form against the given type constraint. For correct results,
+// the type constraint must match (or be consistent with) the one that was
+// used to create the receiver.
+//
+// A nil DynamicValue decodes to cty.NilVal, which is not a valid value and
+// instead represents the absense of a value.
+func (v DynamicValue) Decode(ty cty.Type) (cty.Value, error) {
+        if v == nil {
+                return cty.NilVal, nil
+        }
+
+        return ctymsgpack.Unmarshal([]byte(v), ty)
+}
+
+// ImpliedType returns the type implied by the serialized structure of the
+// receiving value.
+//
+// This will not necessarily be exactly the type that was given when the
+// value was encoded, and in particular must not be used for values that
+// were encoded with their static type given as cty.DynamicPseudoType.
+// It is however safe to use this method for values that were encoded using
+// their runtime type as the conforming type, with the result being
+// semantically equivalent but with all lists and sets represented as tuples,
+// and maps as objects, due to ambiguities of the serialization.
+func (v DynamicValue) ImpliedType() (cty.Type, error) {
+        return ctymsgpack.ImpliedType([]byte(v))
+}
+
+// Copy produces a copy of the receiver with a distinct backing array.
+func (v DynamicValue) Copy() DynamicValue {
+        if v == nil {
+                return nil
+        }
+
+        ret := make(DynamicValue, len(v))
+        copy(ret, v)
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/all_null.go b/vendor/github.com/hashicorp/terraform/plans/objchange/all_null.go
new file mode 100644
index 0000000..18a7e99
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/all_null.go
@@ -0,0 +1,18 @@
+package objchange
+
+import (
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// AllAttributesNull constructs a non-null cty.Value of the object type implied
+// by the given schema that has all of its leaf attributes set to null and all
+// of its nested block collections set to zero-length.
+//
+// This simulates what would result from decoding an empty configuration block
+// with the given schema, except that it does not produce errors
+func AllAttributesNull(schema *configschema.Block) cty.Value {
+        // "All attributes null" happens to be the definition of EmptyValue for
+        // a Block, so we can just delegate to that.
+        return schema.EmptyValue()
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/compatible.go b/vendor/github.com/hashicorp/terraform/plans/objchange/compatible.go
new file mode 100644
index 0000000..8b7ef43
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/compatible.go
@@ -0,0 +1,437 @@
+package objchange
+
+import (
+        "fmt"
+        "strconv"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+)
+
+// AssertObjectCompatible checks whether the given "actual" value is a valid
+// completion of the possibly-partially-unknown "planned" value.
+//
+// This means that any known leaf value in "planned" must be equal to the
+// corresponding value in "actual", and various other similar constraints.
+//
+// Any inconsistencies are reported by returning a non-zero number of errors.
+// These errors are usually (but not necessarily) cty.PathError values
+// referring to a particular nested value within the "actual" value.
+//
+// The two values must have types that conform to the given schema's implied
+// type, or this function will panic.
+func AssertObjectCompatible(schema *configschema.Block, planned, actual cty.Value) []error {
+        return assertObjectCompatible(schema, planned, actual, nil)
+}
+
+func assertObjectCompatible(schema *configschema.Block, planned, actual cty.Value, path cty.Path) []error {
+        var errs []error
+        if planned.IsNull() && !actual.IsNull() {
+                errs = append(errs, path.NewErrorf("was absent, but now present"))
+                return errs
+        }
+        if actual.IsNull() && !planned.IsNull() {
+                errs = append(errs, path.NewErrorf("was present, but now absent"))
+                return errs
+        }
+        if planned.IsNull() {
+                // No further checks possible if both values are null
+                return errs
+        }
+
+        for name, attrS := range schema.Attributes {
+                plannedV := planned.GetAttr(name)
+                actualV := actual.GetAttr(name)
+
+                path := append(path, cty.GetAttrStep{Name: name})
+                moreErrs := assertValueCompatible(plannedV, actualV, path)
+                if attrS.Sensitive {
+                        if len(moreErrs) > 0 {
+                                // Use a vague placeholder message instead, to avoid disclosing
+                                // sensitive information.
+                                errs = append(errs, path.NewErrorf("inconsistent values for sensitive attribute"))
+                        }
+                } else {
+                        errs = append(errs, moreErrs...)
+                }
+        }
+        for name, blockS := range schema.BlockTypes {
+                plannedV := planned.GetAttr(name)
+                actualV := actual.GetAttr(name)
+
+                // As a special case, if there were any blocks whose leaf attributes
+                // are all unknown then we assume (possibly incorrectly) that the
+                // HCL dynamic block extension is in use with an unknown for_each
+                // argument, and so we will do looser validation here that allows
+                // for those blocks to have expanded into a different number of blocks
+                // if the for_each value is now known.
+                maybeUnknownBlocks := couldHaveUnknownBlockPlaceholder(plannedV, blockS, false)
+
+                path := append(path, cty.GetAttrStep{Name: name})
+                switch blockS.Nesting {
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        // If an unknown block placeholder was present then the placeholder
+                        // may have expanded out into zero blocks, which is okay.
+                        if maybeUnknownBlocks && actualV.IsNull() {
+                                continue
+                        }
+                        moreErrs := assertObjectCompatible(&blockS.Block, plannedV, actualV, path)
+                        errs = append(errs, moreErrs...)
+                case configschema.NestingList:
+                        // A NestingList might either be a list or a tuple, depending on
+                        // whether there are dynamically-typed attributes inside. However,
+                        // both support a similar-enough API that we can treat them the
+                        // same for our purposes here.
+                        if !plannedV.IsKnown() || plannedV.IsNull() || actualV.IsNull() {
+                                continue
+                        }
+
+                        if maybeUnknownBlocks {
+                                // When unknown blocks are present the final blocks may be
+                                // at different indices than the planned blocks, so unfortunately
+                                // we can't do our usual checks in this case without generating
+                                // false negatives.
+                                continue
+                        }
+
+                        plannedL := plannedV.LengthInt()
+                        actualL := actualV.LengthInt()
+                        if plannedL != actualL {
+                                errs = append(errs, path.NewErrorf("block count changed from %d to %d", plannedL, actualL))
+                                continue
+                        }
+                        for it := plannedV.ElementIterator(); it.Next(); {
+                                idx, plannedEV := it.Element()
+                                if !actualV.HasIndex(idx).True() {
+                                        continue
+                                }
+                                actualEV := actualV.Index(idx)
+                                moreErrs := assertObjectCompatible(&blockS.Block, plannedEV, actualEV, append(path, cty.IndexStep{Key: idx}))
+                                errs = append(errs, moreErrs...)
+                        }
+                case configschema.NestingMap:
+                        // A NestingMap might either be a map or an object, depending on
+                        // whether there are dynamically-typed attributes inside, but
+                        // that's decided statically and so both values will have the same
+                        // kind.
+                        if plannedV.Type().IsObjectType() {
+                                plannedAtys := plannedV.Type().AttributeTypes()
+                                actualAtys := actualV.Type().AttributeTypes()
+                                for k := range plannedAtys {
+                                        if _, ok := actualAtys[k]; !ok {
+                                                errs = append(errs, path.NewErrorf("block key %q has vanished", k))
+                                                continue
+                                        }
+
+                                        plannedEV := plannedV.GetAttr(k)
+                                        actualEV := actualV.GetAttr(k)
+                                        moreErrs := assertObjectCompatible(&blockS.Block, plannedEV, actualEV, append(path, cty.GetAttrStep{Name: k}))
+                                        errs = append(errs, moreErrs...)
+                                }
+                                if !maybeUnknownBlocks { // new blocks may appear if unknown blocks were present in the plan
+                                        for k := range actualAtys {
+                                                if _, ok := plannedAtys[k]; !ok {
+                                                        errs = append(errs, path.NewErrorf("new block key %q has appeared", k))
+                                                        continue
+                                                }
+                                        }
+                                }
+                        } else {
+                                if !plannedV.IsKnown() || plannedV.IsNull() || actualV.IsNull() {
+                                        continue
+                                }
+                                plannedL := plannedV.LengthInt()
+                                actualL := actualV.LengthInt()
+                                if plannedL != actualL && !maybeUnknownBlocks { // new blocks may appear if unknown blocks were persent in the plan
+                                        errs = append(errs, path.NewErrorf("block count changed from %d to %d", plannedL, actualL))
+                                        continue
+                                }
+                                for it := plannedV.ElementIterator(); it.Next(); {
+                                        idx, plannedEV := it.Element()
+                                        if !actualV.HasIndex(idx).True() {
+                                                continue
+                                        }
+                                        actualEV := actualV.Index(idx)
+                                        moreErrs := assertObjectCompatible(&blockS.Block, plannedEV, actualEV, append(path, cty.IndexStep{Key: idx}))
+                                        errs = append(errs, moreErrs...)
+                                }
+                        }
+                case configschema.NestingSet:
+                        if !plannedV.IsKnown() || !actualV.IsKnown() || plannedV.IsNull() || actualV.IsNull() {
+                                continue
+                        }
+
+                        setErrs := assertSetValuesCompatible(plannedV, actualV, path, func(plannedEV, actualEV cty.Value) bool {
+                                errs := assertObjectCompatible(&blockS.Block, plannedEV, actualEV, append(path, cty.IndexStep{Key: actualEV}))
+                                return len(errs) == 0
+                        })
+                        errs = append(errs, setErrs...)
+
+                        // There can be fewer elements in a set after its elements are all
+                        // known (values that turn out to be equal will coalesce) but the
+                        // number of elements must never get larger.
+                        plannedL := plannedV.LengthInt()
+                        actualL := actualV.LengthInt()
+                        if plannedL < actualL {
+                                errs = append(errs, path.NewErrorf("block set length changed from %d to %d", plannedL, actualL))
+                        }
+                default:
+                        panic(fmt.Sprintf("unsupported nesting mode %s", blockS.Nesting))
+                }
+        }
+        return errs
+}
+
+func assertValueCompatible(planned, actual cty.Value, path cty.Path) []error {
+        // NOTE: We don't normally use the GoString rendering of cty.Value in
+        // user-facing error messages as a rule, but we make an exception
+        // for this function because we expect the user to pass this message on
+        // verbatim to the provider development team and so more detail is better.
+
+        var errs []error
+        if planned.Type() == cty.DynamicPseudoType {
+                // Anything goes, then
+                return errs
+        }
+        if problems := planned.Type().TestConformance(actual.Type()); len(problems) > 0 {
+                errs = append(errs, path.NewErrorf("wrong final value type: %s", convert.MismatchMessage(actual.Type(), planned.Type())))
+                // If the types don't match then we can't do any other comparisons,
+                // so we bail early.
+                return errs
+        }
+
+        if !planned.IsKnown() {
+                // We didn't know what were going to end up with during plan, so
+                // anything goes during apply.
+                return errs
+        }
+
+        if actual.IsNull() {
+                if planned.IsNull() {
+                        return nil
+                }
+                errs = append(errs, path.NewErrorf("was %#v, but now null", planned))
+                return errs
+        }
+        if planned.IsNull() {
+                errs = append(errs, path.NewErrorf("was null, but now %#v", actual))
+                return errs
+        }
+
+        ty := planned.Type()
+        switch {
+
+        case !actual.IsKnown():
+                errs = append(errs, path.NewErrorf("was known, but now unknown"))
+
+        case ty.IsPrimitiveType():
+                if !actual.Equals(planned).True() {
+                        errs = append(errs, path.NewErrorf("was %#v, but now %#v", planned, actual))
+                }
+
+        case ty.IsListType() || ty.IsMapType() || ty.IsTupleType():
+                for it := planned.ElementIterator(); it.Next(); {
+                        k, plannedV := it.Element()
+                        if !actual.HasIndex(k).True() {
+                                errs = append(errs, path.NewErrorf("element %s has vanished", indexStrForErrors(k)))
+                                continue
+                        }
+
+                        actualV := actual.Index(k)
+                        moreErrs := assertValueCompatible(plannedV, actualV, append(path, cty.IndexStep{Key: k}))
+                        errs = append(errs, moreErrs...)
+                }
+
+                for it := actual.ElementIterator(); it.Next(); {
+                        k, _ := it.Element()
+                        if !planned.HasIndex(k).True() {
+                                errs = append(errs, path.NewErrorf("new element %s has appeared", indexStrForErrors(k)))
+                        }
+                }
+
+        case ty.IsObjectType():
+                atys := ty.AttributeTypes()
+                for name := range atys {
+                        // Because we already tested that the two values have the same type,
+                        // we can assume that the same attributes are present in both and
+                        // focus just on testing their values.
+                        plannedV := planned.GetAttr(name)
+                        actualV := actual.GetAttr(name)
+                        moreErrs := assertValueCompatible(plannedV, actualV, append(path, cty.GetAttrStep{Name: name}))
+                        errs = append(errs, moreErrs...)
+                }
+
+        case ty.IsSetType():
+                // We can't really do anything useful for sets here because changing
+                // an unknown element to known changes the identity of the element, and
+                // so we can't correlate them properly. However, we will at least check
+                // to ensure that the number of elements is consistent, along with
+                // the general type-match checks we ran earlier in this function.
+                if planned.IsKnown() && !planned.IsNull() && !actual.IsNull() {
+
+                        setErrs := assertSetValuesCompatible(planned, actual, path, func(plannedV, actualV cty.Value) bool {
+                                errs := assertValueCompatible(plannedV, actualV, append(path, cty.IndexStep{Key: actualV}))
+                                return len(errs) == 0
+                        })
+                        errs = append(errs, setErrs...)
+
+                        // There can be fewer elements in a set after its elements are all
+                        // known (values that turn out to be equal will coalesce) but the
+                        // number of elements must never get larger.
+
+                        plannedL := planned.LengthInt()
+                        actualL := actual.LengthInt()
+                        if plannedL < actualL {
+                                errs = append(errs, path.NewErrorf("length changed from %d to %d", plannedL, actualL))
+                        }
+                }
+        }
+
+        return errs
+}
+
+func indexStrForErrors(v cty.Value) string {
+        switch v.Type() {
+        case cty.Number:
+                return v.AsBigFloat().Text('f', -1)
+        case cty.String:
+                return strconv.Quote(v.AsString())
+        default:
+                // Should be impossible, since no other index types are allowed!
+                return fmt.Sprintf("%#v", v)
+        }
+}
+
+// couldHaveUnknownBlockPlaceholder is a heuristic that recognizes how the
+// HCL dynamic block extension behaves when it's asked to expand a block whose
+// for_each argument is unknown. In such cases, it generates a single placeholder
+// block with all leaf attribute values unknown, and once the for_each
+// expression becomes known the placeholder may be replaced with any number
+// of blocks, so object compatibility checks would need to be more liberal.
+//
+// Set "nested" if testing a block that is nested inside a candidate block
+// placeholder; this changes the interpretation of there being no blocks of
+// a type to allow for there being zero nested blocks.
+func couldHaveUnknownBlockPlaceholder(v cty.Value, blockS *configschema.NestedBlock, nested bool) bool {
+        switch blockS.Nesting {
+        case configschema.NestingSingle, configschema.NestingGroup:
+                if nested && v.IsNull() {
+                        return true // for nested blocks, a single block being unset doesn't disqualify from being an unknown block placeholder
+                }
+                return couldBeUnknownBlockPlaceholderElement(v, &blockS.Block)
+        default:
+                // These situations should be impossible for correct providers, but
+                // we permit the legacy SDK to produce some incorrect outcomes
+                // for compatibility with its existing logic, and so we must be
+                // tolerant here.
+                if !v.IsKnown() {
+                        return true
+                }
+                if v.IsNull() {
+                        return false // treated as if the list were empty, so we would see zero iterations below
+                }
+
+                // For all other nesting modes, our value should be something iterable.
+                for it := v.ElementIterator(); it.Next(); {
+                        _, ev := it.Element()
+                        if couldBeUnknownBlockPlaceholderElement(ev, &blockS.Block) {
+                                return true
+                        }
+                }
+
+                // Our default changes depending on whether we're testing the candidate
+                // block itself or something nested inside of it: zero blocks of a type
+                // can never contain a dynamic block placeholder, but a dynamic block
+                // placeholder might contain zero blocks of one of its own nested block
+                // types, if none were set in the config at all.
+                return nested
+        }
+}
+
+func couldBeUnknownBlockPlaceholderElement(v cty.Value, schema *configschema.Block) bool {
+        if v.IsNull() {
+                return false // null value can never be a placeholder element
+        }
+        if !v.IsKnown() {
+                return true // this should never happen for well-behaved providers, but can happen with the legacy SDK opt-outs
+        }
+        for name := range schema.Attributes {
+                av := v.GetAttr(name)
+
+                // Unknown block placeholders contain only unknown or null attribute
+                // values, depending on whether or not a particular attribute was set
+                // explicitly inside the content block. Note that this is imprecise:
+                // non-placeholders can also match this, so this function can generate
+                // false positives.
+                if av.IsKnown() && !av.IsNull() {
+                        return false
+                }
+        }
+        for name, blockS := range schema.BlockTypes {
+                if !couldHaveUnknownBlockPlaceholder(v.GetAttr(name), blockS, true) {
+                        return false
+                }
+        }
+        return true
+}
+
+// assertSetValuesCompatible checks that each of the elements in a can
+// be correlated with at least one equivalent element in b and vice-versa,
+// using the given correlation function.
+//
+// This allows the number of elements in the sets to change as long as all
+// elements in both sets can be correlated, making this function safe to use
+// with sets that may contain unknown values as long as the unknown case is
+// addressed in some reasonable way in the callback function.
+//
+// The callback always recieves values from set a as its first argument and
+// values from set b in its second argument, so it is safe to use with
+// non-commutative functions.
+//
+// As with assertValueCompatible, we assume that the target audience of error
+// messages here is a provider developer (via a bug report from a user) and so
+// we intentionally violate our usual rule of keeping cty implementation
+// details out of error messages.
+func assertSetValuesCompatible(planned, actual cty.Value, path cty.Path, f func(aVal, bVal cty.Value) bool) []error {
+        a := planned
+        b := actual
+
+        // Our methodology here is a little tricky, to deal with the fact that
+        // it's impossible to directly correlate two non-equal set elements because
+        // they don't have identities separate from their values.
+        // The approach is to count the number of equivalent elements each element
+        // of a has in b and vice-versa, and then return true only if each element
+        // in both sets has at least one equivalent.
+        as := a.AsValueSlice()
+        bs := b.AsValueSlice()
+        aeqs := make([]bool, len(as))
+        beqs := make([]bool, len(bs))
+        for ai, av := range as {
+                for bi, bv := range bs {
+                        if f(av, bv) {
+                                aeqs[ai] = true
+                                beqs[bi] = true
+                        }
+                }
+        }
+
+        var errs []error
+        for i, eq := range aeqs {
+                if !eq {
+                        errs = append(errs, path.NewErrorf("planned set element %#v does not correlate with any element in actual", as[i]))
+                }
+        }
+        if len(errs) > 0 {
+                // Exit early since otherwise we're likely to generate duplicate
+                // error messages from the other perspective in the subsequent loop.
+                return errs
+        }
+        for i, eq := range beqs {
+                if !eq {
+                        errs = append(errs, path.NewErrorf("actual set element %#v does not correlate with any element in plan", bs[i]))
+                }
+        }
+        return errs
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/doc.go b/vendor/github.com/hashicorp/terraform/plans/objchange/doc.go
new file mode 100644
index 0000000..2c18a01
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/doc.go
@@ -0,0 +1,4 @@
+// Package objchange deals with the business logic of taking a prior state
+// value and a config value and producing a proposed new merged value, along
+// with other related rules in this domain.
+package objchange
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/lcs.go b/vendor/github.com/hashicorp/terraform/plans/objchange/lcs.go
new file mode 100644
index 0000000..cbfefdd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/lcs.go
@@ -0,0 +1,104 @@
+package objchange
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// LongestCommonSubsequence finds a sequence of values that are common to both
+// x and y, with the same relative ordering as in both collections. This result
+// is useful as a first step towards computing a diff showing added/removed
+// elements in a sequence.
+//
+// The approached used here is a "naive" one, assuming that both xs and ys will
+// generally be small in most reasonable Terraform configurations. For larger
+// lists the time/space usage may be sub-optimal.
+//
+// A pair of lists may have multiple longest common subsequences. In that
+// case, the one selected by this function is undefined.
+func LongestCommonSubsequence(xs, ys []cty.Value) []cty.Value {
+        if len(xs) == 0 || len(ys) == 0 {
+                return make([]cty.Value, 0)
+        }
+
+        c := make([]int, len(xs)*len(ys))
+        eqs := make([]bool, len(xs)*len(ys))
+        w := len(xs)
+
+        for y := 0; y < len(ys); y++ {
+                for x := 0; x < len(xs); x++ {
+                        eqV := xs[x].Equals(ys[y])
+                        eq := false
+                        if eqV.IsKnown() && eqV.True() {
+                                eq = true
+                                eqs[(w*y)+x] = true // equality tests can be expensive, so cache it
+                        }
+                        if eq {
+                                // Sequence gets one longer than for the cell at top left,
+                                // since we'd append a new item to the sequence here.
+                                if x == 0 || y == 0 {
+                                        c[(w*y)+x] = 1
+                                } else {
+                                        c[(w*y)+x] = c[(w*(y-1))+(x-1)] + 1
+                                }
+                        } else {
+                                // We follow the longest of the sequence above and the sequence
+                                // to the left of us in the matrix.
+                                l := 0
+                                u := 0
+                                if x > 0 {
+                                        l = c[(w*y)+(x-1)]
+                                }
+                                if y > 0 {
+                                        u = c[(w*(y-1))+x]
+                                }
+                                if l > u {
+                                        c[(w*y)+x] = l
+                                } else {
+                                        c[(w*y)+x] = u
+                                }
+                        }
+                }
+        }
+
+        // The bottom right cell tells us how long our longest sequence will be
+        seq := make([]cty.Value, c[len(c)-1])
+
+        // Now we will walk back from the bottom right cell, finding again all
+        // of the equal pairs to construct our sequence.
+        x := len(xs) - 1
+        y := len(ys) - 1
+        i := len(seq) - 1
+
+        for x > -1 && y > -1 {
+                if eqs[(w*y)+x] {
+                        // Add the value to our result list and then walk diagonally
+                        // up and to the left.
+                        seq[i] = xs[x]
+                        x--
+                        y--
+                        i--
+                } else {
+                        // Take the path with the greatest sequence length in the matrix.
+                        l := 0
+                        u := 0
+                        if x > 0 {
+                                l = c[(w*y)+(x-1)]
+                        }
+                        if y > 0 {
+                                u = c[(w*(y-1))+x]
+                        }
+                        if l > u {
+                                x--
+                        } else {
+                                y--
+                        }
+                }
+        }
+
+        if i > -1 {
+                // should never happen if the matrix was constructed properly
+                panic("not enough elements in sequence")
+        }
+
+        return seq
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/normalize_obj.go b/vendor/github.com/hashicorp/terraform/plans/objchange/normalize_obj.go
new file mode 100644
index 0000000..c23f44d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/normalize_obj.go
@@ -0,0 +1,132 @@
+package objchange
+
+import (
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// NormalizeObjectFromLegacySDK takes an object that may have been generated
+// by the legacy Terraform SDK (i.e. returned from a provider with the
+// LegacyTypeSystem opt-out set) and does its best to normalize it for the
+// assumptions we would normally enforce if the provider had not opted out.
+//
+// In particular, this function guarantees that a value representing a nested
+// block will never itself be unknown or null, instead representing that as
+// a non-null value that may contain null/unknown values.
+//
+// The input value must still conform to the implied type of the given schema,
+// or else this function may produce garbage results or panic. This is usually
+// okay because type consistency is enforced when deserializing the value
+// returned from the provider over the RPC wire protocol anyway.
+func NormalizeObjectFromLegacySDK(val cty.Value, schema *configschema.Block) cty.Value {
+        if val == cty.NilVal || val.IsNull() {
+                // This should never happen in reasonable use, but we'll allow it
+                // and normalize to a null of the expected type rather than panicking
+                // below.
+                return cty.NullVal(schema.ImpliedType())
+        }
+
+        vals := make(map[string]cty.Value)
+        for name := range schema.Attributes {
+                // No normalization for attributes, since them being type-conformant
+                // is all that we require.
+                vals[name] = val.GetAttr(name)
+        }
+        for name, blockS := range schema.BlockTypes {
+                lv := val.GetAttr(name)
+
+                // Legacy SDK never generates dynamically-typed attributes and so our
+                // normalization code doesn't deal with them, but we need to make sure
+                // we still pass them through properly so that we don't interfere with
+                // objects generated by other SDKs.
+                if ty := blockS.Block.ImpliedType(); ty.HasDynamicTypes() {
+                        vals[name] = lv
+                        continue
+                }
+
+                switch blockS.Nesting {
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        if lv.IsKnown() {
+                                if lv.IsNull() && blockS.Nesting == configschema.NestingGroup {
+                                        vals[name] = blockS.EmptyValue()
+                                } else {
+                                        vals[name] = NormalizeObjectFromLegacySDK(lv, &blockS.Block)
+                                }
+                        } else {
+                                vals[name] = unknownBlockStub(&blockS.Block)
+                        }
+                case configschema.NestingList:
+                        switch {
+                        case !lv.IsKnown():
+                                vals[name] = cty.ListVal([]cty.Value{unknownBlockStub(&blockS.Block)})
+                        case lv.IsNull() || lv.LengthInt() == 0:
+                                vals[name] = cty.ListValEmpty(blockS.Block.ImpliedType())
+                        default:
+                                subVals := make([]cty.Value, 0, lv.LengthInt())
+                                for it := lv.ElementIterator(); it.Next(); {
+                                        _, subVal := it.Element()
+                                        subVals = append(subVals, NormalizeObjectFromLegacySDK(subVal, &blockS.Block))
+                                }
+                                vals[name] = cty.ListVal(subVals)
+                        }
+                case configschema.NestingSet:
+                        switch {
+                        case !lv.IsKnown():
+                                vals[name] = cty.SetVal([]cty.Value{unknownBlockStub(&blockS.Block)})
+                        case lv.IsNull() || lv.LengthInt() == 0:
+                                vals[name] = cty.SetValEmpty(blockS.Block.ImpliedType())
+                        default:
+                                subVals := make([]cty.Value, 0, lv.LengthInt())
+                                for it := lv.ElementIterator(); it.Next(); {
+                                        _, subVal := it.Element()
+                                        subVals = append(subVals, NormalizeObjectFromLegacySDK(subVal, &blockS.Block))
+                                }
+                                vals[name] = cty.SetVal(subVals)
+                        }
+                default:
+                        // The legacy SDK doesn't support NestingMap, so we just assume
+                        // maps are always okay. (If not, we would've detected and returned
+                        // an error to the user before we got here.)
+                        vals[name] = lv
+                }
+        }
+        return cty.ObjectVal(vals)
+}
+
+// unknownBlockStub constructs an object value that approximates an unknown
+// block by producing a known block object with all of its leaf attribute
+// values set to unknown.
+//
+// Blocks themselves cannot be unknown, so if the legacy SDK tries to return
+// such a thing, we'll use this result instead. This convention mimics how
+// the dynamic block feature deals with being asked to iterate over an unknown
+// value, because our value-checking functions already accept this convention
+// as a special case.
+func unknownBlockStub(schema *configschema.Block) cty.Value {
+        vals := make(map[string]cty.Value)
+        for name, attrS := range schema.Attributes {
+                vals[name] = cty.UnknownVal(attrS.Type)
+        }
+        for name, blockS := range schema.BlockTypes {
+                switch blockS.Nesting {
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        vals[name] = unknownBlockStub(&blockS.Block)
+                case configschema.NestingList:
+                        // In principle we may be expected to produce a tuple value here,
+                        // if there are any dynamically-typed attributes in our nested block,
+                        // but the legacy SDK doesn't support that, so we just assume it'll
+                        // never be necessary to normalize those. (Incorrect usage in any
+                        // other SDK would be caught and returned as an error before we
+                        // get here.)
+                        vals[name] = cty.ListVal([]cty.Value{unknownBlockStub(&blockS.Block)})
+                case configschema.NestingSet:
+                        vals[name] = cty.SetVal([]cty.Value{unknownBlockStub(&blockS.Block)})
+                case configschema.NestingMap:
+                        // A nesting map can never be unknown since we then wouldn't know
+                        // what the keys are. (Legacy SDK doesn't support NestingMap anyway,
+                        // so this should never arise.)
+                        vals[name] = cty.MapValEmpty(blockS.Block.ImpliedType())
+                }
+        }
+        return cty.ObjectVal(vals)
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/objchange.go b/vendor/github.com/hashicorp/terraform/plans/objchange/objchange.go
new file mode 100644
index 0000000..5a8af14
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/objchange.go
@@ -0,0 +1,390 @@
+package objchange
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+)
+
+// ProposedNewObject constructs a proposed new object value by combining the
+// computed attribute values from "prior" with the configured attribute values
+// from "config".
+//
+// Both value must conform to the given schema's implied type, or this function
+// will panic.
+//
+// The prior value must be wholly known, but the config value may be unknown
+// or have nested unknown values.
+//
+// The merging of the two objects includes the attributes of any nested blocks,
+// which will be correlated in a manner appropriate for their nesting mode.
+// Note in particular that the correlation for blocks backed by sets is a
+// heuristic based on matching non-computed attribute values and so it may
+// produce strange results with more "extreme" cases, such as a nested set
+// block where _all_ attributes are computed.
+func ProposedNewObject(schema *configschema.Block, prior, config cty.Value) cty.Value {
+        // If the config and prior are both null, return early here before
+        // populating the prior block. The prevents non-null blocks from appearing
+        // the proposed state value.
+        if config.IsNull() && prior.IsNull() {
+                return prior
+        }
+
+        if prior.IsNull() {
+                // In this case, we will construct a synthetic prior value that is
+                // similar to the result of decoding an empty configuration block,
+                // which simplifies our handling of the top-level attributes/blocks
+                // below by giving us one non-null level of object to pull values from.
+                prior = AllAttributesNull(schema)
+        }
+        return proposedNewObject(schema, prior, config)
+}
+
+// PlannedDataResourceObject is similar to ProposedNewObject but tailored for
+// planning data resources in particular. Specifically, it replaces the values
+// of any Computed attributes not set in the configuration with an unknown
+// value, which serves as a placeholder for a value to be filled in by the
+// provider when the data resource is finally read.
+//
+// Data resources are different because the planning of them is handled
+// entirely within Terraform Core and not subject to customization by the
+// provider. This function is, in effect, producing an equivalent result to
+// passing the ProposedNewObject result into a provider's PlanResourceChange
+// function, assuming a fixed implementation of PlanResourceChange that just
+// fills in unknown values as needed.
+func PlannedDataResourceObject(schema *configschema.Block, config cty.Value) cty.Value {
+        // Our trick here is to run the ProposedNewObject logic with an
+        // entirely-unknown prior value. Because of cty's unknown short-circuit
+        // behavior, any operation on prior returns another unknown, and so
+        // unknown values propagate into all of the parts of the resulting value
+        // that would normally be filled in by preserving the prior state.
+        prior := cty.UnknownVal(schema.ImpliedType())
+        return proposedNewObject(schema, prior, config)
+}
+
+func proposedNewObject(schema *configschema.Block, prior, config cty.Value) cty.Value {
+        if config.IsNull() || !config.IsKnown() {
+                // This is a weird situation, but we'll allow it anyway to free
+                // callers from needing to specifically check for these cases.
+                return prior
+        }
+        if (!prior.Type().IsObjectType()) || (!config.Type().IsObjectType()) {
+                panic("ProposedNewObject only supports object-typed values")
+        }
+
+        // From this point onwards, we can assume that both values are non-null
+        // object types, and that the config value itself is known (though it
+        // may contain nested values that are unknown.)
+
+        newAttrs := map[string]cty.Value{}
+        for name, attr := range schema.Attributes {
+                priorV := prior.GetAttr(name)
+                configV := config.GetAttr(name)
+                var newV cty.Value
+                switch {
+                case attr.Computed && attr.Optional:
+                        // This is the trickiest scenario: we want to keep the prior value
+                        // if the config isn't overriding it. Note that due to some
+                        // ambiguity here, setting an optional+computed attribute from
+                        // config and then later switching the config to null in a
+                        // subsequent change causes the initial config value to be "sticky"
+                        // unless the provider specifically overrides it during its own
+                        // plan customization step.
+                        if configV.IsNull() {
+                                newV = priorV
+                        } else {
+                                newV = configV
+                        }
+                case attr.Computed:
+                        // configV will always be null in this case, by definition.
+                        // priorV may also be null, but that's okay.
+                        newV = priorV
+                default:
+                        // For non-computed attributes, we always take the config value,
+                        // even if it is null. If it's _required_ then null values
+                        // should've been caught during an earlier validation step, and
+                        // so we don't really care about that here.
+                        newV = configV
+                }
+                newAttrs[name] = newV
+        }
+
+        // Merging nested blocks is a little more complex, since we need to
+        // correlate blocks between both objects and then recursively propose
+        // a new object for each. The correlation logic depends on the nesting
+        // mode for each block type.
+        for name, blockType := range schema.BlockTypes {
+                priorV := prior.GetAttr(name)
+                configV := config.GetAttr(name)
+                var newV cty.Value
+                switch blockType.Nesting {
+
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        newV = ProposedNewObject(&blockType.Block, priorV, configV)
+
+                case configschema.NestingList:
+                        // Nested blocks are correlated by index.
+                        configVLen := 0
+                        if configV.IsKnown() && !configV.IsNull() {
+                                configVLen = configV.LengthInt()
+                        }
+                        if configVLen > 0 {
+                                newVals := make([]cty.Value, 0, configVLen)
+                                for it := configV.ElementIterator(); it.Next(); {
+                                        idx, configEV := it.Element()
+                                        if priorV.IsKnown() && (priorV.IsNull() || !priorV.HasIndex(idx).True()) {
+                                                // If there is no corresponding prior element then
+                                                // we just take the config value as-is.
+                                                newVals = append(newVals, configEV)
+                                                continue
+                                        }
+                                        priorEV := priorV.Index(idx)
+
+                                        newEV := ProposedNewObject(&blockType.Block, priorEV, configEV)
+                                        newVals = append(newVals, newEV)
+                                }
+                                // Despite the name, a NestingList might also be a tuple, if
+                                // its nested schema contains dynamically-typed attributes.
+                                if configV.Type().IsTupleType() {
+                                        newV = cty.TupleVal(newVals)
+                                } else {
+                                        newV = cty.ListVal(newVals)
+                                }
+                        } else {
+                                // Despite the name, a NestingList might also be a tuple, if
+                                // its nested schema contains dynamically-typed attributes.
+                                if configV.Type().IsTupleType() {
+                                        newV = cty.EmptyTupleVal
+                                } else {
+                                        newV = cty.ListValEmpty(blockType.ImpliedType())
+                                }
+                        }
+
+                case configschema.NestingMap:
+                        // Despite the name, a NestingMap may produce either a map or
+                        // object value, depending on whether the nested schema contains
+                        // dynamically-typed attributes.
+                        if configV.Type().IsObjectType() {
+                                // Nested blocks are correlated by key.
+                                configVLen := 0
+                                if configV.IsKnown() && !configV.IsNull() {
+                                        configVLen = configV.LengthInt()
+                                }
+                                if configVLen > 0 {
+                                        newVals := make(map[string]cty.Value, configVLen)
+                                        atys := configV.Type().AttributeTypes()
+                                        for name := range atys {
+                                                configEV := configV.GetAttr(name)
+                                                if !priorV.IsKnown() || priorV.IsNull() || !priorV.Type().HasAttribute(name) {
+                                                        // If there is no corresponding prior element then
+                                                        // we just take the config value as-is.
+                                                        newVals[name] = configEV
+                                                        continue
+                                                }
+                                                priorEV := priorV.GetAttr(name)
+
+                                                newEV := ProposedNewObject(&blockType.Block, priorEV, configEV)
+                                                newVals[name] = newEV
+                                        }
+                                        // Although we call the nesting mode "map", we actually use
+                                        // object values so that elements might have different types
+                                        // in case of dynamically-typed attributes.
+                                        newV = cty.ObjectVal(newVals)
+                                } else {
+                                        newV = cty.EmptyObjectVal
+                                }
+                        } else {
+                                configVLen := 0
+                                if configV.IsKnown() && !configV.IsNull() {
+                                        configVLen = configV.LengthInt()
+                                }
+                                if configVLen > 0 {
+                                        newVals := make(map[string]cty.Value, configVLen)
+                                        for it := configV.ElementIterator(); it.Next(); {
+                                                idx, configEV := it.Element()
+                                                k := idx.AsString()
+                                                if priorV.IsKnown() && (priorV.IsNull() || !priorV.HasIndex(idx).True()) {
+                                                        // If there is no corresponding prior element then
+                                                        // we just take the config value as-is.
+                                                        newVals[k] = configEV
+                                                        continue
+                                                }
+                                                priorEV := priorV.Index(idx)
+
+                                                newEV := ProposedNewObject(&blockType.Block, priorEV, configEV)
+                                                newVals[k] = newEV
+                                        }
+                                        newV = cty.MapVal(newVals)
+                                } else {
+                                        newV = cty.MapValEmpty(blockType.ImpliedType())
+                                }
+                        }
+
+                case configschema.NestingSet:
+                        if !configV.Type().IsSetType() {
+                                panic("configschema.NestingSet value is not a set as expected")
+                        }
+
+                        // Nested blocks are correlated by comparing the element values
+                        // after eliminating all of the computed attributes. In practice,
+                        // this means that any config change produces an entirely new
+                        // nested object, and we only propagate prior computed values
+                        // if the non-computed attribute values are identical.
+                        var cmpVals [][2]cty.Value
+                        if priorV.IsKnown() && !priorV.IsNull() {
+                                cmpVals = setElementCompareValues(&blockType.Block, priorV, false)
+                        }
+                        configVLen := 0
+                        if configV.IsKnown() && !configV.IsNull() {
+                                configVLen = configV.LengthInt()
+                        }
+                        if configVLen > 0 {
+                                used := make([]bool, len(cmpVals)) // track used elements in case multiple have the same compare value
+                                newVals := make([]cty.Value, 0, configVLen)
+                                for it := configV.ElementIterator(); it.Next(); {
+                                        _, configEV := it.Element()
+                                        var priorEV cty.Value
+                                        for i, cmp := range cmpVals {
+                                                if used[i] {
+                                                        continue
+                                                }
+                                                if cmp[1].RawEquals(configEV) {
+                                                        priorEV = cmp[0]
+                                                        used[i] = true // we can't use this value on a future iteration
+                                                        break
+                                                }
+                                        }
+                                        if priorEV == cty.NilVal {
+                                                priorEV = cty.NullVal(blockType.ImpliedType())
+                                        }
+
+                                        newEV := ProposedNewObject(&blockType.Block, priorEV, configEV)
+                                        newVals = append(newVals, newEV)
+                                }
+                                newV = cty.SetVal(newVals)
+                        } else {
+                                newV = cty.SetValEmpty(blockType.Block.ImpliedType())
+                        }
+
+                default:
+                        // Should never happen, since the above cases are comprehensive.
+                        panic(fmt.Sprintf("unsupported block nesting mode %s", blockType.Nesting))
+                }
+
+                newAttrs[name] = newV
+        }
+
+        return cty.ObjectVal(newAttrs)
+}
+
+// setElementCompareValues takes a known, non-null value of a cty.Set type and
+// returns a table -- constructed of two-element arrays -- that maps original
+// set element values to corresponding values that have all of the computed
+// values removed, making them suitable for comparison with values obtained
+// from configuration. The element type of the set must conform to the implied
+// type of the given schema, or this function will panic.
+//
+// In the resulting slice, the zeroth element of each array is the original
+// value and the one-indexed element is the corresponding "compare value".
+//
+// This is intended to help correlate prior elements with configured elements
+// in ProposedNewObject. The result is a heuristic rather than an exact science,
+// since e.g. two separate elements may reduce to the same value through this
+// process. The caller must therefore be ready to deal with duplicates.
+func setElementCompareValues(schema *configschema.Block, set cty.Value, isConfig bool) [][2]cty.Value {
+        ret := make([][2]cty.Value, 0, set.LengthInt())
+        for it := set.ElementIterator(); it.Next(); {
+                _, ev := it.Element()
+                ret = append(ret, [2]cty.Value{ev, setElementCompareValue(schema, ev, isConfig)})
+        }
+        return ret
+}
+
+// setElementCompareValue creates a new value that has all of the same
+// non-computed attribute values as the one given but has all computed
+// attribute values forced to null.
+//
+// If isConfig is true then non-null Optional+Computed attribute values will
+// be preserved. Otherwise, they will also be set to null.
+//
+// The input value must conform to the schema's implied type, and the return
+// value is guaranteed to conform to it.
+func setElementCompareValue(schema *configschema.Block, v cty.Value, isConfig bool) cty.Value {
+        if v.IsNull() || !v.IsKnown() {
+                return v
+        }
+
+        attrs := map[string]cty.Value{}
+        for name, attr := range schema.Attributes {
+                switch {
+                case attr.Computed && attr.Optional:
+                        if isConfig {
+                                attrs[name] = v.GetAttr(name)
+                        } else {
+                                attrs[name] = cty.NullVal(attr.Type)
+                        }
+                case attr.Computed:
+                        attrs[name] = cty.NullVal(attr.Type)
+                default:
+                        attrs[name] = v.GetAttr(name)
+                }
+        }
+
+        for name, blockType := range schema.BlockTypes {
+                switch blockType.Nesting {
+
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        attrs[name] = setElementCompareValue(&blockType.Block, v.GetAttr(name), isConfig)
+
+                case configschema.NestingList, configschema.NestingSet:
+                        cv := v.GetAttr(name)
+                        if cv.IsNull() || !cv.IsKnown() {
+                                attrs[name] = cv
+                                continue
+                        }
+                        if l := cv.LengthInt(); l > 0 {
+                                elems := make([]cty.Value, 0, l)
+                                for it := cv.ElementIterator(); it.Next(); {
+                                        _, ev := it.Element()
+                                        elems = append(elems, setElementCompareValue(&blockType.Block, ev, isConfig))
+                                }
+                                if blockType.Nesting == configschema.NestingSet {
+                                        // SetValEmpty would panic if given elements that are not
+                                        // all of the same type, but that's guaranteed not to
+                                        // happen here because our input value was _already_ a
+                                        // set and we've not changed the types of any elements here.
+                                        attrs[name] = cty.SetVal(elems)
+                                } else {
+                                        attrs[name] = cty.TupleVal(elems)
+                                }
+                        } else {
+                                if blockType.Nesting == configschema.NestingSet {
+                                        attrs[name] = cty.SetValEmpty(blockType.Block.ImpliedType())
+                                } else {
+                                        attrs[name] = cty.EmptyTupleVal
+                                }
+                        }
+
+                case configschema.NestingMap:
+                        cv := v.GetAttr(name)
+                        if cv.IsNull() || !cv.IsKnown() {
+                                attrs[name] = cv
+                                continue
+                        }
+                        elems := make(map[string]cty.Value)
+                        for it := cv.ElementIterator(); it.Next(); {
+                                kv, ev := it.Element()
+                                elems[kv.AsString()] = setElementCompareValue(&blockType.Block, ev, isConfig)
+                        }
+                        attrs[name] = cty.ObjectVal(elems)
+
+                default:
+                        // Should never happen, since the above cases are comprehensive.
+                        panic(fmt.Sprintf("unsupported block nesting mode %s", blockType.Nesting))
+                }
+        }
+
+        return cty.ObjectVal(attrs)
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/plan_valid.go b/vendor/github.com/hashicorp/terraform/plans/objchange/plan_valid.go
new file mode 100644
index 0000000..69acb89
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/plan_valid.go
@@ -0,0 +1,267 @@
+package objchange
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+)
+
+// AssertPlanValid checks checks whether a planned new state returned by a
+// provider's PlanResourceChange method is suitable to achieve a change
+// from priorState to config. It returns a slice with nonzero length if
+// any problems are detected. Because problems here indicate bugs in the
+// provider that generated the plannedState, they are written with provider
+// developers as an audience, rather than end-users.
+//
+// All of the given values must have the same type and must conform to the
+// implied type of the given schema, or this function may panic or produce
+// garbage results.
+//
+// During planning, a provider may only make changes to attributes that are
+// null (unset) in the configuration and are marked as "computed" in the
+// resource type schema, in order to insert any default values the provider
+// may know about. If the default value cannot be determined until apply time,
+// the provider can return an unknown value. Providers are forbidden from
+// planning a change that disagrees with any non-null argument in the
+// configuration.
+//
+// As a special exception, providers _are_ allowed to provide attribute values
+// conflicting with configuration if and only if the planned value exactly
+// matches the corresponding attribute value in the prior state. The provider
+// can use this to signal that the new value is functionally equivalent to
+// the old and thus no change is required.
+func AssertPlanValid(schema *configschema.Block, priorState, config, plannedState cty.Value) []error {
+        return assertPlanValid(schema, priorState, config, plannedState, nil)
+}
+
+func assertPlanValid(schema *configschema.Block, priorState, config, plannedState cty.Value, path cty.Path) []error {
+        var errs []error
+        if plannedState.IsNull() && !config.IsNull() {
+                errs = append(errs, path.NewErrorf("planned for absense but config wants existence"))
+                return errs
+        }
+        if config.IsNull() && !plannedState.IsNull() {
+                errs = append(errs, path.NewErrorf("planned for existence but config wants absense"))
+                return errs
+        }
+        if plannedState.IsNull() {
+                // No further checks possible if the planned value is null
+                return errs
+        }
+
+        impTy := schema.ImpliedType()
+
+        for name, attrS := range schema.Attributes {
+                plannedV := plannedState.GetAttr(name)
+                configV := config.GetAttr(name)
+                priorV := cty.NullVal(attrS.Type)
+                if !priorState.IsNull() {
+                        priorV = priorState.GetAttr(name)
+                }
+
+                path := append(path, cty.GetAttrStep{Name: name})
+                moreErrs := assertPlannedValueValid(attrS, priorV, configV, plannedV, path)
+                errs = append(errs, moreErrs...)
+        }
+        for name, blockS := range schema.BlockTypes {
+                path := append(path, cty.GetAttrStep{Name: name})
+                plannedV := plannedState.GetAttr(name)
+                configV := config.GetAttr(name)
+                priorV := cty.NullVal(impTy.AttributeType(name))
+                if !priorState.IsNull() {
+                        priorV = priorState.GetAttr(name)
+                }
+                if plannedV.RawEquals(configV) {
+                        // Easy path: nothing has changed at all
+                        continue
+                }
+                if !plannedV.IsKnown() {
+                        errs = append(errs, path.NewErrorf("attribute representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+                        continue
+                }
+
+                switch blockS.Nesting {
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        moreErrs := assertPlanValid(&blockS.Block, priorV, configV, plannedV, path)
+                        errs = append(errs, moreErrs...)
+                case configschema.NestingList:
+                        // A NestingList might either be a list or a tuple, depending on
+                        // whether there are dynamically-typed attributes inside. However,
+                        // both support a similar-enough API that we can treat them the
+                        // same for our purposes here.
+                        if plannedV.IsNull() {
+                                errs = append(errs, path.NewErrorf("attribute representing a list of nested blocks must be empty to indicate no blocks, not null"))
+                                continue
+                        }
+
+                        plannedL := plannedV.LengthInt()
+                        configL := configV.LengthInt()
+                        if plannedL != configL {
+                                errs = append(errs, path.NewErrorf("block count in plan (%d) disagrees with count in config (%d)", plannedL, configL))
+                                continue
+                        }
+                        for it := plannedV.ElementIterator(); it.Next(); {
+                                idx, plannedEV := it.Element()
+                                path := append(path, cty.IndexStep{Key: idx})
+                                if !plannedEV.IsKnown() {
+                                        errs = append(errs, path.NewErrorf("element representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+                                        continue
+                                }
+                                if !configV.HasIndex(idx).True() {
+                                        continue // should never happen since we checked the lengths above
+                                }
+                                configEV := configV.Index(idx)
+                                priorEV := cty.NullVal(blockS.ImpliedType())
+                                if !priorV.IsNull() && priorV.HasIndex(idx).True() {
+                                        priorEV = priorV.Index(idx)
+                                }
+
+                                moreErrs := assertPlanValid(&blockS.Block, priorEV, configEV, plannedEV, path)
+                                errs = append(errs, moreErrs...)
+                        }
+                case configschema.NestingMap:
+                        if plannedV.IsNull() {
+                                errs = append(errs, path.NewErrorf("attribute representing a map of nested blocks must be empty to indicate no blocks, not null"))
+                                continue
+                        }
+
+                        // A NestingMap might either be a map or an object, depending on
+                        // whether there are dynamically-typed attributes inside, but
+                        // that's decided statically and so all values will have the same
+                        // kind.
+                        if plannedV.Type().IsObjectType() {
+                                plannedAtys := plannedV.Type().AttributeTypes()
+                                configAtys := configV.Type().AttributeTypes()
+                                for k := range plannedAtys {
+                                        if _, ok := configAtys[k]; !ok {
+                                                errs = append(errs, path.NewErrorf("block key %q from plan is not present in config", k))
+                                                continue
+                                        }
+                                        path := append(path, cty.GetAttrStep{Name: k})
+
+                                        plannedEV := plannedV.GetAttr(k)
+                                        if !plannedEV.IsKnown() {
+                                                errs = append(errs, path.NewErrorf("element representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+                                                continue
+                                        }
+                                        configEV := configV.GetAttr(k)
+                                        priorEV := cty.NullVal(blockS.ImpliedType())
+                                        if !priorV.IsNull() && priorV.Type().HasAttribute(k) {
+                                                priorEV = priorV.GetAttr(k)
+                                        }
+                                        moreErrs := assertPlanValid(&blockS.Block, priorEV, configEV, plannedEV, path)
+                                        errs = append(errs, moreErrs...)
+                                }
+                                for k := range configAtys {
+                                        if _, ok := plannedAtys[k]; !ok {
+                                                errs = append(errs, path.NewErrorf("block key %q from config is not present in plan", k))
+                                                continue
+                                        }
+                                }
+                        } else {
+                                plannedL := plannedV.LengthInt()
+                                configL := configV.LengthInt()
+                                if plannedL != configL {
+                                        errs = append(errs, path.NewErrorf("block count in plan (%d) disagrees with count in config (%d)", plannedL, configL))
+                                        continue
+                                }
+                                for it := plannedV.ElementIterator(); it.Next(); {
+                                        idx, plannedEV := it.Element()
+                                        path := append(path, cty.IndexStep{Key: idx})
+                                        if !plannedEV.IsKnown() {
+                                                errs = append(errs, path.NewErrorf("element representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+                                                continue
+                                        }
+                                        k := idx.AsString()
+                                        if !configV.HasIndex(idx).True() {
+                                                errs = append(errs, path.NewErrorf("block key %q from plan is not present in config", k))
+                                                continue
+                                        }
+                                        configEV := configV.Index(idx)
+                                        priorEV := cty.NullVal(blockS.ImpliedType())
+                                        if !priorV.IsNull() && priorV.HasIndex(idx).True() {
+                                                priorEV = priorV.Index(idx)
+                                        }
+                                        moreErrs := assertPlanValid(&blockS.Block, priorEV, configEV, plannedEV, path)
+                                        errs = append(errs, moreErrs...)
+                                }
+                                for it := configV.ElementIterator(); it.Next(); {
+                                        idx, _ := it.Element()
+                                        if !plannedV.HasIndex(idx).True() {
+                                                errs = append(errs, path.NewErrorf("block key %q from config is not present in plan", idx.AsString()))
+                                                continue
+                                        }
+                                }
+                        }
+                case configschema.NestingSet:
+                        if plannedV.IsNull() {
+                                errs = append(errs, path.NewErrorf("attribute representing a set of nested blocks must be empty to indicate no blocks, not null"))
+                                continue
+                        }
+
+                        // Because set elements have no identifier with which to correlate
+                        // them, we can't robustly validate the plan for a nested block
+                        // backed by a set, and so unfortunately we need to just trust the
+                        // provider to do the right thing. :(
+                        //
+                        // (In principle we could correlate elements by matching the
+                        // subset of attributes explicitly set in config, except for the
+                        // special diff suppression rule which allows for there to be a
+                        // planned value that is constructed by mixing part of a prior
+                        // value with part of a config value, creating an entirely new
+                        // element that is not present in either prior nor config.)
+                        for it := plannedV.ElementIterator(); it.Next(); {
+                                idx, plannedEV := it.Element()
+                                path := append(path, cty.IndexStep{Key: idx})
+                                if !plannedEV.IsKnown() {
+                                        errs = append(errs, path.NewErrorf("element representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+                                        continue
+                                }
+                        }
+
+                default:
+                        panic(fmt.Sprintf("unsupported nesting mode %s", blockS.Nesting))
+                }
+        }
+
+        return errs
+}
+
+func assertPlannedValueValid(attrS *configschema.Attribute, priorV, configV, plannedV cty.Value, path cty.Path) []error {
+        var errs []error
+        if plannedV.RawEquals(configV) {
+                // This is the easy path: provider didn't change anything at all.
+                return errs
+        }
+        if plannedV.RawEquals(priorV) && !priorV.IsNull() {
+                // Also pretty easy: there is a prior value and the provider has
+                // returned it unchanged. This indicates that configV and plannedV
+                // are functionally equivalent and so the provider wishes to disregard
+                // the configuration value in favor of the prior.
+                return errs
+        }
+        if attrS.Computed && configV.IsNull() {
+                // The provider is allowed to change the value of any computed
+                // attribute that isn't explicitly set in the config.
+                return errs
+        }
+
+        // If none of the above conditions match, the provider has made an invalid
+        // change to this attribute.
+        if priorV.IsNull() {
+                if attrS.Sensitive {
+                        errs = append(errs, path.NewErrorf("sensitive planned value does not match config value"))
+                } else {
+                        errs = append(errs, path.NewErrorf("planned value %#v does not match config value %#v", plannedV, configV))
+                }
+                return errs
+        }
+        if attrS.Sensitive {
+                errs = append(errs, path.NewErrorf("sensitive planned value does not match config value nor prior value"))
+        } else {
+                errs = append(errs, path.NewErrorf("planned value %#v does not match config value %#v nor prior value %#v", plannedV, configV, priorV))
+        }
+        return errs
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/plan.go b/vendor/github.com/hashicorp/terraform/plans/plan.go
new file mode 100644
index 0000000..5a3e454
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/plan.go
@@ -0,0 +1,92 @@
+package plans
+
+import (
+        "sort"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Plan is the top-level type representing a planned set of changes.
+//
+// A plan is a summary of the set of changes required to move from a current
+// state to a goal state derived from configuration. The described changes
+// are not applied directly, but contain an approximation of the final
+// result that will be completed during apply by resolving any values that
+// cannot be predicted.
+//
+// A plan must always be accompanied by the state and configuration it was
+// built from, since the plan does not itself include all of the information
+// required to make the changes indicated.
+type Plan struct {
+        VariableValues  map[string]DynamicValue
+        Changes         *Changes
+        TargetAddrs     []addrs.Targetable
+        ProviderSHA256s map[string][]byte
+        Backend         Backend
+}
+
+// Backend represents the backend-related configuration and other data as it
+// existed when a plan was created.
+type Backend struct {
+        // Type is the type of backend that the plan will apply against.
+        Type string
+
+        // Config is the configuration of the backend, whose schema is decided by
+        // the backend Type.
+        Config DynamicValue
+
+        // Workspace is the name of the workspace that was active when the plan
+        // was created. It is illegal to apply a plan created for one workspace
+        // to the state of another workspace.
+        // (This constraint is already enforced by the statefile lineage mechanism,
+        // but storing this explicitly allows us to return a better error message
+        // in the situation where the user has the wrong workspace selected.)
+        Workspace string
+}
+
+func NewBackend(typeName string, config cty.Value, configSchema *configschema.Block, workspaceName string) (*Backend, error) {
+        dv, err := NewDynamicValue(config, configSchema.ImpliedType())
+        if err != nil {
+                return nil, err
+        }
+
+        return &Backend{
+                Type:      typeName,
+                Config:    dv,
+                Workspace: workspaceName,
+        }, nil
+}
+
+// ProviderAddrs returns a list of all of the provider configuration addresses
+// referenced throughout the receiving plan.
+//
+// The result is de-duplicated so that each distinct address appears only once.
+func (p *Plan) ProviderAddrs() []addrs.AbsProviderConfig {
+        if p == nil || p.Changes == nil {
+                return nil
+        }
+
+        m := map[string]addrs.AbsProviderConfig{}
+        for _, rc := range p.Changes.Resources {
+                m[rc.ProviderAddr.String()] = rc.ProviderAddr
+        }
+        if len(m) == 0 {
+                return nil
+        }
+
+        // This is mainly just so we'll get stable results for testing purposes.
+        keys := make([]string, 0, len(m))
+        for k := range m {
+                keys = append(keys, k)
+        }
+        sort.Strings(keys)
+
+        ret := make([]addrs.AbsProviderConfig, len(keys))
+        for i, key := range keys {
+                ret[i] = m[key]
+        }
+
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/client.go b/vendor/github.com/hashicorp/terraform/plugin/client.go
index 7e2f4fe..0eab538 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/client.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/client.go
@@ -19,11 +19,13 @@ func ClientConfig(m discovery.PluginMeta) *plugin.ClientConfig {
         })
 
         return &plugin.ClientConfig{
-                Cmd:             exec.Command(m.Path),
-                HandshakeConfig: Handshake,
-                Managed:         true,
-                Plugins:         PluginMap,
-                Logger:          logger,
+                Cmd:              exec.Command(m.Path),
+                HandshakeConfig:  Handshake,
+                VersionedPlugins: VersionedPlugins,
+                Managed:          true,
+                Logger:           logger,
+                AllowedProtocols: []plugin.Protocol{plugin.ProtocolGRPC},
+                AutoMTLS:         true,
         }
 }
 
diff --git a/vendor/github.com/hashicorp/terraform/plugin/convert/diagnostics.go b/vendor/github.com/hashicorp/terraform/plugin/convert/diagnostics.go
new file mode 100644
index 0000000..51cb2fe
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/convert/diagnostics.go
@@ -0,0 +1,132 @@
+package convert
+
+import (
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// WarnsAndErrorsToProto converts the warnings and errors return by the legacy
+// provider to protobuf diagnostics.
+func WarnsAndErrsToProto(warns []string, errs []error) (diags []*proto.Diagnostic) {
+        for _, w := range warns {
+                diags = AppendProtoDiag(diags, w)
+        }
+
+        for _, e := range errs {
+                diags = AppendProtoDiag(diags, e)
+        }
+
+        return diags
+}
+
+// AppendProtoDiag appends a new diagnostic from a warning string or an error.
+// This panics if d is not a string or error.
+func AppendProtoDiag(diags []*proto.Diagnostic, d interface{}) []*proto.Diagnostic {
+        switch d := d.(type) {
+        case cty.PathError:
+                ap := PathToAttributePath(d.Path)
+                diags = append(diags, &proto.Diagnostic{
+                        Severity:  proto.Diagnostic_ERROR,
+                        Summary:   d.Error(),
+                        Attribute: ap,
+                })
+        case error:
+                diags = append(diags, &proto.Diagnostic{
+                        Severity: proto.Diagnostic_ERROR,
+                        Summary:  d.Error(),
+                })
+        case string:
+                diags = append(diags, &proto.Diagnostic{
+                        Severity: proto.Diagnostic_WARNING,
+                        Summary:  d,
+                })
+        case *proto.Diagnostic:
+                diags = append(diags, d)
+        case []*proto.Diagnostic:
+                diags = append(diags, d...)
+        }
+        return diags
+}
+
+// ProtoToDiagnostics converts a list of proto.Diagnostics to a tf.Diagnostics.
+func ProtoToDiagnostics(ds []*proto.Diagnostic) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+        for _, d := range ds {
+                var severity tfdiags.Severity
+
+                switch d.Severity {
+                case proto.Diagnostic_ERROR:
+                        severity = tfdiags.Error
+                case proto.Diagnostic_WARNING:
+                        severity = tfdiags.Warning
+                }
+
+                var newDiag tfdiags.Diagnostic
+
+                // if there's an attribute path, we need to create a AttributeValue diagnostic
+                if d.Attribute != nil {
+                        path := AttributePathToPath(d.Attribute)
+                        newDiag = tfdiags.AttributeValue(severity, d.Summary, d.Detail, path)
+                } else {
+                        newDiag = tfdiags.WholeContainingBody(severity, d.Summary, d.Detail)
+                }
+
+                diags = diags.Append(newDiag)
+        }
+
+        return diags
+}
+
+// AttributePathToPath takes the proto encoded path and converts it to a cty.Path
+func AttributePathToPath(ap *proto.AttributePath) cty.Path {
+        var p cty.Path
+        for _, step := range ap.Steps {
+                switch selector := step.Selector.(type) {
+                case *proto.AttributePath_Step_AttributeName:
+                        p = p.GetAttr(selector.AttributeName)
+                case *proto.AttributePath_Step_ElementKeyString:
+                        p = p.Index(cty.StringVal(selector.ElementKeyString))
+                case *proto.AttributePath_Step_ElementKeyInt:
+                        p = p.Index(cty.NumberIntVal(selector.ElementKeyInt))
+                }
+        }
+        return p
+}
+
+// AttributePathToPath takes a cty.Path and converts it to a proto-encoded path.
+func PathToAttributePath(p cty.Path) *proto.AttributePath {
+        ap := &proto.AttributePath{}
+        for _, step := range p {
+                switch selector := step.(type) {
+                case cty.GetAttrStep:
+                        ap.Steps = append(ap.Steps, &proto.AttributePath_Step{
+                                Selector: &proto.AttributePath_Step_AttributeName{
+                                        AttributeName: selector.Name,
+                                },
+                        })
+                case cty.IndexStep:
+                        key := selector.Key
+                        switch key.Type() {
+                        case cty.String:
+                                ap.Steps = append(ap.Steps, &proto.AttributePath_Step{
+                                        Selector: &proto.AttributePath_Step_ElementKeyString{
+                                                ElementKeyString: key.AsString(),
+                                        },
+                                })
+                        case cty.Number:
+                                v, _ := key.AsBigFloat().Int64()
+                                ap.Steps = append(ap.Steps, &proto.AttributePath_Step{
+                                        Selector: &proto.AttributePath_Step_ElementKeyInt{
+                                                ElementKeyInt: v,
+                                        },
+                                })
+                        default:
+                                // We'll bail early if we encounter anything else, and just
+                                // return the valid prefix.
+                                return ap
+                        }
+                }
+        }
+        return ap
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/convert/schema.go b/vendor/github.com/hashicorp/terraform/plugin/convert/schema.go
new file mode 100644
index 0000000..6a45f54
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/convert/schema.go
@@ -0,0 +1,154 @@
+package convert
+
+import (
+        "encoding/json"
+        "reflect"
+        "sort"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/providers"
+)
+
+// ConfigSchemaToProto takes a *configschema.Block and converts it to a
+// proto.Schema_Block for a grpc response.
+func ConfigSchemaToProto(b *configschema.Block) *proto.Schema_Block {
+        block := &proto.Schema_Block{}
+
+        for _, name := range sortedKeys(b.Attributes) {
+                a := b.Attributes[name]
+                attr := &proto.Schema_Attribute{
+                        Name:        name,
+                        Description: a.Description,
+                        Optional:    a.Optional,
+                        Computed:    a.Computed,
+                        Required:    a.Required,
+                        Sensitive:   a.Sensitive,
+                }
+
+                ty, err := json.Marshal(a.Type)
+                if err != nil {
+                        panic(err)
+                }
+
+                attr.Type = ty
+
+                block.Attributes = append(block.Attributes, attr)
+        }
+
+        for _, name := range sortedKeys(b.BlockTypes) {
+                b := b.BlockTypes[name]
+                block.BlockTypes = append(block.BlockTypes, protoSchemaNestedBlock(name, b))
+        }
+
+        return block
+}
+
+func protoSchemaNestedBlock(name string, b *configschema.NestedBlock) *proto.Schema_NestedBlock {
+        var nesting proto.Schema_NestedBlock_NestingMode
+        switch b.Nesting {
+        case configschema.NestingSingle:
+                nesting = proto.Schema_NestedBlock_SINGLE
+        case configschema.NestingGroup:
+                nesting = proto.Schema_NestedBlock_GROUP
+        case configschema.NestingList:
+                nesting = proto.Schema_NestedBlock_LIST
+        case configschema.NestingSet:
+                nesting = proto.Schema_NestedBlock_SET
+        case configschema.NestingMap:
+                nesting = proto.Schema_NestedBlock_MAP
+        default:
+                nesting = proto.Schema_NestedBlock_INVALID
+        }
+        return &proto.Schema_NestedBlock{
+                TypeName: name,
+                Block:    ConfigSchemaToProto(&b.Block),
+                Nesting:  nesting,
+                MinItems: int64(b.MinItems),
+                MaxItems: int64(b.MaxItems),
+        }
+}
+
+// ProtoToProviderSchema takes a proto.Schema and converts it to a providers.Schema.
+func ProtoToProviderSchema(s *proto.Schema) providers.Schema {
+        return providers.Schema{
+                Version: s.Version,
+                Block:   ProtoToConfigSchema(s.Block),
+        }
+}
+
+// ProtoToConfigSchema takes the GetSchcema_Block from a grpc response and converts it
+// to a terraform *configschema.Block.
+func ProtoToConfigSchema(b *proto.Schema_Block) *configschema.Block {
+        block := &configschema.Block{
+                Attributes: make(map[string]*configschema.Attribute),
+                BlockTypes: make(map[string]*configschema.NestedBlock),
+        }
+
+        for _, a := range b.Attributes {
+                attr := &configschema.Attribute{
+                        Description: a.Description,
+                        Required:    a.Required,
+                        Optional:    a.Optional,
+                        Computed:    a.Computed,
+                        Sensitive:   a.Sensitive,
+                }
+
+                if err := json.Unmarshal(a.Type, &attr.Type); err != nil {
+                        panic(err)
+                }
+
+                block.Attributes[a.Name] = attr
+        }
+
+        for _, b := range b.BlockTypes {
+                block.BlockTypes[b.TypeName] = schemaNestedBlock(b)
+        }
+
+        return block
+}
+
+func schemaNestedBlock(b *proto.Schema_NestedBlock) *configschema.NestedBlock {
+        var nesting configschema.NestingMode
+        switch b.Nesting {
+        case proto.Schema_NestedBlock_SINGLE:
+                nesting = configschema.NestingSingle
+        case proto.Schema_NestedBlock_GROUP:
+                nesting = configschema.NestingGroup
+        case proto.Schema_NestedBlock_LIST:
+                nesting = configschema.NestingList
+        case proto.Schema_NestedBlock_MAP:
+                nesting = configschema.NestingMap
+        case proto.Schema_NestedBlock_SET:
+                nesting = configschema.NestingSet
+        default:
+                // In all other cases we'll leave it as the zero value (invalid) and
+                // let the caller validate it and deal with this.
+        }
+
+        nb := &configschema.NestedBlock{
+                Nesting:  nesting,
+                MinItems: int(b.MinItems),
+                MaxItems: int(b.MaxItems),
+        }
+
+        nested := ProtoToConfigSchema(b.Block)
+        nb.Block = *nested
+        return nb
+}
+
+// sortedKeys returns the lexically sorted keys from the given map. This is
+// used to make schema conversions are deterministic. This panics if map keys
+// are not a string.
+func sortedKeys(m interface{}) []string {
+        v := reflect.ValueOf(m)
+        keys := make([]string, v.Len())
+
+        mapKeys := v.MapKeys()
+        for i, k := range mapKeys {
+                keys[i] = k.Interface().(string)
+        }
+
+        sort.Strings(keys)
+        return keys
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/error.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/error.go
index df855a7..729e970 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/error.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/error.go
@@ -22,9 +22,43 @@ const ErrorNoSuitableVersion = Error("no suitable version is available")
 // version of Terraform.
 const ErrorNoVersionCompatible = Error("no available version is compatible with this version of Terraform")
 
+// ErrorVersionIncompatible indicates that all of the versions within the
+// constraints are not compatible with the current version of Terrafrom, though
+// there does exist a version outside of the constaints that is compatible.
+const ErrorVersionIncompatible = Error("incompatible provider version")
+
 // ErrorNoSuchProvider indicates that no provider exists with a name given
 const ErrorNoSuchProvider = Error("no provider exists with the given name")
 
+// ErrorNoVersionCompatibleWithPlatform indicates that all of the available
+// versions that otherwise met constraints are not compatible with the
+// requested platform
+const ErrorNoVersionCompatibleWithPlatform = Error("no available version is compatible for the requested platform")
+
+// ErrorMissingChecksumVerification indicates that either the provider
+// distribution is missing the SHA256SUMS file or the checksum file does
+// not contain a checksum for the binary plugin
+const ErrorMissingChecksumVerification = Error("unable to verify checksum")
+
+// ErrorChecksumVerification indicates that the current checksum of the
+// provider plugin has changed since the initial release and is not trusted
+// to download
+const ErrorChecksumVerification = Error("unexpected plugin checksum")
+
+// ErrorSignatureVerification indicates that the digital signature for a
+// provider distribution could not be verified for one of the following
+// reasons: missing signature file, missing public key, or the signature
+// was not signed by any known key for the publisher
+const ErrorSignatureVerification = Error("unable to verify signature")
+
+// ErrorServiceUnreachable indicates that the network was unable to connect
+// to the registry service
+const ErrorServiceUnreachable = Error("registry service is unreachable")
+
+// ErrorPublicRegistryUnreachable indicates that the network was unable to connect
+// to the public registry in particular, so we can show a link to the statuspage
+const ErrorPublicRegistryUnreachable = Error("registry service is unreachable, check https://status.hashicorp.com/ for status updates")
+
 func (err Error) Error() string {
         return string(err)
 }
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go
index 815640f..b1d01fb 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go
@@ -13,28 +13,27 @@ import (
         "strconv"
         "strings"
 
-        "golang.org/x/net/html"
-
+        "github.com/hashicorp/errwrap"
         getter "github.com/hashicorp/go-getter"
         multierror "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/terraform/httpclient"
+        "github.com/hashicorp/terraform/registry"
+        "github.com/hashicorp/terraform/registry/regsrc"
+        "github.com/hashicorp/terraform/registry/response"
+        "github.com/hashicorp/terraform/svchost/disco"
+        "github.com/hashicorp/terraform/tfdiags"
+        tfversion "github.com/hashicorp/terraform/version"
         "github.com/mitchellh/cli"
 )
 
-// Releases are located by parsing the html listing from releases.hashicorp.com.
-//
-// The URL for releases follows the pattern:
-//    https://releases.hashicorp.com/terraform-provider-name/<x.y.z>/terraform-provider-name_<x.y.z>_<os>_<arch>.<ext>
-//
-// The plugin protocol version will be saved with the release and returned in
-// the header X-TERRAFORM_PROTOCOL_VERSION.
+// Releases are located by querying the terraform registry.
 
 const protocolVersionHeader = "x-terraform-protocol-version"
 
-var releaseHost = "https://releases.hashicorp.com"
-
 var httpClient *http.Client
 
+var errVersionNotFound = errors.New("version not found")
+
 func init() {
         httpClient = httpclient.New()
 
@@ -50,7 +49,7 @@ func init() {
 // An Installer maintains a local cache of plugins by downloading plugins
 // from an online repository.
 type Installer interface {
-        Get(name string, req Constraints) (PluginMeta, error)
+        Get(name string, req Constraints) (PluginMeta, tfdiags.Diagnostics, error)
         PurgeUnused(used map[string]PluginMeta) (removed PluginMetaSet, err error)
 }
 
@@ -79,6 +78,13 @@ type ProviderInstaller struct {
         SkipVerify bool
 
         Ui cli.Ui // Ui for output
+
+        // Services is a required *disco.Disco, which may have services and
+        // credentials pre-loaded.
+        Services *disco.Disco
+
+        // registry client
+        registry *registry.Client
 }
 
 // Get is part of an implementation of type Installer, and attempts to download
@@ -100,96 +106,170 @@ type ProviderInstaller struct {
 // are produced under the assumption that if presented to the user they will
 // be presented alongside context about what is being installed, and thus the
 // error messages do not redundantly include such information.
-func (i *ProviderInstaller) Get(provider string, req Constraints) (PluginMeta, error) {
-        versions, err := i.listProviderVersions(provider)
+func (i *ProviderInstaller) Get(provider string, req Constraints) (PluginMeta, tfdiags.Diagnostics, error) {
+        var diags tfdiags.Diagnostics
+
+        // a little bit of initialization.
+        if i.OS == "" {
+                i.OS = runtime.GOOS
+        }
+        if i.Arch == "" {
+                i.Arch = runtime.GOARCH
+        }
+        if i.registry == nil {
+                i.registry = registry.NewClient(i.Services, nil)
+        }
+
+        // get a full listing of versions for the requested provider
+        allVersions, err := i.listProviderVersions(provider)
+
         // TODO: return multiple errors
         if err != nil {
-                return PluginMeta{}, err
+                log.Printf("[DEBUG] %s", err)
+                if registry.IsServiceUnreachable(err) {
+                        registryHost, err := i.hostname()
+                        if err == nil && registryHost == regsrc.PublicRegistryHost.Raw {
+                                return PluginMeta{}, diags, ErrorPublicRegistryUnreachable
+                        }
+                        return PluginMeta{}, diags, ErrorServiceUnreachable
+                }
+                if registry.IsServiceNotProvided(err) {
+                        return PluginMeta{}, diags, err
+                }
+                return PluginMeta{}, diags, ErrorNoSuchProvider
         }
 
-        if len(versions) == 0 {
-                return PluginMeta{}, ErrorNoSuitableVersion
+        // Add any warnings from the response to diags
+        for _, warning := range allVersions.Warnings {
+                hostname, err := i.hostname()
+                if err != nil {
+                        return PluginMeta{}, diags, err
+                }
+                diag := tfdiags.SimpleWarning(fmt.Sprintf("%s: %s", hostname, warning))
+                diags = diags.Append(diag)
         }
 
-        versions = allowedVersions(versions, req)
+        if len(allVersions.Versions) == 0 {
+                return PluginMeta{}, diags, ErrorNoSuitableVersion
+        }
+        providerSource := allVersions.ID
+
+        // Filter the list of plugin versions to those which meet the version constraints
+        versions := allowedVersions(allVersions, req)
         if len(versions) == 0 {
-                return PluginMeta{}, ErrorNoSuitableVersion
+                return PluginMeta{}, diags, ErrorNoSuitableVersion
         }
 
-        // sort them newest to oldest
-        Versions(versions).Sort()
+        // sort them newest to oldest. The newest version wins!
+        response.ProviderVersionCollection(versions).Sort()
 
-        // Ensure that our installation directory exists
-        err = os.MkdirAll(i.Dir, os.ModePerm)
-        if err != nil {
-                return PluginMeta{}, fmt.Errorf("failed to create plugin dir %s: %s", i.Dir, err)
+        // if the chosen provider version does not support the requested platform,
+        // filter the list of acceptable versions to those that support that platform
+        if err := i.checkPlatformCompatibility(versions[0]); err != nil {
+                versions = i.platformCompatibleVersions(versions)
+                if len(versions) == 0 {
+                        return PluginMeta{}, diags, ErrorNoVersionCompatibleWithPlatform
+                }
         }
 
-        // take the first matching plugin we find
-        for _, v := range versions {
-                url := i.providerURL(provider, v.String())
+        // we now have a winning platform-compatible version
+        versionMeta := versions[0]
+        v := VersionStr(versionMeta.Version).MustParse()
 
-                if !i.SkipVerify {
-                        sha256, err := i.getProviderChecksum(provider, v.String())
-                        if err != nil {
-                                return PluginMeta{}, err
-                        }
+        // check protocol compatibility
+        if err := i.checkPluginProtocol(versionMeta); err != nil {
+                closestMatch, err := i.findClosestProtocolCompatibleVersion(allVersions.Versions)
+                if err != nil {
+                        // No operation here if we can't find a version with compatible protocol
+                        return PluginMeta{}, diags, err
+                }
 
-                        // add the checksum parameter for go-getter to verify the download for us.
-                        if sha256 != "" {
-                                url = url + "?checksum=sha256:" + sha256
-                        }
+                // Prompt version suggestion to UI based on closest protocol match
+                var errMsg string
+                closestVersion := VersionStr(closestMatch.Version).MustParse()
+                if v.NewerThan(closestVersion) {
+                        errMsg = providerProtocolTooNew
+                } else {
+                        errMsg = providerProtocolTooOld
                 }
 
-                log.Printf("[DEBUG] fetching provider info for %s version %s", provider, v)
-                if checkPlugin(url, i.PluginProtocolVersion) {
-                        i.Ui.Info(fmt.Sprintf("- Downloading plugin for provider %q (%s)...", provider, v.String()))
-                        log.Printf("[DEBUG] getting provider %q version %q", provider, v)
-                        err := i.install(provider, v, url)
-                        if err != nil {
-                                return PluginMeta{}, err
-                        }
+                constraintStr := req.String()
+                if constraintStr == "" {
+                        constraintStr = "(any version)"
+                }
 
-                        // Find what we just installed
-                        // (This is weird, because go-getter doesn't directly return
-                        //  information about what was extracted, and we just extracted
-                        //  the archive directly into a shared dir here.)
-                        log.Printf("[DEBUG] looking for the %s %s plugin we just installed", provider, v)
-                        metas := FindPlugins("provider", []string{i.Dir})
-                        log.Printf("[DEBUG] all plugins found %#v", metas)
-                        metas, _ = metas.ValidateVersions()
-                        metas = metas.WithName(provider).WithVersion(v)
-                        log.Printf("[DEBUG] filtered plugins %#v", metas)
-                        if metas.Count() == 0 {
-                                // This should never happen. Suggests that the release archive
-                                // contains an executable file whose name doesn't match the
-                                // expected convention.
-                                return PluginMeta{}, fmt.Errorf(
-                                        "failed to find installed plugin version %s; this is a bug in Terraform and should be reported",
-                                        v,
-                                )
-                        }
+                return PluginMeta{}, diags, errwrap.Wrap(ErrorVersionIncompatible, fmt.Errorf(fmt.Sprintf(
+                        errMsg, provider, v.String(), tfversion.String(),
+                        closestVersion.String(), closestVersion.MinorUpgradeConstraintStr(), constraintStr)))
+        }
 
-                        if metas.Count() > 1 {
-                                // This should also never happen, and suggests that a
-                                // particular version was re-released with a different
-                                // executable filename. We consider releases as immutable, so
-                                // this is an error.
-                                return PluginMeta{}, fmt.Errorf(
-                                        "multiple plugins installed for version %s; this is a bug in Terraform and should be reported",
-                                        v,
-                                )
-                        }
+        downloadURLs, err := i.listProviderDownloadURLs(providerSource, versionMeta.Version)
+        providerURL := downloadURLs.DownloadURL
+
+        if !i.SkipVerify {
+                // Terraform verifies the integrity of a provider release before downloading
+                // the plugin binary. The digital signature (SHA256SUMS.sig) on the
+                // release distribution (SHA256SUMS) is verified with the public key of the
+                // publisher provided in the Terraform Registry response, ensuring that
+                // everything is as intended by the publisher. The checksum of the provider
+                // plugin is expected in the SHA256SUMS file and is double checked to match
+                // the checksum of the original published release to the Registry. This
+                // enforces immutability of releases between the Registry and the plugin's
+                // host location. Lastly, the integrity of the binary is verified upon
+                // download matches the Registry and signed checksum.
+                sha256, err := i.getProviderChecksum(downloadURLs)
+                if err != nil {
+                        return PluginMeta{}, diags, err
+                }
 
-                        // By now we know we have exactly one meta, and so "Newest" will
-                        // return that one.
-                        return metas.Newest(), nil
+                // add the checksum parameter for go-getter to verify the download for us.
+                if sha256 != "" {
+                        providerURL = providerURL + "?checksum=sha256:" + sha256
                 }
+        }
+
+        printedProviderName := fmt.Sprintf("%q (%s)", provider, providerSource)
+        i.Ui.Info(fmt.Sprintf("- Downloading plugin for provider %s %s...", printedProviderName, versionMeta.Version))
+        log.Printf("[DEBUG] getting provider %s version %q", printedProviderName, versionMeta.Version)
+        err = i.install(provider, v, providerURL)
+        if err != nil {
+                return PluginMeta{}, diags, err
+        }
+
+        // Find what we just installed
+        // (This is weird, because go-getter doesn't directly return
+        //  information about what was extracted, and we just extracted
+        //  the archive directly into a shared dir here.)
+        log.Printf("[DEBUG] looking for the %s %s plugin we just installed", provider, versionMeta.Version)
+        metas := FindPlugins("provider", []string{i.Dir})
+        log.Printf("[DEBUG] all plugins found %#v", metas)
+        metas, _ = metas.ValidateVersions()
+        metas = metas.WithName(provider).WithVersion(v)
+        log.Printf("[DEBUG] filtered plugins %#v", metas)
+        if metas.Count() == 0 {
+                // This should never happen. Suggests that the release archive
+                // contains an executable file whose name doesn't match the
+                // expected convention.
+                return PluginMeta{}, diags, fmt.Errorf(
+                        "failed to find installed plugin version %s; this is a bug in Terraform and should be reported",
+                        versionMeta.Version,
+                )
+        }
 
-                log.Printf("[INFO] incompatible ProtocolVersion for %s version %s", provider, v)
+        if metas.Count() > 1 {
+                // This should also never happen, and suggests that a
+                // particular version was re-released with a different
+                // executable filename. We consider releases as immutable, so
+                // this is an error.
+                return PluginMeta{}, diags, fmt.Errorf(
+                        "multiple plugins installed for version %s; this is a bug in Terraform and should be reported",
+                        versionMeta.Version,
+                )
         }
 
-        return PluginMeta{}, ErrorNoVersionCompatible
+        // By now we know we have exactly one meta, and so "Newest" will
+        // return that one.
+        return metas.Newest(), diags, nil
 }
 
 func (i *ProviderInstaller) install(provider string, version Version, url string) error {
@@ -215,6 +295,14 @@ func (i *ProviderInstaller) install(provider string, version Version, url string
                 // normal resolution machinery can find it.
                 filename := filepath.Base(cached)
                 targetPath := filepath.Join(i.Dir, filename)
+                // check if the target dir exists, and create it if not
+                var err error
+                if _, StatErr := os.Stat(i.Dir); os.IsNotExist(StatErr) {
+                        err = os.MkdirAll(i.Dir, 0700)
+                }
+                if err != nil {
+                        return err
+                }
 
                 log.Printf("[DEBUG] installing %s %s to %s from local cache %s", provider, version, targetPath, cached)
 
@@ -280,7 +368,6 @@ func (i *ProviderInstaller) install(provider string, version Version, url string
                         return err
                 }
         }
-
         return nil
 }
 
@@ -316,182 +403,222 @@ func (i *ProviderInstaller) PurgeUnused(used map[string]PluginMeta) (PluginMetaS
         return removed, errs
 }
 
-// Plugins are referred to by the short name, but all URLs and files will use
-// the full name prefixed with terraform-<plugin_type>-
-func (i *ProviderInstaller) providerName(name string) string {
-        return "terraform-provider-" + name
-}
+func (i *ProviderInstaller) getProviderChecksum(resp *response.TerraformProviderPlatformLocation) (string, error) {
+        // Get SHA256SUMS file.
+        shasums, err := getFile(resp.ShasumsURL)
+        if err != nil {
+                log.Printf("[ERROR] error fetching checksums from %q: %s", resp.ShasumsURL, err)
+                return "", ErrorMissingChecksumVerification
+        }
 
-func (i *ProviderInstaller) providerFileName(name, version string) string {
-        os := i.OS
-        arch := i.Arch
-        if os == "" {
-                os = runtime.GOOS
+        // Get SHA256SUMS.sig file.
+        signature, err := getFile(resp.ShasumsSignatureURL)
+        if err != nil {
+                log.Printf("[ERROR] error fetching checksums signature from %q: %s", resp.ShasumsSignatureURL, err)
+                return "", ErrorSignatureVerification
         }
-        if arch == "" {
-                arch = runtime.GOARCH
+
+        // Verify the GPG signature returned from the Registry.
+        asciiArmor := resp.SigningKeys.GPGASCIIArmor()
+        signer, err := verifySig(shasums, signature, asciiArmor)
+        if err != nil {
+                log.Printf("[ERROR] error verifying signature: %s", err)
+                return "", ErrorSignatureVerification
         }
-        return fmt.Sprintf("%s_%s_%s_%s.zip", i.providerName(name), version, os, arch)
-}
 
-// providerVersionsURL returns the path to the released versions directory for the provider:
-// https://releases.hashicorp.com/terraform-provider-name/
-func (i *ProviderInstaller) providerVersionsURL(name string) string {
-        return releaseHost + "/" + i.providerName(name) + "/"
-}
+        // Also verify the GPG signature against the HashiCorp public key. This is
+        // a temporary additional check until a more robust key verification
+        // process is added in a future release.
+        _, err = verifySig(shasums, signature, HashicorpPublicKey)
+        if err != nil {
+                log.Printf("[ERROR] error verifying signature against HashiCorp public key: %s", err)
+                return "", ErrorSignatureVerification
+        }
 
-// providerURL returns the full path to the provider file, using the current OS
-// and ARCH:
-// .../terraform-provider-name_<x.y.z>/terraform-provider-name_<x.y.z>_<os>_<arch>.<ext>
-func (i *ProviderInstaller) providerURL(name, version string) string {
-        return fmt.Sprintf("%s%s/%s", i.providerVersionsURL(name), version, i.providerFileName(name, version))
-}
+        // Display identity for GPG key which succeeded verifying the signature.
+        // This could also be used to display to the user with i.Ui.Info().
+        identities := []string{}
+        for k := range signer.Identities {
+                identities = append(identities, k)
+        }
+        identity := strings.Join(identities, ", ")
+        log.Printf("[DEBUG] verified GPG signature with key from %s", identity)
+
+        // Extract checksum for this os/arch platform binary and verify against Registry
+        checksum := checksumForFile(shasums, resp.Filename)
+        if checksum == "" {
+                log.Printf("[ERROR] missing checksum for %s from source %s", resp.Filename, resp.ShasumsURL)
+                return "", ErrorMissingChecksumVerification
+        } else if checksum != resp.Shasum {
+                log.Printf("[ERROR] unexpected checksum for %s from source %q", resp.Filename, resp.ShasumsURL)
+                return "", ErrorChecksumVerification
+        }
 
-func (i *ProviderInstaller) providerChecksumURL(name, version string) string {
-        fileName := fmt.Sprintf("%s_%s_SHA256SUMS", i.providerName(name), version)
-        u := fmt.Sprintf("%s%s/%s", i.providerVersionsURL(name), version, fileName)
-        return u
+        return checksum, nil
 }
 
-func (i *ProviderInstaller) getProviderChecksum(name, version string) (string, error) {
-        checksums, err := getPluginSHA256SUMs(i.providerChecksumURL(name, version))
+func (i *ProviderInstaller) hostname() (string, error) {
+        provider := regsrc.NewTerraformProvider("", i.OS, i.Arch)
+        svchost, err := provider.SvcHost()
         if err != nil {
                 return "", err
         }
 
-        return checksumForFile(checksums, i.providerFileName(name, version)), nil
+        return svchost.ForDisplay(), nil
 }
 
-// Return the plugin version by making a HEAD request to the provided url.
-// If the header is not present, we assume the latest version will be
-// compatible, and leave the check for discovery or execution.
-func checkPlugin(url string, pluginProtocolVersion uint) bool {
-        resp, err := httpClient.Head(url)
-        if err != nil {
-                log.Printf("[ERROR] error fetching plugin headers: %s", err)
-                return false
-        }
+// list all versions available for the named provider
+func (i *ProviderInstaller) listProviderVersions(name string) (*response.TerraformProviderVersions, error) {
+        provider := regsrc.NewTerraformProvider(name, i.OS, i.Arch)
+        versions, err := i.registry.TerraformProviderVersions(provider)
+        return versions, err
+}
 
-        if resp.StatusCode != http.StatusOK {
-                log.Println("[ERROR] non-200 status fetching plugin headers:", resp.Status)
-                return false
+func (i *ProviderInstaller) listProviderDownloadURLs(name, version string) (*response.TerraformProviderPlatformLocation, error) {
+        urls, err := i.registry.TerraformProviderLocation(regsrc.NewTerraformProvider(name, i.OS, i.Arch), version)
+        if urls == nil {
+                return nil, fmt.Errorf("No download urls found for provider %s", name)
         }
+        return urls, err
+}
+
+// findClosestProtocolCompatibleVersion searches for the provider version with the closest protocol match.
+// Prerelease versions are filtered.
+func (i *ProviderInstaller) findClosestProtocolCompatibleVersion(versions []*response.TerraformProviderVersion) (*response.TerraformProviderVersion, error) {
+        // Loop through all the provider versions to find the earliest and latest
+        // versions that match the installer protocol to then select the closest of the two
+        var latest, earliest *response.TerraformProviderVersion
+        for _, version := range versions {
+                // Prereleases are filtered and will not be suggested
+                v, err := VersionStr(version.Version).Parse()
+                if err != nil || v.IsPrerelease() {
+                        continue
+                }
 
-        proto := resp.Header.Get(protocolVersionHeader)
-        if proto == "" {
-                // The header isn't present, but we don't make this error fatal since
-                // the latest version will probably work.
-                log.Printf("[WARN] missing %s from: %s", protocolVersionHeader, url)
-                return true
+                if err := i.checkPluginProtocol(version); err == nil {
+                        if earliest == nil {
+                                // Found the first provider version with compatible protocol
+                                earliest = version
+                        }
+                        // Update the latest protocol compatible version
+                        latest = version
+                }
+        }
+        if earliest == nil {
+                // No compatible protocol was found for any version
+                return nil, ErrorNoVersionCompatible
         }
 
-        protoVersion, err := strconv.Atoi(proto)
+        // Convert protocols to comparable types
+        protoString := strconv.Itoa(int(i.PluginProtocolVersion))
+        protocolVersion, err := VersionStr(protoString).Parse()
         if err != nil {
-                log.Printf("[ERROR] invalid ProtocolVersion: %s", proto)
-                return false
+                return nil, fmt.Errorf("invalid plugin protocol version: %q", i.PluginProtocolVersion)
         }
 
-        return protoVersion == int(pluginProtocolVersion)
-}
-
-// list the version available for the named plugin
-func (i *ProviderInstaller) listProviderVersions(name string) ([]Version, error) {
-        versions, err := listPluginVersions(i.providerVersionsURL(name))
+        earliestVersionProtocol, err := VersionStr(earliest.Protocols[0]).Parse()
         if err != nil {
-                // listPluginVersions returns a verbose error message indicating
-                // what was being accessed and what failed
                 return nil, err
         }
-        return versions, nil
-}
-
-var errVersionNotFound = errors.New("version not found")
 
-// take the list of available versions for a plugin, and filter out those that
-// don't fit the constraints.
-func allowedVersions(available []Version, required Constraints) []Version {
-        var allowed []Version
-
-        for _, v := range available {
-                if required.Allows(v) {
-                        allowed = append(allowed, v)
-                }
+        // Compare installer protocol version with the first protocol listed of the earliest match
+        // [A, B] where A is assumed the earliest compatible major version of the protocol pair
+        if protocolVersion.NewerThan(earliestVersionProtocol) {
+                // Provider protocols are too old, the closest version is the earliest compatible version
+                return earliest, nil
         }
 
-        return allowed
+        // Provider protocols are too new, the closest version is the latest compatible version
+        return latest, nil
 }
 
-// return a list of the plugin versions at the given URL
-func listPluginVersions(url string) ([]Version, error) {
-        resp, err := httpClient.Get(url)
+func (i *ProviderInstaller) checkPluginProtocol(versionMeta *response.TerraformProviderVersion) error {
+        // TODO: should this be a different error? We should probably differentiate between
+        // no compatible versions and no protocol versions listed at all
+        if len(versionMeta.Protocols) == 0 {
+                return fmt.Errorf("no plugin protocol versions listed")
+        }
+
+        protoString := strconv.Itoa(int(i.PluginProtocolVersion))
+        protocolVersion, err := VersionStr(protoString).Parse()
         if err != nil {
-                // http library produces a verbose error message that includes the
-                // URL being accessed, etc.
-                return nil, err
+                return fmt.Errorf("invalid plugin protocol version: %q", i.PluginProtocolVersion)
+        }
+        protocolConstraint, err := protocolVersion.MinorUpgradeConstraintStr().Parse()
+        if err != nil {
+                // This should not fail if the preceding function succeeded.
+                return fmt.Errorf("invalid plugin protocol version: %q", protocolVersion.String())
         }
-        defer resp.Body.Close()
 
-        if resp.StatusCode != http.StatusOK {
-                body, _ := ioutil.ReadAll(resp.Body)
-                log.Printf("[ERROR] failed to fetch plugin versions from %s\n%s\n%s", url, resp.Status, body)
-
-                switch resp.StatusCode {
-                case http.StatusNotFound, http.StatusForbidden:
-                        // These are treated as indicative of the given name not being
-                        // a valid provider name at all.
-                        return nil, ErrorNoSuchProvider
-
-                default:
-                        // All other errors are assumed to be operational problems.
-                        return nil, fmt.Errorf("error accessing %s: %s", url, resp.Status)
+        for _, p := range versionMeta.Protocols {
+                proPro, err := VersionStr(p).Parse()
+                if err != nil {
+                        // invalid protocol reported by the registry. Move along.
+                        log.Printf("[WARN] invalid provider protocol version %q found in the registry", versionMeta.Version)
+                        continue
+                }
+                // success!
+                if protocolConstraint.Allows(proPro) {
+                        return nil
                 }
-
         }
 
-        body, err := html.Parse(resp.Body)
-        if err != nil {
-                log.Fatal(err)
+        return ErrorNoVersionCompatible
+}
+
+// REVIEWER QUESTION (again): this ends up swallowing a bunch of errors from
+// checkPluginProtocol. Do they need to be percolated up better, or would
+// debug messages would suffice in these situations?
+func (i *ProviderInstaller) findPlatformCompatibleVersion(versions []*response.TerraformProviderVersion) (*response.TerraformProviderVersion, error) {
+        for _, version := range versions {
+                if err := i.checkPlatformCompatibility(version); err == nil {
+                        return version, nil
+                }
         }
 
-        names := []string{}
+        return nil, ErrorNoVersionCompatibleWithPlatform
+}
 
-        // all we need to do is list links on the directory listing page that look like plugins
-        var f func(*html.Node)
-        f = func(n *html.Node) {
-                if n.Type == html.ElementNode && n.Data == "a" {
-                        c := n.FirstChild
-                        if c != nil && c.Type == html.TextNode && strings.HasPrefix(c.Data, "terraform-") {
-                                names = append(names, c.Data)
-                                return
-                        }
-                }
-                for c := n.FirstChild; c != nil; c = c.NextSibling {
-                        f(c)
+// platformCompatibleVersions returns a list of provider versions that are
+// compatible with the requested platform.
+func (i *ProviderInstaller) platformCompatibleVersions(versions []*response.TerraformProviderVersion) []*response.TerraformProviderVersion {
+        var v []*response.TerraformProviderVersion
+        for _, version := range versions {
+                if err := i.checkPlatformCompatibility(version); err == nil {
+                        v = append(v, version)
                 }
         }
-        f(body)
+        return v
+}
 
-        return versionsFromNames(names), nil
+func (i *ProviderInstaller) checkPlatformCompatibility(versionMeta *response.TerraformProviderVersion) error {
+        if len(versionMeta.Platforms) == 0 {
+                return fmt.Errorf("no supported provider platforms listed")
+        }
+        for _, p := range versionMeta.Platforms {
+                if p.Arch == i.Arch && p.OS == i.OS {
+                        return nil
+                }
+        }
+        return fmt.Errorf("version %s does not support the requested platform %s_%s", versionMeta.Version, i.OS, i.Arch)
 }
 
-// parse the list of directory names into a sorted list of available versions
-func versionsFromNames(names []string) []Version {
-        var versions []Version
-        for _, name := range names {
-                parts := strings.SplitN(name, "_", 2)
-                if len(parts) == 2 && parts[1] != "" {
-                        v, err := VersionStr(parts[1]).Parse()
-                        if err != nil {
-                                // filter invalid versions scraped from the page
-                                log.Printf("[WARN] invalid version found for %q: %s", name, err)
-                                continue
-                        }
+// take the list of available versions for a plugin, and filter out those that
+// don't fit the constraints.
+func allowedVersions(available *response.TerraformProviderVersions, required Constraints) []*response.TerraformProviderVersion {
+        var allowed []*response.TerraformProviderVersion
 
-                        versions = append(versions, v)
+        for _, v := range available.Versions {
+                version, err := VersionStr(v.Version).Parse()
+                if err != nil {
+                        log.Printf("[WARN] invalid version found for %q: %s", available.ID, err)
+                        continue
+                }
+                if required.Allows(version) {
+                        allowed = append(allowed, v)
                 }
         }
-
-        return versions
+        return allowed
 }
 
 func checksumForFile(sums []byte, name string) string {
@@ -504,27 +631,6 @@ func checksumForFile(sums []byte, name string) string {
         return ""
 }
 
-// fetch the SHA256SUMS file provided, and verify its signature.
-func getPluginSHA256SUMs(sumsURL string) ([]byte, error) {
-        sigURL := sumsURL + ".sig"
-
-        sums, err := getFile(sumsURL)
-        if err != nil {
-                return nil, fmt.Errorf("error fetching checksums: %s", err)
-        }
-
-        sig, err := getFile(sigURL)
-        if err != nil {
-                return nil, fmt.Errorf("error fetching checksums signature: %s", err)
-        }
-
-        if err := verifySig(sums, sig); err != nil {
-                return nil, err
-        }
-
-        return sums, nil
-}
-
 func getFile(url string) ([]byte, error) {
         resp, err := httpClient.Get(url)
         if err != nil {
@@ -543,6 +649,41 @@ func getFile(url string) ([]byte, error) {
         return data, nil
 }
 
-func GetReleaseHost() string {
-        return releaseHost
-}
+// providerProtocolTooOld is a message sent to the CLI UI if the provider's
+// supported protocol versions are too old for the user's version of terraform,
+// but an older version of the provider is compatible.
+const providerProtocolTooOld = `
+[reset][bold][red]Provider %q v%s is not compatible with Terraform %s.[reset][red]
+
+Provider version %s is the earliest compatible version. Select it with 
+the following version constraint:
+
+        version = %q
+
+Terraform checked all of the plugin versions matching the given constraint:
+    %s
+
+Consult the documentation for this provider for more information on
+compatibility between provider and Terraform versions.
+`
+
+// providerProtocolTooNew is a message sent to the CLI UI if the provider's
+// supported protocol versions are too new for the user's version of terraform,
+// and the user could either upgrade terraform or choose an older version of the
+// provider
+const providerProtocolTooNew = `
+[reset][bold][red]Provider %q v%s is not compatible with Terraform %s.[reset][red]
+
+Provider version %s is the latest compatible version. Select it with 
+the following constraint:
+
+    version = %q
+
+Terraform checked all of the plugin versions matching the given constraint:
+    %s
+
+Consult the documentation for this provider for more information on
+compatibility between provider and Terraform versions.
+
+Alternatively, upgrade to the latest version of Terraform for compatibility with newer provider releases.
+`
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/hashicorp.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/hashicorp.go
new file mode 100644
index 0000000..4622ca0
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/hashicorp.go
@@ -0,0 +1,34 @@
+package discovery
+
+// HashicorpPublicKey is the HashiCorp public key, also available at
+// https://www.hashicorp.com/security
+const HashicorpPublicKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQENBFMORM0BCADBRyKO1MhCirazOSVwcfTr1xUxjPvfxD3hjUwHtjsOy/bT6p9f
+W2mRPfwnq2JB5As+paL3UGDsSRDnK9KAxQb0NNF4+eVhr/EJ18s3wwXXDMjpIifq
+fIm2WyH3G+aRLTLPIpscUNKDyxFOUbsmgXAmJ46Re1fn8uKxKRHbfa39aeuEYWFA
+3drdL1WoUngvED7f+RnKBK2G6ZEpO+LDovQk19xGjiMTtPJrjMjZJ3QXqPvx5wca
+KSZLr4lMTuoTI/ZXyZy5bD4tShiZz6KcyX27cD70q2iRcEZ0poLKHyEIDAi3TM5k
+SwbbWBFd5RNPOR0qzrb/0p9ksKK48IIfH2FvABEBAAG0K0hhc2hpQ29ycCBTZWN1
+cml0eSA8c2VjdXJpdHlAaGFzaGljb3JwLmNvbT6JATgEEwECACIFAlMORM0CGwMG
+CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEFGFLYc0j/xMyWIIAIPhcVqiQ59n
+Jc07gjUX0SWBJAxEG1lKxfzS4Xp+57h2xxTpdotGQ1fZwsihaIqow337YHQI3q0i
+SqV534Ms+j/tU7X8sq11xFJIeEVG8PASRCwmryUwghFKPlHETQ8jJ+Y8+1asRydi
+psP3B/5Mjhqv/uOK+Vy3zAyIpyDOMtIpOVfjSpCplVRdtSTFWBu9Em7j5I2HMn1w
+sJZnJgXKpybpibGiiTtmnFLOwibmprSu04rsnP4ncdC2XRD4wIjoyA+4PKgX3sCO
+klEzKryWYBmLkJOMDdo52LttP3279s7XrkLEE7ia0fXa2c12EQ0f0DQ1tGUvyVEW
+WmJVccm5bq25AQ0EUw5EzQEIANaPUY04/g7AmYkOMjaCZ6iTp9hB5Rsj/4ee/ln9
+wArzRO9+3eejLWh53FoN1rO+su7tiXJA5YAzVy6tuolrqjM8DBztPxdLBbEi4V+j
+2tK0dATdBQBHEh3OJApO2UBtcjaZBT31zrG9K55D+CrcgIVEHAKY8Cb4kLBkb5wM
+skn+DrASKU0BNIV1qRsxfiUdQHZfSqtp004nrql1lbFMLFEuiY8FZrkkQ9qduixo
+mTT6f34/oiY+Jam3zCK7RDN/OjuWheIPGj/Qbx9JuNiwgX6yRj7OE1tjUx6d8g9y
+0H1fmLJbb3WZZbuuGFnK6qrE3bGeY8+AWaJAZ37wpWh1p0cAEQEAAYkBHwQYAQIA
+CQUCUw5EzQIbDAAKCRBRhS2HNI/8TJntCAClU7TOO/X053eKF1jqNW4A1qpxctVc
+z8eTcY8Om5O4f6a/rfxfNFKn9Qyja/OG1xWNobETy7MiMXYjaa8uUx5iFy6kMVaP
+0BXJ59NLZjMARGw6lVTYDTIvzqqqwLxgliSDfSnqUhubGwvykANPO+93BBx89MRG
+unNoYGXtPlhNFrAsB1VR8+EyKLv2HQtGCPSFBhrjuzH3gxGibNDDdFQLxxuJWepJ
+EK1UbTS4ms0NgZ2Uknqn1WRU1Ki7rE4sTy68iZtWpKQXZEJa0IGnuI2sSINGcXCJ
+oEIgXTMyCILo34Fa/C6VCm2WBgz9zZO8/rHIiQm1J5zqz0DrDwKBUM9C
+=LYpS
+-----END PGP PUBLIC KEY BLOCK-----`
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/meta_set.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/meta_set.go
index 181ea1f..3a99289 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/meta_set.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/meta_set.go
@@ -63,7 +63,7 @@ func (s PluginMetaSet) WithName(name string) PluginMetaSet {
 // WithVersion returns the subset of metas that have the given version.
 //
 // This should be used only with the "valid" result from ValidateVersions;
-// it will ignore any plugin metas that have a invalid version strings.
+// it will ignore any plugin metas that have invalid version strings.
 func (s PluginMetaSet) WithVersion(version Version) PluginMetaSet {
         ns := make(PluginMetaSet)
         for p := range s {
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/requirements.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/requirements.go
index 75430fd..0466ab2 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/requirements.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/requirements.go
@@ -4,6 +4,12 @@ import (
         "bytes"
 )
 
+// PluginInstallProtocolVersion is the protocol version TF-core
+// supports to communicate with servers, and is used to resolve
+// plugin discovery with terraform registry, in addition to
+// any specified plugin version constraints
+const PluginInstallProtocolVersion = 5
+
 // PluginRequirements describes a set of plugins (assumed to be of a consistent
 // kind) that are required to exist and have versions within the given
 // corresponding sets.
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/signature.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/signature.go
index b6686a5..7bbae50 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/signature.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/signature.go
@@ -2,7 +2,6 @@ package discovery
 
 import (
         "bytes"
-        "log"
         "strings"
 
         "golang.org/x/crypto/openpgp"
@@ -10,44 +9,11 @@ import (
 
 // Verify the data using the provided openpgp detached signature and the
 // embedded hashicorp public key.
-func verifySig(data, sig []byte) error {
-        el, err := openpgp.ReadArmoredKeyRing(strings.NewReader(hashiPublicKey))
+func verifySig(data, sig []byte, armor string) (*openpgp.Entity, error) {
+        el, err := openpgp.ReadArmoredKeyRing(strings.NewReader(armor))
         if err != nil {
-                log.Fatal(err)
+                return nil, err
         }
 
-        _, err = openpgp.CheckDetachedSignature(el, bytes.NewReader(data), bytes.NewReader(sig))
-        return err
+        return openpgp.CheckDetachedSignature(el, bytes.NewReader(data), bytes.NewReader(sig))
 }
-
-// this is the public key that signs the checksums file for releases.
-const hashiPublicKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1
-
-mQENBFMORM0BCADBRyKO1MhCirazOSVwcfTr1xUxjPvfxD3hjUwHtjsOy/bT6p9f
-W2mRPfwnq2JB5As+paL3UGDsSRDnK9KAxQb0NNF4+eVhr/EJ18s3wwXXDMjpIifq
-fIm2WyH3G+aRLTLPIpscUNKDyxFOUbsmgXAmJ46Re1fn8uKxKRHbfa39aeuEYWFA
-3drdL1WoUngvED7f+RnKBK2G6ZEpO+LDovQk19xGjiMTtPJrjMjZJ3QXqPvx5wca
-KSZLr4lMTuoTI/ZXyZy5bD4tShiZz6KcyX27cD70q2iRcEZ0poLKHyEIDAi3TM5k
-SwbbWBFd5RNPOR0qzrb/0p9ksKK48IIfH2FvABEBAAG0K0hhc2hpQ29ycCBTZWN1
-cml0eSA8c2VjdXJpdHlAaGFzaGljb3JwLmNvbT6JATgEEwECACIFAlMORM0CGwMG
-CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEFGFLYc0j/xMyWIIAIPhcVqiQ59n
-Jc07gjUX0SWBJAxEG1lKxfzS4Xp+57h2xxTpdotGQ1fZwsihaIqow337YHQI3q0i
-SqV534Ms+j/tU7X8sq11xFJIeEVG8PASRCwmryUwghFKPlHETQ8jJ+Y8+1asRydi
-psP3B/5Mjhqv/uOK+Vy3zAyIpyDOMtIpOVfjSpCplVRdtSTFWBu9Em7j5I2HMn1w
-sJZnJgXKpybpibGiiTtmnFLOwibmprSu04rsnP4ncdC2XRD4wIjoyA+4PKgX3sCO
-klEzKryWYBmLkJOMDdo52LttP3279s7XrkLEE7ia0fXa2c12EQ0f0DQ1tGUvyVEW
-WmJVccm5bq25AQ0EUw5EzQEIANaPUY04/g7AmYkOMjaCZ6iTp9hB5Rsj/4ee/ln9
-wArzRO9+3eejLWh53FoN1rO+su7tiXJA5YAzVy6tuolrqjM8DBztPxdLBbEi4V+j
-2tK0dATdBQBHEh3OJApO2UBtcjaZBT31zrG9K55D+CrcgIVEHAKY8Cb4kLBkb5wM
-skn+DrASKU0BNIV1qRsxfiUdQHZfSqtp004nrql1lbFMLFEuiY8FZrkkQ9qduixo
-mTT6f34/oiY+Jam3zCK7RDN/OjuWheIPGj/Qbx9JuNiwgX6yRj7OE1tjUx6d8g9y
-0H1fmLJbb3WZZbuuGFnK6qrE3bGeY8+AWaJAZ37wpWh1p0cAEQEAAYkBHwQYAQIA
-CQUCUw5EzQIbDAAKCRBRhS2HNI/8TJntCAClU7TOO/X053eKF1jqNW4A1qpxctVc
-z8eTcY8Om5O4f6a/rfxfNFKn9Qyja/OG1xWNobETy7MiMXYjaa8uUx5iFy6kMVaP
-0BXJ59NLZjMARGw6lVTYDTIvzqqqwLxgliSDfSnqUhubGwvykANPO+93BBx89MRG
-unNoYGXtPlhNFrAsB1VR8+EyKLv2HQtGCPSFBhrjuzH3gxGibNDDdFQLxxuJWepJ
-EK1UbTS4ms0NgZ2Uknqn1WRU1Ki7rE4sTy68iZtWpKQXZEJa0IGnuI2sSINGcXCJ
-oEIgXTMyCILo34Fa/C6VCm2WBgz9zZO8/rHIiQm1J5zqz0DrDwKBUM9C
-=LYpS
------END PGP PUBLIC KEY BLOCK-----`
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/version.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/version.go
index 8fad58d..4311d51 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/version.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/version.go
@@ -55,6 +55,11 @@ func (v Version) Equal(other Version) bool {
         return v.raw.Equal(other.raw)
 }
 
+// IsPrerelease determines if version is a prerelease
+func (v Version) IsPrerelease() bool {
+        return v.raw.Prerelease() != ""
+}
+
 // MinorUpgradeConstraintStr returns a ConstraintStr that would permit
 // minor upgrades relative to the receiving version.
 func (v Version) MinorUpgradeConstraintStr() ConstraintStr {
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/version_set.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/version_set.go
index 0aefd75..de02f5e 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/version_set.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/version_set.go
@@ -36,6 +36,11 @@ type Constraints struct {
         raw version.Constraints
 }
 
+// NewConstraints creates a Constraints based on a version.Constraints.
+func NewConstraints(c version.Constraints) Constraints {
+        return Constraints{c}
+}
+
 // AllVersions is a Constraints containing all versions
 var AllVersions Constraints
 
diff --git a/vendor/github.com/hashicorp/terraform/plugin/grpc_provider.go b/vendor/github.com/hashicorp/terraform/plugin/grpc_provider.go
new file mode 100644
index 0000000..ae9a400
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/grpc_provider.go
@@ -0,0 +1,562 @@
+package plugin
+
+import (
+        "context"
+        "errors"
+        "log"
+        "sync"
+
+        "github.com/zclconf/go-cty/cty"
+
+        plugin "github.com/hashicorp/go-plugin"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/plugin/convert"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/version"
+        "github.com/zclconf/go-cty/cty/msgpack"
+        "google.golang.org/grpc"
+)
+
+// GRPCProviderPlugin implements plugin.GRPCPlugin for the go-plugin package.
+type GRPCProviderPlugin struct {
+        plugin.Plugin
+        GRPCProvider func() proto.ProviderServer
+}
+
+func (p *GRPCProviderPlugin) GRPCClient(ctx context.Context, broker *plugin.GRPCBroker, c *grpc.ClientConn) (interface{}, error) {
+        return &GRPCProvider{
+                client: proto.NewProviderClient(c),
+                ctx:    ctx,
+        }, nil
+}
+
+func (p *GRPCProviderPlugin) GRPCServer(broker *plugin.GRPCBroker, s *grpc.Server) error {
+        proto.RegisterProviderServer(s, p.GRPCProvider())
+        return nil
+}
+
+// GRPCProvider handles the client, or core side of the plugin rpc connection.
+// The GRPCProvider methods are mostly a translation layer between the
+// terraform provioders types and the grpc proto types, directly converting
+// between the two.
+type GRPCProvider struct {
+        // PluginClient provides a reference to the plugin.Client which controls the plugin process.
+        // This allows the GRPCProvider a way to shutdown the plugin process.
+        PluginClient *plugin.Client
+
+        // TestServer contains a grpc.Server to close when the GRPCProvider is being
+        // used in an end to end test of a provider.
+        TestServer *grpc.Server
+
+        // Proto client use to make the grpc service calls.
+        client proto.ProviderClient
+
+        // this context is created by the plugin package, and is canceled when the
+        // plugin process ends.
+        ctx context.Context
+
+        // schema stores the schema for this provider. This is used to properly
+        // serialize the state for requests.
+        mu      sync.Mutex
+        schemas providers.GetSchemaResponse
+}
+
+// getSchema is used internally to get the saved provider schema.  The schema
+// should have already been fetched from the provider, but we have to
+// synchronize access to avoid being called concurrently with GetSchema.
+func (p *GRPCProvider) getSchema() providers.GetSchemaResponse {
+        p.mu.Lock()
+        // unlock inline in case GetSchema needs to be called
+        if p.schemas.Provider.Block != nil {
+                p.mu.Unlock()
+                return p.schemas
+        }
+        p.mu.Unlock()
+
+        // the schema should have been fetched already, but give it another shot
+        // just in case things are being called out of order. This may happen for
+        // tests.
+        schemas := p.GetSchema()
+        if schemas.Diagnostics.HasErrors() {
+                panic(schemas.Diagnostics.Err())
+        }
+
+        return schemas
+}
+
+// getResourceSchema is a helper to extract the schema for a resource, and
+// panics if the schema is not available.
+func (p *GRPCProvider) getResourceSchema(name string) providers.Schema {
+        schema := p.getSchema()
+        resSchema, ok := schema.ResourceTypes[name]
+        if !ok {
+                panic("unknown resource type " + name)
+        }
+        return resSchema
+}
+
+// gettDatasourceSchema is a helper to extract the schema for a datasource, and
+// panics if that schema is not available.
+func (p *GRPCProvider) getDatasourceSchema(name string) providers.Schema {
+        schema := p.getSchema()
+        dataSchema, ok := schema.DataSources[name]
+        if !ok {
+                panic("unknown data source " + name)
+        }
+        return dataSchema
+}
+
+func (p *GRPCProvider) GetSchema() (resp providers.GetSchemaResponse) {
+        log.Printf("[TRACE] GRPCProvider: GetSchema")
+        p.mu.Lock()
+        defer p.mu.Unlock()
+
+        if p.schemas.Provider.Block != nil {
+                return p.schemas
+        }
+
+        resp.ResourceTypes = make(map[string]providers.Schema)
+        resp.DataSources = make(map[string]providers.Schema)
+
+        // Some providers may generate quite large schemas, and the internal default
+        // grpc response size limit is 4MB. 64MB should cover most any use case, and
+        // if we get providers nearing that we may want to consider a finer-grained
+        // API to fetch individual resource schemas.
+        // Note: this option is marked as EXPERIMENTAL in the grpc API.
+        const maxRecvSize = 64 << 20
+        protoResp, err := p.client.GetSchema(p.ctx, new(proto.GetProviderSchema_Request), grpc.MaxRecvMsgSizeCallOption{MaxRecvMsgSize: maxRecvSize})
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        if protoResp.Provider == nil {
+                resp.Diagnostics = resp.Diagnostics.Append(errors.New("missing provider schema"))
+                return resp
+        }
+
+        resp.Provider = convert.ProtoToProviderSchema(protoResp.Provider)
+
+        for name, res := range protoResp.ResourceSchemas {
+                resp.ResourceTypes[name] = convert.ProtoToProviderSchema(res)
+        }
+
+        for name, data := range protoResp.DataSourceSchemas {
+                resp.DataSources[name] = convert.ProtoToProviderSchema(data)
+        }
+
+        p.schemas = resp
+
+        return resp
+}
+
+func (p *GRPCProvider) PrepareProviderConfig(r providers.PrepareProviderConfigRequest) (resp providers.PrepareProviderConfigResponse) {
+        log.Printf("[TRACE] GRPCProvider: PrepareProviderConfig")
+
+        schema := p.getSchema()
+        ty := schema.Provider.Block.ImpliedType()
+
+        mp, err := msgpack.Marshal(r.Config, ty)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.PrepareProviderConfig_Request{
+                Config: &proto.DynamicValue{Msgpack: mp},
+        }
+
+        protoResp, err := p.client.PrepareProviderConfig(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        config := cty.NullVal(ty)
+        if protoResp.PreparedConfig != nil {
+                config, err = msgpack.Unmarshal(protoResp.PreparedConfig.Msgpack, ty)
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                        return resp
+                }
+        }
+        resp.PreparedConfig = config
+
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+        return resp
+}
+
+func (p *GRPCProvider) ValidateResourceTypeConfig(r providers.ValidateResourceTypeConfigRequest) (resp providers.ValidateResourceTypeConfigResponse) {
+        log.Printf("[TRACE] GRPCProvider: ValidateResourceTypeConfig")
+        resourceSchema := p.getResourceSchema(r.TypeName)
+
+        mp, err := msgpack.Marshal(r.Config, resourceSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ValidateResourceTypeConfig_Request{
+                TypeName: r.TypeName,
+                Config:   &proto.DynamicValue{Msgpack: mp},
+        }
+
+        protoResp, err := p.client.ValidateResourceTypeConfig(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+        return resp
+}
+
+func (p *GRPCProvider) ValidateDataSourceConfig(r providers.ValidateDataSourceConfigRequest) (resp providers.ValidateDataSourceConfigResponse) {
+        log.Printf("[TRACE] GRPCProvider: ValidateDataSourceConfig")
+
+        dataSchema := p.getDatasourceSchema(r.TypeName)
+
+        mp, err := msgpack.Marshal(r.Config, dataSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ValidateDataSourceConfig_Request{
+                TypeName: r.TypeName,
+                Config:   &proto.DynamicValue{Msgpack: mp},
+        }
+
+        protoResp, err := p.client.ValidateDataSourceConfig(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+        return resp
+}
+
+func (p *GRPCProvider) UpgradeResourceState(r providers.UpgradeResourceStateRequest) (resp providers.UpgradeResourceStateResponse) {
+        log.Printf("[TRACE] GRPCProvider: UpgradeResourceState")
+
+        resSchema := p.getResourceSchema(r.TypeName)
+
+        protoReq := &proto.UpgradeResourceState_Request{
+                TypeName: r.TypeName,
+                Version:  int64(r.Version),
+                RawState: &proto.RawState{
+                        Json:    r.RawStateJSON,
+                        Flatmap: r.RawStateFlatmap,
+                },
+        }
+
+        protoResp, err := p.client.UpgradeResourceState(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        state := cty.NullVal(resSchema.Block.ImpliedType())
+        if protoResp.UpgradedState != nil {
+                state, err = msgpack.Unmarshal(protoResp.UpgradedState.Msgpack, resSchema.Block.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                        return resp
+                }
+        }
+
+        resp.UpgradedState = state
+        return resp
+}
+
+func (p *GRPCProvider) Configure(r providers.ConfigureRequest) (resp providers.ConfigureResponse) {
+        log.Printf("[TRACE] GRPCProvider: Configure")
+
+        schema := p.getSchema()
+
+        var mp []byte
+
+        // we don't have anything to marshal if there's no config
+        mp, err := msgpack.Marshal(r.Config, schema.Provider.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.Configure_Request{
+                TerraformVersion: version.Version,
+                Config: &proto.DynamicValue{
+                        Msgpack: mp,
+                },
+        }
+
+        protoResp, err := p.client.Configure(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+        return resp
+}
+
+func (p *GRPCProvider) Stop() error {
+        log.Printf("[TRACE] GRPCProvider: Stop")
+
+        resp, err := p.client.Stop(p.ctx, new(proto.Stop_Request))
+        if err != nil {
+                return err
+        }
+
+        if resp.Error != "" {
+                return errors.New(resp.Error)
+        }
+        return nil
+}
+
+func (p *GRPCProvider) ReadResource(r providers.ReadResourceRequest) (resp providers.ReadResourceResponse) {
+        log.Printf("[TRACE] GRPCProvider: ReadResource")
+
+        resSchema := p.getResourceSchema(r.TypeName)
+
+        mp, err := msgpack.Marshal(r.PriorState, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ReadResource_Request{
+                TypeName:     r.TypeName,
+                CurrentState: &proto.DynamicValue{Msgpack: mp},
+        }
+
+        protoResp, err := p.client.ReadResource(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        state := cty.NullVal(resSchema.Block.ImpliedType())
+        if protoResp.NewState != nil {
+                state, err = msgpack.Unmarshal(protoResp.NewState.Msgpack, resSchema.Block.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                        return resp
+                }
+        }
+        resp.NewState = state
+
+        return resp
+}
+
+func (p *GRPCProvider) PlanResourceChange(r providers.PlanResourceChangeRequest) (resp providers.PlanResourceChangeResponse) {
+        log.Printf("[TRACE] GRPCProvider: PlanResourceChange")
+
+        resSchema := p.getResourceSchema(r.TypeName)
+
+        priorMP, err := msgpack.Marshal(r.PriorState, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        configMP, err := msgpack.Marshal(r.Config, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        propMP, err := msgpack.Marshal(r.ProposedNewState, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.PlanResourceChange_Request{
+                TypeName:         r.TypeName,
+                PriorState:       &proto.DynamicValue{Msgpack: priorMP},
+                Config:           &proto.DynamicValue{Msgpack: configMP},
+                ProposedNewState: &proto.DynamicValue{Msgpack: propMP},
+                PriorPrivate:     r.PriorPrivate,
+        }
+
+        protoResp, err := p.client.PlanResourceChange(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        state := cty.NullVal(resSchema.Block.ImpliedType())
+        if protoResp.PlannedState != nil {
+                state, err = msgpack.Unmarshal(protoResp.PlannedState.Msgpack, resSchema.Block.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                        return resp
+                }
+        }
+        resp.PlannedState = state
+
+        for _, p := range protoResp.RequiresReplace {
+                resp.RequiresReplace = append(resp.RequiresReplace, convert.AttributePathToPath(p))
+        }
+
+        resp.PlannedPrivate = protoResp.PlannedPrivate
+
+        resp.LegacyTypeSystem = protoResp.LegacyTypeSystem
+
+        return resp
+}
+
+func (p *GRPCProvider) ApplyResourceChange(r providers.ApplyResourceChangeRequest) (resp providers.ApplyResourceChangeResponse) {
+        log.Printf("[TRACE] GRPCProvider: ApplyResourceChange")
+
+        resSchema := p.getResourceSchema(r.TypeName)
+
+        priorMP, err := msgpack.Marshal(r.PriorState, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        plannedMP, err := msgpack.Marshal(r.PlannedState, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        configMP, err := msgpack.Marshal(r.Config, resSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ApplyResourceChange_Request{
+                TypeName:       r.TypeName,
+                PriorState:     &proto.DynamicValue{Msgpack: priorMP},
+                PlannedState:   &proto.DynamicValue{Msgpack: plannedMP},
+                Config:         &proto.DynamicValue{Msgpack: configMP},
+                PlannedPrivate: r.PlannedPrivate,
+        }
+
+        protoResp, err := p.client.ApplyResourceChange(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        resp.Private = protoResp.Private
+
+        state := cty.NullVal(resSchema.Block.ImpliedType())
+        if protoResp.NewState != nil {
+                state, err = msgpack.Unmarshal(protoResp.NewState.Msgpack, resSchema.Block.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                        return resp
+                }
+        }
+        resp.NewState = state
+
+        resp.LegacyTypeSystem = protoResp.LegacyTypeSystem
+
+        return resp
+}
+
+func (p *GRPCProvider) ImportResourceState(r providers.ImportResourceStateRequest) (resp providers.ImportResourceStateResponse) {
+        log.Printf("[TRACE] GRPCProvider: ImportResourceState")
+
+        protoReq := &proto.ImportResourceState_Request{
+                TypeName: r.TypeName,
+                Id:       r.ID,
+        }
+
+        protoResp, err := p.client.ImportResourceState(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        for _, imported := range protoResp.ImportedResources {
+                resource := providers.ImportedResource{
+                        TypeName: imported.TypeName,
+                        Private:  imported.Private,
+                }
+
+                resSchema := p.getResourceSchema(resource.TypeName)
+                state := cty.NullVal(resSchema.Block.ImpliedType())
+                if imported.State != nil {
+                        state, err = msgpack.Unmarshal(imported.State.Msgpack, resSchema.Block.ImpliedType())
+                        if err != nil {
+                                resp.Diagnostics = resp.Diagnostics.Append(err)
+                                return resp
+                        }
+                }
+                resource.State = state
+                resp.ImportedResources = append(resp.ImportedResources, resource)
+        }
+
+        return resp
+}
+
+func (p *GRPCProvider) ReadDataSource(r providers.ReadDataSourceRequest) (resp providers.ReadDataSourceResponse) {
+        log.Printf("[TRACE] GRPCProvider: ReadDataSource")
+
+        dataSchema := p.getDatasourceSchema(r.TypeName)
+
+        config, err := msgpack.Marshal(r.Config, dataSchema.Block.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ReadDataSource_Request{
+                TypeName: r.TypeName,
+                Config: &proto.DynamicValue{
+                        Msgpack: config,
+                },
+        }
+
+        protoResp, err := p.client.ReadDataSource(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        state := cty.NullVal(dataSchema.Block.ImpliedType())
+        if protoResp.State != nil {
+                state, err = msgpack.Unmarshal(protoResp.State.Msgpack, dataSchema.Block.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                        return resp
+                }
+        }
+        resp.State = state
+
+        return resp
+}
+
+// closing the grpc connection is final, and terraform will call it at the end of every phase.
+func (p *GRPCProvider) Close() error {
+        log.Printf("[TRACE] GRPCProvider: Close")
+
+        // Make sure to stop the server if we're not running within go-plugin.
+        if p.TestServer != nil {
+                p.TestServer.Stop()
+        }
+
+        // Check this since it's not automatically inserted during plugin creation.
+        // It's currently only inserted by the command package, because that is
+        // where the factory is built and is the only point with access to the
+        // plugin.Client.
+        if p.PluginClient == nil {
+                log.Println("[DEBUG] provider has no plugin.Client")
+                return nil
+        }
+
+        p.PluginClient.Kill()
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/grpc_provisioner.go b/vendor/github.com/hashicorp/terraform/plugin/grpc_provisioner.go
new file mode 100644
index 0000000..136c88d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/grpc_provisioner.go
@@ -0,0 +1,178 @@
+package plugin
+
+import (
+        "context"
+        "errors"
+        "io"
+        "log"
+        "sync"
+
+        plugin "github.com/hashicorp/go-plugin"
+        "github.com/hashicorp/terraform/configs/configschema"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/plugin/convert"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/msgpack"
+        "google.golang.org/grpc"
+)
+
+// GRPCProvisionerPlugin is the plugin.GRPCPlugin implementation.
+type GRPCProvisionerPlugin struct {
+        plugin.Plugin
+        GRPCProvisioner func() proto.ProvisionerServer
+}
+
+func (p *GRPCProvisionerPlugin) GRPCClient(ctx context.Context, broker *plugin.GRPCBroker, c *grpc.ClientConn) (interface{}, error) {
+        return &GRPCProvisioner{
+                client: proto.NewProvisionerClient(c),
+                ctx:    ctx,
+        }, nil
+}
+
+func (p *GRPCProvisionerPlugin) GRPCServer(broker *plugin.GRPCBroker, s *grpc.Server) error {
+        proto.RegisterProvisionerServer(s, p.GRPCProvisioner())
+        return nil
+}
+
+// provisioners.Interface grpc implementation
+type GRPCProvisioner struct {
+        // PluginClient provides a reference to the plugin.Client which controls the plugin process.
+        // This allows the GRPCProvider a way to shutdown the plugin process.
+        PluginClient *plugin.Client
+
+        client proto.ProvisionerClient
+        ctx    context.Context
+
+        // Cache the schema since we need it for serialization in each method call.
+        mu     sync.Mutex
+        schema *configschema.Block
+}
+
+func (p *GRPCProvisioner) GetSchema() (resp provisioners.GetSchemaResponse) {
+        p.mu.Lock()
+        defer p.mu.Unlock()
+
+        if p.schema != nil {
+                return provisioners.GetSchemaResponse{
+                        Provisioner: p.schema,
+                }
+        }
+
+        protoResp, err := p.client.GetSchema(p.ctx, new(proto.GetProvisionerSchema_Request))
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+
+        if protoResp.Provisioner == nil {
+                resp.Diagnostics = resp.Diagnostics.Append(errors.New("missing provisioner schema"))
+                return resp
+        }
+
+        resp.Provisioner = convert.ProtoToConfigSchema(protoResp.Provisioner.Block)
+
+        p.schema = resp.Provisioner
+
+        return resp
+}
+
+func (p *GRPCProvisioner) ValidateProvisionerConfig(r provisioners.ValidateProvisionerConfigRequest) (resp provisioners.ValidateProvisionerConfigResponse) {
+        schema := p.GetSchema()
+        if schema.Diagnostics.HasErrors() {
+                resp.Diagnostics = resp.Diagnostics.Append(schema.Diagnostics)
+                return resp
+        }
+
+        mp, err := msgpack.Marshal(r.Config, schema.Provisioner.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ValidateProvisionerConfig_Request{
+                Config: &proto.DynamicValue{Msgpack: mp},
+        }
+        protoResp, err := p.client.ValidateProvisionerConfig(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics))
+        return resp
+}
+
+func (p *GRPCProvisioner) ProvisionResource(r provisioners.ProvisionResourceRequest) (resp provisioners.ProvisionResourceResponse) {
+        schema := p.GetSchema()
+        if schema.Diagnostics.HasErrors() {
+                resp.Diagnostics = resp.Diagnostics.Append(schema.Diagnostics)
+                return resp
+        }
+
+        mp, err := msgpack.Marshal(r.Config, schema.Provisioner.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        // connection is always assumed to be a simple string map
+        connMP, err := msgpack.Marshal(r.Connection, cty.Map(cty.String))
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        protoReq := &proto.ProvisionResource_Request{
+                Config:     &proto.DynamicValue{Msgpack: mp},
+                Connection: &proto.DynamicValue{Msgpack: connMP},
+        }
+
+        outputClient, err := p.client.ProvisionResource(p.ctx, protoReq)
+        if err != nil {
+                resp.Diagnostics = resp.Diagnostics.Append(err)
+                return resp
+        }
+
+        for {
+                rcv, err := outputClient.Recv()
+                if rcv != nil {
+                        r.UIOutput.Output(rcv.Output)
+                }
+                if err != nil {
+                        if err != io.EOF {
+                                resp.Diagnostics = resp.Diagnostics.Append(err)
+                        }
+                        break
+                }
+
+                if len(rcv.Diagnostics) > 0 {
+                        resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(rcv.Diagnostics))
+                        break
+                }
+        }
+
+        return resp
+}
+
+func (p *GRPCProvisioner) Stop() error {
+        protoResp, err := p.client.Stop(p.ctx, &proto.Stop_Request{})
+        if err != nil {
+                return err
+        }
+        if protoResp.Error != "" {
+                return errors.New(protoResp.Error)
+        }
+        return nil
+}
+
+func (p *GRPCProvisioner) Close() error {
+        // check this since it's not automatically inserted during plugin creation
+        if p.PluginClient == nil {
+                log.Println("[DEBUG] provider has no plugin.Client")
+                return nil
+        }
+
+        p.PluginClient.Kill()
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/plugin.go b/vendor/github.com/hashicorp/terraform/plugin/plugin.go
index 00fa7b2..e4fb577 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/plugin.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/plugin.go
@@ -6,8 +6,9 @@ import (
 
 // See serve.go for serving plugins
 
-// PluginMap should be used by clients for the map of plugins.
-var PluginMap = map[string]plugin.Plugin{
-        "provider":    &ResourceProviderPlugin{},
-        "provisioner": &ResourceProvisionerPlugin{},
+var VersionedPlugins = map[int]plugin.PluginSet{
+        5: {
+                "provider":    &GRPCProviderPlugin{},
+                "provisioner": &GRPCProvisionerPlugin{},
+        },
 }
diff --git a/vendor/github.com/hashicorp/terraform/plugin/resource_provider.go b/vendor/github.com/hashicorp/terraform/plugin/resource_provider.go
index d6a433c..459661a 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/resource_provider.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/resource_provider.go
@@ -9,11 +9,14 @@ import (
 
 // ResourceProviderPlugin is the plugin.Plugin implementation.
 type ResourceProviderPlugin struct {
-        F func() terraform.ResourceProvider
+        ResourceProvider func() terraform.ResourceProvider
 }
 
 func (p *ResourceProviderPlugin) Server(b *plugin.MuxBroker) (interface{}, error) {
-        return &ResourceProviderServer{Broker: b, Provider: p.F()}, nil
+        return &ResourceProviderServer{
+                Broker:   b,
+                Provider: p.ResourceProvider(),
+        }, nil
 }
 
 func (p *ResourceProviderPlugin) Client(
diff --git a/vendor/github.com/hashicorp/terraform/plugin/resource_provisioner.go b/vendor/github.com/hashicorp/terraform/plugin/resource_provisioner.go
index 8fce9d8..f0cc341 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/resource_provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/resource_provisioner.go
@@ -4,16 +4,20 @@ import (
         "net/rpc"
 
         "github.com/hashicorp/go-plugin"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/terraform"
 )
 
 // ResourceProvisionerPlugin is the plugin.Plugin implementation.
 type ResourceProvisionerPlugin struct {
-        F func() terraform.ResourceProvisioner
+        ResourceProvisioner func() terraform.ResourceProvisioner
 }
 
 func (p *ResourceProvisionerPlugin) Server(b *plugin.MuxBroker) (interface{}, error) {
-        return &ResourceProvisionerServer{Broker: b, Provisioner: p.F()}, nil
+        return &ResourceProvisionerServer{
+                Broker:      b,
+                Provisioner: p.ResourceProvisioner(),
+        }, nil
 }
 
 func (p *ResourceProvisionerPlugin) Client(
@@ -28,6 +32,11 @@ type ResourceProvisioner struct {
         Client *rpc.Client
 }
 
+func (p *ResourceProvisioner) GetConfigSchema() (*configschema.Block, error) {
+        panic("not implemented")
+        return nil, nil
+}
+
 func (p *ResourceProvisioner) Validate(c *terraform.ResourceConfig) ([]string, []error) {
         var resp ResourceProvisionerValidateResponse
         args := ResourceProvisionerValidateArgs{
diff --git a/vendor/github.com/hashicorp/terraform/plugin/serve.go b/vendor/github.com/hashicorp/terraform/plugin/serve.go
index 2028a61..8d056c5 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/serve.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/serve.go
@@ -2,14 +2,23 @@ package plugin
 
 import (
         "github.com/hashicorp/go-plugin"
+        grpcplugin "github.com/hashicorp/terraform/helper/plugin"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
         "github.com/hashicorp/terraform/terraform"
 )
 
-// The constants below are the names of the plugins that can be dispensed
-// from the plugin server.
 const (
+        // The constants below are the names of the plugins that can be dispensed
+        // from the plugin server.
         ProviderPluginName    = "provider"
         ProvisionerPluginName = "provisioner"
+
+        // DefaultProtocolVersion is the protocol version assumed for legacy clients that don't specify
+        // a particular version during their handshake. This is the version used when Terraform 0.10
+        // and 0.11 launch plugins that were built with support for both versions 4 and 5, and must
+        // stay unchanged at 4 until we intentionally build plugins that are not compatible with 0.10 and
+        // 0.11.
+        DefaultProtocolVersion = 4
 )
 
 // Handshake is the HandshakeConfig used to configure clients and servers.
@@ -19,7 +28,7 @@ var Handshake = plugin.HandshakeConfig{
         // one or the other that makes it so that they can't safely communicate.
         // This could be adding a new interface value, it could be how
         // helper/schema computes diffs, etc.
-        ProtocolVersion: 4,
+        ProtocolVersion: DefaultProtocolVersion,
 
         // The magic cookie values should NEVER be changed.
         MagicCookieKey:   "TF_PLUGIN_MAGIC_COOKIE",
@@ -28,27 +37,85 @@ var Handshake = plugin.HandshakeConfig{
 
 type ProviderFunc func() terraform.ResourceProvider
 type ProvisionerFunc func() terraform.ResourceProvisioner
+type GRPCProviderFunc func() proto.ProviderServer
+type GRPCProvisionerFunc func() proto.ProvisionerServer
 
 // ServeOpts are the configurations to serve a plugin.
 type ServeOpts struct {
         ProviderFunc    ProviderFunc
         ProvisionerFunc ProvisionerFunc
+
+        // Wrapped versions of the above plugins will automatically shimmed and
+        // added to the GRPC functions when possible.
+        GRPCProviderFunc    GRPCProviderFunc
+        GRPCProvisionerFunc GRPCProvisionerFunc
 }
 
 // Serve serves a plugin. This function never returns and should be the final
 // function called in the main function of the plugin.
 func Serve(opts *ServeOpts) {
+        // since the plugins may not yet be aware of the new protocol, we
+        // automatically wrap the plugins in the grpc shims.
+        if opts.GRPCProviderFunc == nil && opts.ProviderFunc != nil {
+                provider := grpcplugin.NewGRPCProviderServerShim(opts.ProviderFunc())
+                // this is almost always going to be a *schema.Provider, but check that
+                // we got back a valid provider just in case.
+                if provider != nil {
+                        opts.GRPCProviderFunc = func() proto.ProviderServer {
+                                return provider
+                        }
+                }
+        }
+        if opts.GRPCProvisionerFunc == nil && opts.ProvisionerFunc != nil {
+                provisioner := grpcplugin.NewGRPCProvisionerServerShim(opts.ProvisionerFunc())
+                if provisioner != nil {
+                        opts.GRPCProvisionerFunc = func() proto.ProvisionerServer {
+                                return provisioner
+                        }
+                }
+        }
+
         plugin.Serve(&plugin.ServeConfig{
-                HandshakeConfig: Handshake,
-                Plugins:         pluginMap(opts),
+                HandshakeConfig:  Handshake,
+                VersionedPlugins: pluginSet(opts),
+                GRPCServer:       plugin.DefaultGRPCServer,
         })
 }
 
-// pluginMap returns the map[string]plugin.Plugin to use for configuring a plugin
-// server or client.
-func pluginMap(opts *ServeOpts) map[string]plugin.Plugin {
+// pluginMap returns the legacy map[string]plugin.Plugin to use for configuring
+// a plugin server or client.
+func legacyPluginMap(opts *ServeOpts) map[string]plugin.Plugin {
         return map[string]plugin.Plugin{
-                "provider":    &ResourceProviderPlugin{F: opts.ProviderFunc},
-                "provisioner": &ResourceProvisionerPlugin{F: opts.ProvisionerFunc},
+                "provider": &ResourceProviderPlugin{
+                        ResourceProvider: opts.ProviderFunc,
+                },
+                "provisioner": &ResourceProvisionerPlugin{
+                        ResourceProvisioner: opts.ProvisionerFunc,
+                },
+        }
+}
+
+func pluginSet(opts *ServeOpts) map[int]plugin.PluginSet {
+        // Set the legacy netrpc plugins at version 4.
+        // The oldest version is returned in when executed by a legacy go-plugin
+        // client.
+        plugins := map[int]plugin.PluginSet{
+                4: legacyPluginMap(opts),
+        }
+
+        // add the new protocol versions if they're configured
+        if opts.GRPCProviderFunc != nil || opts.GRPCProvisionerFunc != nil {
+                plugins[5] = plugin.PluginSet{}
+                if opts.GRPCProviderFunc != nil {
+                        plugins[5]["provider"] = &GRPCProviderPlugin{
+                                GRPCProvider: opts.GRPCProviderFunc,
+                        }
+                }
+                if opts.GRPCProvisionerFunc != nil {
+                        plugins[5]["provisioner"] = &GRPCProvisionerPlugin{
+                                GRPCProvisioner: opts.GRPCProvisionerFunc,
+                        }
+                }
         }
+        return plugins
 }
diff --git a/vendor/github.com/hashicorp/terraform/plugin/ui_input.go b/vendor/github.com/hashicorp/terraform/plugin/ui_input.go
index 493efc0..3469e6a 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/ui_input.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/ui_input.go
@@ -1,19 +1,20 @@
 package plugin
 
 import (
+        "context"
         "net/rpc"
 
         "github.com/hashicorp/go-plugin"
         "github.com/hashicorp/terraform/terraform"
 )
 
-// UIInput is an implementatin of terraform.UIInput that communicates
+// UIInput is an implementation of terraform.UIInput that communicates
 // over RPC.
 type UIInput struct {
         Client *rpc.Client
 }
 
-func (i *UIInput) Input(opts *terraform.InputOpts) (string, error) {
+func (i *UIInput) Input(ctx context.Context, opts *terraform.InputOpts) (string, error) {
         var resp UIInputInputResponse
         err := i.Client.Call("Plugin.Input", opts, &resp)
         if err != nil {
@@ -41,7 +42,7 @@ type UIInputServer struct {
 func (s *UIInputServer) Input(
         opts *terraform.InputOpts,
         reply *UIInputInputResponse) error {
-        value, err := s.UIInput.Input(opts)
+        value, err := s.UIInput.Input(context.Background(), opts)
         *reply = UIInputInputResponse{
                 Value: value,
                 Error: plugin.NewBasicError(err),
diff --git a/vendor/github.com/hashicorp/terraform/providers/addressed_types.go b/vendor/github.com/hashicorp/terraform/providers/addressed_types.go
new file mode 100644
index 0000000..7ed523f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/providers/addressed_types.go
@@ -0,0 +1,47 @@
+package providers
+
+import (
+        "sort"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// AddressedTypes is a helper that extracts all of the distinct provider
+// types from the given list of relative provider configuration addresses.
+func AddressedTypes(providerAddrs []addrs.ProviderConfig) []string {
+        if len(providerAddrs) == 0 {
+                return nil
+        }
+        m := map[string]struct{}{}
+        for _, addr := range providerAddrs {
+                m[addr.Type] = struct{}{}
+        }
+
+        names := make([]string, 0, len(m))
+        for typeName := range m {
+                names = append(names, typeName)
+        }
+
+        sort.Strings(names) // Stable result for tests
+        return names
+}
+
+// AddressedTypesAbs is a helper that extracts all of the distinct provider
+// types from the given list of absolute provider configuration addresses.
+func AddressedTypesAbs(providerAddrs []addrs.AbsProviderConfig) []string {
+        if len(providerAddrs) == 0 {
+                return nil
+        }
+        m := map[string]struct{}{}
+        for _, addr := range providerAddrs {
+                m[addr.ProviderConfig.Type] = struct{}{}
+        }
+
+        names := make([]string, 0, len(m))
+        for typeName := range m {
+                names = append(names, typeName)
+        }
+
+        sort.Strings(names) // Stable result for tests
+        return names
+}
diff --git a/vendor/github.com/hashicorp/terraform/providers/doc.go b/vendor/github.com/hashicorp/terraform/providers/doc.go
new file mode 100644
index 0000000..39aa1de
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/providers/doc.go
@@ -0,0 +1,3 @@
+// Package providers contains the interface and primary types required to
+// implement a Terraform resource provider.
+package providers
diff --git a/vendor/github.com/hashicorp/terraform/providers/provider.go b/vendor/github.com/hashicorp/terraform/providers/provider.go
new file mode 100644
index 0000000..1aa08c2
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/providers/provider.go
@@ -0,0 +1,351 @@
+package providers
+
+import (
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// Interface represents the set of methods required for a complete resource
+// provider plugin.
+type Interface interface {
+        // GetSchema returns the complete schema for the provider.
+        GetSchema() GetSchemaResponse
+
+        // PrepareProviderConfig allows the provider to validate the configuration
+        // values, and set or override any values with defaults.
+        PrepareProviderConfig(PrepareProviderConfigRequest) PrepareProviderConfigResponse
+
+        // ValidateResourceTypeConfig allows the provider to validate the resource
+        // configuration values.
+        ValidateResourceTypeConfig(ValidateResourceTypeConfigRequest) ValidateResourceTypeConfigResponse
+
+        // ValidateDataSource allows the provider to validate the data source
+        // configuration values.
+        ValidateDataSourceConfig(ValidateDataSourceConfigRequest) ValidateDataSourceConfigResponse
+
+        // UpgradeResourceState is called when the state loader encounters an
+        // instance state whose schema version is less than the one reported by the
+        // currently-used version of the corresponding provider, and the upgraded
+        // result is used for any further processing.
+        UpgradeResourceState(UpgradeResourceStateRequest) UpgradeResourceStateResponse
+
+        // Configure configures and initialized the provider.
+        Configure(ConfigureRequest) ConfigureResponse
+
+        // Stop is called when the provider should halt any in-flight actions.
+        //
+        // Stop should not block waiting for in-flight actions to complete. It
+        // should take any action it wants and return immediately acknowledging it
+        // has received the stop request. Terraform will not make any further API
+        // calls to the provider after Stop is called.
+        //
+        // The error returned, if non-nil, is assumed to mean that signaling the
+        // stop somehow failed and that the user should expect potentially waiting
+        // a longer period of time.
+        Stop() error
+
+        // ReadResource refreshes a resource and returns its current state.
+        ReadResource(ReadResourceRequest) ReadResourceResponse
+
+        // PlanResourceChange takes the current state and proposed state of a
+        // resource, and returns the planned final state.
+        PlanResourceChange(PlanResourceChangeRequest) PlanResourceChangeResponse
+
+        // ApplyResourceChange takes the planned state for a resource, which may
+        // yet contain unknown computed values, and applies the changes returning
+        // the final state.
+        ApplyResourceChange(ApplyResourceChangeRequest) ApplyResourceChangeResponse
+
+        // ImportResourceState requests that the given resource be imported.
+        ImportResourceState(ImportResourceStateRequest) ImportResourceStateResponse
+
+        // ReadDataSource returns the data source's current state.
+        ReadDataSource(ReadDataSourceRequest) ReadDataSourceResponse
+
+        // Close shuts down the plugin process if applicable.
+        Close() error
+}
+
+type GetSchemaResponse struct {
+        // Provider is the schema for the provider itself.
+        Provider Schema
+
+        // ResourceTypes map the resource type name to that type's schema.
+        ResourceTypes map[string]Schema
+
+        // DataSources maps the data source name to that data source's schema.
+        DataSources map[string]Schema
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+// Schema pairs a provider or resource schema with that schema's version.
+// This is used to be able to upgrade the schema in UpgradeResourceState.
+type Schema struct {
+        Version int64
+        Block   *configschema.Block
+}
+
+type PrepareProviderConfigRequest struct {
+        // Config is the raw configuration value for the provider.
+        Config cty.Value
+}
+
+type PrepareProviderConfigResponse struct {
+        // PreparedConfig is the configuration as prepared by the provider.
+        PreparedConfig cty.Value
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type ValidateResourceTypeConfigRequest struct {
+        // TypeName is the name of the resource type to validate.
+        TypeName string
+
+        // Config is the configuration value to validate, which may contain unknown
+        // values.
+        Config cty.Value
+}
+
+type ValidateResourceTypeConfigResponse struct {
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type ValidateDataSourceConfigRequest struct {
+        // TypeName is the name of the data source type to validate.
+        TypeName string
+
+        // Config is the configuration value to validate, which may contain unknown
+        // values.
+        Config cty.Value
+}
+
+type ValidateDataSourceConfigResponse struct {
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type UpgradeResourceStateRequest struct {
+        // TypeName is the name of the resource type being upgraded
+        TypeName string
+
+        // Version is version of the schema that created the current state.
+        Version int64
+
+        // RawStateJSON and RawStateFlatmap contiain the state that needs to be
+        // upgraded to match the current schema version. Because the schema is
+        // unknown, this contains only the raw data as stored in the state.
+        // RawStateJSON is the current json state encoding.
+        // RawStateFlatmap is the legacy flatmap encoding.
+        // Only on of these fields may be set for the upgrade request.
+        RawStateJSON    []byte
+        RawStateFlatmap map[string]string
+}
+
+type UpgradeResourceStateResponse struct {
+        // UpgradedState is the newly upgraded resource state.
+        UpgradedState cty.Value
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type ConfigureRequest struct {
+        // Terraform version is the version string from the running instance of
+        // terraform. Providers can use TerraformVersion to verify compatibility,
+        // and to store for informational purposes.
+        TerraformVersion string
+
+        // Config is the complete configuration value for the provider.
+        Config cty.Value
+}
+
+type ConfigureResponse struct {
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type ReadResourceRequest struct {
+        // TypeName is the name of the resource type being read.
+        TypeName string
+
+        // PriorState contains the previously saved state value for this resource.
+        PriorState cty.Value
+}
+
+type ReadResourceResponse struct {
+        // NewState contains the current state of the resource.
+        NewState cty.Value
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type PlanResourceChangeRequest struct {
+        // TypeName is the name of the resource type to plan.
+        TypeName string
+
+        // PriorState is the previously saved state value for this resource.
+        PriorState cty.Value
+
+        // ProposedNewState is the expected state after the new configuration is
+        // applied. This is created by directly applying the configuration to the
+        // PriorState. The provider is then responsible for applying any further
+        // changes required to create the proposed final state.
+        ProposedNewState cty.Value
+
+        // Config is the resource configuration, before being merged with the
+        // PriorState. Any value not explicitly set in the configuration will be
+        // null. Config is supplied for reference, but Provider implementations
+        // should prefer the ProposedNewState in most circumstances.
+        Config cty.Value
+
+        // PriorPrivate is the previously saved private data returned from the
+        // provider during the last apply.
+        PriorPrivate []byte
+}
+
+type PlanResourceChangeResponse struct {
+        // PlannedState is the expected state of the resource once the current
+        // configuration is applied.
+        PlannedState cty.Value
+
+        // RequiresReplace is the list of thee attributes that are requiring
+        // resource replacement.
+        RequiresReplace []cty.Path
+
+        // PlannedPrivate is an opaque blob that is not interpreted by terraform
+        // core. This will be saved and relayed back to the provider during
+        // ApplyResourceChange.
+        PlannedPrivate []byte
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+
+        // LegacyTypeSystem is set only if the provider is using the legacy SDK
+        // whose type system cannot be precisely mapped into the Terraform type
+        // system. We use this to bypass certain consistency checks that would
+        // otherwise fail due to this imprecise mapping. No other provider or SDK
+        // implementation is permitted to set this.
+        LegacyTypeSystem bool
+}
+
+type ApplyResourceChangeRequest struct {
+        // TypeName is the name of the resource type being applied.
+        TypeName string
+
+        // PriorState is the current state of resource.
+        PriorState cty.Value
+
+        // Planned state is the state returned from PlanResourceChange, and should
+        // represent the new state, minus any remaining computed attributes.
+        PlannedState cty.Value
+
+        // Config is the resource configuration, before being merged with the
+        // PriorState. Any value not explicitly set in the configuration will be
+        // null. Config is supplied for reference, but Provider implementations
+        // should prefer the PlannedState in most circumstances.
+        Config cty.Value
+
+        // PlannedPrivate is the same value as returned by PlanResourceChange.
+        PlannedPrivate []byte
+}
+
+type ApplyResourceChangeResponse struct {
+        // NewState is the new complete state after applying the planned change.
+        // In the event of an error, NewState should represent the most recent
+        // known state of the resource, if it exists.
+        NewState cty.Value
+
+        // Private is an opaque blob that will be stored in state along with the
+        // resource. It is intended only for interpretation by the provider itself.
+        Private []byte
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+
+        // LegacyTypeSystem is set only if the provider is using the legacy SDK
+        // whose type system cannot be precisely mapped into the Terraform type
+        // system. We use this to bypass certain consistency checks that would
+        // otherwise fail due to this imprecise mapping. No other provider or SDK
+        // implementation is permitted to set this.
+        LegacyTypeSystem bool
+}
+
+type ImportResourceStateRequest struct {
+        // TypeName is the name of the resource type to be imported.
+        TypeName string
+
+        // ID is a string with which the provider can identify the resource to be
+        // imported.
+        ID string
+}
+
+type ImportResourceStateResponse struct {
+        // ImportedResources contains one or more state values related to the
+        // imported resource. It is not required that these be complete, only that
+        // there is enough identifying information for the provider to successfully
+        // update the states in ReadResource.
+        ImportedResources []ImportedResource
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+// ImportedResource represents an object being imported into Terraform with the
+// help of a provider. An ImportedObject is a RemoteObject that has been read
+// by the provider's import handler but hasn't yet been committed to state.
+type ImportedResource struct {
+        // TypeName is the name of the resource type associated with the
+        // returned state. It's possible for providers to import multiple related
+        // types with a single import request.
+        TypeName string
+
+        // State is the state of the remote object being imported. This may not be
+        // complete, but must contain enough information to uniquely identify the
+        // resource.
+        State cty.Value
+
+        // Private is an opaque blob that will be stored in state along with the
+        // resource. It is intended only for interpretation by the provider itself.
+        Private []byte
+}
+
+// AsInstanceObject converts the receiving ImportedObject into a
+// ResourceInstanceObject that has status ObjectReady.
+//
+// The returned object does not know its own resource type, so the caller must
+// retain the ResourceType value from the source object if this information is
+// needed.
+//
+// The returned object also has no dependency addresses, but the caller may
+// freely modify the direct fields of the returned object without affecting
+// the receiver.
+func (ir ImportedResource) AsInstanceObject() *states.ResourceInstanceObject {
+        return &states.ResourceInstanceObject{
+                Status:  states.ObjectReady,
+                Value:   ir.State,
+                Private: ir.Private,
+        }
+}
+
+type ReadDataSourceRequest struct {
+        // TypeName is the name of the data source type to Read.
+        TypeName string
+
+        // Config is the complete configuration for the requested data source.
+        Config cty.Value
+}
+
+type ReadDataSourceResponse struct {
+        // State is the current state of the requested data source.
+        State cty.Value
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
diff --git a/vendor/github.com/hashicorp/terraform/providers/resolver.go b/vendor/github.com/hashicorp/terraform/providers/resolver.go
new file mode 100644
index 0000000..4de8e0a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/providers/resolver.go
@@ -0,0 +1,112 @@
+package providers
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/plugin/discovery"
+)
+
+// Resolver is an interface implemented by objects that are able to resolve
+// a given set of resource provider version constraints into Factory
+// callbacks.
+type Resolver interface {
+        // Given a constraint map, return a Factory for each requested provider.
+        // If some or all of the constraints cannot be satisfied, return a non-nil
+        // slice of errors describing the problems.
+        ResolveProviders(reqd discovery.PluginRequirements) (map[string]Factory, []error)
+}
+
+// ResolverFunc wraps a callback function and turns it into a Resolver
+// implementation, for convenience in situations where a function and its
+// associated closure are sufficient as a resolver implementation.
+type ResolverFunc func(reqd discovery.PluginRequirements) (map[string]Factory, []error)
+
+// ResolveProviders implements Resolver by calling the
+// wrapped function.
+func (f ResolverFunc) ResolveProviders(reqd discovery.PluginRequirements) (map[string]Factory, []error) {
+        return f(reqd)
+}
+
+// ResolverFixed returns a Resolver that has a fixed set of provider factories
+// provided by the caller. The returned resolver ignores version constraints
+// entirely and just returns the given factory for each requested provider
+// name.
+//
+// This function is primarily used in tests, to provide mock providers or
+// in-process providers under test.
+func ResolverFixed(factories map[string]Factory) Resolver {
+        return ResolverFunc(func(reqd discovery.PluginRequirements) (map[string]Factory, []error) {
+                ret := make(map[string]Factory, len(reqd))
+                var errs []error
+                for name := range reqd {
+                        if factory, exists := factories[name]; exists {
+                                ret[name] = factory
+                        } else {
+                                errs = append(errs, fmt.Errorf("provider %q is not available", name))
+                        }
+                }
+                return ret, errs
+        })
+}
+
+// Factory is a function type that creates a new instance of a resource
+// provider, or returns an error if that is impossible.
+type Factory func() (Interface, error)
+
+// FactoryFixed is a helper that creates a Factory that just returns some given
+// single provider.
+//
+// Unlike usual factories, the exact same instance is returned for each call
+// to the factory and so this must be used in only specialized situations where
+// the caller can take care to either not mutate the given provider at all
+// or to mutate it in ways that will not cause unexpected behavior for others
+// holding the same reference.
+func FactoryFixed(p Interface) Factory {
+        return func() (Interface, error) {
+                return p, nil
+        }
+}
+
+// ProviderHasResource is a helper that requests schema from the given provider
+// and checks if it has a resource type of the given name.
+//
+// This function is more expensive than it may first appear since it must
+// retrieve the entire schema from the underlying provider, and so it should
+// be used sparingly and especially not in tight loops.
+//
+// Since retrieving the provider may fail (e.g. if the provider is accessed
+// over an RPC channel that has operational problems), this function will
+// return false if the schema cannot be retrieved, under the assumption that
+// a subsequent call to do anything with the resource type would fail
+// anyway.
+func ProviderHasResource(provider Interface, typeName string) bool {
+        resp := provider.GetSchema()
+        if resp.Diagnostics.HasErrors() {
+                return false
+        }
+
+        _, exists := resp.ResourceTypes[typeName]
+        return exists
+}
+
+// ProviderHasDataSource is a helper that requests schema from the given
+// provider and checks if it has a data source of the given name.
+//
+// This function is more expensive than it may first appear since it must
+// retrieve the entire schema from the underlying provider, and so it should
+// be used sparingly and especially not in tight loops.
+//
+// Since retrieving the provider may fail (e.g. if the provider is accessed
+// over an RPC channel that has operational problems), this function will
+// return false if the schema cannot be retrieved, under the assumption that
+// a subsequent call to do anything with the data source would fail
+// anyway.
+func ProviderHasDataSource(provider Interface, dataSourceName string) bool {
+        resp := provider.GetSchema()
+        if resp.Diagnostics.HasErrors() {
+                return false
+        }
+
+        _, exists := resp.DataSources[dataSourceName]
+        return exists
+}
diff --git a/vendor/github.com/hashicorp/terraform/provisioners/doc.go b/vendor/github.com/hashicorp/terraform/provisioners/doc.go
new file mode 100644
index 0000000..b03ba9a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/provisioners/doc.go
@@ -0,0 +1,3 @@
+// Package provisioners contains the interface and primary types to implement a
+// Terraform resource provisioner.
+package provisioners
diff --git a/vendor/github.com/hashicorp/terraform/provisioners/factory.go b/vendor/github.com/hashicorp/terraform/provisioners/factory.go
new file mode 100644
index 0000000..590b97a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/provisioners/factory.go
@@ -0,0 +1,19 @@
+package provisioners
+
+// Factory is a function type that creates a new instance of a resource
+// provisioner, or returns an error if that is impossible.
+type Factory func() (Interface, error)
+
+// FactoryFixed is a helper that creates a Factory that just returns some given
+// single provisioner.
+//
+// Unlike usual factories, the exact same instance is returned for each call
+// to the factory and so this must be used in only specialized situations where
+// the caller can take care to either not mutate the given provider at all
+// or to mutate it in ways that will not cause unexpected behavior for others
+// holding the same reference.
+func FactoryFixed(p Interface) Factory {
+        return func() (Interface, error) {
+                return p, nil
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/provisioners/provisioner.go b/vendor/github.com/hashicorp/terraform/provisioners/provisioner.go
new file mode 100644
index 0000000..e53c884
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/provisioners/provisioner.go
@@ -0,0 +1,82 @@
+package provisioners
+
+import (
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Interface is the set of methods required for a resource provisioner plugin.
+type Interface interface {
+        // GetSchema returns the schema for the provisioner configuration.
+        GetSchema() GetSchemaResponse
+
+        // ValidateProvisionerConfig allows the provisioner to validate the
+        // configuration values.
+        ValidateProvisionerConfig(ValidateProvisionerConfigRequest) ValidateProvisionerConfigResponse
+
+        // ProvisionResource runs the provisioner with provided configuration.
+        // ProvisionResource blocks until the execution is complete.
+        // If the returned diagnostics contain any errors, the resource will be
+        // left in a tainted state.
+        ProvisionResource(ProvisionResourceRequest) ProvisionResourceResponse
+
+        // Stop is called to interrupt the provisioner.
+        //
+        // Stop should not block waiting for in-flight actions to complete. It
+        // should take any action it wants and return immediately acknowledging it
+        // has received the stop request. Terraform will not make any further API
+        // calls to the provisioner after Stop is called.
+        //
+        // The error returned, if non-nil, is assumed to mean that signaling the
+        // stop somehow failed and that the user should expect potentially waiting
+        // a longer period of time.
+        Stop() error
+
+        // Close shuts down the plugin process if applicable.
+        Close() error
+}
+
+type GetSchemaResponse struct {
+        // Provisioner contains the schema for this provisioner.
+        Provisioner *configschema.Block
+
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+// UIOutput provides the Output method for resource provisioner
+// plugins to write any output to the UI.
+//
+// Provisioners may call the Output method multiple times while Apply is in
+// progress. It is invalid to call Output after Apply returns.
+type UIOutput interface {
+        Output(string)
+}
+
+type ValidateProvisionerConfigRequest struct {
+        // Config is the complete configuration to be used for the provisioner.
+        Config cty.Value
+}
+
+type ValidateProvisionerConfigResponse struct {
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
+
+type ProvisionResourceRequest struct {
+        // Config is the complete provisioner configuration.
+        Config cty.Value
+
+        // Connection contains any information required to access the resource
+        // instance.
+        Connection cty.Value
+
+        // UIOutput is used to return output during the Apply operation.
+        UIOutput UIOutput
+}
+
+type ProvisionResourceResponse struct {
+        // Diagnostics contains any warnings or errors from the method call.
+        Diagnostics tfdiags.Diagnostics
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/client.go b/vendor/github.com/hashicorp/terraform/registry/client.go
index a18e6b8..93424d1 100644
--- a/vendor/github.com/hashicorp/terraform/registry/client.go
+++ b/vendor/github.com/hashicorp/terraform/registry/client.go
@@ -20,10 +20,11 @@ import (
 )
 
 const (
-        xTerraformGet     = "X-Terraform-Get"
-        xTerraformVersion = "X-Terraform-Version"
-        requestTimeout    = 10 * time.Second
-        serviceID         = "modules.v1"
+        xTerraformGet      = "X-Terraform-Get"
+        xTerraformVersion  = "X-Terraform-Version"
+        requestTimeout     = 10 * time.Second
+        modulesServiceID   = "modules.v1"
+        providersServiceID = "providers.v1"
 )
 
 var tfVersion = version.String()
@@ -58,10 +59,10 @@ func NewClient(services *disco.Disco, client *http.Client) *Client {
 }
 
 // Discover queries the host, and returns the url for the registry.
-func (c *Client) Discover(host svchost.Hostname) (*url.URL, error) {
+func (c *Client) Discover(host svchost.Hostname, serviceID string) (*url.URL, error) {
         service, err := c.services.DiscoverServiceURL(host, serviceID)
         if err != nil {
-                return nil, err
+                return nil, &ServiceUnreachableError{err}
         }
         if !strings.HasSuffix(service.Path, "/") {
                 service.Path += "/"
@@ -69,14 +70,14 @@ func (c *Client) Discover(host svchost.Hostname) (*url.URL, error) {
         return service, nil
 }
 
-// Versions queries the registry for a module, and returns the available versions.
-func (c *Client) Versions(module *regsrc.Module) (*response.ModuleVersions, error) {
+// ModuleVersions queries the registry for a module, and returns the available versions.
+func (c *Client) ModuleVersions(module *regsrc.Module) (*response.ModuleVersions, error) {
         host, err := module.SvcHost()
         if err != nil {
                 return nil, err
         }
 
-        service, err := c.Discover(host)
+        service, err := c.Discover(host, modulesServiceID)
         if err != nil {
                 return nil, err
         }
@@ -141,15 +142,15 @@ func (c *Client) addRequestCreds(host svchost.Hostname, req *http.Request) {
         }
 }
 
-// Location find the download location for a specific version module.
+// ModuleLocation find the download location for a specific version module.
 // This returns a string, because the final location may contain special go-getter syntax.
-func (c *Client) Location(module *regsrc.Module, version string) (string, error) {
+func (c *Client) ModuleLocation(module *regsrc.Module, version string) (string, error) {
         host, err := module.SvcHost()
         if err != nil {
                 return "", err
         }
 
-        service, err := c.Discover(host)
+        service, err := c.Discover(host, modulesServiceID)
         if err != nil {
                 return "", err
         }
@@ -225,3 +226,118 @@ func (c *Client) Location(module *regsrc.Module, version string) (string, error)
 
         return location, nil
 }
+
+// TerraformProviderVersions queries the registry for a provider, and returns the available versions.
+func (c *Client) TerraformProviderVersions(provider *regsrc.TerraformProvider) (*response.TerraformProviderVersions, error) {
+        host, err := provider.SvcHost()
+        if err != nil {
+                return nil, err
+        }
+
+        service, err := c.Discover(host, providersServiceID)
+        if err != nil {
+                return nil, err
+        }
+
+        p, err := url.Parse(path.Join(provider.TerraformProvider(), "versions"))
+        if err != nil {
+                return nil, err
+        }
+
+        service = service.ResolveReference(p)
+
+        log.Printf("[DEBUG] fetching provider versions from %q", service)
+
+        req, err := http.NewRequest("GET", service.String(), nil)
+        if err != nil {
+                return nil, err
+        }
+
+        c.addRequestCreds(host, req)
+        req.Header.Set(xTerraformVersion, tfVersion)
+
+        resp, err := c.client.Do(req)
+        if err != nil {
+                return nil, err
+        }
+        defer resp.Body.Close()
+
+        switch resp.StatusCode {
+        case http.StatusOK:
+                // OK
+        case http.StatusNotFound:
+                return nil, &errProviderNotFound{addr: provider}
+        default:
+                return nil, fmt.Errorf("error looking up provider versions: %s", resp.Status)
+        }
+
+        var versions response.TerraformProviderVersions
+
+        dec := json.NewDecoder(resp.Body)
+        if err := dec.Decode(&versions); err != nil {
+                return nil, err
+        }
+
+        return &versions, nil
+}
+
+// TerraformProviderLocation queries the registry for a provider download metadata
+func (c *Client) TerraformProviderLocation(provider *regsrc.TerraformProvider, version string) (*response.TerraformProviderPlatformLocation, error) {
+        host, err := provider.SvcHost()
+        if err != nil {
+                return nil, err
+        }
+
+        service, err := c.Discover(host, providersServiceID)
+        if err != nil {
+                return nil, err
+        }
+
+        p, err := url.Parse(path.Join(
+                provider.TerraformProvider(),
+                version,
+                "download",
+                provider.OS,
+                provider.Arch,
+        ))
+        if err != nil {
+                return nil, err
+        }
+
+        service = service.ResolveReference(p)
+
+        log.Printf("[DEBUG] fetching provider location from %q", service)
+
+        req, err := http.NewRequest("GET", service.String(), nil)
+        if err != nil {
+                return nil, err
+        }
+
+        c.addRequestCreds(host, req)
+        req.Header.Set(xTerraformVersion, tfVersion)
+
+        resp, err := c.client.Do(req)
+        if err != nil {
+                return nil, err
+        }
+        defer resp.Body.Close()
+
+        var loc response.TerraformProviderPlatformLocation
+
+        dec := json.NewDecoder(resp.Body)
+        if err := dec.Decode(&loc); err != nil {
+                return nil, err
+        }
+
+        switch resp.StatusCode {
+        case http.StatusOK, http.StatusNoContent:
+                // OK
+        case http.StatusNotFound:
+                return nil, fmt.Errorf("provider %q version %q not found", provider.TerraformProvider(), version)
+        default:
+                // anything else is an error:
+                return nil, fmt.Errorf("error getting download location for %q: %s", provider.TerraformProvider(), resp.Status)
+        }
+
+        return &loc, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/errors.go b/vendor/github.com/hashicorp/terraform/registry/errors.go
index b8dcd31..5a6a31b 100644
--- a/vendor/github.com/hashicorp/terraform/registry/errors.go
+++ b/vendor/github.com/hashicorp/terraform/registry/errors.go
@@ -4,6 +4,7 @@ import (
         "fmt"
 
         "github.com/hashicorp/terraform/registry/regsrc"
+        "github.com/hashicorp/terraform/svchost/disco"
 )
 
 type errModuleNotFound struct {
@@ -21,3 +22,42 @@ func IsModuleNotFound(err error) bool {
         _, ok := err.(*errModuleNotFound)
         return ok
 }
+
+type errProviderNotFound struct {
+        addr *regsrc.TerraformProvider
+}
+
+func (e *errProviderNotFound) Error() string {
+        return fmt.Sprintf("provider %s not found", e.addr)
+}
+
+// IsProviderNotFound returns true only if the given error is a "provider not found"
+// error. This allows callers to recognize this particular error condition
+// as distinct from operational errors such as poor network connectivity.
+func IsProviderNotFound(err error) bool {
+        _, ok := err.(*errProviderNotFound)
+        return ok
+}
+
+// IsServiceNotProvided returns true only if the given error is a "service not provided"
+// error. This allows callers to recognize this particular error condition
+// as distinct from operational errors such as poor network connectivity.
+func IsServiceNotProvided(err error) bool {
+        _, ok := err.(*disco.ErrServiceNotProvided)
+        return ok
+}
+
+// ServiceUnreachableError Registry service is unreachable
+type ServiceUnreachableError struct {
+        err error
+}
+
+func (e *ServiceUnreachableError) Error() string {
+        return e.err.Error()
+}
+
+// IsServiceUnreachable returns true if the registry/discovery service was unreachable
+func IsServiceUnreachable(err error) bool {
+        _, ok := err.(*ServiceUnreachableError)
+        return ok
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/regsrc/terraform_provider.go b/vendor/github.com/hashicorp/terraform/registry/regsrc/terraform_provider.go
new file mode 100644
index 0000000..58dedee
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/regsrc/terraform_provider.go
@@ -0,0 +1,60 @@
+package regsrc
+
+import (
+        "fmt"
+        "runtime"
+        "strings"
+
+        "github.com/hashicorp/terraform/svchost"
+)
+
+var (
+        // DefaultProviderNamespace represents the namespace for canonical
+        // HashiCorp-controlled providers.
+        DefaultProviderNamespace = "-"
+)
+
+// TerraformProvider describes a Terraform Registry Provider source.
+type TerraformProvider struct {
+        RawHost      *FriendlyHost
+        RawNamespace string
+        RawName      string
+        OS           string
+        Arch         string
+}
+
+// NewTerraformProvider constructs a new provider source.
+func NewTerraformProvider(name, os, arch string) *TerraformProvider {
+        if os == "" {
+                os = runtime.GOOS
+        }
+        if arch == "" {
+                arch = runtime.GOARCH
+        }
+
+        // separate namespace if included
+        namespace := DefaultProviderNamespace
+        if names := strings.SplitN(name, "/", 2); len(names) == 2 {
+                namespace, name = names[0], names[1]
+        }
+        p := &TerraformProvider{
+                RawHost:      PublicRegistryHost,
+                RawNamespace: namespace,
+                RawName:      name,
+                OS:           os,
+                Arch:         arch,
+        }
+
+        return p
+}
+
+// Provider returns just the registry ID of the provider
+func (p *TerraformProvider) TerraformProvider() string {
+        return fmt.Sprintf("%s/%s", p.RawNamespace, p.RawName)
+}
+
+// SvcHost returns the svchost.Hostname for this provider. The
+// default PublicRegistryHost is returned.
+func (p *TerraformProvider) SvcHost() (svchost.Hostname, error) {
+        return svchost.ForComparison(PublicRegistryHost.Raw)
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/provider.go b/vendor/github.com/hashicorp/terraform/registry/response/provider.go
new file mode 100644
index 0000000..5e8bae3
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/provider.go
@@ -0,0 +1,36 @@
+package response
+
+import (
+        "time"
+)
+
+// Provider is the response structure with the data for a single provider
+// version. This is just the metadata. A full provider response will be
+// ProviderDetail.
+type Provider struct {
+        ID string `json:"id"`
+
+        //---------------------------------------------------------------
+        // Metadata about the overall provider.
+
+        Owner       string    `json:"owner"`
+        Namespace   string    `json:"namespace"`
+        Name        string    `json:"name"`
+        Version     string    `json:"version"`
+        Description string    `json:"description"`
+        Source      string    `json:"source"`
+        PublishedAt time.Time `json:"published_at"`
+        Downloads   int       `json:"downloads"`
+}
+
+// ProviderDetail represents a Provider with full detail.
+type ProviderDetail struct {
+        Provider
+
+        //---------------------------------------------------------------
+        // The fields below are only set when requesting this specific
+        // module. They are available to easily know all available versions
+        // without multiple API calls.
+
+        Versions []string `json:"versions"` // All versions
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/provider_list.go b/vendor/github.com/hashicorp/terraform/registry/response/provider_list.go
new file mode 100644
index 0000000..1dc7d23
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/provider_list.go
@@ -0,0 +1,7 @@
+package response
+
+// ProviderList is the response structure for a pageable list of providers.
+type ProviderList struct {
+        Meta      PaginationMeta `json:"meta"`
+        Providers []*Provider    `json:"providers"`
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/terraform_provider.go b/vendor/github.com/hashicorp/terraform/registry/response/terraform_provider.go
new file mode 100644
index 0000000..64e454a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/terraform_provider.go
@@ -0,0 +1,96 @@
+package response
+
+import (
+        "sort"
+        "strings"
+
+        version "github.com/hashicorp/go-version"
+)
+
+// TerraformProvider is the response structure for all required information for
+// Terraform to choose a download URL. It must include all versions and all
+// platforms for Terraform to perform version and os/arch constraint matching
+// locally.
+type TerraformProvider struct {
+        ID       string `json:"id"`
+        Verified bool   `json:"verified"`
+
+        Versions []*TerraformProviderVersion `json:"versions"`
+}
+
+// TerraformProviderVersion is the Terraform-specific response structure for a
+// provider version.
+type TerraformProviderVersion struct {
+        Version   string   `json:"version"`
+        Protocols []string `json:"protocols"`
+
+        Platforms []*TerraformProviderPlatform `json:"platforms"`
+}
+
+// TerraformProviderVersions is the Terraform-specific response structure for an
+// array of provider versions
+type TerraformProviderVersions struct {
+        ID       string                      `json:"id"`
+        Versions []*TerraformProviderVersion `json:"versions"`
+        Warnings []string                    `json:"warnings"`
+}
+
+// TerraformProviderPlatform is the Terraform-specific response structure for a
+// provider platform.
+type TerraformProviderPlatform struct {
+        OS   string `json:"os"`
+        Arch string `json:"arch"`
+}
+
+// TerraformProviderPlatformLocation is the Terraform-specific response
+// structure for a provider platform with all details required to perform a
+// download.
+type TerraformProviderPlatformLocation struct {
+        Protocols           []string `json:"protocols"`
+        OS                  string   `json:"os"`
+        Arch                string   `json:"arch"`
+        Filename            string   `json:"filename"`
+        DownloadURL         string   `json:"download_url"`
+        ShasumsURL          string   `json:"shasums_url"`
+        ShasumsSignatureURL string   `json:"shasums_signature_url"`
+        Shasum              string   `json:"shasum"`
+
+        SigningKeys SigningKeyList `json:"signing_keys"`
+}
+
+// SigningKeyList is the response structure for a list of signing keys.
+type SigningKeyList struct {
+        GPGKeys []*GPGKey `json:"gpg_public_keys"`
+}
+
+// GPGKey is the response structure for a GPG key.
+type GPGKey struct {
+        ASCIIArmor string  `json:"ascii_armor"`
+        Source     string  `json:"source"`
+        SourceURL  *string `json:"source_url"`
+}
+
+// Collection type for TerraformProviderVersion
+type ProviderVersionCollection []*TerraformProviderVersion
+
+// GPGASCIIArmor returns an ASCII-armor-formatted string for all of the gpg
+// keys in the response.
+func (signingKeys *SigningKeyList) GPGASCIIArmor() string {
+        keys := []string{}
+
+        for _, gpgKey := range signingKeys.GPGKeys {
+                keys = append(keys, gpgKey.ASCIIArmor)
+        }
+
+        return strings.Join(keys, "\n")
+}
+
+// Sort sorts versions from newest to oldest.
+func (v ProviderVersionCollection) Sort() {
+        sort.Slice(v, func(i, j int) bool {
+                versionA, _ := version.NewVersion(v[i].Version)
+                versionB, _ := version.NewVersion(v[j].Version)
+
+                return versionA.GreaterThan(versionB)
+        })
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/doc.go b/vendor/github.com/hashicorp/terraform/states/doc.go
new file mode 100644
index 0000000..7dd74ac
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/doc.go
@@ -0,0 +1,3 @@
+// Package states contains the types that are used to represent Terraform
+// states.
+package states
diff --git a/vendor/github.com/hashicorp/terraform/states/eachmode_string.go b/vendor/github.com/hashicorp/terraform/states/eachmode_string.go
new file mode 100644
index 0000000..0dc7349
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/eachmode_string.go
@@ -0,0 +1,35 @@
+// Code generated by "stringer -type EachMode"; DO NOT EDIT.
+
+package states
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[NoEach-0]
+        _ = x[EachList-76]
+        _ = x[EachMap-77]
+}
+
+const (
+        _EachMode_name_0 = "NoEach"
+        _EachMode_name_1 = "EachListEachMap"
+)
+
+var (
+        _EachMode_index_1 = [...]uint8{0, 8, 15}
+)
+
+func (i EachMode) String() string {
+        switch {
+        case i == 0:
+                return _EachMode_name_0
+        case 76 <= i && i <= 77:
+                i -= 76
+                return _EachMode_name_1[_EachMode_index_1[i]:_EachMode_index_1[i+1]]
+        default:
+                return "EachMode(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/instance_generation.go b/vendor/github.com/hashicorp/terraform/states/instance_generation.go
new file mode 100644
index 0000000..617ad4e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/instance_generation.go
@@ -0,0 +1,24 @@
+package states
+
+// Generation is used to represent multiple objects in a succession of objects
+// represented by a single resource instance address. A resource instance can
+// have multiple generations over its lifetime due to object replacement
+// (when a change can't be applied without destroying and re-creating), and
+// multiple generations can exist at the same time when create_before_destroy
+// is used.
+//
+// A Generation value can either be the value of the variable "CurrentGen" or
+// a value of type DeposedKey. Generation values can be compared for equality
+// using "==" and used as map keys. The zero value of Generation (nil) is not
+// a valid generation and must not be used.
+type Generation interface {
+        generation()
+}
+
+// CurrentGen is the Generation representing the currently-active object for
+// a resource instance.
+var CurrentGen Generation
+
+type currentGen struct{}
+
+func (g currentGen) generation() {}
diff --git a/vendor/github.com/hashicorp/terraform/states/instance_object.go b/vendor/github.com/hashicorp/terraform/states/instance_object.go
new file mode 100644
index 0000000..1374c59
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/instance_object.go
@@ -0,0 +1,120 @@
+package states
+
+import (
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// ResourceInstanceObject is the local representation of a specific remote
+// object associated with a resource instance. In practice not all remote
+// objects are actually remote in the sense of being accessed over the network,
+// but this is the most common case.
+//
+// It is not valid to mutate a ResourceInstanceObject once it has been created.
+// Instead, create a new object and replace the existing one.
+type ResourceInstanceObject struct {
+        // Value is the object-typed value representing the remote object within
+        // Terraform.
+        Value cty.Value
+
+        // Private is an opaque value set by the provider when this object was
+        // last created or updated. Terraform Core does not use this value in
+        // any way and it is not exposed anywhere in the user interface, so
+        // a provider can use it for retaining any necessary private state.
+        Private []byte
+
+        // Status represents the "readiness" of the object as of the last time
+        // it was updated.
+        Status ObjectStatus
+
+        // Dependencies is a set of other addresses in the same module which
+        // this instance depended on when the given attributes were evaluated.
+        // This is used to construct the dependency relationships for an object
+        // whose configuration is no longer available, such as if it has been
+        // removed from configuration altogether, or is now deposed.
+        Dependencies []addrs.Referenceable
+}
+
+// ObjectStatus represents the status of a RemoteObject.
+type ObjectStatus rune
+
+//go:generate stringer -type ObjectStatus
+
+const (
+        // ObjectReady is an object status for an object that is ready to use.
+        ObjectReady ObjectStatus = 'R'
+
+        // ObjectTainted is an object status representing an object that is in
+        // an unrecoverable bad state due to a partial failure during a create,
+        // update, or delete operation. Since it cannot be moved into the
+        // ObjectRead state, a tainted object must be replaced.
+        ObjectTainted ObjectStatus = 'T'
+
+        // ObjectPlanned is a special object status used only for the transient
+        // placeholder objects we place into state during the refresh and plan
+        // walks to stand in for objects that will be created during apply.
+        //
+        // Any object of this status must have a corresponding change recorded
+        // in the current plan, whose value must then be used in preference to
+        // the value stored in state when evaluating expressions. A planned
+        // object stored in state will be incomplete if any of its attributes are
+        // not yet known, and the plan must be consulted in order to "see" those
+        // unknown values, because the state is not able to represent them.
+        ObjectPlanned ObjectStatus = 'P'
+)
+
+// Encode marshals the value within the receiver to produce a
+// ResourceInstanceObjectSrc ready to be written to a state file.
+//
+// The given type must be the implied type of the resource type schema, and
+// the given value must conform to it. It is important to pass the schema
+// type and not the object's own type so that dynamically-typed attributes
+// will be stored correctly. The caller must also provide the version number
+// of the schema that the given type was derived from, which will be recorded
+// in the source object so it can be used to detect when schema migration is
+// required on read.
+//
+// The returned object may share internal references with the receiver and
+// so the caller must not mutate the receiver any further once once this
+// method is called.
+func (o *ResourceInstanceObject) Encode(ty cty.Type, schemaVersion uint64) (*ResourceInstanceObjectSrc, error) {
+        // Our state serialization can't represent unknown values, so we convert
+        // them to nulls here. This is lossy, but nobody should be writing unknown
+        // values here and expecting to get them out again later.
+        //
+        // We get unknown values here while we're building out a "planned state"
+        // during the plan phase, but the value stored in the plan takes precedence
+        // for expression evaluation. The apply step should never produce unknown
+        // values, but if it does it's the responsibility of the caller to detect
+        // and raise an error about that.
+        val := cty.UnknownAsNull(o.Value)
+
+        src, err := ctyjson.Marshal(val, ty)
+        if err != nil {
+                return nil, err
+        }
+
+        return &ResourceInstanceObjectSrc{
+                SchemaVersion: schemaVersion,
+                AttrsJSON:     src,
+                Private:       o.Private,
+                Status:        o.Status,
+                Dependencies:  o.Dependencies,
+        }, nil
+}
+
+// AsTainted returns a deep copy of the receiver with the status updated to
+// ObjectTainted.
+func (o *ResourceInstanceObject) AsTainted() *ResourceInstanceObject {
+        if o == nil {
+                // A nil object can't be tainted, but we'll allow this anyway to
+                // avoid a crash, since we presumably intend to eventually record
+                // the object has having been deleted anyway.
+                return nil
+        }
+        ret := o.DeepCopy()
+        ret.Status = ObjectTainted
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/instance_object_src.go b/vendor/github.com/hashicorp/terraform/states/instance_object_src.go
new file mode 100644
index 0000000..6cb3c27
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/instance_object_src.go
@@ -0,0 +1,113 @@
+package states
+
+import (
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+)
+
+// ResourceInstanceObjectSrc is a not-fully-decoded version of
+// ResourceInstanceObject. Decoding of it can be completed by first handling
+// any schema migration steps to get to the latest schema version and then
+// calling method Decode with the implied type of the latest schema.
+type ResourceInstanceObjectSrc struct {
+        // SchemaVersion is the resource-type-specific schema version number that
+        // was current when either AttrsJSON or AttrsFlat was encoded. Migration
+        // steps are required if this is less than the current version number
+        // reported by the corresponding provider.
+        SchemaVersion uint64
+
+        // AttrsJSON is a JSON-encoded representation of the object attributes,
+        // encoding the value (of the object type implied by the associated resource
+        // type schema) that represents this remote object in Terraform Language
+        // expressions, and is compared with configuration when producing a diff.
+        //
+        // This is retained in JSON format here because it may require preprocessing
+        // before decoding if, for example, the stored attributes are for an older
+        // schema version which the provider must upgrade before use. If the
+        // version is current, it is valid to simply decode this using the
+        // type implied by the current schema, without the need for the provider
+        // to perform an upgrade first.
+        //
+        // When writing a ResourceInstanceObject into the state, AttrsJSON should
+        // always be conformant to the current schema version and the current
+        // schema version should be recorded in the SchemaVersion field.
+        AttrsJSON []byte
+
+        // AttrsFlat is a legacy form of attributes used in older state file
+        // formats, and in the new state format for objects that haven't yet been
+        // upgraded. This attribute is mutually exclusive with Attrs: for any
+        // ResourceInstanceObject, only one of these attributes may be populated
+        // and the other must be nil.
+        //
+        // An instance object with this field populated should be upgraded to use
+        // Attrs at the earliest opportunity, since this legacy flatmap-based
+        // format will be phased out over time. AttrsFlat should not be used when
+        // writing new or updated objects to state; instead, callers must follow
+        // the recommendations in the AttrsJSON documentation above.
+        AttrsFlat map[string]string
+
+        // These fields all correspond to the fields of the same name on
+        // ResourceInstanceObject.
+        Private      []byte
+        Status       ObjectStatus
+        Dependencies []addrs.Referenceable
+}
+
+// Decode unmarshals the raw representation of the object attributes. Pass the
+// implied type of the corresponding resource type schema for correct operation.
+//
+// Before calling Decode, the caller must check that the SchemaVersion field
+// exactly equals the version number of the schema whose implied type is being
+// passed, or else the result is undefined.
+//
+// The returned object may share internal references with the receiver and
+// so the caller must not mutate the receiver any further once once this
+// method is called.
+func (os *ResourceInstanceObjectSrc) Decode(ty cty.Type) (*ResourceInstanceObject, error) {
+        var val cty.Value
+        var err error
+        if os.AttrsFlat != nil {
+                // Legacy mode. We'll do our best to unpick this from the flatmap.
+                val, err = hcl2shim.HCL2ValueFromFlatmap(os.AttrsFlat, ty)
+                if err != nil {
+                        return nil, err
+                }
+        } else {
+                val, err = ctyjson.Unmarshal(os.AttrsJSON, ty)
+                if err != nil {
+                        return nil, err
+                }
+        }
+
+        return &ResourceInstanceObject{
+                Value:        val,
+                Status:       os.Status,
+                Dependencies: os.Dependencies,
+                Private:      os.Private,
+        }, nil
+}
+
+// CompleteUpgrade creates a new ResourceInstanceObjectSrc by copying the
+// metadata from the receiver and writing in the given new schema version
+// and attribute value that are presumed to have resulted from upgrading
+// from an older schema version.
+func (os *ResourceInstanceObjectSrc) CompleteUpgrade(newAttrs cty.Value, newType cty.Type, newSchemaVersion uint64) (*ResourceInstanceObjectSrc, error) {
+        new := os.DeepCopy()
+        new.AttrsFlat = nil // We always use JSON after an upgrade, even if the source used flatmap
+
+        // This is the same principle as ResourceInstanceObject.Encode, but
+        // avoiding a decode/re-encode cycle because we don't have type info
+        // available for the "old" attributes.
+        newAttrs = cty.UnknownAsNull(newAttrs)
+        src, err := ctyjson.Marshal(newAttrs, newType)
+        if err != nil {
+                return nil, err
+        }
+
+        new.AttrsJSON = src
+        new.SchemaVersion = newSchemaVersion
+        return new, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/module.go b/vendor/github.com/hashicorp/terraform/states/module.go
new file mode 100644
index 0000000..d89e787
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/module.go
@@ -0,0 +1,285 @@
+package states
+
+import (
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Module is a container for the states of objects within a particular module.
+type Module struct {
+        Addr addrs.ModuleInstance
+
+        // Resources contains the state for each resource. The keys in this map are
+        // an implementation detail and must not be used by outside callers.
+        Resources map[string]*Resource
+
+        // OutputValues contains the state for each output value. The keys in this
+        // map are output value names.
+        OutputValues map[string]*OutputValue
+
+        // LocalValues contains the value for each named output value. The keys
+        // in this map are local value names.
+        LocalValues map[string]cty.Value
+}
+
+// NewModule constructs an empty module state for the given module address.
+func NewModule(addr addrs.ModuleInstance) *Module {
+        return &Module{
+                Addr:         addr,
+                Resources:    map[string]*Resource{},
+                OutputValues: map[string]*OutputValue{},
+                LocalValues:  map[string]cty.Value{},
+        }
+}
+
+// Resource returns the state for the resource with the given address within
+// the receiving module state, or nil if the requested resource is not tracked
+// in the state.
+func (ms *Module) Resource(addr addrs.Resource) *Resource {
+        return ms.Resources[addr.String()]
+}
+
+// ResourceInstance returns the state for the resource instance with the given
+// address within the receiving module state, or nil if the requested instance
+// is not tracked in the state.
+func (ms *Module) ResourceInstance(addr addrs.ResourceInstance) *ResourceInstance {
+        rs := ms.Resource(addr.Resource)
+        if rs == nil {
+                return nil
+        }
+        return rs.Instance(addr.Key)
+}
+
+// SetResourceMeta updates the resource-level metadata for the resource
+// with the given address, creating the resource state for it if it doesn't
+// already exist.
+func (ms *Module) SetResourceMeta(addr addrs.Resource, eachMode EachMode, provider addrs.AbsProviderConfig) {
+        rs := ms.Resource(addr)
+        if rs == nil {
+                rs = &Resource{
+                        Addr:      addr,
+                        Instances: map[addrs.InstanceKey]*ResourceInstance{},
+                }
+                ms.Resources[addr.String()] = rs
+        }
+
+        rs.EachMode = eachMode
+        rs.ProviderConfig = provider
+}
+
+// RemoveResource removes the entire state for the given resource, taking with
+// it any instances associated with the resource. This should generally be
+// called only for resource objects whose instances have all been destroyed.
+func (ms *Module) RemoveResource(addr addrs.Resource) {
+        delete(ms.Resources, addr.String())
+}
+
+// SetResourceInstanceCurrent saves the given instance object as the current
+// generation of the resource instance with the given address, simulataneously
+// updating the recorded provider configuration address, dependencies, and
+// resource EachMode.
+//
+// Any existing current instance object for the given resource is overwritten.
+// Set obj to nil to remove the primary generation object altogether. If there
+// are no deposed objects then the instance will be removed altogether.
+//
+// The provider address and "each mode" are resource-wide settings and so they
+// are updated for all other instances of the same resource as a side-effect of
+// this call.
+func (ms *Module) SetResourceInstanceCurrent(addr addrs.ResourceInstance, obj *ResourceInstanceObjectSrc, provider addrs.AbsProviderConfig) {
+        ms.SetResourceMeta(addr.Resource, eachModeForInstanceKey(addr.Key), provider)
+
+        rs := ms.Resource(addr.Resource)
+        is := rs.EnsureInstance(addr.Key)
+
+        is.Current = obj
+
+        if !is.HasObjects() {
+                // If we have no objects at all then we'll clean up.
+                delete(rs.Instances, addr.Key)
+        }
+        if rs.EachMode == NoEach && len(rs.Instances) == 0 {
+                // Also clean up if we only expect to have one instance anyway
+                // and there are none. We leave the resource behind if an each mode
+                // is active because an empty list or map of instances is a valid state.
+                delete(ms.Resources, addr.Resource.String())
+        }
+}
+
+// SetResourceInstanceDeposed saves the given instance object as a deposed
+// generation of the resource instance with the given address and deposed key.
+//
+// Call this method only for pre-existing deposed objects that already have
+// a known DeposedKey. For example, this method is useful if reloading objects
+// that were persisted to a state file. To mark the current object as deposed,
+// use DeposeResourceInstanceObject instead.
+//
+// The resource that contains the given instance must already exist in the
+// state, or this method will panic. Use Resource to check first if its
+// presence is not already guaranteed.
+//
+// Any existing current instance object for the given resource and deposed key
+// is overwritten. Set obj to nil to remove the deposed object altogether. If
+// the instance is left with no objects after this operation then it will
+// be removed from its containing resource altogether.
+func (ms *Module) SetResourceInstanceDeposed(addr addrs.ResourceInstance, key DeposedKey, obj *ResourceInstanceObjectSrc, provider addrs.AbsProviderConfig) {
+        ms.SetResourceMeta(addr.Resource, eachModeForInstanceKey(addr.Key), provider)
+
+        rs := ms.Resource(addr.Resource)
+        is := rs.EnsureInstance(addr.Key)
+        if obj != nil {
+                is.Deposed[key] = obj
+        } else {
+                delete(is.Deposed, key)
+        }
+
+        if !is.HasObjects() {
+                // If we have no objects at all then we'll clean up.
+                delete(rs.Instances, addr.Key)
+        }
+        if rs.EachMode == NoEach && len(rs.Instances) == 0 {
+                // Also clean up if we only expect to have one instance anyway
+                // and there are none. We leave the resource behind if an each mode
+                // is active because an empty list or map of instances is a valid state.
+                delete(ms.Resources, addr.Resource.String())
+        }
+}
+
+// ForgetResourceInstanceAll removes the record of all objects associated with
+// the specified resource instance, if present. If not present, this is a no-op.
+func (ms *Module) ForgetResourceInstanceAll(addr addrs.ResourceInstance) {
+        rs := ms.Resource(addr.Resource)
+        if rs == nil {
+                return
+        }
+        delete(rs.Instances, addr.Key)
+
+        if rs.EachMode == NoEach && len(rs.Instances) == 0 {
+                // Also clean up if we only expect to have one instance anyway
+                // and there are none. We leave the resource behind if an each mode
+                // is active because an empty list or map of instances is a valid state.
+                delete(ms.Resources, addr.Resource.String())
+        }
+}
+
+// ForgetResourceInstanceDeposed removes the record of the deposed object with
+// the given address and key, if present. If not present, this is a no-op.
+func (ms *Module) ForgetResourceInstanceDeposed(addr addrs.ResourceInstance, key DeposedKey) {
+        rs := ms.Resource(addr.Resource)
+        if rs == nil {
+                return
+        }
+        is := rs.Instance(addr.Key)
+        if is == nil {
+                return
+        }
+        delete(is.Deposed, key)
+
+        if !is.HasObjects() {
+                // If we have no objects at all then we'll clean up.
+                delete(rs.Instances, addr.Key)
+        }
+        if rs.EachMode == NoEach && len(rs.Instances) == 0 {
+                // Also clean up if we only expect to have one instance anyway
+                // and there are none. We leave the resource behind if an each mode
+                // is active because an empty list or map of instances is a valid state.
+                delete(ms.Resources, addr.Resource.String())
+        }
+}
+
+// deposeResourceInstanceObject is the real implementation of
+// SyncState.DeposeResourceInstanceObject.
+func (ms *Module) deposeResourceInstanceObject(addr addrs.ResourceInstance, forceKey DeposedKey) DeposedKey {
+        is := ms.ResourceInstance(addr)
+        if is == nil {
+                return NotDeposed
+        }
+        return is.deposeCurrentObject(forceKey)
+}
+
+// maybeRestoreResourceInstanceDeposed is the real implementation of
+// SyncState.MaybeRestoreResourceInstanceDeposed.
+func (ms *Module) maybeRestoreResourceInstanceDeposed(addr addrs.ResourceInstance, key DeposedKey) bool {
+        rs := ms.Resource(addr.Resource)
+        if rs == nil {
+                return false
+        }
+        is := rs.Instance(addr.Key)
+        if is == nil {
+                return false
+        }
+        if is.Current != nil {
+                return false
+        }
+        if len(is.Deposed) == 0 {
+                return false
+        }
+        is.Current = is.Deposed[key]
+        delete(is.Deposed, key)
+        return true
+}
+
+// SetOutputValue writes an output value into the state, overwriting any
+// existing value of the same name.
+func (ms *Module) SetOutputValue(name string, value cty.Value, sensitive bool) *OutputValue {
+        os := &OutputValue{
+                Value:     value,
+                Sensitive: sensitive,
+        }
+        ms.OutputValues[name] = os
+        return os
+}
+
+// RemoveOutputValue removes the output value of the given name from the state,
+// if it exists. This method is a no-op if there is no value of the given
+// name.
+func (ms *Module) RemoveOutputValue(name string) {
+        delete(ms.OutputValues, name)
+}
+
+// SetLocalValue writes a local value into the state, overwriting any
+// existing value of the same name.
+func (ms *Module) SetLocalValue(name string, value cty.Value) {
+        ms.LocalValues[name] = value
+}
+
+// RemoveLocalValue removes the local value of the given name from the state,
+// if it exists. This method is a no-op if there is no value of the given
+// name.
+func (ms *Module) RemoveLocalValue(name string) {
+        delete(ms.LocalValues, name)
+}
+
+// PruneResourceHusks is a specialized method that will remove any Resource
+// objects that do not contain any instances, even if they have an EachMode.
+//
+// You probably shouldn't call this! See the method of the same name on
+// type State for more information on what this is for and the rare situations
+// where it is safe to use.
+func (ms *Module) PruneResourceHusks() {
+        for _, rs := range ms.Resources {
+                if len(rs.Instances) == 0 {
+                        ms.RemoveResource(rs.Addr)
+                }
+        }
+}
+
+// empty returns true if the receving module state is contributing nothing
+// to the state. In other words, it returns true if the module could be
+// removed from the state altogether without changing the meaning of the state.
+//
+// In practice a module containing no objects is the same as a non-existent
+// module, and so we can opportunistically clean up once a module becomes
+// empty on the assumption that it will be re-added if needed later.
+func (ms *Module) empty() bool {
+        if ms == nil {
+                return true
+        }
+
+        // This must be updated to cover any new collections added to Module
+        // in future.
+        return (len(ms.Resources) == 0 &&
+                len(ms.OutputValues) == 0 &&
+                len(ms.LocalValues) == 0)
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/objectstatus_string.go b/vendor/github.com/hashicorp/terraform/states/objectstatus_string.go
new file mode 100644
index 0000000..96a6db2
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/objectstatus_string.go
@@ -0,0 +1,33 @@
+// Code generated by "stringer -type ObjectStatus"; DO NOT EDIT.
+
+package states
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[ObjectReady-82]
+        _ = x[ObjectTainted-84]
+        _ = x[ObjectPlanned-80]
+}
+
+const (
+        _ObjectStatus_name_0 = "ObjectPlanned"
+        _ObjectStatus_name_1 = "ObjectReady"
+        _ObjectStatus_name_2 = "ObjectTainted"
+)
+
+func (i ObjectStatus) String() string {
+        switch {
+        case i == 80:
+                return _ObjectStatus_name_0
+        case i == 82:
+                return _ObjectStatus_name_1
+        case i == 84:
+                return _ObjectStatus_name_2
+        default:
+                return "ObjectStatus(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/output_value.go b/vendor/github.com/hashicorp/terraform/states/output_value.go
new file mode 100644
index 0000000..d232b76
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/output_value.go
@@ -0,0 +1,14 @@
+package states
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// OutputValue represents the state of a particular output value.
+//
+// It is not valid to mutate an OutputValue object once it has been created.
+// Instead, create an entirely new OutputValue to replace the previous one.
+type OutputValue struct {
+        Value     cty.Value
+        Sensitive bool
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/resource.go b/vendor/github.com/hashicorp/terraform/states/resource.go
new file mode 100644
index 0000000..e2a2b85
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/resource.go
@@ -0,0 +1,239 @@
+package states
+
+import (
+        "fmt"
+        "math/rand"
+        "time"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// Resource represents the state of a resource.
+type Resource struct {
+        // Addr is the module-relative address for the resource this state object
+        // belongs to.
+        Addr addrs.Resource
+
+        // EachMode is the multi-instance mode currently in use for this resource,
+        // or NoEach if this is a single-instance resource. This dictates what
+        // type of value is returned when accessing this resource via expressions
+        // in the Terraform language.
+        EachMode EachMode
+
+        // Instances contains the potentially-multiple instances associated with
+        // this resource. This map can contain a mixture of different key types,
+        // but only the ones of InstanceKeyType are considered current.
+        Instances map[addrs.InstanceKey]*ResourceInstance
+
+        // ProviderConfig is the absolute address for the provider configuration that
+        // most recently managed this resource. This is used to connect a resource
+        // with a provider configuration when the resource configuration block is
+        // not available, such as if it has been removed from configuration
+        // altogether.
+        ProviderConfig addrs.AbsProviderConfig
+}
+
+// Instance returns the state for the instance with the given key, or nil
+// if no such instance is tracked within the state.
+func (rs *Resource) Instance(key addrs.InstanceKey) *ResourceInstance {
+        return rs.Instances[key]
+}
+
+// EnsureInstance returns the state for the instance with the given key,
+// creating a new empty state for it if one doesn't already exist.
+//
+// Because this may create and save a new state, it is considered to be
+// a write operation.
+func (rs *Resource) EnsureInstance(key addrs.InstanceKey) *ResourceInstance {
+        ret := rs.Instance(key)
+        if ret == nil {
+                ret = NewResourceInstance()
+                rs.Instances[key] = ret
+        }
+        return ret
+}
+
+// ResourceInstance represents the state of a particular instance of a resource.
+type ResourceInstance struct {
+        // Current, if non-nil, is the remote object that is currently represented
+        // by the corresponding resource instance.
+        Current *ResourceInstanceObjectSrc
+
+        // Deposed, if len > 0, contains any remote objects that were previously
+        // represented by the corresponding resource instance but have been
+        // replaced and are pending destruction due to the create_before_destroy
+        // lifecycle mode.
+        Deposed map[DeposedKey]*ResourceInstanceObjectSrc
+}
+
+// NewResourceInstance constructs and returns a new ResourceInstance, ready to
+// use.
+func NewResourceInstance() *ResourceInstance {
+        return &ResourceInstance{
+                Deposed: map[DeposedKey]*ResourceInstanceObjectSrc{},
+        }
+}
+
+// HasCurrent returns true if this resource instance has a "current"-generation
+// object. Most instances do, but this can briefly be false during a
+// create-before-destroy replace operation when the current has been deposed
+// but its replacement has not yet been created.
+func (i *ResourceInstance) HasCurrent() bool {
+        return i != nil && i.Current != nil
+}
+
+// HasDeposed returns true if this resource instance has a deposed object
+// with the given key.
+func (i *ResourceInstance) HasDeposed(key DeposedKey) bool {
+        return i != nil && i.Deposed[key] != nil
+}
+
+// HasAnyDeposed returns true if this resource instance has one or more
+// deposed objects.
+func (i *ResourceInstance) HasAnyDeposed() bool {
+        return i != nil && len(i.Deposed) > 0
+}
+
+// HasObjects returns true if this resource has any objects at all, whether
+// current or deposed.
+func (i *ResourceInstance) HasObjects() bool {
+        return i.Current != nil || len(i.Deposed) != 0
+}
+
+// deposeCurrentObject is part of the real implementation of
+// SyncState.DeposeResourceInstanceObject. The exported method uses a lock
+// to ensure that we can safely allocate an unused deposed key without
+// collision.
+func (i *ResourceInstance) deposeCurrentObject(forceKey DeposedKey) DeposedKey {
+        if !i.HasCurrent() {
+                return NotDeposed
+        }
+
+        key := forceKey
+        if key == NotDeposed {
+                key = i.findUnusedDeposedKey()
+        } else {
+                if _, exists := i.Deposed[key]; exists {
+                        panic(fmt.Sprintf("forced key %s is already in use", forceKey))
+                }
+        }
+        i.Deposed[key] = i.Current
+        i.Current = nil
+        return key
+}
+
+// GetGeneration retrieves the object of the given generation from the
+// ResourceInstance, or returns nil if there is no such object.
+//
+// If the given generation is nil or invalid, this method will panic.
+func (i *ResourceInstance) GetGeneration(gen Generation) *ResourceInstanceObjectSrc {
+        if gen == CurrentGen {
+                return i.Current
+        }
+        if dk, ok := gen.(DeposedKey); ok {
+                return i.Deposed[dk]
+        }
+        if gen == nil {
+                panic(fmt.Sprintf("get with nil Generation"))
+        }
+        // Should never fall out here, since the above covers all possible
+        // Generation values.
+        panic(fmt.Sprintf("get invalid Generation %#v", gen))
+}
+
+// FindUnusedDeposedKey generates a unique DeposedKey that is guaranteed not to
+// already be in use for this instance at the time of the call.
+//
+// Note that the validity of this result may change if new deposed keys are
+// allocated before it is used. To avoid this risk, instead use the
+// DeposeResourceInstanceObject method on the SyncState wrapper type, which
+// allocates a key and uses it atomically.
+func (i *ResourceInstance) FindUnusedDeposedKey() DeposedKey {
+        return i.findUnusedDeposedKey()
+}
+
+// findUnusedDeposedKey generates a unique DeposedKey that is guaranteed not to
+// already be in use for this instance.
+func (i *ResourceInstance) findUnusedDeposedKey() DeposedKey {
+        for {
+                key := NewDeposedKey()
+                if _, exists := i.Deposed[key]; !exists {
+                        return key
+                }
+                // Spin until we find a unique one. This shouldn't take long, because
+                // we have a 32-bit keyspace and there's rarely more than one deposed
+                // instance.
+        }
+}
+
+// EachMode specifies the multi-instance mode for a resource.
+type EachMode rune
+
+const (
+        NoEach   EachMode = 0
+        EachList EachMode = 'L'
+        EachMap  EachMode = 'M'
+)
+
+//go:generate stringer -type EachMode
+
+func eachModeForInstanceKey(key addrs.InstanceKey) EachMode {
+        switch key.(type) {
+        case addrs.IntKey:
+                return EachList
+        case addrs.StringKey:
+                return EachMap
+        default:
+                if key == addrs.NoKey {
+                        return NoEach
+                }
+                panic(fmt.Sprintf("don't know an each mode for instance key %#v", key))
+        }
+}
+
+// DeposedKey is a 8-character hex string used to uniquely identify deposed
+// instance objects in the state.
+type DeposedKey string
+
+// NotDeposed is a special invalid value of DeposedKey that is used to represent
+// the absense of a deposed key. It must not be used as an actual deposed key.
+const NotDeposed = DeposedKey("")
+
+var deposedKeyRand = rand.New(rand.NewSource(time.Now().UnixNano()))
+
+// NewDeposedKey generates a pseudo-random deposed key. Because of the short
+// length of these keys, uniqueness is not a natural consequence and so the
+// caller should test to see if the generated key is already in use and generate
+// another if so, until a unique key is found.
+func NewDeposedKey() DeposedKey {
+        v := deposedKeyRand.Uint32()
+        return DeposedKey(fmt.Sprintf("%08x", v))
+}
+
+func (k DeposedKey) String() string {
+        return string(k)
+}
+
+func (k DeposedKey) GoString() string {
+        ks := string(k)
+        switch {
+        case ks == "":
+                return "states.NotDeposed"
+        default:
+                return fmt.Sprintf("states.DeposedKey(%s)", ks)
+        }
+}
+
+// Generation is a helper method to convert a DeposedKey into a Generation.
+// If the reciever is anything other than NotDeposed then the result is
+// just the same value as a Generation. If the receiver is NotDeposed then
+// the result is CurrentGen.
+func (k DeposedKey) Generation() Generation {
+        if k == NotDeposed {
+                return CurrentGen
+        }
+        return k
+}
+
+// generation is an implementation of Generation.
+func (k DeposedKey) generation() {}
diff --git a/vendor/github.com/hashicorp/terraform/states/state.go b/vendor/github.com/hashicorp/terraform/states/state.go
new file mode 100644
index 0000000..1f84235
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/state.go
@@ -0,0 +1,229 @@
+package states
+
+import (
+        "sort"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+)
+
+// State is the top-level type of a Terraform state.
+//
+// A state should be mutated only via its accessor methods, to ensure that
+// invariants are preserved.
+//
+// Access to State and the nested values within it is not concurrency-safe,
+// so when accessing a State object concurrently it is the caller's
+// responsibility to ensure that only one write is in progress at a time
+// and that reads only occur when no write is in progress. The most common
+// way to acheive this is to wrap the State in a SyncState and use the
+// higher-level atomic operations supported by that type.
+type State struct {
+        // Modules contains the state for each module. The keys in this map are
+        // an implementation detail and must not be used by outside callers.
+        Modules map[string]*Module
+}
+
+// NewState constructs a minimal empty state, containing an empty root module.
+func NewState() *State {
+        modules := map[string]*Module{}
+        modules[addrs.RootModuleInstance.String()] = NewModule(addrs.RootModuleInstance)
+        return &State{
+                Modules: modules,
+        }
+}
+
+// BuildState is a helper -- primarily intended for tests -- to build a state
+// using imperative code against the StateSync type while still acting as
+// an expression of type *State to assign into a containing struct.
+func BuildState(cb func(*SyncState)) *State {
+        s := NewState()
+        cb(s.SyncWrapper())
+        return s
+}
+
+// Empty returns true if there are no resources or populated output values
+// in the receiver. In other words, if this state could be safely replaced
+// with the return value of NewState and be functionally equivalent.
+func (s *State) Empty() bool {
+        if s == nil {
+                return true
+        }
+        for _, ms := range s.Modules {
+                if len(ms.Resources) != 0 {
+                        return false
+                }
+                if len(ms.OutputValues) != 0 {
+                        return false
+                }
+        }
+        return true
+}
+
+// Module returns the state for the module with the given address, or nil if
+// the requested module is not tracked in the state.
+func (s *State) Module(addr addrs.ModuleInstance) *Module {
+        if s == nil {
+                panic("State.Module on nil *State")
+        }
+        return s.Modules[addr.String()]
+}
+
+// RemoveModule removes the module with the given address from the state,
+// unless it is the root module. The root module cannot be deleted, and so
+// this method will panic if that is attempted.
+//
+// Removing a module implicitly discards all of the resources, outputs and
+// local values within it, and so this should usually be done only for empty
+// modules. For callers accessing the state through a SyncState wrapper, modules
+// are automatically pruned if they are empty after one of their contained
+// elements is removed.
+func (s *State) RemoveModule(addr addrs.ModuleInstance) {
+        if addr.IsRoot() {
+                panic("attempted to remove root module")
+        }
+
+        delete(s.Modules, addr.String())
+}
+
+// RootModule is a convenient alias for Module(addrs.RootModuleInstance).
+func (s *State) RootModule() *Module {
+        if s == nil {
+                panic("RootModule called on nil State")
+        }
+        return s.Modules[addrs.RootModuleInstance.String()]
+}
+
+// EnsureModule returns the state for the module with the given address,
+// creating and adding a new one if necessary.
+//
+// Since this might modify the state to add a new instance, it is considered
+// to be a write operation.
+func (s *State) EnsureModule(addr addrs.ModuleInstance) *Module {
+        ms := s.Module(addr)
+        if ms == nil {
+                ms = NewModule(addr)
+                s.Modules[addr.String()] = ms
+        }
+        return ms
+}
+
+// HasResources returns true if there is at least one resource (of any mode)
+// present in the receiving state.
+func (s *State) HasResources() bool {
+        if s == nil {
+                return false
+        }
+        for _, ms := range s.Modules {
+                if len(ms.Resources) > 0 {
+                        return true
+                }
+        }
+        return false
+}
+
+// Resource returns the state for the resource with the given address, or nil
+// if no such resource is tracked in the state.
+func (s *State) Resource(addr addrs.AbsResource) *Resource {
+        ms := s.Module(addr.Module)
+        if ms == nil {
+                return nil
+        }
+        return ms.Resource(addr.Resource)
+}
+
+// ResourceInstance returns the state for the resource instance with the given
+// address, or nil if no such resource is tracked in the state.
+func (s *State) ResourceInstance(addr addrs.AbsResourceInstance) *ResourceInstance {
+        if s == nil {
+                panic("State.ResourceInstance on nil *State")
+        }
+        ms := s.Module(addr.Module)
+        if ms == nil {
+                return nil
+        }
+        return ms.ResourceInstance(addr.Resource)
+}
+
+// OutputValue returns the state for the output value with the given address,
+// or nil if no such output value is tracked in the state.
+func (s *State) OutputValue(addr addrs.AbsOutputValue) *OutputValue {
+        ms := s.Module(addr.Module)
+        if ms == nil {
+                return nil
+        }
+        return ms.OutputValues[addr.OutputValue.Name]
+}
+
+// LocalValue returns the value of the named local value with the given address,
+// or cty.NilVal if no such value is tracked in the state.
+func (s *State) LocalValue(addr addrs.AbsLocalValue) cty.Value {
+        ms := s.Module(addr.Module)
+        if ms == nil {
+                return cty.NilVal
+        }
+        return ms.LocalValues[addr.LocalValue.Name]
+}
+
+// ProviderAddrs returns a list of all of the provider configuration addresses
+// referenced throughout the receiving state.
+//
+// The result is de-duplicated so that each distinct address appears only once.
+func (s *State) ProviderAddrs() []addrs.AbsProviderConfig {
+        if s == nil {
+                return nil
+        }
+
+        m := map[string]addrs.AbsProviderConfig{}
+        for _, ms := range s.Modules {
+                for _, rc := range ms.Resources {
+                        m[rc.ProviderConfig.String()] = rc.ProviderConfig
+                }
+        }
+        if len(m) == 0 {
+                return nil
+        }
+
+        // This is mainly just so we'll get stable results for testing purposes.
+        keys := make([]string, 0, len(m))
+        for k := range m {
+                keys = append(keys, k)
+        }
+        sort.Strings(keys)
+
+        ret := make([]addrs.AbsProviderConfig, len(keys))
+        for i, key := range keys {
+                ret[i] = m[key]
+        }
+
+        return ret
+}
+
+// PruneResourceHusks is a specialized method that will remove any Resource
+// objects that do not contain any instances, even if they have an EachMode.
+//
+// This should generally be used only after a "terraform destroy" operation,
+// to finalize the cleanup of the state. It is not correct to use this after
+// other operations because if a resource has "count = 0" or "for_each" over
+// an empty collection then we want to retain it in the state so that references
+// to it, particularly in "strange" contexts like "terraform console", can be
+// properly resolved.
+//
+// This method MUST NOT be called concurrently with other readers and writers
+// of the receiving state.
+func (s *State) PruneResourceHusks() {
+        for _, m := range s.Modules {
+                m.PruneResourceHusks()
+                if len(m.Resources) == 0 && !m.Addr.IsRoot() {
+                        s.RemoveModule(m.Addr)
+                }
+        }
+}
+
+// SyncWrapper returns a SyncState object wrapping the receiver.
+func (s *State) SyncWrapper() *SyncState {
+        return &SyncState{
+                state: s,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/state_deepcopy.go b/vendor/github.com/hashicorp/terraform/states/state_deepcopy.go
new file mode 100644
index 0000000..ea717d0
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/state_deepcopy.go
@@ -0,0 +1,218 @@
+package states
+
+import (
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Taking deep copies of states is an important operation because state is
+// otherwise a mutable data structure that is challenging to share across
+// many separate callers. It is important that the DeepCopy implementations
+// in this file comprehensively copy all parts of the state data structure
+// that could be mutated via pointers.
+
+// DeepCopy returns a new state that contains equivalent data to the reciever
+// but shares no backing memory in common.
+//
+// As with all methods on State, this method is not safe to use concurrently
+// with writing to any portion of the recieving data structure. It is the
+// caller's responsibility to ensure mutual exclusion for the duration of the
+// operation, but may then freely modify the receiver and the returned copy
+// independently once this method returns.
+func (s *State) DeepCopy() *State {
+        if s == nil {
+                return nil
+        }
+
+        modules := make(map[string]*Module, len(s.Modules))
+        for k, m := range s.Modules {
+                modules[k] = m.DeepCopy()
+        }
+        return &State{
+                Modules: modules,
+        }
+}
+
+// DeepCopy returns a new module state that contains equivalent data to the
+// receiver but shares no backing memory in common.
+//
+// As with all methods on Module, this method is not safe to use concurrently
+// with writing to any portion of the recieving data structure. It is the
+// caller's responsibility to ensure mutual exclusion for the duration of the
+// operation, but may then freely modify the receiver and the returned copy
+// independently once this method returns.
+func (ms *Module) DeepCopy() *Module {
+        if ms == nil {
+                return nil
+        }
+
+        resources := make(map[string]*Resource, len(ms.Resources))
+        for k, r := range ms.Resources {
+                resources[k] = r.DeepCopy()
+        }
+        outputValues := make(map[string]*OutputValue, len(ms.OutputValues))
+        for k, v := range ms.OutputValues {
+                outputValues[k] = v.DeepCopy()
+        }
+        localValues := make(map[string]cty.Value, len(ms.LocalValues))
+        for k, v := range ms.LocalValues {
+                // cty.Value is immutable, so we don't need to copy these.
+                localValues[k] = v
+        }
+
+        return &Module{
+                Addr:         ms.Addr, // technically mutable, but immutable by convention
+                Resources:    resources,
+                OutputValues: outputValues,
+                LocalValues:  localValues,
+        }
+}
+
+// DeepCopy returns a new resource state that contains equivalent data to the
+// receiver but shares no backing memory in common.
+//
+// As with all methods on Resource, this method is not safe to use concurrently
+// with writing to any portion of the recieving data structure. It is the
+// caller's responsibility to ensure mutual exclusion for the duration of the
+// operation, but may then freely modify the receiver and the returned copy
+// independently once this method returns.
+func (rs *Resource) DeepCopy() *Resource {
+        if rs == nil {
+                return nil
+        }
+
+        instances := make(map[addrs.InstanceKey]*ResourceInstance, len(rs.Instances))
+        for k, i := range rs.Instances {
+                instances[k] = i.DeepCopy()
+        }
+
+        return &Resource{
+                Addr:           rs.Addr,
+                EachMode:       rs.EachMode,
+                Instances:      instances,
+                ProviderConfig: rs.ProviderConfig, // technically mutable, but immutable by convention
+        }
+}
+
+// DeepCopy returns a new resource instance state that contains equivalent data
+// to the receiver but shares no backing memory in common.
+//
+// As with all methods on ResourceInstance, this method is not safe to use
+// concurrently with writing to any portion of the recieving data structure. It
+// is the caller's responsibility to ensure mutual exclusion for the duration
+// of the operation, but may then freely modify the receiver and the returned
+// copy independently once this method returns.
+func (is *ResourceInstance) DeepCopy() *ResourceInstance {
+        if is == nil {
+                return nil
+        }
+
+        deposed := make(map[DeposedKey]*ResourceInstanceObjectSrc, len(is.Deposed))
+        for k, obj := range is.Deposed {
+                deposed[k] = obj.DeepCopy()
+        }
+
+        return &ResourceInstance{
+                Current: is.Current.DeepCopy(),
+                Deposed: deposed,
+        }
+}
+
+// DeepCopy returns a new resource instance object that contains equivalent data
+// to the receiver but shares no backing memory in common.
+//
+// As with all methods on ResourceInstanceObjectSrc, this method is not safe to
+// use concurrently with writing to any portion of the recieving data structure.
+// It is the caller's responsibility to ensure mutual exclusion for the duration
+// of the operation, but may then freely modify the receiver and the returned
+// copy independently once this method returns.
+func (obj *ResourceInstanceObjectSrc) DeepCopy() *ResourceInstanceObjectSrc {
+        if obj == nil {
+                return nil
+        }
+
+        var attrsFlat map[string]string
+        if obj.AttrsFlat != nil {
+                attrsFlat = make(map[string]string, len(obj.AttrsFlat))
+                for k, v := range obj.AttrsFlat {
+                        attrsFlat[k] = v
+                }
+        }
+
+        var attrsJSON []byte
+        if obj.AttrsJSON != nil {
+                attrsJSON = make([]byte, len(obj.AttrsJSON))
+                copy(attrsJSON, obj.AttrsJSON)
+        }
+
+        var private []byte
+        if obj.Private != nil {
+                private := make([]byte, len(obj.Private))
+                copy(private, obj.Private)
+        }
+
+        // Some addrs.Referencable implementations are technically mutable, but
+        // we treat them as immutable by convention and so we don't deep-copy here.
+        dependencies := make([]addrs.Referenceable, len(obj.Dependencies))
+        copy(dependencies, obj.Dependencies)
+
+        return &ResourceInstanceObjectSrc{
+                Status:        obj.Status,
+                SchemaVersion: obj.SchemaVersion,
+                Private:       private,
+                AttrsFlat:     attrsFlat,
+                AttrsJSON:     attrsJSON,
+                Dependencies:  dependencies,
+        }
+}
+
+// DeepCopy returns a new resource instance object that contains equivalent data
+// to the receiver but shares no backing memory in common.
+//
+// As with all methods on ResourceInstanceObject, this method is not safe to use
+// concurrently with writing to any portion of the recieving data structure. It
+// is the caller's responsibility to ensure mutual exclusion for the duration
+// of the operation, but may then freely modify the receiver and the returned
+// copy independently once this method returns.
+func (obj *ResourceInstanceObject) DeepCopy() *ResourceInstanceObject {
+        if obj == nil {
+                return nil
+        }
+
+        var private []byte
+        if obj.Private != nil {
+                private := make([]byte, len(obj.Private))
+                copy(private, obj.Private)
+        }
+
+        // Some addrs.Referencable implementations are technically mutable, but
+        // we treat them as immutable by convention and so we don't deep-copy here.
+        dependencies := make([]addrs.Referenceable, len(obj.Dependencies))
+        copy(dependencies, obj.Dependencies)
+
+        return &ResourceInstanceObject{
+                Value:        obj.Value,
+                Status:       obj.Status,
+                Private:      private,
+                Dependencies: dependencies,
+        }
+}
+
+// DeepCopy returns a new output value state that contains equivalent data
+// to the receiver but shares no backing memory in common.
+//
+// As with all methods on OutputValue, this method is not safe to use
+// concurrently with writing to any portion of the recieving data structure. It
+// is the caller's responsibility to ensure mutual exclusion for the duration
+// of the operation, but may then freely modify the receiver and the returned
+// copy independently once this method returns.
+func (os *OutputValue) DeepCopy() *OutputValue {
+        if os == nil {
+                return nil
+        }
+
+        return &OutputValue{
+                Value:     os.Value,
+                Sensitive: os.Sensitive,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/state_equal.go b/vendor/github.com/hashicorp/terraform/states/state_equal.go
new file mode 100644
index 0000000..ea20967
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/state_equal.go
@@ -0,0 +1,18 @@
+package states
+
+import (
+        "reflect"
+)
+
+// Equal returns true if the receiver is functionally equivalent to other,
+// including any ephemeral portions of the state that would not be included
+// if the state were saved to files.
+//
+// To test only the persistent portions of two states for equality, instead
+// use statefile.StatesMarshalEqual.
+func (s *State) Equal(other *State) bool {
+        // For the moment this is sufficient, but we may need to do something
+        // more elaborate in future if we have any portions of state that require
+        // more sophisticated comparisons.
+        return reflect.DeepEqual(s, other)
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/state_string.go b/vendor/github.com/hashicorp/terraform/states/state_string.go
new file mode 100644
index 0000000..bca4581
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/state_string.go
@@ -0,0 +1,279 @@
+package states
+
+import (
+        "bufio"
+        "bytes"
+        "encoding/json"
+        "fmt"
+        "sort"
+        "strings"
+
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+)
+
+// String returns a rather-odd string representation of the entire state.
+//
+// This is intended to match the behavior of the older terraform.State.String
+// method that is used in lots of existing tests. It should not be used in
+// new tests: instead, use "cmp" to directly compare the state data structures
+// and print out a diff if they do not match.
+//
+// This method should never be used in non-test code, whether directly by call
+// or indirectly via a %s or %q verb in package fmt.
+func (s *State) String() string {
+        if s == nil {
+                return "<nil>"
+        }
+
+        // sort the modules by name for consistent output
+        modules := make([]string, 0, len(s.Modules))
+        for m := range s.Modules {
+                modules = append(modules, m)
+        }
+        sort.Strings(modules)
+
+        var buf bytes.Buffer
+        for _, name := range modules {
+                m := s.Modules[name]
+                mStr := m.testString()
+
+                // If we're the root module, we just write the output directly.
+                if m.Addr.IsRoot() {
+                        buf.WriteString(mStr + "\n")
+                        continue
+                }
+
+                // We need to build out a string that resembles the not-quite-standard
+                // format that terraform.State.String used to use, where there's a
+                // "module." prefix but then just a chain of all of the module names
+                // without any further "module." portions.
+                buf.WriteString("module")
+                for _, step := range m.Addr {
+                        buf.WriteByte('.')
+                        buf.WriteString(step.Name)
+                        if step.InstanceKey != addrs.NoKey {
+                                buf.WriteByte('[')
+                                buf.WriteString(step.InstanceKey.String())
+                                buf.WriteByte(']')
+                        }
+                }
+                buf.WriteString(":\n")
+
+                s := bufio.NewScanner(strings.NewReader(mStr))
+                for s.Scan() {
+                        text := s.Text()
+                        if text != "" {
+                                text = "  " + text
+                        }
+
+                        buf.WriteString(fmt.Sprintf("%s\n", text))
+                }
+        }
+
+        return strings.TrimSpace(buf.String())
+}
+
+// testString is used to produce part of the output of State.String. It should
+// never be used directly.
+func (m *Module) testString() string {
+        var buf bytes.Buffer
+
+        if len(m.Resources) == 0 {
+                buf.WriteString("<no state>")
+        }
+
+        // We use AbsResourceInstance here, even though everything belongs to
+        // the same module, just because we have a sorting behavior defined
+        // for those but not for just ResourceInstance.
+        addrsOrder := make([]addrs.AbsResourceInstance, 0, len(m.Resources))
+        for _, rs := range m.Resources {
+                for ik := range rs.Instances {
+                        addrsOrder = append(addrsOrder, rs.Addr.Instance(ik).Absolute(addrs.RootModuleInstance))
+                }
+        }
+
+        sort.Slice(addrsOrder, func(i, j int) bool {
+                return addrsOrder[i].Less(addrsOrder[j])
+        })
+
+        for _, fakeAbsAddr := range addrsOrder {
+                addr := fakeAbsAddr.Resource
+                rs := m.Resource(addr.ContainingResource())
+                is := m.ResourceInstance(addr)
+
+                // Here we need to fake up a legacy-style address as the old state
+                // types would've used, since that's what our tests against those
+                // old types expect. The significant difference is that instancekey
+                // is dot-separated rather than using index brackets.
+                k := addr.ContainingResource().String()
+                if addr.Key != addrs.NoKey {
+                        switch tk := addr.Key.(type) {
+                        case addrs.IntKey:
+                                k = fmt.Sprintf("%s.%d", k, tk)
+                        default:
+                                // No other key types existed for the legacy types, so we
+                                // can do whatever we want here. We'll just use our standard
+                                // syntax for these.
+                                k = k + tk.String()
+                        }
+                }
+
+                id := LegacyInstanceObjectID(is.Current)
+
+                taintStr := ""
+                if is.Current != nil && is.Current.Status == ObjectTainted {
+                        taintStr = " (tainted)"
+                }
+
+                deposedStr := ""
+                if len(is.Deposed) > 0 {
+                        deposedStr = fmt.Sprintf(" (%d deposed)", len(is.Deposed))
+                }
+
+                buf.WriteString(fmt.Sprintf("%s:%s%s\n", k, taintStr, deposedStr))
+                buf.WriteString(fmt.Sprintf("  ID = %s\n", id))
+                buf.WriteString(fmt.Sprintf("  provider = %s\n", rs.ProviderConfig.String()))
+
+                // Attributes were a flatmap before, but are not anymore. To preserve
+                // our old output as closely as possible we need to do a conversion
+                // to flatmap. Normally we'd want to do this with schema for
+                // accuracy, but for our purposes here it only needs to be approximate.
+                // This should produce an identical result for most cases, though
+                // in particular will differ in a few cases:
+                //  - The keys used for elements in a set will be different
+                //  - Values for attributes of type cty.DynamicPseudoType will be
+                //    misinterpreted (but these weren't possible in old world anyway)
+                var attributes map[string]string
+                if obj := is.Current; obj != nil {
+                        switch {
+                        case obj.AttrsFlat != nil:
+                                // Easy (but increasingly unlikely) case: the state hasn't
+                                // actually been upgraded to the new form yet.
+                                attributes = obj.AttrsFlat
+                        case obj.AttrsJSON != nil:
+                                ty, err := ctyjson.ImpliedType(obj.AttrsJSON)
+                                if err == nil {
+                                        val, err := ctyjson.Unmarshal(obj.AttrsJSON, ty)
+                                        if err == nil {
+                                                attributes = hcl2shim.FlatmapValueFromHCL2(val)
+                                        }
+                                }
+                        }
+                }
+                attrKeys := make([]string, 0, len(attributes))
+                for ak, val := range attributes {
+                        if ak == "id" {
+                                continue
+                        }
+
+                        // don't show empty containers in the output
+                        if val == "0" && (strings.HasSuffix(ak, ".#") || strings.HasSuffix(ak, ".%")) {
+                                continue
+                        }
+
+                        attrKeys = append(attrKeys, ak)
+                }
+
+                sort.Strings(attrKeys)
+
+                for _, ak := range attrKeys {
+                        av := attributes[ak]
+                        buf.WriteString(fmt.Sprintf("  %s = %s\n", ak, av))
+                }
+
+                // CAUTION: Since deposed keys are now random strings instead of
+                // incrementing integers, this result will not be deterministic
+                // if there is more than one deposed object.
+                i := 1
+                for _, t := range is.Deposed {
+                        id := LegacyInstanceObjectID(t)
+                        taintStr := ""
+                        if t.Status == ObjectTainted {
+                                taintStr = " (tainted)"
+                        }
+                        buf.WriteString(fmt.Sprintf("  Deposed ID %d = %s%s\n", i, id, taintStr))
+                        i++
+                }
+
+                if obj := is.Current; obj != nil && len(obj.Dependencies) > 0 {
+                        buf.WriteString(fmt.Sprintf("\n  Dependencies:\n"))
+                        for _, dep := range obj.Dependencies {
+                                buf.WriteString(fmt.Sprintf("    %s\n", dep.String()))
+                        }
+                }
+        }
+
+        if len(m.OutputValues) > 0 {
+                buf.WriteString("\nOutputs:\n\n")
+
+                ks := make([]string, 0, len(m.OutputValues))
+                for k := range m.OutputValues {
+                        ks = append(ks, k)
+                }
+                sort.Strings(ks)
+
+                for _, k := range ks {
+                        v := m.OutputValues[k]
+                        lv := hcl2shim.ConfigValueFromHCL2(v.Value)
+                        switch vTyped := lv.(type) {
+                        case string:
+                                buf.WriteString(fmt.Sprintf("%s = %s\n", k, vTyped))
+                        case []interface{}:
+                                buf.WriteString(fmt.Sprintf("%s = %s\n", k, vTyped))
+                        case map[string]interface{}:
+                                var mapKeys []string
+                                for key := range vTyped {
+                                        mapKeys = append(mapKeys, key)
+                                }
+                                sort.Strings(mapKeys)
+
+                                var mapBuf bytes.Buffer
+                                mapBuf.WriteString("{")
+                                for _, key := range mapKeys {
+                                        mapBuf.WriteString(fmt.Sprintf("%s:%s ", key, vTyped[key]))
+                                }
+                                mapBuf.WriteString("}")
+
+                                buf.WriteString(fmt.Sprintf("%s = %s\n", k, mapBuf.String()))
+                        default:
+                                buf.WriteString(fmt.Sprintf("%s = %#v\n", k, lv))
+                        }
+                }
+        }
+
+        return buf.String()
+}
+
+// LegacyInstanceObjectID is a helper for extracting an object id value from
+// an instance object in a way that approximates how we used to do this
+// for the old state types. ID is no longer first-class, so this is preserved
+// only for compatibility with old tests that include the id as part of their
+// expected value.
+func LegacyInstanceObjectID(obj *ResourceInstanceObjectSrc) string {
+        if obj == nil {
+                return "<not created>"
+        }
+
+        if obj.AttrsJSON != nil {
+                type WithID struct {
+                        ID string `json:"id"`
+                }
+                var withID WithID
+                err := json.Unmarshal(obj.AttrsJSON, &withID)
+                if err == nil {
+                        return withID.ID
+                }
+        } else if obj.AttrsFlat != nil {
+                if flatID, exists := obj.AttrsFlat["id"]; exists {
+                        return flatID
+                }
+        }
+
+        // For resource types created after we removed id as special there may
+        // not actually be one at all. This is okay because older tests won't
+        // encounter this, and new tests shouldn't be using ids.
+        return "<none>"
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/diagnostics.go b/vendor/github.com/hashicorp/terraform/states/statefile/diagnostics.go
new file mode 100644
index 0000000..a6d88ec
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/diagnostics.go
@@ -0,0 +1,62 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+const invalidFormat = "Invalid state file format"
+
+// jsonUnmarshalDiags is a helper that translates errors returned from
+// json.Unmarshal into hopefully-more-helpful diagnostics messages.
+func jsonUnmarshalDiags(err error) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+        if err == nil {
+                return diags
+        }
+
+        switch tErr := err.(type) {
+        case *json.SyntaxError:
+                // We've usually already successfully parsed a source file as JSON at
+                // least once before we'd use jsonUnmarshalDiags with it (to sniff
+                // the version number) so this particular error should not appear much
+                // in practice.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        invalidFormat,
+                        fmt.Sprintf("The state file could not be parsed as JSON: syntax error at byte offset %d.", tErr.Offset),
+                ))
+        case *json.UnmarshalTypeError:
+                // This is likely to be the most common area, describing a
+                // non-conformance between the file and the expected file format
+                // at a semantic level.
+                if tErr.Field != "" {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                invalidFormat,
+                                fmt.Sprintf("The state file field %q has invalid value %s", tErr.Field, tErr.Value),
+                        ))
+                        break
+                } else {
+                        // Without a field name, we can't really say anything helpful.
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                invalidFormat,
+                                "The state file does not conform to the expected JSON data structure.",
+                        ))
+                }
+        default:
+                // Fallback for all other types of errors. This can happen only for
+                // custom UnmarshalJSON implementations, so should be encountered
+                // only rarely.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        invalidFormat,
+                        fmt.Sprintf("The state file does not conform to the expected JSON data structure: %s.", err.Error()),
+                ))
+        }
+
+        return diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/doc.go b/vendor/github.com/hashicorp/terraform/states/statefile/doc.go
new file mode 100644
index 0000000..625d0cf
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/doc.go
@@ -0,0 +1,3 @@
+// Package statefile deals with the file format used to serialize states for
+// persistent storage and then deserialize them into memory again later.
+package statefile
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/file.go b/vendor/github.com/hashicorp/terraform/states/statefile/file.go
new file mode 100644
index 0000000..6e20240
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/file.go
@@ -0,0 +1,62 @@
+package statefile
+
+import (
+        version "github.com/hashicorp/go-version"
+
+        "github.com/hashicorp/terraform/states"
+        tfversion "github.com/hashicorp/terraform/version"
+)
+
+// File is the in-memory representation of a state file. It includes the state
+// itself along with various metadata used to track changing state files for
+// the same configuration over time.
+type File struct {
+        // TerraformVersion is the version of Terraform that wrote this state file.
+        TerraformVersion *version.Version
+
+        // Serial is incremented on any operation that modifies
+        // the State file. It is used to detect potentially conflicting
+        // updates.
+        Serial uint64
+
+        // Lineage is set when a new, blank state file is created and then
+        // never updated. This allows us to determine whether the serials
+        // of two states can be meaningfully compared.
+        // Apart from the guarantee that collisions between two lineages
+        // are very unlikely, this value is opaque and external callers
+        // should only compare lineage strings byte-for-byte for equality.
+        Lineage string
+
+        // State is the actual state represented by this file.
+        State *states.State
+}
+
+func New(state *states.State, lineage string, serial uint64) *File {
+        // To make life easier on callers, we'll accept a nil state here and just
+        // allocate an empty one, which is required for this file to be successfully
+        // written out.
+        if state == nil {
+                state = states.NewState()
+        }
+
+        return &File{
+                TerraformVersion: tfversion.SemVer,
+                State:            state,
+                Lineage:          lineage,
+                Serial:           serial,
+        }
+}
+
+// DeepCopy is a convenience method to create a new File object whose state
+// is a deep copy of the receiver's, as implemented by states.State.DeepCopy.
+func (f *File) DeepCopy() *File {
+        if f == nil {
+                return nil
+        }
+        return &File{
+                TerraformVersion: f.TerraformVersion,
+                Serial:           f.Serial,
+                Lineage:          f.Lineage,
+                State:            f.State.DeepCopy(),
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/marshal_equal.go b/vendor/github.com/hashicorp/terraform/states/statefile/marshal_equal.go
new file mode 100644
index 0000000..4948b39
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/marshal_equal.go
@@ -0,0 +1,40 @@
+package statefile
+
+import (
+        "bytes"
+
+        "github.com/hashicorp/terraform/states"
+)
+
+// StatesMarshalEqual returns true if and only if the two given states have
+// an identical (byte-for-byte) statefile representation.
+//
+// This function compares only the portions of the state that are persisted
+// in state files, so for example it will not return false if the only
+// differences between the two states are local values or descendent module
+// outputs.
+func StatesMarshalEqual(a, b *states.State) bool {
+        var aBuf bytes.Buffer
+        var bBuf bytes.Buffer
+
+        // nil states are not valid states, and so they can never martial equal.
+        if a == nil || b == nil {
+                return false
+        }
+
+        // We write here some temporary files that have no header information
+        // populated, thus ensuring that we're only comparing the state itself
+        // and not any metadata.
+        err := Write(&File{State: a}, &aBuf)
+        if err != nil {
+                // Should never happen, because we're writing to an in-memory buffer
+                panic(err)
+        }
+        err = Write(&File{State: b}, &bBuf)
+        if err != nil {
+                // Should never happen, because we're writing to an in-memory buffer
+                panic(err)
+        }
+
+        return bytes.Equal(aBuf.Bytes(), bBuf.Bytes())
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/read.go b/vendor/github.com/hashicorp/terraform/states/statefile/read.go
new file mode 100644
index 0000000..d691c02
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/read.go
@@ -0,0 +1,209 @@
+package statefile
+
+import (
+        "encoding/json"
+        "errors"
+        "fmt"
+        "io"
+        "io/ioutil"
+        "os"
+
+        version "github.com/hashicorp/go-version"
+
+        "github.com/hashicorp/terraform/tfdiags"
+        tfversion "github.com/hashicorp/terraform/version"
+)
+
+// ErrNoState is returned by ReadState when the state file is empty.
+var ErrNoState = errors.New("no state")
+
+// Read reads a state from the given reader.
+//
+// Legacy state format versions 1 through 3 are supported, but the result will
+// contain object attributes in the deprecated "flatmap" format and so must
+// be upgraded by the caller before use.
+//
+// If the state file is empty, the special error value ErrNoState is returned.
+// Otherwise, the returned error might be a wrapper around tfdiags.Diagnostics
+// potentially describing multiple errors.
+func Read(r io.Reader) (*File, error) {
+        // Some callers provide us a "typed nil" *os.File here, which would
+        // cause us to panic below if we tried to use it.
+        if f, ok := r.(*os.File); ok && f == nil {
+                return nil, ErrNoState
+        }
+
+        var diags tfdiags.Diagnostics
+
+        // We actually just buffer the whole thing in memory, because states are
+        // generally not huge and we need to do be able to sniff for a version
+        // number before full parsing.
+        src, err := ioutil.ReadAll(r)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to read state file",
+                        fmt.Sprintf("The state file could not be read: %s", err),
+                ))
+                return nil, diags.Err()
+        }
+
+        if len(src) == 0 {
+                return nil, ErrNoState
+        }
+
+        state, diags := readState(src)
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        if state == nil {
+                // Should never happen
+                panic("readState returned nil state with no errors")
+        }
+
+        if state.TerraformVersion != nil && state.TerraformVersion.GreaterThan(tfversion.SemVer) {
+                return state, fmt.Errorf(
+                        "state snapshot was created by Terraform v%s, which is newer than current v%s; upgrade to Terraform v%s or greater to work with this state",
+                        state.TerraformVersion,
+                        tfversion.SemVer,
+                        state.TerraformVersion,
+                )
+        }
+
+        return state, diags.Err()
+}
+
+func readState(src []byte) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        if looksLikeVersion0(src) {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        unsupportedFormat,
+                        "The state is stored in a legacy binary format that is not supported since Terraform v0.7. To continue, first upgrade the state using Terraform 0.6.16 or earlier.",
+                ))
+                return nil, diags
+        }
+
+        version, versionDiags := sniffJSONStateVersion(src)
+        diags = diags.Append(versionDiags)
+        if versionDiags.HasErrors() {
+                return nil, diags
+        }
+
+        switch version {
+        case 0:
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        unsupportedFormat,
+                        "The state file uses JSON syntax but has a version number of zero. There was never a JSON-based state format zero, so this state file is invalid and cannot be processed.",
+                ))
+                return nil, diags
+        case 1:
+                return readStateV1(src)
+        case 2:
+                return readStateV2(src)
+        case 3:
+                return readStateV3(src)
+        case 4:
+                return readStateV4(src)
+        default:
+                thisVersion := tfversion.SemVer.String()
+                creatingVersion := sniffJSONStateTerraformVersion(src)
+                switch {
+                case creatingVersion != "":
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                unsupportedFormat,
+                                fmt.Sprintf("The state file uses format version %d, which is not supported by Terraform %s. This state file was created by Terraform %s.", version, thisVersion, creatingVersion),
+                        ))
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                unsupportedFormat,
+                                fmt.Sprintf("The state file uses format version %d, which is not supported by Terraform %s. This state file may have been created by a newer version of Terraform.", version, thisVersion),
+                        ))
+                }
+                return nil, diags
+        }
+}
+
+func sniffJSONStateVersion(src []byte) (uint64, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        type VersionSniff struct {
+                Version *uint64 `json:"version"`
+        }
+        var sniff VersionSniff
+        err := json.Unmarshal(src, &sniff)
+        if err != nil {
+                switch tErr := err.(type) {
+                case *json.SyntaxError:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                unsupportedFormat,
+                                fmt.Sprintf("The state file could not be parsed as JSON: syntax error at byte offset %d.", tErr.Offset),
+                        ))
+                case *json.UnmarshalTypeError:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                unsupportedFormat,
+                                fmt.Sprintf("The version in the state file is %s. A positive whole number is required.", tErr.Value),
+                        ))
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                unsupportedFormat,
+                                "The state file could not be parsed as JSON.",
+                        ))
+                }
+        }
+
+        if sniff.Version == nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        unsupportedFormat,
+                        "The state file does not have a \"version\" attribute, which is required to identify the format version.",
+                ))
+                return 0, diags
+        }
+
+        return *sniff.Version, diags
+}
+
+// sniffJSONStateTerraformVersion attempts to sniff the Terraform version
+// specification from the given state file source code. The result is either
+// a version string or an empty string if no version number could be extracted.
+//
+// This is a best-effort function intended to produce nicer error messages. It
+// should not be used for any real processing.
+func sniffJSONStateTerraformVersion(src []byte) string {
+        type VersionSniff struct {
+                Version string `json:"terraform_version"`
+        }
+        var sniff VersionSniff
+
+        err := json.Unmarshal(src, &sniff)
+        if err != nil {
+                return ""
+        }
+
+        // Attempt to parse the string as a version so we won't report garbage
+        // as a version number.
+        _, err = version.NewVersion(sniff.Version)
+        if err != nil {
+                return ""
+        }
+
+        return sniff.Version
+}
+
+// unsupportedFormat is a diagnostic summary message for when the state file
+// seems to not be a state file at all, or is not a supported version.
+//
+// Use invalidFormat instead for the subtly-different case of "this looks like
+// it's intended to be a state file but it's not structured correctly".
+const unsupportedFormat = "Unsupported state file format"
+
+const upgradeFailed = "State format upgrade failed"
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version0.go b/vendor/github.com/hashicorp/terraform/states/statefile/version0.go
new file mode 100644
index 0000000..9b53331
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version0.go
@@ -0,0 +1,23 @@
+package statefile
+
+// looksLikeVersion0 sniffs for the signature indicating a version 0 state
+// file.
+//
+// Version 0 was the number retroactively assigned to Terraform's initial
+// (unversioned) binary state file format, which was later superseded by the
+// version 1 format in JSON.
+//
+// Version 0 is no longer supported, so this is used only to detect it and
+// return a nice error to the user.
+func looksLikeVersion0(src []byte) bool {
+        // Version 0 files begin with the magic prefix "tfstate".
+        const magic = "tfstate"
+        if len(src) < len(magic) {
+                // Not even long enough to have the magic prefix
+                return false
+        }
+        if string(src[0:len(magic)]) == magic {
+                return true
+        }
+        return false
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version1.go b/vendor/github.com/hashicorp/terraform/states/statefile/version1.go
new file mode 100644
index 0000000..80d711b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version1.go
@@ -0,0 +1,174 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func readStateV1(src []byte) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV1 := &stateV1{}
+        err := json.Unmarshal(src, sV1)
+        if err != nil {
+                diags = diags.Append(jsonUnmarshalDiags(err))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV1(sV1)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+func prepareStateV1(sV1 *stateV1) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV2, err := upgradeStateV1ToV2(sV1)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        upgradeFailed,
+                        fmt.Sprintf("Error upgrading state file format from version 1 to version 2: %s.", err),
+                ))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV2(sV2)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+// stateV1 is a representation of the legacy JSON state format version 1.
+//
+// It is only used to read version 1 JSON files prior to upgrading them to
+// the current format.
+type stateV1 struct {
+        // Version is the protocol version. "1" for a StateV1.
+        Version int `json:"version"`
+
+        // Serial is incremented on any operation that modifies
+        // the State file. It is used to detect potentially conflicting
+        // updates.
+        Serial int64 `json:"serial"`
+
+        // Remote is used to track the metadata required to
+        // pull and push state files from a remote storage endpoint.
+        Remote *remoteStateV1 `json:"remote,omitempty"`
+
+        // Modules contains all the modules in a breadth-first order
+        Modules []*moduleStateV1 `json:"modules"`
+}
+
+type remoteStateV1 struct {
+        // Type controls the client we use for the remote state
+        Type string `json:"type"`
+
+        // Config is used to store arbitrary configuration that
+        // is type specific
+        Config map[string]string `json:"config"`
+}
+
+type moduleStateV1 struct {
+        // Path is the import path from the root module. Modules imports are
+        // always disjoint, so the path represents amodule tree
+        Path []string `json:"path"`
+
+        // Outputs declared by the module and maintained for each module
+        // even though only the root module technically needs to be kept.
+        // This allows operators to inspect values at the boundaries.
+        Outputs map[string]string `json:"outputs"`
+
+        // Resources is a mapping of the logically named resource to
+        // the state of the resource. Each resource may actually have
+        // N instances underneath, although a user only needs to think
+        // about the 1:1 case.
+        Resources map[string]*resourceStateV1 `json:"resources"`
+
+        // Dependencies are a list of things that this module relies on
+        // existing to remain intact. For example: an module may depend
+        // on a VPC ID given by an aws_vpc resource.
+        //
+        // Terraform uses this information to build valid destruction
+        // orders and to warn the user if they're destroying a module that
+        // another resource depends on.
+        //
+        // Things can be put into this list that may not be managed by
+        // Terraform. If Terraform doesn't find a matching ID in the
+        // overall state, then it assumes it isn't managed and doesn't
+        // worry about it.
+        Dependencies []string `json:"depends_on,omitempty"`
+}
+
+type resourceStateV1 struct {
+        // This is filled in and managed by Terraform, and is the resource
+        // type itself such as "mycloud_instance". If a resource provider sets
+        // this value, it won't be persisted.
+        Type string `json:"type"`
+
+        // Dependencies are a list of things that this resource relies on
+        // existing to remain intact. For example: an AWS instance might
+        // depend on a subnet (which itself might depend on a VPC, and so
+        // on).
+        //
+        // Terraform uses this information to build valid destruction
+        // orders and to warn the user if they're destroying a resource that
+        // another resource depends on.
+        //
+        // Things can be put into this list that may not be managed by
+        // Terraform. If Terraform doesn't find a matching ID in the
+        // overall state, then it assumes it isn't managed and doesn't
+        // worry about it.
+        Dependencies []string `json:"depends_on,omitempty"`
+
+        // Primary is the current active instance for this resource.
+        // It can be replaced but only after a successful creation.
+        // This is the instances on which providers will act.
+        Primary *instanceStateV1 `json:"primary"`
+
+        // Tainted is used to track any underlying instances that
+        // have been created but are in a bad or unknown state and
+        // need to be cleaned up subsequently.  In the
+        // standard case, there is only at most a single instance.
+        // However, in pathological cases, it is possible for the number
+        // of instances to accumulate.
+        Tainted []*instanceStateV1 `json:"tainted,omitempty"`
+
+        // Deposed is used in the mechanics of CreateBeforeDestroy: the existing
+        // Primary is Deposed to get it out of the way for the replacement Primary to
+        // be created by Apply. If the replacement Primary creates successfully, the
+        // Deposed instance is cleaned up. If there were problems creating the
+        // replacement, the instance remains in the Deposed list so it can be
+        // destroyed in a future run. Functionally, Deposed instances are very
+        // similar to Tainted instances in that Terraform is only tracking them in
+        // order to remember to destroy them.
+        Deposed []*instanceStateV1 `json:"deposed,omitempty"`
+
+        // Provider is used when a resource is connected to a provider with an alias.
+        // If this string is empty, the resource is connected to the default provider,
+        // e.g. "aws_instance" goes with the "aws" provider.
+        // If the resource block contained a "provider" key, that value will be set here.
+        Provider string `json:"provider,omitempty"`
+}
+
+type instanceStateV1 struct {
+        // A unique ID for this resource. This is opaque to Terraform
+        // and is only meant as a lookup mechanism for the providers.
+        ID string `json:"id"`
+
+        // Attributes are basic information about the resource. Any keys here
+        // are accessible in variable format within Terraform configurations:
+        // ${resourcetype.name.attribute}.
+        Attributes map[string]string `json:"attributes,omitempty"`
+
+        // Meta is a simple K/V map that is persisted to the State but otherwise
+        // ignored by Terraform core. It's meant to be used for accounting by
+        // external client code.
+        Meta map[string]string `json:"meta,omitempty"`
+}
+
+type ephemeralStateV1 struct {
+        // ConnInfo is used for the providers to export information which is
+        // used to connect to the resource for provisioning. For example,
+        // this could contain SSH or WinRM credentials.
+        ConnInfo map[string]string `json:"-"`
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version1_upgrade.go b/vendor/github.com/hashicorp/terraform/states/statefile/version1_upgrade.go
new file mode 100644
index 0000000..0b417e1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version1_upgrade.go
@@ -0,0 +1,172 @@
+package statefile
+
+import (
+        "fmt"
+        "log"
+
+        "github.com/mitchellh/copystructure"
+)
+
+// upgradeStateV1ToV2 is used to upgrade a V1 state representation
+// into a V2 state representation
+func upgradeStateV1ToV2(old *stateV1) (*stateV2, error) {
+        log.Printf("[TRACE] statefile.Read: upgrading format from v1 to v2")
+        if old == nil {
+                return nil, nil
+        }
+
+        remote, err := old.Remote.upgradeToV2()
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading State V1: %v", err)
+        }
+
+        modules := make([]*moduleStateV2, len(old.Modules))
+        for i, module := range old.Modules {
+                upgraded, err := module.upgradeToV2()
+                if err != nil {
+                        return nil, fmt.Errorf("Error upgrading State V1: %v", err)
+                }
+                modules[i] = upgraded
+        }
+        if len(modules) == 0 {
+                modules = nil
+        }
+
+        newState := &stateV2{
+                Version: 2,
+                Serial:  old.Serial,
+                Remote:  remote,
+                Modules: modules,
+        }
+
+        return newState, nil
+}
+
+func (old *remoteStateV1) upgradeToV2() (*remoteStateV2, error) {
+        if old == nil {
+                return nil, nil
+        }
+
+        config, err := copystructure.Copy(old.Config)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading RemoteState V1: %v", err)
+        }
+
+        return &remoteStateV2{
+                Type:   old.Type,
+                Config: config.(map[string]string),
+        }, nil
+}
+
+func (old *moduleStateV1) upgradeToV2() (*moduleStateV2, error) {
+        if old == nil {
+                return nil, nil
+        }
+
+        pathRaw, err := copystructure.Copy(old.Path)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading ModuleState V1: %v", err)
+        }
+        path, ok := pathRaw.([]string)
+        if !ok {
+                return nil, fmt.Errorf("Error upgrading ModuleState V1: path is not a list of strings")
+        }
+        if len(path) == 0 {
+                // We found some V1 states with a nil path. Assume root.
+                path = []string{"root"}
+        }
+
+        // Outputs needs upgrading to use the new structure
+        outputs := make(map[string]*outputStateV2)
+        for key, output := range old.Outputs {
+                outputs[key] = &outputStateV2{
+                        Type:      "string",
+                        Value:     output,
+                        Sensitive: false,
+                }
+        }
+
+        resources := make(map[string]*resourceStateV2)
+        for key, oldResource := range old.Resources {
+                upgraded, err := oldResource.upgradeToV2()
+                if err != nil {
+                        return nil, fmt.Errorf("Error upgrading ModuleState V1: %v", err)
+                }
+                resources[key] = upgraded
+        }
+
+        dependencies, err := copystructure.Copy(old.Dependencies)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading ModuleState V1: %v", err)
+        }
+
+        return &moduleStateV2{
+                Path:         path,
+                Outputs:      outputs,
+                Resources:    resources,
+                Dependencies: dependencies.([]string),
+        }, nil
+}
+
+func (old *resourceStateV1) upgradeToV2() (*resourceStateV2, error) {
+        if old == nil {
+                return nil, nil
+        }
+
+        dependencies, err := copystructure.Copy(old.Dependencies)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading ResourceState V1: %v", err)
+        }
+
+        primary, err := old.Primary.upgradeToV2()
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading ResourceState V1: %v", err)
+        }
+
+        deposed := make([]*instanceStateV2, len(old.Deposed))
+        for i, v := range old.Deposed {
+                upgraded, err := v.upgradeToV2()
+                if err != nil {
+                        return nil, fmt.Errorf("Error upgrading ResourceState V1: %v", err)
+                }
+                deposed[i] = upgraded
+        }
+        if len(deposed) == 0 {
+                deposed = nil
+        }
+
+        return &resourceStateV2{
+                Type:         old.Type,
+                Dependencies: dependencies.([]string),
+                Primary:      primary,
+                Deposed:      deposed,
+                Provider:     old.Provider,
+        }, nil
+}
+
+func (old *instanceStateV1) upgradeToV2() (*instanceStateV2, error) {
+        if old == nil {
+                return nil, nil
+        }
+
+        attributes, err := copystructure.Copy(old.Attributes)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading InstanceState V1: %v", err)
+        }
+
+        meta, err := copystructure.Copy(old.Meta)
+        if err != nil {
+                return nil, fmt.Errorf("Error upgrading InstanceState V1: %v", err)
+        }
+
+        newMeta := make(map[string]interface{})
+        for k, v := range meta.(map[string]string) {
+                newMeta[k] = v
+        }
+
+        return &instanceStateV2{
+                ID:         old.ID,
+                Attributes: attributes.(map[string]string),
+                Meta:       newMeta,
+        }, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version2.go b/vendor/github.com/hashicorp/terraform/states/statefile/version2.go
new file mode 100644
index 0000000..6fe2ab8
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version2.go
@@ -0,0 +1,209 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+        "sync"
+
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func readStateV2(src []byte) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV2 := &stateV2{}
+        err := json.Unmarshal(src, sV2)
+        if err != nil {
+                diags = diags.Append(jsonUnmarshalDiags(err))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV2(sV2)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+func prepareStateV2(sV2 *stateV2) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV3, err := upgradeStateV2ToV3(sV2)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        upgradeFailed,
+                        fmt.Sprintf("Error upgrading state file format from version 2 to version 3: %s.", err),
+                ))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV3(sV3)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+// stateV2 is a representation of the legacy JSON state format version 2.
+//
+// It is only used to read version 2 JSON files prior to upgrading them to
+// the current format.
+type stateV2 struct {
+        // Version is the state file protocol version.
+        Version int `json:"version"`
+
+        // TFVersion is the version of Terraform that wrote this state.
+        TFVersion string `json:"terraform_version,omitempty"`
+
+        // Serial is incremented on any operation that modifies
+        // the State file. It is used to detect potentially conflicting
+        // updates.
+        Serial int64 `json:"serial"`
+
+        // Lineage is set when a new, blank state is created and then
+        // never updated. This allows us to determine whether the serials
+        // of two states can be meaningfully compared.
+        // Apart from the guarantee that collisions between two lineages
+        // are very unlikely, this value is opaque and external callers
+        // should only compare lineage strings byte-for-byte for equality.
+        Lineage string `json:"lineage"`
+
+        // Remote is used to track the metadata required to
+        // pull and push state files from a remote storage endpoint.
+        Remote *remoteStateV2 `json:"remote,omitempty"`
+
+        // Backend tracks the configuration for the backend in use with
+        // this state. This is used to track any changes in the backend
+        // configuration.
+        Backend *backendStateV2 `json:"backend,omitempty"`
+
+        // Modules contains all the modules in a breadth-first order
+        Modules []*moduleStateV2 `json:"modules"`
+}
+
+type remoteStateV2 struct {
+        // Type controls the client we use for the remote state
+        Type string `json:"type"`
+
+        // Config is used to store arbitrary configuration that
+        // is type specific
+        Config map[string]string `json:"config"`
+}
+
+type outputStateV2 struct {
+        // Sensitive describes whether the output is considered sensitive,
+        // which may lead to masking the value on screen in some cases.
+        Sensitive bool `json:"sensitive"`
+        // Type describes the structure of Value. Valid values are "string",
+        // "map" and "list"
+        Type string `json:"type"`
+        // Value contains the value of the output, in the structure described
+        // by the Type field.
+        Value interface{} `json:"value"`
+
+        mu sync.Mutex
+}
+
+type moduleStateV2 struct {
+        // Path is the import path from the root module. Modules imports are
+        // always disjoint, so the path represents amodule tree
+        Path []string `json:"path"`
+
+        // Locals are kept only transiently in-memory, because we can always
+        // re-compute them.
+        Locals map[string]interface{} `json:"-"`
+
+        // Outputs declared by the module and maintained for each module
+        // even though only the root module technically needs to be kept.
+        // This allows operators to inspect values at the boundaries.
+        Outputs map[string]*outputStateV2 `json:"outputs"`
+
+        // Resources is a mapping of the logically named resource to
+        // the state of the resource. Each resource may actually have
+        // N instances underneath, although a user only needs to think
+        // about the 1:1 case.
+        Resources map[string]*resourceStateV2 `json:"resources"`
+
+        // Dependencies are a list of things that this module relies on
+        // existing to remain intact. For example: an module may depend
+        // on a VPC ID given by an aws_vpc resource.
+        //
+        // Terraform uses this information to build valid destruction
+        // orders and to warn the user if they're destroying a module that
+        // another resource depends on.
+        //
+        // Things can be put into this list that may not be managed by
+        // Terraform. If Terraform doesn't find a matching ID in the
+        // overall state, then it assumes it isn't managed and doesn't
+        // worry about it.
+        Dependencies []string `json:"depends_on"`
+}
+
+type resourceStateV2 struct {
+        // This is filled in and managed by Terraform, and is the resource
+        // type itself such as "mycloud_instance". If a resource provider sets
+        // this value, it won't be persisted.
+        Type string `json:"type"`
+
+        // Dependencies are a list of things that this resource relies on
+        // existing to remain intact. For example: an AWS instance might
+        // depend on a subnet (which itself might depend on a VPC, and so
+        // on).
+        //
+        // Terraform uses this information to build valid destruction
+        // orders and to warn the user if they're destroying a resource that
+        // another resource depends on.
+        //
+        // Things can be put into this list that may not be managed by
+        // Terraform. If Terraform doesn't find a matching ID in the
+        // overall state, then it assumes it isn't managed and doesn't
+        // worry about it.
+        Dependencies []string `json:"depends_on"`
+
+        // Primary is the current active instance for this resource.
+        // It can be replaced but only after a successful creation.
+        // This is the instances on which providers will act.
+        Primary *instanceStateV2 `json:"primary"`
+
+        // Deposed is used in the mechanics of CreateBeforeDestroy: the existing
+        // Primary is Deposed to get it out of the way for the replacement Primary to
+        // be created by Apply. If the replacement Primary creates successfully, the
+        // Deposed instance is cleaned up.
+        //
+        // If there were problems creating the replacement Primary, the Deposed
+        // instance and the (now tainted) replacement Primary will be swapped so the
+        // tainted replacement will be cleaned up instead.
+        //
+        // An instance will remain in the Deposed list until it is successfully
+        // destroyed and purged.
+        Deposed []*instanceStateV2 `json:"deposed"`
+
+        // Provider is used when a resource is connected to a provider with an alias.
+        // If this string is empty, the resource is connected to the default provider,
+        // e.g. "aws_instance" goes with the "aws" provider.
+        // If the resource block contained a "provider" key, that value will be set here.
+        Provider string `json:"provider"`
+
+        mu sync.Mutex
+}
+
+type instanceStateV2 struct {
+        // A unique ID for this resource. This is opaque to Terraform
+        // and is only meant as a lookup mechanism for the providers.
+        ID string `json:"id"`
+
+        // Attributes are basic information about the resource. Any keys here
+        // are accessible in variable format within Terraform configurations:
+        // ${resourcetype.name.attribute}.
+        Attributes map[string]string `json:"attributes"`
+
+        // Meta is a simple K/V map that is persisted to the State but otherwise
+        // ignored by Terraform core. It's meant to be used for accounting by
+        // external client code. The value here must only contain Go primitives
+        // and collections.
+        Meta map[string]interface{} `json:"meta"`
+
+        // Tainted is used to mark a resource for recreation.
+        Tainted bool `json:"tainted"`
+}
+
+type backendStateV2 struct {
+        Type      string          `json:"type"`   // Backend type
+        ConfigRaw json.RawMessage `json:"config"` // Backend raw config
+        Hash      int             `json:"hash"`   // Hash of portion of configuration from config files
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version2_upgrade.go b/vendor/github.com/hashicorp/terraform/states/statefile/version2_upgrade.go
new file mode 100644
index 0000000..2d03c07
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version2_upgrade.go
@@ -0,0 +1,145 @@
+package statefile
+
+import (
+        "fmt"
+        "log"
+        "regexp"
+        "sort"
+        "strconv"
+        "strings"
+
+        "github.com/mitchellh/copystructure"
+)
+
+func upgradeStateV2ToV3(old *stateV2) (*stateV3, error) {
+        if old == nil {
+                return (*stateV3)(nil), nil
+        }
+
+        var new *stateV3
+        {
+                copy, err := copystructure.Config{Lock: true}.Copy(old)
+                if err != nil {
+                        panic(err)
+                }
+                newWrongType := copy.(*stateV2)
+                newRightType := (stateV3)(*newWrongType)
+                new = &newRightType
+        }
+
+        // Set the new version number
+        new.Version = 3
+
+        // Change the counts for things which look like maps to use the %
+        // syntax. Remove counts for empty collections - they will be added
+        // back in later.
+        for _, module := range new.Modules {
+                for _, resource := range module.Resources {
+                        // Upgrade Primary
+                        if resource.Primary != nil {
+                                upgradeAttributesV2ToV3(resource.Primary)
+                        }
+
+                        // Upgrade Deposed
+                        for _, deposed := range resource.Deposed {
+                                upgradeAttributesV2ToV3(deposed)
+                        }
+                }
+        }
+
+        return new, nil
+}
+
+func upgradeAttributesV2ToV3(instanceState *instanceStateV2) error {
+        collectionKeyRegexp := regexp.MustCompile(`^(.*\.)#$`)
+        collectionSubkeyRegexp := regexp.MustCompile(`^([^\.]+)\..*`)
+
+        // Identify the key prefix of anything which is a collection
+        var collectionKeyPrefixes []string
+        for key := range instanceState.Attributes {
+                if submatches := collectionKeyRegexp.FindAllStringSubmatch(key, -1); len(submatches) > 0 {
+                        collectionKeyPrefixes = append(collectionKeyPrefixes, submatches[0][1])
+                }
+        }
+        sort.Strings(collectionKeyPrefixes)
+
+        log.Printf("[STATE UPGRADE] Detected the following collections in state: %v", collectionKeyPrefixes)
+
+        // This could be rolled into fewer loops, but it is somewhat clearer this way, and will not
+        // run very often.
+        for _, prefix := range collectionKeyPrefixes {
+                // First get the actual keys that belong to this prefix
+                var potentialKeysMatching []string
+                for key := range instanceState.Attributes {
+                        if strings.HasPrefix(key, prefix) {
+                                potentialKeysMatching = append(potentialKeysMatching, strings.TrimPrefix(key, prefix))
+                        }
+                }
+                sort.Strings(potentialKeysMatching)
+
+                var actualKeysMatching []string
+                for _, key := range potentialKeysMatching {
+                        if submatches := collectionSubkeyRegexp.FindAllStringSubmatch(key, -1); len(submatches) > 0 {
+                                actualKeysMatching = append(actualKeysMatching, submatches[0][1])
+                        } else {
+                                if key != "#" {
+                                        actualKeysMatching = append(actualKeysMatching, key)
+                                }
+                        }
+                }
+                actualKeysMatching = uniqueSortedStrings(actualKeysMatching)
+
+                // Now inspect the keys in order to determine whether this is most likely to be
+                // a map, list or set. There is room for error here, so we log in each case. If
+                // there is no method of telling, we remove the key from the InstanceState in
+                // order that it will be recreated. Again, this could be rolled into fewer loops
+                // but we prefer clarity.
+
+                oldCountKey := fmt.Sprintf("%s#", prefix)
+
+                // First, detect "obvious" maps - which have non-numeric keys (mostly).
+                hasNonNumericKeys := false
+                for _, key := range actualKeysMatching {
+                        if _, err := strconv.Atoi(key); err != nil {
+                                hasNonNumericKeys = true
+                        }
+                }
+                if hasNonNumericKeys {
+                        newCountKey := fmt.Sprintf("%s%%", prefix)
+
+                        instanceState.Attributes[newCountKey] = instanceState.Attributes[oldCountKey]
+                        delete(instanceState.Attributes, oldCountKey)
+                        log.Printf("[STATE UPGRADE] Detected %s as a map. Replaced count = %s",
+                                strings.TrimSuffix(prefix, "."), instanceState.Attributes[newCountKey])
+                }
+
+                // Now detect empty collections and remove them from state.
+                if len(actualKeysMatching) == 0 {
+                        delete(instanceState.Attributes, oldCountKey)
+                        log.Printf("[STATE UPGRADE] Detected %s as an empty collection. Removed from state.",
+                                strings.TrimSuffix(prefix, "."))
+                }
+        }
+
+        return nil
+}
+
+// uniqueSortedStrings removes duplicates from a slice of strings and returns
+// a sorted slice of the unique strings.
+func uniqueSortedStrings(input []string) []string {
+        uniquemap := make(map[string]struct{})
+        for _, str := range input {
+                uniquemap[str] = struct{}{}
+        }
+
+        output := make([]string, len(uniquemap))
+
+        i := 0
+        for key := range uniquemap {
+                output[i] = key
+                i = i + 1
+        }
+
+        sort.Strings(output)
+        return output
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version3.go b/vendor/github.com/hashicorp/terraform/states/statefile/version3.go
new file mode 100644
index 0000000..ab6414b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version3.go
@@ -0,0 +1,50 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func readStateV3(src []byte) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV3 := &stateV3{}
+        err := json.Unmarshal(src, sV3)
+        if err != nil {
+                diags = diags.Append(jsonUnmarshalDiags(err))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV3(sV3)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+func prepareStateV3(sV3 *stateV3) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV4, err := upgradeStateV3ToV4(sV3)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        upgradeFailed,
+                        fmt.Sprintf("Error upgrading state file format from version 3 to version 4: %s.", err),
+                ))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV4(sV4)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+// stateV2 is a representation of the legacy JSON state format version 3.
+//
+// It is only used to read version 3 JSON files prior to upgrading them to
+// the current format.
+//
+// The differences between version 2 and version 3 are only in the data and
+// not in the structure, so stateV3 actually shares the same structs as
+// stateV2. Type stateV3 represents that the data within is formatted as
+// expected by the V3 format, rather than the V2 format.
+type stateV3 stateV2
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version3_upgrade.go b/vendor/github.com/hashicorp/terraform/states/statefile/version3_upgrade.go
new file mode 100644
index 0000000..2cbe8a5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version3_upgrade.go
@@ -0,0 +1,431 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+        "strconv"
+        "strings"
+
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func upgradeStateV3ToV4(old *stateV3) (*stateV4, error) {
+
+        if old.Serial < 0 {
+                // The new format is using uint64 here, which should be fine for any
+                // real state (we only used positive integers in practice) but we'll
+                // catch this explicitly here to avoid weird behavior if a state file
+                // has been tampered with in some way.
+                return nil, fmt.Errorf("state has serial less than zero, which is invalid")
+        }
+
+        new := &stateV4{
+                TerraformVersion: old.TFVersion,
+                Serial:           uint64(old.Serial),
+                Lineage:          old.Lineage,
+                RootOutputs:      map[string]outputStateV4{},
+                Resources:        []resourceStateV4{},
+        }
+
+        if new.TerraformVersion == "" {
+                // Older formats considered this to be optional, but now it's required
+                // and so we'll stub it out with something that's definitely older
+                // than the version that really created this state.
+                new.TerraformVersion = "0.0.0"
+        }
+
+        for _, msOld := range old.Modules {
+                if len(msOld.Path) < 1 || msOld.Path[0] != "root" {
+                        return nil, fmt.Errorf("state contains invalid module path %#v", msOld.Path)
+                }
+
+                // Convert legacy-style module address into our newer address type.
+                // Since these old formats are only generated by versions of Terraform
+                // that don't support count and for_each on modules, we can just assume
+                // all of the modules are unkeyed.
+                moduleAddr := make(addrs.ModuleInstance, len(msOld.Path)-1)
+                for i, name := range msOld.Path[1:] {
+                        moduleAddr[i] = addrs.ModuleInstanceStep{
+                                Name:        name,
+                                InstanceKey: addrs.NoKey,
+                        }
+                }
+
+                // In a v3 state file, a "resource state" is actually an instance
+                // state, so we need to fill in a missing level of heirarchy here
+                // by lazily creating resource states as we encounter them.
+                // We'll track them in here, keyed on the string representation of
+                // the resource address.
+                resourceStates := map[string]*resourceStateV4{}
+
+                for legacyAddr, rsOld := range msOld.Resources {
+                        instAddr, err := parseLegacyResourceAddress(legacyAddr)
+                        if err != nil {
+                                return nil, err
+                        }
+
+                        resAddr := instAddr.Resource
+                        rs, exists := resourceStates[resAddr.String()]
+                        if !exists {
+                                var modeStr string
+                                switch resAddr.Mode {
+                                case addrs.ManagedResourceMode:
+                                        modeStr = "managed"
+                                case addrs.DataResourceMode:
+                                        modeStr = "data"
+                                default:
+                                        return nil, fmt.Errorf("state contains resource %s with an unsupported resource mode", resAddr)
+                                }
+
+                                // In state versions prior to 4 we allowed each instance of a
+                                // resource to have its own provider configuration address,
+                                // which makes no real sense in practice because providers
+                                // are associated with resources in the configuration. We
+                                // elevate that to the resource level during this upgrade,
+                                // implicitly taking the provider address of the first instance
+                                // we encounter for each resource. While this is lossy in
+                                // theory, in practice there is no reason for these values to
+                                // differ between instances.
+                                var providerAddr addrs.AbsProviderConfig
+                                oldProviderAddr := rsOld.Provider
+                                if strings.Contains(oldProviderAddr, "provider.") {
+                                        // Smells like a new-style provider address, but we'll test it.
+                                        var diags tfdiags.Diagnostics
+                                        providerAddr, diags = addrs.ParseAbsProviderConfigStr(oldProviderAddr)
+                                        if diags.HasErrors() {
+                                                return nil, diags.Err()
+                                        }
+                                } else {
+                                        // Smells like an old-style module-local provider address,
+                                        // which we'll need to migrate. We'll assume it's referring
+                                        // to the same module the resource is in, which might be
+                                        // incorrect but it'll get fixed up next time any updates
+                                        // are made to an instance.
+                                        if oldProviderAddr != "" {
+                                                localAddr, diags := addrs.ParseProviderConfigCompactStr(oldProviderAddr)
+                                                if diags.HasErrors() {
+                                                        return nil, diags.Err()
+                                                }
+                                                providerAddr = localAddr.Absolute(moduleAddr)
+                                        } else {
+                                                providerAddr = resAddr.DefaultProviderConfig().Absolute(moduleAddr)
+                                        }
+                                }
+
+                                rs = &resourceStateV4{
+                                        Module:         moduleAddr.String(),
+                                        Mode:           modeStr,
+                                        Type:           resAddr.Type,
+                                        Name:           resAddr.Name,
+                                        Instances:      []instanceObjectStateV4{},
+                                        ProviderConfig: providerAddr.String(),
+                                }
+                                resourceStates[resAddr.String()] = rs
+                        }
+
+                        // Now we'll deal with the instance itself, which may either be
+                        // the first instance in a resource we just created or an additional
+                        // instance for a resource added on a prior loop.
+                        instKey := instAddr.Key
+                        if isOld := rsOld.Primary; isOld != nil {
+                                isNew, err := upgradeInstanceObjectV3ToV4(rsOld, isOld, instKey, states.NotDeposed)
+                                if err != nil {
+                                        return nil, fmt.Errorf("failed to migrate primary generation of %s: %s", instAddr, err)
+                                }
+                                rs.Instances = append(rs.Instances, *isNew)
+                        }
+                        for i, isOld := range rsOld.Deposed {
+                                // When we migrate old instances we'll use sequential deposed
+                                // keys just so that the upgrade result is deterministic. New
+                                // deposed keys allocated moving forward will be pseudorandomly
+                                // selected, but we check for collisions and so these
+                                // non-random ones won't hurt.
+                                deposedKey := states.DeposedKey(fmt.Sprintf("%08x", i+1))
+                                isNew, err := upgradeInstanceObjectV3ToV4(rsOld, isOld, instKey, deposedKey)
+                                if err != nil {
+                                        return nil, fmt.Errorf("failed to migrate deposed generation index %d of %s: %s", i, instAddr, err)
+                                }
+                                rs.Instances = append(rs.Instances, *isNew)
+                        }
+
+                        if instKey != addrs.NoKey && rs.EachMode == "" {
+                                rs.EachMode = "list"
+                        }
+                }
+
+                for _, rs := range resourceStates {
+                        new.Resources = append(new.Resources, *rs)
+                }
+
+                if len(msOld.Path) == 1 && msOld.Path[0] == "root" {
+                        // We'll migrate the outputs for this module too, then.
+                        for name, oldOS := range msOld.Outputs {
+                                newOS := outputStateV4{
+                                        Sensitive: oldOS.Sensitive,
+                                }
+
+                                valRaw := oldOS.Value
+                                valSrc, err := json.Marshal(valRaw)
+                                if err != nil {
+                                        // Should never happen, because this value came from JSON
+                                        // in the first place and so we're just round-tripping here.
+                                        return nil, fmt.Errorf("failed to serialize output %q value as JSON: %s", name, err)
+                                }
+
+                                // The "type" field in state V2 wasn't really that useful
+                                // since it was only able to capture string vs. list vs. map.
+                                // For this reason, during upgrade we'll just discard it
+                                // altogether and use cty's idea of the implied type of
+                                // turning our old value into JSON.
+                                ty, err := ctyjson.ImpliedType(valSrc)
+                                if err != nil {
+                                        // REALLY should never happen, because we literally just
+                                        // encoded this as JSON above!
+                                        return nil, fmt.Errorf("failed to parse output %q value from JSON: %s", name, err)
+                                }
+
+                                // ImpliedType tends to produce structural types, but since older
+                                // version of Terraform didn't support those a collection type
+                                // is probably what was intended, so we'll see if we can
+                                // interpret our value as one.
+                                ty = simplifyImpliedValueType(ty)
+
+                                tySrc, err := ctyjson.MarshalType(ty)
+                                if err != nil {
+                                        return nil, fmt.Errorf("failed to serialize output %q type as JSON: %s", name, err)
+                                }
+
+                                newOS.ValueRaw = json.RawMessage(valSrc)
+                                newOS.ValueTypeRaw = json.RawMessage(tySrc)
+
+                                new.RootOutputs[name] = newOS
+                        }
+                }
+        }
+
+        new.normalize()
+
+        return new, nil
+}
+
+func upgradeInstanceObjectV3ToV4(rsOld *resourceStateV2, isOld *instanceStateV2, instKey addrs.InstanceKey, deposedKey states.DeposedKey) (*instanceObjectStateV4, error) {
+
+        // Schema versions were, in prior formats, a private concern of the provider
+        // SDK, and not a first-class concept in the state format. Here we're
+        // sniffing for the pre-0.12 SDK's way of representing schema versions
+        // and promoting it to our first-class field if we find it. We'll ignore
+        // it if it doesn't look like what the SDK would've written. If this
+        // sniffing fails then we'll assume schema version 0.
+        var schemaVersion uint64
+        migratedSchemaVersion := false
+        if raw, exists := isOld.Meta["schema_version"]; exists {
+                switch tv := raw.(type) {
+                case string:
+                        v, err := strconv.ParseUint(tv, 10, 64)
+                        if err == nil {
+                                schemaVersion = v
+                                migratedSchemaVersion = true
+                        }
+                case int:
+                        schemaVersion = uint64(tv)
+                        migratedSchemaVersion = true
+                case float64:
+                        schemaVersion = uint64(tv)
+                        migratedSchemaVersion = true
+                }
+        }
+
+        private := map[string]interface{}{}
+        for k, v := range isOld.Meta {
+                if k == "schema_version" && migratedSchemaVersion {
+                        // We're gonna promote this into our first-class schema version field
+                        continue
+                }
+                private[k] = v
+        }
+        var privateJSON []byte
+        if len(private) != 0 {
+                var err error
+                privateJSON, err = json.Marshal(private)
+                if err != nil {
+                        // This shouldn't happen, because the Meta values all came from JSON
+                        // originally anyway.
+                        return nil, fmt.Errorf("cannot serialize private instance object data: %s", err)
+                }
+        }
+
+        var status string
+        if isOld.Tainted {
+                status = "tainted"
+        }
+
+        var instKeyRaw interface{}
+        switch tk := instKey.(type) {
+        case addrs.IntKey:
+                instKeyRaw = int(tk)
+        case addrs.StringKey:
+                instKeyRaw = string(tk)
+        default:
+                if instKeyRaw != nil {
+                        return nil, fmt.Errorf("insupported instance key: %#v", instKey)
+                }
+        }
+
+        var attributes map[string]string
+        if isOld.Attributes != nil {
+                attributes = make(map[string]string, len(isOld.Attributes))
+                for k, v := range isOld.Attributes {
+                        attributes[k] = v
+                }
+        }
+        if isOld.ID != "" {
+                // As a special case, if we don't already have an "id" attribute and
+                // yet there's a non-empty first-class ID on the old object then we'll
+                // create a synthetic id attribute to avoid losing that first-class id.
+                // In practice this generally arises only in tests where state literals
+                // are hand-written in a non-standard way; real code prior to 0.12
+                // would always force the first-class ID to be copied into the
+                // id attribute before storing.
+                if attributes == nil {
+                        attributes = make(map[string]string, len(isOld.Attributes))
+                }
+                if idVal := attributes["id"]; idVal == "" {
+                        attributes["id"] = isOld.ID
+                }
+        }
+
+        dependencies := make([]string, len(rsOld.Dependencies))
+        for i, v := range rsOld.Dependencies {
+                dependencies[i] = parseLegacyDependency(v)
+        }
+
+        return &instanceObjectStateV4{
+                IndexKey:       instKeyRaw,
+                Status:         status,
+                Deposed:        string(deposedKey),
+                AttributesFlat: attributes,
+                Dependencies:   dependencies,
+                SchemaVersion:  schemaVersion,
+                PrivateRaw:     privateJSON,
+        }, nil
+}
+
+// parseLegacyResourceAddress parses the different identifier format used
+// state formats before version 4, like "instance.name.0".
+func parseLegacyResourceAddress(s string) (addrs.ResourceInstance, error) {
+        var ret addrs.ResourceInstance
+
+        // Split based on ".". Every resource address should have at least two
+        // elements (type and name).
+        parts := strings.Split(s, ".")
+        if len(parts) < 2 || len(parts) > 4 {
+                return ret, fmt.Errorf("invalid internal resource address format: %s", s)
+        }
+
+        // Data resource if we have at least 3 parts and the first one is data
+        ret.Resource.Mode = addrs.ManagedResourceMode
+        if len(parts) > 2 && parts[0] == "data" {
+                ret.Resource.Mode = addrs.DataResourceMode
+                parts = parts[1:]
+        }
+
+        // If we're not a data resource and we have more than 3, then it is an error
+        if len(parts) > 3 && ret.Resource.Mode != addrs.DataResourceMode {
+                return ret, fmt.Errorf("invalid internal resource address format: %s", s)
+        }
+
+        // Build the parts of the resource address that are guaranteed to exist
+        ret.Resource.Type = parts[0]
+        ret.Resource.Name = parts[1]
+        ret.Key = addrs.NoKey
+
+        // If we have more parts, then we have an index. Parse that.
+        if len(parts) > 2 {
+                idx, err := strconv.ParseInt(parts[2], 0, 0)
+                if err != nil {
+                        return ret, fmt.Errorf("error parsing resource address %q: %s", s, err)
+                }
+
+                ret.Key = addrs.IntKey(idx)
+        }
+
+        return ret, nil
+}
+
+// simplifyImpliedValueType attempts to heuristically simplify a value type
+// derived from a legacy stored output value into something simpler that
+// is closer to what would've fitted into the pre-v0.12 value type system.
+func simplifyImpliedValueType(ty cty.Type) cty.Type {
+        switch {
+        case ty.IsTupleType():
+                // If all of the element types are the same then we'll make this
+                // a list instead. This is very likely to be true, since prior versions
+                // of Terraform did not officially support mixed-type collections.
+
+                if ty.Equals(cty.EmptyTuple) {
+                        // Don't know what the element type would be, then.
+                        return ty
+                }
+
+                etys := ty.TupleElementTypes()
+                ety := etys[0]
+                for _, other := range etys[1:] {
+                        if !other.Equals(ety) {
+                                // inconsistent types
+                                return ty
+                        }
+                }
+                ety = simplifyImpliedValueType(ety)
+                return cty.List(ety)
+
+        case ty.IsObjectType():
+                // If all of the attribute types are the same then we'll make this
+                // a map instead. This is very likely to be true, since prior versions
+                // of Terraform did not officially support mixed-type collections.
+
+                if ty.Equals(cty.EmptyObject) {
+                        // Don't know what the element type would be, then.
+                        return ty
+                }
+
+                atys := ty.AttributeTypes()
+                var ety cty.Type
+                for _, other := range atys {
+                        if ety == cty.NilType {
+                                ety = other
+                                continue
+                        }
+                        if !other.Equals(ety) {
+                                // inconsistent types
+                                return ty
+                        }
+                }
+                ety = simplifyImpliedValueType(ety)
+                return cty.Map(ety)
+
+        default:
+                // No other normalizations are possible
+                return ty
+        }
+}
+
+func parseLegacyDependency(s string) string {
+        parts := strings.Split(s, ".")
+        ret := parts[0]
+        for _, part := range parts[1:] {
+                if part == "*" {
+                        break
+                }
+                if i, err := strconv.Atoi(part); err == nil {
+                        ret = ret + fmt.Sprintf("[%d]", i)
+                        break
+                }
+                ret = ret + "." + part
+        }
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/version4.go b/vendor/github.com/hashicorp/terraform/states/statefile/version4.go
new file mode 100644
index 0000000..ee8b652
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/version4.go
@@ -0,0 +1,604 @@
+package statefile
+
+import (
+        "encoding/json"
+        "fmt"
+        "io"
+        "sort"
+
+        version "github.com/hashicorp/go-version"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+func readStateV4(src []byte) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        sV4 := &stateV4{}
+        err := json.Unmarshal(src, sV4)
+        if err != nil {
+                diags = diags.Append(jsonUnmarshalDiags(err))
+                return nil, diags
+        }
+
+        file, prepDiags := prepareStateV4(sV4)
+        diags = diags.Append(prepDiags)
+        return file, diags
+}
+
+func prepareStateV4(sV4 *stateV4) (*File, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        var tfVersion *version.Version
+        if sV4.TerraformVersion != "" {
+                var err error
+                tfVersion, err = version.NewVersion(sV4.TerraformVersion)
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid Terraform version string",
+                                fmt.Sprintf("State file claims to have been written by Terraform version %q, which is not a valid version string.", sV4.TerraformVersion),
+                        ))
+                }
+        }
+
+        file := &File{
+                TerraformVersion: tfVersion,
+                Serial:           sV4.Serial,
+                Lineage:          sV4.Lineage,
+        }
+
+        state := states.NewState()
+
+        for _, rsV4 := range sV4.Resources {
+                rAddr := addrs.Resource{
+                        Type: rsV4.Type,
+                        Name: rsV4.Name,
+                }
+                switch rsV4.Mode {
+                case "managed":
+                        rAddr.Mode = addrs.ManagedResourceMode
+                case "data":
+                        rAddr.Mode = addrs.DataResourceMode
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid resource mode in state",
+                                fmt.Sprintf("State contains a resource with mode %q (%q %q) which is not supported.", rsV4.Mode, rAddr.Type, rAddr.Name),
+                        ))
+                        continue
+                }
+
+                moduleAddr := addrs.RootModuleInstance
+                if rsV4.Module != "" {
+                        var addrDiags tfdiags.Diagnostics
+                        moduleAddr, addrDiags = addrs.ParseModuleInstanceStr(rsV4.Module)
+                        diags = diags.Append(addrDiags)
+                        if addrDiags.HasErrors() {
+                                continue
+                        }
+                }
+
+                providerAddr, addrDiags := addrs.ParseAbsProviderConfigStr(rsV4.ProviderConfig)
+                diags.Append(addrDiags)
+                if addrDiags.HasErrors() {
+                        continue
+                }
+
+                var eachMode states.EachMode
+                switch rsV4.EachMode {
+                case "":
+                        eachMode = states.NoEach
+                case "list":
+                        eachMode = states.EachList
+                case "map":
+                        eachMode = states.EachMap
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid resource metadata in state",
+                                fmt.Sprintf("Resource %s has invalid \"each\" value %q in state.", rAddr.Absolute(moduleAddr), eachMode),
+                        ))
+                        continue
+                }
+
+                ms := state.EnsureModule(moduleAddr)
+
+                // Ensure the resource container object is present in the state.
+                ms.SetResourceMeta(rAddr, eachMode, providerAddr)
+
+                for _, isV4 := range rsV4.Instances {
+                        keyRaw := isV4.IndexKey
+                        var key addrs.InstanceKey
+                        switch tk := keyRaw.(type) {
+                        case int:
+                                key = addrs.IntKey(tk)
+                        case float64:
+                                // Since JSON only has one number type, reading from encoding/json
+                                // gives us a float64 here even if the number is whole.
+                                // float64 has a smaller integer range than int, but in practice
+                                // we rarely have more than a few tens of instances and so
+                                // it's unlikely that we'll exhaust the 52 bits in a float64.
+                                key = addrs.IntKey(int(tk))
+                        case string:
+                                key = addrs.StringKey(tk)
+                        default:
+                                if keyRaw != nil {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Invalid resource instance metadata in state",
+                                                fmt.Sprintf("Resource %s has an instance with the invalid instance key %#v.", rAddr.Absolute(moduleAddr), keyRaw),
+                                        ))
+                                        continue
+                                }
+                                key = addrs.NoKey
+                        }
+
+                        instAddr := rAddr.Instance(key)
+
+                        obj := &states.ResourceInstanceObjectSrc{
+                                SchemaVersion: isV4.SchemaVersion,
+                        }
+
+                        {
+                                // Instance attributes
+                                switch {
+                                case isV4.AttributesRaw != nil:
+                                        obj.AttrsJSON = isV4.AttributesRaw
+                                case isV4.AttributesFlat != nil:
+                                        obj.AttrsFlat = isV4.AttributesFlat
+                                default:
+                                        // This is odd, but we'll accept it and just treat the
+                                        // object has being empty. In practice this should arise
+                                        // only from the contrived sort of state objects we tend
+                                        // to hand-write inline in tests.
+                                        obj.AttrsJSON = []byte{'{', '}'}
+                                }
+                        }
+
+                        {
+                                // Status
+                                raw := isV4.Status
+                                switch raw {
+                                case "":
+                                        obj.Status = states.ObjectReady
+                                case "tainted":
+                                        obj.Status = states.ObjectTainted
+                                default:
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Invalid resource instance metadata in state",
+                                                fmt.Sprintf("Instance %s has invalid status %q.", instAddr.Absolute(moduleAddr), raw),
+                                        ))
+                                        continue
+                                }
+                        }
+
+                        if raw := isV4.PrivateRaw; len(raw) > 0 {
+                                obj.Private = raw
+                        }
+
+                        {
+                                depsRaw := isV4.Dependencies
+                                deps := make([]addrs.Referenceable, 0, len(depsRaw))
+                                for _, depRaw := range depsRaw {
+                                        ref, refDiags := addrs.ParseRefStr(depRaw)
+                                        diags = diags.Append(refDiags)
+                                        if refDiags.HasErrors() {
+                                                continue
+                                        }
+                                        if len(ref.Remaining) != 0 {
+                                                diags = diags.Append(tfdiags.Sourceless(
+                                                        tfdiags.Error,
+                                                        "Invalid resource instance metadata in state",
+                                                        fmt.Sprintf("Instance %s declares dependency on %q, which is not a reference to a dependable object.", instAddr.Absolute(moduleAddr), depRaw),
+                                                ))
+                                        }
+                                        if ref.Subject == nil {
+                                                // Should never happen
+                                                panic(fmt.Sprintf("parsing dependency %q for instance %s returned a nil address", depRaw, instAddr.Absolute(moduleAddr)))
+                                        }
+                                        deps = append(deps, ref.Subject)
+                                }
+                                obj.Dependencies = deps
+                        }
+
+                        switch {
+                        case isV4.Deposed != "":
+                                dk := states.DeposedKey(isV4.Deposed)
+                                if len(dk) != 8 {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Invalid resource instance metadata in state",
+                                                fmt.Sprintf("Instance %s has an object with deposed key %q, which is not correctly formatted.", instAddr.Absolute(moduleAddr), isV4.Deposed),
+                                        ))
+                                        continue
+                                }
+                                is := ms.ResourceInstance(instAddr)
+                                if is.HasDeposed(dk) {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Duplicate resource instance in state",
+                                                fmt.Sprintf("Instance %s deposed object %q appears multiple times in the state file.", instAddr.Absolute(moduleAddr), dk),
+                                        ))
+                                        continue
+                                }
+
+                                ms.SetResourceInstanceDeposed(instAddr, dk, obj, providerAddr)
+                        default:
+                                is := ms.ResourceInstance(instAddr)
+                                if is.HasCurrent() {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Duplicate resource instance in state",
+                                                fmt.Sprintf("Instance %s appears multiple times in the state file.", instAddr.Absolute(moduleAddr)),
+                                        ))
+                                        continue
+                                }
+
+                                ms.SetResourceInstanceCurrent(instAddr, obj, providerAddr)
+                        }
+                }
+
+                // We repeat this after creating the instances because
+                // SetResourceInstanceCurrent automatically resets this metadata based
+                // on the incoming objects. That behavior is useful when we're making
+                // piecemeal updates to the state during an apply, but when we're
+                // reading the state file we want to reflect its contents exactly.
+                ms.SetResourceMeta(rAddr, eachMode, providerAddr)
+        }
+
+        // The root module is special in that we persist its attributes and thus
+        // need to reload them now. (For descendent modules we just re-calculate
+        // them based on the latest configuration on each run.)
+        {
+                rootModule := state.RootModule()
+                for name, fos := range sV4.RootOutputs {
+                        os := &states.OutputValue{}
+                        os.Sensitive = fos.Sensitive
+
+                        ty, err := ctyjson.UnmarshalType([]byte(fos.ValueTypeRaw))
+                        if err != nil {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid output value type in state",
+                                        fmt.Sprintf("The state file has an invalid type specification for output %q: %s.", name, err),
+                                ))
+                                continue
+                        }
+
+                        val, err := ctyjson.Unmarshal([]byte(fos.ValueRaw), ty)
+                        if err != nil {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid output value saved in state",
+                                        fmt.Sprintf("The state file has an invalid value for output %q: %s.", name, err),
+                                ))
+                                continue
+                        }
+
+                        os.Value = val
+                        rootModule.OutputValues[name] = os
+                }
+        }
+
+        file.State = state
+        return file, diags
+}
+
+func writeStateV4(file *File, w io.Writer) tfdiags.Diagnostics {
+        // Here we'll convert back from the "File" representation to our
+        // stateV4 struct representation and write that.
+        //
+        // While we support legacy state formats for reading, we only support the
+        // latest for writing and so if a V5 is added in future then this function
+        // should be deleted and replaced with a writeStateV5, even though the
+        // read/prepare V4 functions above would stick around.
+
+        var diags tfdiags.Diagnostics
+        if file == nil || file.State == nil {
+                panic("attempt to write nil state to file")
+        }
+
+        var terraformVersion string
+        if file.TerraformVersion != nil {
+                terraformVersion = file.TerraformVersion.String()
+        }
+
+        sV4 := &stateV4{
+                TerraformVersion: terraformVersion,
+                Serial:           file.Serial,
+                Lineage:          file.Lineage,
+                RootOutputs:      map[string]outputStateV4{},
+                Resources:        []resourceStateV4{},
+        }
+
+        for name, os := range file.State.RootModule().OutputValues {
+                src, err := ctyjson.Marshal(os.Value, os.Value.Type())
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to serialize output value in state",
+                                fmt.Sprintf("An error occured while serializing output value %q: %s.", name, err),
+                        ))
+                        continue
+                }
+
+                typeSrc, err := ctyjson.MarshalType(os.Value.Type())
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to serialize output value in state",
+                                fmt.Sprintf("An error occured while serializing the type of output value %q: %s.", name, err),
+                        ))
+                        continue
+                }
+
+                sV4.RootOutputs[name] = outputStateV4{
+                        Sensitive:    os.Sensitive,
+                        ValueRaw:     json.RawMessage(src),
+                        ValueTypeRaw: json.RawMessage(typeSrc),
+                }
+        }
+
+        for _, ms := range file.State.Modules {
+                moduleAddr := ms.Addr
+                for _, rs := range ms.Resources {
+                        resourceAddr := rs.Addr
+
+                        var mode string
+                        switch resourceAddr.Mode {
+                        case addrs.ManagedResourceMode:
+                                mode = "managed"
+                        case addrs.DataResourceMode:
+                                mode = "data"
+                        default:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Failed to serialize resource in state",
+                                        fmt.Sprintf("Resource %s has mode %s, which cannot be serialized in state", resourceAddr.Absolute(moduleAddr), resourceAddr.Mode),
+                                ))
+                                continue
+                        }
+
+                        var eachMode string
+                        switch rs.EachMode {
+                        case states.NoEach:
+                                eachMode = ""
+                        case states.EachList:
+                                eachMode = "list"
+                        case states.EachMap:
+                                eachMode = "map"
+                        default:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Failed to serialize resource in state",
+                                        fmt.Sprintf("Resource %s has \"each\" mode %s, which cannot be serialized in state", resourceAddr.Absolute(moduleAddr), rs.EachMode),
+                                ))
+                                continue
+                        }
+
+                        sV4.Resources = append(sV4.Resources, resourceStateV4{
+                                Module:         moduleAddr.String(),
+                                Mode:           mode,
+                                Type:           resourceAddr.Type,
+                                Name:           resourceAddr.Name,
+                                EachMode:       eachMode,
+                                ProviderConfig: rs.ProviderConfig.String(),
+                                Instances:      []instanceObjectStateV4{},
+                        })
+                        rsV4 := &(sV4.Resources[len(sV4.Resources)-1])
+
+                        for key, is := range rs.Instances {
+                                if is.HasCurrent() {
+                                        var objDiags tfdiags.Diagnostics
+                                        rsV4.Instances, objDiags = appendInstanceObjectStateV4(
+                                                rs, is, key, is.Current, states.NotDeposed,
+                                                rsV4.Instances,
+                                        )
+                                        diags = diags.Append(objDiags)
+                                }
+                                for dk, obj := range is.Deposed {
+                                        var objDiags tfdiags.Diagnostics
+                                        rsV4.Instances, objDiags = appendInstanceObjectStateV4(
+                                                rs, is, key, obj, dk,
+                                                rsV4.Instances,
+                                        )
+                                        diags = diags.Append(objDiags)
+                                }
+                        }
+                }
+        }
+
+        sV4.normalize()
+
+        src, err := json.MarshalIndent(sV4, "", "  ")
+        if err != nil {
+                // Shouldn't happen if we do our conversion to *stateV4 correctly above.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to serialize state",
+                        fmt.Sprintf("An error occured while serializing the state to save it. This is a bug in Terraform and should be reported: %s.", err),
+                ))
+                return diags
+        }
+        src = append(src, '\n')
+
+        _, err = w.Write(src)
+        if err != nil {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to write state",
+                        fmt.Sprintf("An error occured while writing the serialized state: %s.", err),
+                ))
+                return diags
+        }
+
+        return diags
+}
+
+func appendInstanceObjectStateV4(rs *states.Resource, is *states.ResourceInstance, key addrs.InstanceKey, obj *states.ResourceInstanceObjectSrc, deposed states.DeposedKey, isV4s []instanceObjectStateV4) ([]instanceObjectStateV4, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        var status string
+        switch obj.Status {
+        case states.ObjectReady:
+                status = ""
+        case states.ObjectTainted:
+                status = "tainted"
+        default:
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to serialize resource instance in state",
+                        fmt.Sprintf("Instance %s has status %s, which cannot be saved in state.", rs.Addr.Instance(key), obj.Status),
+                ))
+        }
+
+        var privateRaw []byte
+        if len(obj.Private) > 0 {
+                privateRaw = obj.Private
+        }
+
+        deps := make([]string, len(obj.Dependencies))
+        for i, depAddr := range obj.Dependencies {
+                deps[i] = depAddr.String()
+        }
+
+        var rawKey interface{}
+        switch tk := key.(type) {
+        case addrs.IntKey:
+                rawKey = int(tk)
+        case addrs.StringKey:
+                rawKey = string(tk)
+        default:
+                if key != addrs.NoKey {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to serialize resource instance in state",
+                                fmt.Sprintf("Instance %s has an unsupported instance key: %#v.", rs.Addr.Instance(key), key),
+                        ))
+                }
+        }
+
+        return append(isV4s, instanceObjectStateV4{
+                IndexKey:       rawKey,
+                Deposed:        string(deposed),
+                Status:         status,
+                SchemaVersion:  obj.SchemaVersion,
+                AttributesFlat: obj.AttrsFlat,
+                AttributesRaw:  obj.AttrsJSON,
+                PrivateRaw:     privateRaw,
+                Dependencies:   deps,
+        }), diags
+}
+
+type stateV4 struct {
+        Version          stateVersionV4           `json:"version"`
+        TerraformVersion string                   `json:"terraform_version"`
+        Serial           uint64                   `json:"serial"`
+        Lineage          string                   `json:"lineage"`
+        RootOutputs      map[string]outputStateV4 `json:"outputs"`
+        Resources        []resourceStateV4        `json:"resources"`
+}
+
+// normalize makes some in-place changes to normalize the way items are
+// stored to ensure that two functionally-equivalent states will be stored
+// identically.
+func (s *stateV4) normalize() {
+        sort.Stable(sortResourcesV4(s.Resources))
+        for _, rs := range s.Resources {
+                sort.Stable(sortInstancesV4(rs.Instances))
+        }
+}
+
+type outputStateV4 struct {
+        ValueRaw     json.RawMessage `json:"value"`
+        ValueTypeRaw json.RawMessage `json:"type"`
+        Sensitive    bool            `json:"sensitive,omitempty"`
+}
+
+type resourceStateV4 struct {
+        Module         string                  `json:"module,omitempty"`
+        Mode           string                  `json:"mode"`
+        Type           string                  `json:"type"`
+        Name           string                  `json:"name"`
+        EachMode       string                  `json:"each,omitempty"`
+        ProviderConfig string                  `json:"provider"`
+        Instances      []instanceObjectStateV4 `json:"instances"`
+}
+
+type instanceObjectStateV4 struct {
+        IndexKey interface{} `json:"index_key,omitempty"`
+        Status   string      `json:"status,omitempty"`
+        Deposed  string      `json:"deposed,omitempty"`
+
+        SchemaVersion  uint64            `json:"schema_version"`
+        AttributesRaw  json.RawMessage   `json:"attributes,omitempty"`
+        AttributesFlat map[string]string `json:"attributes_flat,omitempty"`
+
+        PrivateRaw []byte `json:"private,omitempty"`
+
+        Dependencies []string `json:"depends_on,omitempty"`
+}
+
+// stateVersionV4 is a weird special type we use to produce our hard-coded
+// "version": 4 in the JSON serialization.
+type stateVersionV4 struct{}
+
+func (sv stateVersionV4) MarshalJSON() ([]byte, error) {
+        return []byte{'4'}, nil
+}
+
+func (sv stateVersionV4) UnmarshalJSON([]byte) error {
+        // Nothing to do: we already know we're version 4
+        return nil
+}
+
+type sortResourcesV4 []resourceStateV4
+
+func (sr sortResourcesV4) Len() int      { return len(sr) }
+func (sr sortResourcesV4) Swap(i, j int) { sr[i], sr[j] = sr[j], sr[i] }
+func (sr sortResourcesV4) Less(i, j int) bool {
+        switch {
+        case sr[i].Mode != sr[j].Mode:
+                return sr[i].Mode < sr[j].Mode
+        case sr[i].Type != sr[j].Type:
+                return sr[i].Type < sr[j].Type
+        case sr[i].Name != sr[j].Name:
+                return sr[i].Name < sr[j].Name
+        default:
+                return false
+        }
+}
+
+type sortInstancesV4 []instanceObjectStateV4
+
+func (si sortInstancesV4) Len() int      { return len(si) }
+func (si sortInstancesV4) Swap(i, j int) { si[i], si[j] = si[j], si[i] }
+func (si sortInstancesV4) Less(i, j int) bool {
+        ki := si[i].IndexKey
+        kj := si[j].IndexKey
+        if ki != kj {
+                if (ki == nil) != (kj == nil) {
+                        return ki == nil
+                }
+                if kii, isInt := ki.(int); isInt {
+                        if kji, isInt := kj.(int); isInt {
+                                return kii < kji
+                        }
+                        return true
+                }
+                if kis, isStr := ki.(string); isStr {
+                        if kjs, isStr := kj.(string); isStr {
+                                return kis < kjs
+                        }
+                        return true
+                }
+        }
+        if si[i].Deposed != si[j].Deposed {
+                return si[i].Deposed < si[j].Deposed
+        }
+        return false
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/statefile/write.go b/vendor/github.com/hashicorp/terraform/states/statefile/write.go
new file mode 100644
index 0000000..548ba8a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/statefile/write.go
@@ -0,0 +1,17 @@
+package statefile
+
+import (
+        "io"
+
+        tfversion "github.com/hashicorp/terraform/version"
+)
+
+// Write writes the given state to the given writer in the current state
+// serialization format.
+func Write(s *File, w io.Writer) error {
+        // Always record the current terraform version in the state.
+        s.TerraformVersion = tfversion.SemVer
+
+        diags := writeStateV4(s, w)
+        return diags.Err()
+}
diff --git a/vendor/github.com/hashicorp/terraform/states/sync.go b/vendor/github.com/hashicorp/terraform/states/sync.go
new file mode 100644
index 0000000..a377446
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/states/sync.go
@@ -0,0 +1,537 @@
+package states
+
+import (
+        "log"
+        "sync"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// SyncState is a wrapper around State that provides concurrency-safe access to
+// various common operations that occur during a Terraform graph walk, or other
+// similar concurrent contexts.
+//
+// When a SyncState wrapper is in use, no concurrent direct access to the
+// underlying objects is permitted unless the caller first acquires an explicit
+// lock, using the Lock and Unlock methods. Most callers should _not_
+// explicitly lock, and should instead use the other methods of this type that
+// handle locking automatically.
+//
+// Since SyncState is able to safely consolidate multiple updates into a single
+// atomic operation, many of its methods are at a higher level than those
+// of the underlying types, and operate on the state as a whole rather than
+// on individual sub-structures of the state.
+//
+// SyncState can only protect against races within its own methods. It cannot
+// provide any guarantees about the order in which concurrent operations will
+// be processed, so callers may still need to employ higher-level techniques
+// for ensuring correct operation sequencing, such as building and walking
+// a dependency graph.
+type SyncState struct {
+        state *State
+        lock  sync.RWMutex
+}
+
+// Module returns a snapshot of the state of the module instance with the given
+// address, or nil if no such module is tracked.
+//
+// The return value is a pointer to a copy of the module state, which the
+// caller may then freely access and mutate. However, since the module state
+// tends to be a large data structure with many child objects, where possible
+// callers should prefer to use a more granular accessor to access a child
+// module directly, and thus reduce the amount of copying required.
+func (s *SyncState) Module(addr addrs.ModuleInstance) *Module {
+        s.lock.RLock()
+        ret := s.state.Module(addr).DeepCopy()
+        s.lock.RUnlock()
+        return ret
+}
+
+// RemoveModule removes the entire state for the given module, taking with
+// it any resources associated with the module. This should generally be
+// called only for modules whose resources have all been destroyed, but
+// that is not enforced by this method.
+func (s *SyncState) RemoveModule(addr addrs.ModuleInstance) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        s.state.RemoveModule(addr)
+}
+
+// OutputValue returns a snapshot of the state of the output value with the
+// given address, or nil if no such output value is tracked.
+//
+// The return value is a pointer to a copy of the output value state, which the
+// caller may then freely access and mutate.
+func (s *SyncState) OutputValue(addr addrs.AbsOutputValue) *OutputValue {
+        s.lock.RLock()
+        ret := s.state.OutputValue(addr).DeepCopy()
+        s.lock.RUnlock()
+        return ret
+}
+
+// SetOutputValue writes a given output value into the state, overwriting
+// any existing value of the same name.
+//
+// If the module containing the output is not yet tracked in state then it
+// be added as a side-effect.
+func (s *SyncState) SetOutputValue(addr addrs.AbsOutputValue, value cty.Value, sensitive bool) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.SetOutputValue(addr.OutputValue.Name, value, sensitive)
+}
+
+// RemoveOutputValue removes the stored value for the output value with the
+// given address.
+//
+// If this results in its containing module being empty, the module will be
+// pruned from the state as a side-effect.
+func (s *SyncState) RemoveOutputValue(addr addrs.AbsOutputValue) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return
+        }
+        ms.RemoveOutputValue(addr.OutputValue.Name)
+        s.maybePruneModule(addr.Module)
+}
+
+// LocalValue returns the current value associated with the given local value
+// address.
+func (s *SyncState) LocalValue(addr addrs.AbsLocalValue) cty.Value {
+        s.lock.RLock()
+        // cty.Value is immutable, so we don't need any extra copying here.
+        ret := s.state.LocalValue(addr)
+        s.lock.RUnlock()
+        return ret
+}
+
+// SetLocalValue writes a given output value into the state, overwriting
+// any existing value of the same name.
+//
+// If the module containing the local value is not yet tracked in state then it
+// will be added as a side-effect.
+func (s *SyncState) SetLocalValue(addr addrs.AbsLocalValue, value cty.Value) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.SetLocalValue(addr.LocalValue.Name, value)
+}
+
+// RemoveLocalValue removes the stored value for the local value with the
+// given address.
+//
+// If this results in its containing module being empty, the module will be
+// pruned from the state as a side-effect.
+func (s *SyncState) RemoveLocalValue(addr addrs.AbsLocalValue) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return
+        }
+        ms.RemoveLocalValue(addr.LocalValue.Name)
+        s.maybePruneModule(addr.Module)
+}
+
+// Resource returns a snapshot of the state of the resource with the given
+// address, or nil if no such resource is tracked.
+//
+// The return value is a pointer to a copy of the resource state, which the
+// caller may then freely access and mutate.
+func (s *SyncState) Resource(addr addrs.AbsResource) *Resource {
+        s.lock.RLock()
+        ret := s.state.Resource(addr).DeepCopy()
+        s.lock.RUnlock()
+        return ret
+}
+
+// ResourceInstance returns a snapshot of the state the resource instance with
+// the given address, or nil if no such instance is tracked.
+//
+// The return value is a pointer to a copy of the instance state, which the
+// caller may then freely access and mutate.
+func (s *SyncState) ResourceInstance(addr addrs.AbsResourceInstance) *ResourceInstance {
+        s.lock.RLock()
+        ret := s.state.ResourceInstance(addr).DeepCopy()
+        s.lock.RUnlock()
+        return ret
+}
+
+// ResourceInstanceObject returns a snapshot of the current instance object
+// of the given generation belonging to the instance with the given address,
+// or nil if no such object is tracked..
+//
+// The return value is a pointer to a copy of the object, which the caller may
+// then freely access and mutate.
+func (s *SyncState) ResourceInstanceObject(addr addrs.AbsResourceInstance, gen Generation) *ResourceInstanceObjectSrc {
+        s.lock.RLock()
+        defer s.lock.RUnlock()
+
+        inst := s.state.ResourceInstance(addr)
+        if inst == nil {
+                return nil
+        }
+        return inst.GetGeneration(gen).DeepCopy()
+}
+
+// SetResourceMeta updates the resource-level metadata for the resource at
+// the given address, creating the containing module state and resource state
+// as a side-effect if not already present.
+func (s *SyncState) SetResourceMeta(addr addrs.AbsResource, eachMode EachMode, provider addrs.AbsProviderConfig) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.SetResourceMeta(addr.Resource, eachMode, provider)
+}
+
+// RemoveResource removes the entire state for the given resource, taking with
+// it any instances associated with the resource. This should generally be
+// called only for resource objects whose instances have all been destroyed,
+// but that is not enforced by this method. (Use RemoveResourceIfEmpty instead
+// to safely check first.)
+func (s *SyncState) RemoveResource(addr addrs.AbsResource) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.RemoveResource(addr.Resource)
+        s.maybePruneModule(addr.Module)
+}
+
+// RemoveResourceIfEmpty is similar to RemoveResource but first checks to
+// make sure there are no instances or objects left in the resource.
+//
+// Returns true if the resource was removed, or false if remaining child
+// objects prevented its removal. Returns true also if the resource was
+// already absent, and thus no action needed to be taken.
+func (s *SyncState) RemoveResourceIfEmpty(addr addrs.AbsResource) bool {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return true // nothing to do
+        }
+        rs := ms.Resource(addr.Resource)
+        if rs == nil {
+                return true // nothing to do
+        }
+        if len(rs.Instances) != 0 {
+                // We don't check here for the possibility of instances that exist
+                // but don't have any objects because it's the responsibility of the
+                // instance-mutation methods to prune those away automatically.
+                return false
+        }
+        ms.RemoveResource(addr.Resource)
+        s.maybePruneModule(addr.Module)
+        return true
+}
+
+// MaybeFixUpResourceInstanceAddressForCount deals with the situation where a
+// resource has changed from having "count" set to not set, or vice-versa, and
+// so we need to rename the zeroth instance key to no key at all, or vice-versa.
+//
+// Set countEnabled to true if the resource has count set in its new
+// configuration, or false if it does not.
+//
+// The state is modified in-place if necessary, moving a resource instance
+// between the two addresses. The return value is true if a change was made,
+// and false otherwise.
+func (s *SyncState) MaybeFixUpResourceInstanceAddressForCount(addr addrs.AbsResource, countEnabled bool) bool {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return false
+        }
+
+        relAddr := addr.Resource
+        rs := ms.Resource(relAddr)
+        if rs == nil {
+                return false
+        }
+        huntKey := addrs.NoKey
+        replaceKey := addrs.InstanceKey(addrs.IntKey(0))
+        if !countEnabled {
+                huntKey, replaceKey = replaceKey, huntKey
+        }
+
+        is, exists := rs.Instances[huntKey]
+        if !exists {
+                return false
+        }
+
+        if _, exists := rs.Instances[replaceKey]; exists {
+                // If the replacement key also exists then we'll do nothing and keep both.
+                return false
+        }
+
+        // If we get here then we need to "rename" from hunt to replace
+        rs.Instances[replaceKey] = is
+        delete(rs.Instances, huntKey)
+        return true
+}
+
+// SetResourceInstanceCurrent saves the given instance object as the current
+// generation of the resource instance with the given address, simulataneously
+// updating the recorded provider configuration address, dependencies, and
+// resource EachMode.
+//
+// Any existing current instance object for the given resource is overwritten.
+// Set obj to nil to remove the primary generation object altogether. If there
+// are no deposed objects then the instance as a whole will be removed, which
+// may in turn also remove the containing module if it becomes empty.
+//
+// The caller must ensure that the given ResourceInstanceObject is not
+// concurrently mutated during this call, but may be freely used again once
+// this function returns.
+//
+// The provider address and "each mode" are resource-wide settings and so they
+// are updated for all other instances of the same resource as a side-effect of
+// this call.
+//
+// If the containing module for this resource or the resource itself are not
+// already tracked in state then they will be added as a side-effect.
+func (s *SyncState) SetResourceInstanceCurrent(addr addrs.AbsResourceInstance, obj *ResourceInstanceObjectSrc, provider addrs.AbsProviderConfig) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.SetResourceInstanceCurrent(addr.Resource, obj.DeepCopy(), provider)
+        s.maybePruneModule(addr.Module)
+}
+
+// SetResourceInstanceDeposed saves the given instance object as a deposed
+// generation of the resource instance with the given address and deposed key.
+//
+// Call this method only for pre-existing deposed objects that already have
+// a known DeposedKey. For example, this method is useful if reloading objects
+// that were persisted to a state file. To mark the current object as deposed,
+// use DeposeResourceInstanceObject instead.
+//
+// The caller must ensure that the given ResourceInstanceObject is not
+// concurrently mutated during this call, but may be freely used again once
+// this function returns.
+//
+// The resource that contains the given instance must already exist in the
+// state, or this method will panic. Use Resource to check first if its
+// presence is not already guaranteed.
+//
+// Any existing current instance object for the given resource and deposed key
+// is overwritten. Set obj to nil to remove the deposed object altogether. If
+// the instance is left with no objects after this operation then it will
+// be removed from its containing resource altogether.
+//
+// If the containing module for this resource or the resource itself are not
+// already tracked in state then they will be added as a side-effect.
+func (s *SyncState) SetResourceInstanceDeposed(addr addrs.AbsResourceInstance, key DeposedKey, obj *ResourceInstanceObjectSrc, provider addrs.AbsProviderConfig) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.EnsureModule(addr.Module)
+        ms.SetResourceInstanceDeposed(addr.Resource, key, obj.DeepCopy(), provider)
+        s.maybePruneModule(addr.Module)
+}
+
+// DeposeResourceInstanceObject moves the current instance object for the
+// given resource instance address into the deposed set, leaving the instance
+// without a current object.
+//
+// The return value is the newly-allocated deposed key, or NotDeposed if the
+// given instance is already lacking a current object.
+//
+// If the containing module for this resource or the resource itself are not
+// already tracked in state then there cannot be a current object for the
+// given instance, and so NotDeposed will be returned without modifying the
+// state at all.
+func (s *SyncState) DeposeResourceInstanceObject(addr addrs.AbsResourceInstance) DeposedKey {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return NotDeposed
+        }
+
+        return ms.deposeResourceInstanceObject(addr.Resource, NotDeposed)
+}
+
+// DeposeResourceInstanceObjectForceKey is like DeposeResourceInstanceObject
+// but uses a pre-allocated key. It's the caller's responsibility to ensure
+// that there aren't any races to use a particular key; this method will panic
+// if the given key is already in use.
+func (s *SyncState) DeposeResourceInstanceObjectForceKey(addr addrs.AbsResourceInstance, forcedKey DeposedKey) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        if forcedKey == NotDeposed {
+                // Usage error: should use DeposeResourceInstanceObject in this case
+                panic("DeposeResourceInstanceObjectForceKey called without forced key")
+        }
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return // Nothing to do, since there can't be any current object either.
+        }
+
+        ms.deposeResourceInstanceObject(addr.Resource, forcedKey)
+}
+
+// ForgetResourceInstanceAll removes the record of all objects associated with
+// the specified resource instance, if present. If not present, this is a no-op.
+func (s *SyncState) ForgetResourceInstanceAll(addr addrs.AbsResourceInstance) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return
+        }
+        ms.ForgetResourceInstanceAll(addr.Resource)
+        s.maybePruneModule(addr.Module)
+}
+
+// ForgetResourceInstanceDeposed removes the record of the deposed object with
+// the given address and key, if present. If not present, this is a no-op.
+func (s *SyncState) ForgetResourceInstanceDeposed(addr addrs.AbsResourceInstance, key DeposedKey) {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                return
+        }
+        ms.ForgetResourceInstanceDeposed(addr.Resource, key)
+        s.maybePruneModule(addr.Module)
+}
+
+// MaybeRestoreResourceInstanceDeposed will restore the deposed object with the
+// given key on the specified resource as the current object for that instance
+// if and only if that would not cause us to forget an existing current
+// object for that instance.
+//
+// Returns true if the object was restored to current, or false if no change
+// was made at all.
+func (s *SyncState) MaybeRestoreResourceInstanceDeposed(addr addrs.AbsResourceInstance, key DeposedKey) bool {
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        if key == NotDeposed {
+                panic("MaybeRestoreResourceInstanceDeposed called without DeposedKey")
+        }
+
+        ms := s.state.Module(addr.Module)
+        if ms == nil {
+                // Nothing to do, since the specified deposed object cannot exist.
+                return false
+        }
+
+        return ms.maybeRestoreResourceInstanceDeposed(addr.Resource, key)
+}
+
+// RemovePlannedResourceInstanceObjects removes from the state any resource
+// instance objects that have the status ObjectPlanned, indiciating that they
+// are just transient placeholders created during planning.
+//
+// Note that this does not restore any "ready" or "tainted" object that might
+// have been present before the planned object was written. The only real use
+// for this method is in preparing the state created during a refresh walk,
+// where we run the planning step for certain instances just to create enough
+// information to allow correct expression evaluation within provider and
+// data resource blocks. Discarding planned instances in that case is okay
+// because the refresh phase only creates planned objects to stand in for
+// objects that don't exist yet, and thus the planned object must have been
+// absent before by definition.
+func (s *SyncState) RemovePlannedResourceInstanceObjects() {
+        // TODO: Merge together the refresh and plan phases into a single walk,
+        // so we can remove the need to create this "partial plan" during refresh
+        // that we then need to clean up before proceeding.
+
+        s.lock.Lock()
+        defer s.lock.Unlock()
+
+        for _, ms := range s.state.Modules {
+                moduleAddr := ms.Addr
+
+                for _, rs := range ms.Resources {
+                        resAddr := rs.Addr
+
+                        for ik, is := range rs.Instances {
+                                instAddr := resAddr.Instance(ik)
+
+                                if is.Current != nil && is.Current.Status == ObjectPlanned {
+                                        // Setting the current instance to nil removes it from the
+                                        // state altogether if there are not also deposed instances.
+                                        ms.SetResourceInstanceCurrent(instAddr, nil, rs.ProviderConfig)
+                                }
+
+                                for dk, obj := range is.Deposed {
+                                        // Deposed objects should never be "planned", but we'll
+                                        // do this anyway for the sake of completeness.
+                                        if obj.Status == ObjectPlanned {
+                                                ms.ForgetResourceInstanceDeposed(instAddr, dk)
+                                        }
+                                }
+                        }
+                }
+
+                // We may have deleted some objects, which means that we may have
+                // left a module empty, and so we must prune to preserve the invariant
+                // that only the root module is allowed to be empty.
+                s.maybePruneModule(moduleAddr)
+        }
+}
+
+// Lock acquires an explicit lock on the state, allowing direct read and write
+// access to the returned state object. The caller must call Unlock once
+// access is no longer needed, and then immediately discard the state pointer
+// pointer.
+//
+// Most callers should not use this. Instead, use the concurrency-safe
+// accessors and mutators provided directly on SyncState.
+func (s *SyncState) Lock() *State {
+        s.lock.Lock()
+        return s.state
+}
+
+// Unlock releases a lock previously acquired by Lock, at which point the
+// caller must cease all use of the state pointer that was returned.
+//
+// Do not call this method except to end an explicit lock acquired by
+// Lock. If a caller calls Unlock without first holding the lock, behavior
+// is undefined.
+func (s *SyncState) Unlock() {
+        s.lock.Unlock()
+}
+
+// maybePruneModule will remove a module from the state altogether if it is
+// empty, unless it's the root module which must always be present.
+//
+// This helper method is not concurrency-safe on its own, so must only be
+// called while the caller is already holding the lock for writing.
+func (s *SyncState) maybePruneModule(addr addrs.ModuleInstance) {
+        if addr.IsRoot() {
+                // We never prune the root.
+                return
+        }
+
+        ms := s.state.Module(addr)
+        if ms == nil {
+                return
+        }
+
+        if ms.empty() {
+                log.Printf("[TRACE] states.SyncState: pruning %s because it is empty", addr)
+                s.state.RemoveModule(addr)
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/context.go b/vendor/github.com/hashicorp/terraform/terraform/context.go
index f133cc2..afdba99 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/context.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/context.go
@@ -1,20 +1,26 @@
 package terraform
 
 import (
+        "bytes"
         "context"
         "fmt"
         "log"
-        "sort"
         "strings"
         "sync"
 
-        "github.com/hashicorp/terraform/tfdiags"
-
-        "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/hcl"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
-        "github.com/hashicorp/terraform/version"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/states/statefile"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // InputMode defines what sort of input will be asked for when Input
@@ -51,19 +57,18 @@ var (
 // ContextOpts are the user-configurable options to create a context with
 // NewContext.
 type ContextOpts struct {
-        Meta               *ContextMeta
-        Destroy            bool
-        Diff               *Diff
-        Hooks              []Hook
-        Module             *module.Tree
-        Parallelism        int
-        State              *State
-        StateFutureAllowed bool
-        ProviderResolver   ResourceProviderResolver
-        Provisioners       map[string]ResourceProvisionerFactory
-        Shadow             bool
-        Targets            []string
-        Variables          map[string]interface{}
+        Config    *configs.Config
+        Changes   *plans.Changes
+        State     *states.State
+        Targets   []addrs.Targetable
+        Variables InputValues
+        Meta      *ContextMeta
+        Destroy   bool
+
+        Hooks            []Hook
+        Parallelism      int
+        ProviderResolver providers.Resolver
+        Provisioners     map[string]ProvisionerFactory
 
         // If non-nil, will apply as additional constraints on the provider
         // plugins that will be requested from the provider resolver.
@@ -83,32 +88,25 @@ type ContextMeta struct {
 
 // Context represents all the context that Terraform needs in order to
 // perform operations on infrastructure. This structure is built using
-// NewContext. See the documentation for that.
-//
-// Extra functions on Context can be found in context_*.go files.
+// NewContext.
 type Context struct {
-        // Maintainer note: Anytime this struct is changed, please verify
-        // that newShadowContext still does the right thing. Tests should
-        // fail regardless but putting this note here as well.
+        config    *configs.Config
+        changes   *plans.Changes
+        state     *states.State
+        targets   []addrs.Targetable
+        variables InputValues
+        meta      *ContextMeta
+        destroy   bool
 
-        components contextComponentFactory
-        destroy    bool
-        diff       *Diff
-        diffLock   sync.RWMutex
         hooks      []Hook
-        meta       *ContextMeta
-        module     *module.Tree
+        components contextComponentFactory
+        schemas    *Schemas
         sh         *stopHook
-        shadow     bool
-        state      *State
-        stateLock  sync.RWMutex
-        targets    []string
         uiInput    UIInput
-        variables  map[string]interface{}
 
         l                   sync.Mutex // Lock acquired during any task
         parallelSem         Semaphore
-        providerInputConfig map[string]map[string]interface{}
+        providerInputConfig map[string]map[string]cty.Value
         providerSHA256s     map[string][]byte
         runLock             sync.Mutex
         runCond             *sync.Cond
@@ -117,17 +115,23 @@ type Context struct {
         shadowErr           error
 }
 
+// (additional methods on Context can be found in context_*.go files.)
+
 // NewContext creates a new Context structure.
 //
-// Once a Context is creator, the pointer values within ContextOpts
-// should not be mutated in any way, since the pointers are copied, not
-// the values themselves.
-func NewContext(opts *ContextOpts) (*Context, error) {
-        // Validate the version requirement if it is given
-        if opts.Module != nil {
-                if err := CheckRequiredVersion(opts.Module); err != nil {
-                        return nil, err
-                }
+// Once a Context is created, the caller must not access or mutate any of
+// the objects referenced (directly or indirectly) by the ContextOpts fields.
+//
+// If the returned diagnostics contains errors then the resulting context is
+// invalid and must not be used.
+func NewContext(opts *ContextOpts) (*Context, tfdiags.Diagnostics) {
+        log.Printf("[TRACE] terraform.NewContext: starting")
+        diags := CheckCoreVersionRequirements(opts.Config)
+        // If version constraints are not met then we'll bail early since otherwise
+        // we're likely to just see a bunch of other errors related to
+        // incompatibilities, which could be overwhelming for the user.
+        if diags.HasErrors() {
+                return nil, diags
         }
 
         // Copy all the hooks and add our stop hook. We don't append directly
@@ -139,21 +143,9 @@ func NewContext(opts *ContextOpts) (*Context, error) {
 
         state := opts.State
         if state == nil {
-                state = new(State)
-                state.init()
-        }
-
-        // If our state is from the future, then error. Callers can avoid
-        // this error by explicitly setting `StateFutureAllowed`.
-        if err := CheckStateVersion(state); err != nil && !opts.StateFutureAllowed {
-                return nil, err
+                state = states.NewState()
         }
 
-        // Explicitly reset our state version to our current version so that
-        // any operations we do will write out that our latest version
-        // has run.
-        state.TFVersion = version.Version
-
         // Determine parallelism, default to 10. We do this both to limit
         // CPU pressure but also to have an extra guard against rate throttling
         // from providers.
@@ -168,60 +160,84 @@ func NewContext(opts *ContextOpts) (*Context, error) {
         //    2 - Take values specified in -var flags, overriding values
         //        set by environment variables if necessary. This includes
         //        values taken from -var-file in addition.
-        variables := make(map[string]interface{})
-        if opts.Module != nil {
-                var err error
-                variables, err = Variables(opts.Module, opts.Variables)
-                if err != nil {
-                        return nil, err
-                }
+        var variables InputValues
+        if opts.Config != nil {
+                // Default variables from the configuration seed our map.
+                variables = DefaultVariableValues(opts.Config.Module.Variables)
         }
+        // Variables provided by the caller (from CLI, environment, etc) can
+        // override the defaults.
+        variables = variables.Override(opts.Variables)
 
         // Bind available provider plugins to the constraints in config
-        var providers map[string]ResourceProviderFactory
+        var providerFactories map[string]providers.Factory
         if opts.ProviderResolver != nil {
-                var err error
-                deps := ModuleTreeDependencies(opts.Module, state)
+                deps := ConfigTreeDependencies(opts.Config, state)
                 reqd := deps.AllPluginRequirements()
                 if opts.ProviderSHA256s != nil && !opts.SkipProviderVerify {
                         reqd.LockExecutables(opts.ProviderSHA256s)
                 }
-                providers, err = resourceProviderFactories(opts.ProviderResolver, reqd)
-                if err != nil {
-                        return nil, err
+                log.Printf("[TRACE] terraform.NewContext: resolving provider version selections")
+
+                var providerDiags tfdiags.Diagnostics
+                providerFactories, providerDiags = resourceProviderFactories(opts.ProviderResolver, reqd)
+                diags = diags.Append(providerDiags)
+
+                if diags.HasErrors() {
+                        return nil, diags
                 }
         } else {
-                providers = make(map[string]ResourceProviderFactory)
+                providerFactories = make(map[string]providers.Factory)
         }
 
-        diff := opts.Diff
-        if diff == nil {
-                diff = &Diff{}
+        components := &basicComponentFactory{
+                providers:    providerFactories,
+                provisioners: opts.Provisioners,
         }
 
+        log.Printf("[TRACE] terraform.NewContext: loading provider schemas")
+        schemas, err := LoadSchemas(opts.Config, opts.State, components)
+        if err != nil {
+                diags = diags.Append(err)
+                return nil, diags
+        }
+
+        changes := opts.Changes
+        if changes == nil {
+                changes = plans.NewChanges()
+        }
+
+        config := opts.Config
+        if config == nil {
+                config = configs.NewEmptyConfig()
+        }
+
+        log.Printf("[TRACE] terraform.NewContext: complete")
+
         return &Context{
-                components: &basicComponentFactory{
-                        providers:    providers,
-                        provisioners: opts.Provisioners,
-                },
-                destroy:   opts.Destroy,
-                diff:      diff,
-                hooks:     hooks,
-                meta:      opts.Meta,
-                module:    opts.Module,
-                shadow:    opts.Shadow,
-                state:     state,
-                targets:   opts.Targets,
-                uiInput:   opts.UIInput,
-                variables: variables,
+                components: components,
+                schemas:    schemas,
+                destroy:    opts.Destroy,
+                changes:    changes,
+                hooks:      hooks,
+                meta:       opts.Meta,
+                config:     config,
+                state:      state,
+                targets:    opts.Targets,
+                uiInput:    opts.UIInput,
+                variables:  variables,
 
                 parallelSem:         NewSemaphore(par),
-                providerInputConfig: make(map[string]map[string]interface{}),
+                providerInputConfig: make(map[string]map[string]cty.Value),
                 providerSHA256s:     opts.ProviderSHA256s,
                 sh:                  sh,
         }, nil
 }
 
+func (c *Context) Schemas() *Schemas {
+        return c.schemas
+}
+
 type ContextGraphOpts struct {
         // If true, validates the graph structure (checks for cycles).
         Validate bool
@@ -233,7 +249,7 @@ type ContextGraphOpts struct {
 // Graph returns the graph used for the given operation type.
 //
 // The most extensive or complex graph type is GraphTypePlan.
-func (c *Context) Graph(typ GraphType, opts *ContextGraphOpts) (*Graph, error) {
+func (c *Context) Graph(typ GraphType, opts *ContextGraphOpts) (*Graph, tfdiags.Diagnostics) {
         if opts == nil {
                 opts = &ContextGraphOpts{Validate: true}
         }
@@ -242,65 +258,71 @@ func (c *Context) Graph(typ GraphType, opts *ContextGraphOpts) (*Graph, error) {
         switch typ {
         case GraphTypeApply:
                 return (&ApplyGraphBuilder{
-                        Module:       c.module,
-                        Diff:         c.diff,
-                        State:        c.state,
-                        Providers:    c.components.ResourceProviders(),
-                        Provisioners: c.components.ResourceProvisioners(),
-                        Targets:      c.targets,
-                        Destroy:      c.destroy,
-                        Validate:     opts.Validate,
-                }).Build(RootModulePath)
-
-        case GraphTypeInput:
-                // The input graph is just a slightly modified plan graph
-                fallthrough
+                        Config:     c.config,
+                        Changes:    c.changes,
+                        State:      c.state,
+                        Components: c.components,
+                        Schemas:    c.schemas,
+                        Targets:    c.targets,
+                        Destroy:    c.destroy,
+                        Validate:   opts.Validate,
+                }).Build(addrs.RootModuleInstance)
+
         case GraphTypeValidate:
                 // The validate graph is just a slightly modified plan graph
                 fallthrough
         case GraphTypePlan:
                 // Create the plan graph builder
                 p := &PlanGraphBuilder{
-                        Module:    c.module,
-                        State:     c.state,
-                        Providers: c.components.ResourceProviders(),
-                        Targets:   c.targets,
-                        Validate:  opts.Validate,
+                        Config:     c.config,
+                        State:      c.state,
+                        Components: c.components,
+                        Schemas:    c.schemas,
+                        Targets:    c.targets,
+                        Validate:   opts.Validate,
                 }
 
                 // Some special cases for other graph types shared with plan currently
                 var b GraphBuilder = p
                 switch typ {
-                case GraphTypeInput:
-                        b = InputGraphBuilder(p)
                 case GraphTypeValidate:
-                        // We need to set the provisioners so those can be validated
-                        p.Provisioners = c.components.ResourceProvisioners()
-
                         b = ValidateGraphBuilder(p)
                 }
 
-                return b.Build(RootModulePath)
+                return b.Build(addrs.RootModuleInstance)
 
         case GraphTypePlanDestroy:
                 return (&DestroyPlanGraphBuilder{
-                        Module:   c.module,
-                        State:    c.state,
-                        Targets:  c.targets,
-                        Validate: opts.Validate,
-                }).Build(RootModulePath)
+                        Config:     c.config,
+                        State:      c.state,
+                        Components: c.components,
+                        Schemas:    c.schemas,
+                        Targets:    c.targets,
+                        Validate:   opts.Validate,
+                }).Build(addrs.RootModuleInstance)
 
         case GraphTypeRefresh:
                 return (&RefreshGraphBuilder{
-                        Module:    c.module,
-                        State:     c.state,
-                        Providers: c.components.ResourceProviders(),
-                        Targets:   c.targets,
-                        Validate:  opts.Validate,
-                }).Build(RootModulePath)
-        }
+                        Config:     c.config,
+                        State:      c.state,
+                        Components: c.components,
+                        Schemas:    c.schemas,
+                        Targets:    c.targets,
+                        Validate:   opts.Validate,
+                }).Build(addrs.RootModuleInstance)
+
+        case GraphTypeEval:
+                return (&EvalGraphBuilder{
+                        Config:     c.config,
+                        State:      c.state,
+                        Components: c.components,
+                        Schemas:    c.schemas,
+                }).Build(addrs.RootModuleInstance)
 
-        return nil, fmt.Errorf("unknown graph type: %s", typ)
+        default:
+                // Should never happen, because the above is exhaustive for all graph types.
+                panic(fmt.Errorf("unsupported graph type %s", typ))
+        }
 }
 
 // ShadowError returns any errors caught during a shadow operation.
@@ -333,141 +355,72 @@ func (c *Context) ShadowError() error {
 // State returns a copy of the current state associated with this context.
 //
 // This cannot safely be called in parallel with any other Context function.
-func (c *Context) State() *State {
+func (c *Context) State() *states.State {
         return c.state.DeepCopy()
 }
 
-// Interpolater returns an Interpolater built on a copy of the state
-// that can be used to test interpolation values.
-func (c *Context) Interpolater() *Interpolater {
-        var varLock sync.Mutex
-        var stateLock sync.RWMutex
-        return &Interpolater{
-                Operation:          walkApply,
-                Meta:               c.meta,
-                Module:             c.module,
-                State:              c.state.DeepCopy(),
-                StateLock:          &stateLock,
-                VariableValues:     c.variables,
-                VariableValuesLock: &varLock,
-        }
-}
-
-// Input asks for input to fill variables and provider configurations.
-// This modifies the configuration in-place, so asking for Input twice
-// may result in different UI output showing different current values.
-func (c *Context) Input(mode InputMode) error {
-        defer c.acquireRun("input")()
-
-        if mode&InputModeVar != 0 {
-                // Walk the variables first for the root module. We walk them in
-                // alphabetical order for UX reasons.
-                rootConf := c.module.Config()
-                names := make([]string, len(rootConf.Variables))
-                m := make(map[string]*config.Variable)
-                for i, v := range rootConf.Variables {
-                        names[i] = v.Name
-                        m[v.Name] = v
-                }
-                sort.Strings(names)
-                for _, n := range names {
-                        // If we only care about unset variables, then if the variable
-                        // is set, continue on.
-                        if mode&InputModeVarUnset != 0 {
-                                if _, ok := c.variables[n]; ok {
-                                        continue
-                                }
-                        }
-
-                        var valueType config.VariableType
-
-                        v := m[n]
-                        switch valueType = v.Type(); valueType {
-                        case config.VariableTypeUnknown:
-                                continue
-                        case config.VariableTypeMap:
-                                // OK
-                        case config.VariableTypeList:
-                                // OK
-                        case config.VariableTypeString:
-                                // OK
-                        default:
-                                panic(fmt.Sprintf("Unknown variable type: %#v", v.Type()))
-                        }
-
-                        // If the variable is not already set, and the variable defines a
-                        // default, use that for the value.
-                        if _, ok := c.variables[n]; !ok {
-                                if v.Default != nil {
-                                        c.variables[n] = v.Default.(string)
-                                        continue
-                                }
-                        }
-
-                        // this should only happen during tests
-                        if c.uiInput == nil {
-                                log.Println("[WARN] Content.uiInput is nil")
-                                continue
-                        }
-
-                        // Ask the user for a value for this variable
-                        var value string
-                        retry := 0
-                        for {
-                                var err error
-                                value, err = c.uiInput.Input(&InputOpts{
-                                        Id:          fmt.Sprintf("var.%s", n),
-                                        Query:       fmt.Sprintf("var.%s", n),
-                                        Description: v.Description,
-                                })
-                                if err != nil {
-                                        return fmt.Errorf(
-                                                "Error asking for %s: %s", n, err)
-                                }
-
-                                if value == "" && v.Required() {
-                                        // Redo if it is required, but abort if we keep getting
-                                        // blank entries
-                                        if retry > 2 {
-                                                return fmt.Errorf("missing required value for %q", n)
-                                        }
-                                        retry++
-                                        continue
-                                }
-
-                                break
-                        }
-
-                        // no value provided, so don't set the variable at all
-                        if value == "" {
-                                continue
-                        }
-
-                        decoded, err := parseVariableAsHCL(n, value, valueType)
-                        if err != nil {
-                                return err
-                        }
-
-                        if decoded != nil {
-                                c.variables[n] = decoded
-                        }
-                }
-        }
+// Eval produces a scope in which expressions can be evaluated for
+// the given module path.
+//
+// This method must first evaluate any ephemeral values (input variables, local
+// values, and output values) in the configuration. These ephemeral values are
+// not included in the persisted state, so they must be re-computed using other
+// values in the state before they can be properly evaluated. The updated
+// values are retained in the main state associated with the receiving context.
+//
+// This function takes no action against remote APIs but it does need access
+// to all provider and provisioner instances in order to obtain their schemas
+// for type checking.
+//
+// The result is an evaluation scope that can be used to resolve references
+// against the root module. If the returned diagnostics contains errors then
+// the returned scope may be nil. If it is not nil then it may still be used
+// to attempt expression evaluation or other analysis, but some expressions
+// may not behave as expected.
+func (c *Context) Eval(path addrs.ModuleInstance) (*lang.Scope, tfdiags.Diagnostics) {
+        // This is intended for external callers such as the "terraform console"
+        // command. Internally, we create an evaluator in c.walk before walking
+        // the graph, and create scopes in ContextGraphWalker.
 
-        if mode&InputModeProvider != 0 {
-                // Build the graph
-                graph, err := c.Graph(GraphTypeInput, nil)
-                if err != nil {
-                        return err
-                }
+        var diags tfdiags.Diagnostics
+        defer c.acquireRun("eval")()
 
-                // Do the walk
-                if _, err := c.walk(graph, walkInput); err != nil {
-                        return err
-                }
-        }
+        // Start with a copy of state so that we don't affect any instances
+        // that other methods may have already returned.
+        c.state = c.state.DeepCopy()
+        var walker *ContextGraphWalker
+
+        graph, graphDiags := c.Graph(GraphTypeEval, nil)
+        diags = diags.Append(graphDiags)
+        if !diags.HasErrors() {
+                var walkDiags tfdiags.Diagnostics
+                walker, walkDiags = c.walk(graph, walkEval)
+                diags = diags.Append(walker.NonFatalDiagnostics)
+                diags = diags.Append(walkDiags)
+        }
+
+        if walker == nil {
+                // If we skipped walking the graph (due to errors) then we'll just
+                // use a placeholder graph walker here, which'll refer to the
+                // unmodified state.
+                walker = c.graphWalker(walkEval)
+        }
+
+        // This is a bit weird since we don't normally evaluate outside of
+        // the context of a walk, but we'll "re-enter" our desired path here
+        // just to get hold of an EvalContext for it. GraphContextBuiltin
+        // caches its contexts, so we should get hold of the context that was
+        // previously used for evaluation here, unless we skipped walking.
+        evalCtx := walker.EnterPath(path)
+        return evalCtx.EvaluationScope(nil, EvalDataForNoInstanceKey), diags
+}
 
-        return nil
+// Interpolater is no longer used. Use Evaluator instead.
+//
+// The interpolator returned from this function will return an error on any use.
+func (c *Context) Interpolater() *Interpolater {
+        // FIXME: Remove this once all callers are updated to no longer use it.
+        return &Interpolater{}
 }
 
 // Apply applies the changes represented by this context and returns
@@ -484,23 +437,16 @@ func (c *Context) Input(mode InputMode) error {
 //       State() method. Currently the helper/resource testing framework relies
 //       on the absence of a returned state to determine if Destroy can be
 //       called, so that will need to be refactored before this can be changed.
-func (c *Context) Apply() (*State, error) {
+func (c *Context) Apply() (*states.State, tfdiags.Diagnostics) {
         defer c.acquireRun("apply")()
 
-        // Check there are no empty target parameter values
-        for _, target := range c.targets {
-                if target == "" {
-                        return nil, fmt.Errorf("Target parameter must not have empty value")
-                }
-        }
-
         // Copy our own state
         c.state = c.state.DeepCopy()
 
         // Build the graph.
-        graph, err := c.Graph(GraphTypeApply, nil)
-        if err != nil {
-                return nil, err
+        graph, diags := c.Graph(GraphTypeApply, nil)
+        if diags.HasErrors() {
+                return nil, diags
         }
 
         // Determine the operation
@@ -510,15 +456,30 @@ func (c *Context) Apply() (*State, error) {
         }
 
         // Walk the graph
-        walker, err := c.walk(graph, operation)
-        if len(walker.ValidationErrors) > 0 {
-                err = multierror.Append(err, walker.ValidationErrors...)
-        }
-
-        // Clean out any unused things
-        c.state.prune()
-
-        return c.state, err
+        walker, walkDiags := c.walk(graph, operation)
+        diags = diags.Append(walker.NonFatalDiagnostics)
+        diags = diags.Append(walkDiags)
+
+        if c.destroy && !diags.HasErrors() {
+                // If we know we were trying to destroy objects anyway, and we
+                // completed without any errors, then we'll also prune out any
+                // leftover empty resource husks (left after all of the instances
+                // of a resource with "count" or "for_each" are destroyed) to
+                // help ensure we end up with an _actually_ empty state, assuming
+                // we weren't destroying with -target here.
+                //
+                // (This doesn't actually take into account -target, but that should
+                // be okay because it doesn't throw away anything we can't recompute
+                // on a subsequent "terraform plan" run, if the resources are still
+                // present in the configuration. However, this _will_ cause "count = 0"
+                // resources to read as unknown during the next refresh walk, which
+                // may cause some additional churn if used in a data resource or
+                // provider block, until we remove refreshing as a separate walk and
+                // just do it as part of the plan walk.)
+                c.state.PruneResourceHusks()
+        }
+
+        return c.state, diags
 }
 
 // Plan generates an execution plan for the given context.
@@ -528,38 +489,45 @@ func (c *Context) Apply() (*State, error) {
 //
 // Plan also updates the diff of this context to be the diff generated
 // by the plan, so Apply can be called after.
-func (c *Context) Plan() (*Plan, error) {
+func (c *Context) Plan() (*plans.Plan, tfdiags.Diagnostics) {
         defer c.acquireRun("plan")()
+        c.changes = plans.NewChanges()
 
-        // Check there are no empty target parameter values
-        for _, target := range c.targets {
-                if target == "" {
-                        return nil, fmt.Errorf("Target parameter must not have empty value")
+        var diags tfdiags.Diagnostics
+
+        varVals := make(map[string]plans.DynamicValue, len(c.variables))
+        for k, iv := range c.variables {
+                // We use cty.DynamicPseudoType here so that we'll save both the
+                // value _and_ its dynamic type in the plan, so we can recover
+                // exactly the same value later.
+                dv, err := plans.NewDynamicValue(iv.Value, cty.DynamicPseudoType)
+                if err != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Failed to prepare variable value for plan",
+                                fmt.Sprintf("The value for variable %q could not be serialized to store in the plan: %s.", k, err),
+                        ))
+                        continue
                 }
+                varVals[k] = dv
         }
 
-        p := &Plan{
-                Module:  c.module,
-                Vars:    c.variables,
-                State:   c.state,
-                Targets: c.targets,
-
-                TerraformVersion: version.String(),
-                ProviderSHA256s:  c.providerSHA256s,
+        p := &plans.Plan{
+                VariableValues:  varVals,
+                TargetAddrs:     c.targets,
+                ProviderSHA256s: c.providerSHA256s,
         }
 
         var operation walkOperation
         if c.destroy {
                 operation = walkPlanDestroy
-                p.Destroy = true
         } else {
                 // Set our state to be something temporary. We do this so that
                 // the plan can update a fake state so that variables work, then
                 // we replace it back with our old state.
                 old := c.state
                 if old == nil {
-                        c.state = &State{}
-                        c.state.init()
+                        c.state = states.NewState()
                 } else {
                         c.state = old.DeepCopy()
                 }
@@ -570,57 +538,27 @@ func (c *Context) Plan() (*Plan, error) {
                 operation = walkPlan
         }
 
-        // Setup our diff
-        c.diffLock.Lock()
-        c.diff = new(Diff)
-        c.diff.init()
-        c.diffLock.Unlock()
-
         // Build the graph.
         graphType := GraphTypePlan
         if c.destroy {
                 graphType = GraphTypePlanDestroy
         }
-        graph, err := c.Graph(graphType, nil)
-        if err != nil {
-                return nil, err
+        graph, graphDiags := c.Graph(graphType, nil)
+        diags = diags.Append(graphDiags)
+        if graphDiags.HasErrors() {
+                return nil, diags
         }
 
         // Do the walk
-        walker, err := c.walk(graph, operation)
-        if err != nil {
-                return nil, err
+        walker, walkDiags := c.walk(graph, operation)
+        diags = diags.Append(walker.NonFatalDiagnostics)
+        diags = diags.Append(walkDiags)
+        if walkDiags.HasErrors() {
+                return nil, diags
         }
-        p.Diff = c.diff
-
-        // If this is true, it means we're running unit tests. In this case,
-        // we perform a deep copy just to ensure that all context tests also
-        // test that a diff is copy-able. This will panic if it fails. This
-        // is enabled during unit tests.
-        //
-        // This should never be true during production usage, but even if it is,
-        // it can't do any real harm.
-        if contextTestDeepCopyOnPlan {
-                p.Diff.DeepCopy()
-        }
-
-        /*
-                // We don't do the reverification during the new destroy plan because
-                // it will use a different apply process.
-                if X_legacyGraph {
-                        // Now that we have a diff, we can build the exact graph that Apply will use
-                        // and catch any possible cycles during the Plan phase.
-                        if _, err := c.Graph(GraphTypeLegacy, nil); err != nil {
-                                return nil, err
-                        }
-                }
-        */
+        p.Changes = c.changes
 
-        var errs error
-        if len(walker.ValidationErrors) > 0 {
-                errs = multierror.Append(errs, walker.ValidationErrors...)
-        }
-        return p, errs
+        return p, diags
 }
 
 // Refresh goes through all the resources in the state and refreshes them
@@ -629,27 +567,46 @@ func (c *Context) Plan() (*Plan, error) {
 //
 // Even in the case an error is returned, the state may be returned and
 // will potentially be partially updated.
-func (c *Context) Refresh() (*State, error) {
+func (c *Context) Refresh() (*states.State, tfdiags.Diagnostics) {
         defer c.acquireRun("refresh")()
 
         // Copy our own state
         c.state = c.state.DeepCopy()
 
+        // Refresh builds a partial changeset as part of its work because it must
+        // create placeholder stubs for any resource instances that'll be created
+        // in subsequent plan so that provider configurations and data resources
+        // can interpolate from them. This plan is always thrown away after
+        // the operation completes, restoring any existing changeset.
+        oldChanges := c.changes
+        defer func() { c.changes = oldChanges }()
+        c.changes = plans.NewChanges()
+
         // Build the graph.
-        graph, err := c.Graph(GraphTypeRefresh, nil)
-        if err != nil {
-                return nil, err
+        graph, diags := c.Graph(GraphTypeRefresh, nil)
+        if diags.HasErrors() {
+                return nil, diags
         }
 
         // Do the walk
-        if _, err := c.walk(graph, walkRefresh); err != nil {
-                return nil, err
-        }
-
-        // Clean out any unused things
-        c.state.prune()
-
-        return c.state, nil
+        _, walkDiags := c.walk(graph, walkRefresh)
+        diags = diags.Append(walkDiags)
+        if walkDiags.HasErrors() {
+                return nil, diags
+        }
+
+        // During our walk we will have created planned object placeholders in
+        // state for resource instances that are in configuration but not yet
+        // created. These were created only to allow expression evaluation to
+        // work properly in provider and data blocks during the walk and must
+        // now be discarded, since a subsequent plan walk is responsible for
+        // creating these "for real".
+        // TODO: Consolidate refresh and plan into a single walk, so that the
+        // refresh walk doesn't need to emulate various aspects of the plan
+        // walk in order to properly evaluate provider and data blocks.
+        c.state.SyncWrapper().RemovePlannedResourceInstanceObjects()
+
+        return c.state, diags
 }
 
 // Stop stops the running task.
@@ -675,32 +632,33 @@ func (c *Context) Stop() {
 
         // Grab the condition var before we exit
         if cond := c.runCond; cond != nil {
+                log.Printf("[INFO] terraform: waiting for graceful stop to complete")
                 cond.Wait()
         }
 
         log.Printf("[WARN] terraform: stop complete")
 }
 
-// Validate validates the configuration and returns any warnings or errors.
+// Validate performs semantic validation of the configuration, and returning
+// any warnings or errors.
+//
+// Syntax and structural checks are performed by the configuration loader,
+// and so are not repeated here.
 func (c *Context) Validate() tfdiags.Diagnostics {
         defer c.acquireRun("validate")()
 
         var diags tfdiags.Diagnostics
 
-        // Validate the configuration itself
-        diags = diags.Append(c.module.Validate())
-
-        // This only needs to be done for the root module, since inter-module
-        // variables are validated in the module tree.
-        if config := c.module.Config(); config != nil {
-                // Validate the user variables
-                for _, err := range smcUserVariables(config, c.variables) {
-                        diags = diags.Append(err)
-                }
+        // Validate input variables. We do this only for the values supplied
+        // by the root module, since child module calls are validated when we
+        // visit their graph nodes.
+        if c.config != nil {
+                varDiags := checkInputVariables(c.config.Module.Variables, c.variables)
+                diags = diags.Append(varDiags)
         }
 
-        // If we have errors at this point, the graphing has no chance,
-        // so just bail early.
+        // If we have errors at this point then we probably won't be able to
+        // construct a graph without producing redundant errors, so we'll halt early.
         if diags.HasErrors() {
                 return diags
         }
@@ -709,48 +667,41 @@ func (c *Context) Validate() tfdiags.Diagnostics {
         // We also validate the graph generated here, but this graph doesn't
         // necessarily match the graph that Plan will generate, so we'll validate the
         // graph again later after Planning.
-        graph, err := c.Graph(GraphTypeValidate, nil)
-        if err != nil {
-                diags = diags.Append(err)
+        graph, graphDiags := c.Graph(GraphTypeValidate, nil)
+        diags = diags.Append(graphDiags)
+        if graphDiags.HasErrors() {
                 return diags
         }
 
         // Walk
-        walker, err := c.walk(graph, walkValidate)
-        if err != nil {
-                diags = diags.Append(err)
-        }
-
-        sort.Strings(walker.ValidationWarnings)
-        sort.Slice(walker.ValidationErrors, func(i, j int) bool {
-                return walker.ValidationErrors[i].Error() < walker.ValidationErrors[j].Error()
-        })
-
-        for _, warn := range walker.ValidationWarnings {
-                diags = diags.Append(tfdiags.SimpleWarning(warn))
-        }
-        for _, err := range walker.ValidationErrors {
-                diags = diags.Append(err)
+        walker, walkDiags := c.walk(graph, walkValidate)
+        diags = diags.Append(walker.NonFatalDiagnostics)
+        diags = diags.Append(walkDiags)
+        if walkDiags.HasErrors() {
+                return diags
         }
 
         return diags
 }
 
-// Module returns the module tree associated with this context.
-func (c *Context) Module() *module.Tree {
-        return c.module
+// Config returns the configuration tree associated with this context.
+func (c *Context) Config() *configs.Config {
+        return c.config
 }
 
 // Variables will return the mapping of variables that were defined
 // for this Context. If Input was called, this mapping may be different
 // than what was given.
-func (c *Context) Variables() map[string]interface{} {
+func (c *Context) Variables() InputValues {
         return c.variables
 }
 
 // SetVariable sets a variable after a context has already been built.
-func (c *Context) SetVariable(k string, v interface{}) {
-        c.variables[k] = v
+func (c *Context) SetVariable(k string, v cty.Value) {
+        c.variables[k] = &InputValue{
+                Value:      v,
+                SourceType: ValueFromCaller,
+        }
 }
 
 func (c *Context) acquireRun(phase string) func() {
@@ -767,9 +718,6 @@ func (c *Context) acquireRun(phase string) func() {
         // Build our lock
         c.runCond = sync.NewCond(&c.l)
 
-        // Setup debugging
-        dbug.SetPhase(phase)
-
         // Create a new run context
         c.runContext, c.runContextCancel = context.WithCancel(context.Background())
 
@@ -787,11 +735,6 @@ func (c *Context) releaseRun() {
         c.l.Lock()
         defer c.l.Unlock()
 
-        // setting the phase to "INVALID" lets us easily detect if we have
-        // operations happening outside of a run, or we missed setting the proper
-        // phase
-        dbug.SetPhase("INVALID")
-
         // End our run. We check if runContext is non-nil because it can be
         // set to nil if it was cancelled via Stop()
         if c.runContextCancel != nil {
@@ -807,30 +750,33 @@ func (c *Context) releaseRun() {
         c.runContext = nil
 }
 
-func (c *Context) walk(graph *Graph, operation walkOperation) (*ContextGraphWalker, error) {
-        // Keep track of the "real" context which is the context that does
-        // the real work: talking to real providers, modifying real state, etc.
-        realCtx := c
-
+func (c *Context) walk(graph *Graph, operation walkOperation) (*ContextGraphWalker, tfdiags.Diagnostics) {
         log.Printf("[DEBUG] Starting graph walk: %s", operation.String())
 
-        walker := &ContextGraphWalker{
-                Context:     realCtx,
-                Operation:   operation,
-                StopContext: c.runContext,
-        }
+        walker := c.graphWalker(operation)
 
         // Watch for a stop so we can call the provider Stop() API.
         watchStop, watchWait := c.watchStop(walker)
 
         // Walk the real graph, this will block until it completes
-        realErr := graph.Walk(walker)
+        diags := graph.Walk(walker)
 
         // Close the channel so the watcher stops, and wait for it to return.
         close(watchStop)
         <-watchWait
 
-        return walker, realErr
+        return walker, diags
+}
+
+func (c *Context) graphWalker(operation walkOperation) *ContextGraphWalker {
+        return &ContextGraphWalker{
+                Context:            c,
+                State:              c.state.SyncWrapper(),
+                Changes:            c.changes.SyncWrapper(),
+                Operation:          operation,
+                StopContext:        c.runContext,
+                RootVariableValues: c.variables,
+        }
 }
 
 // watchStop immediately returns a `stop` and a `wait` chan after dispatching
@@ -863,12 +809,13 @@ func (c *Context) watchStop(walker *ContextGraphWalker) (chan struct{}, <-chan s
                 }
 
                 // If we're here, we're stopped, trigger the call.
+                log.Printf("[TRACE] Context: requesting providers and provisioners to gracefully stop")
 
                 {
                         // Copy the providers so that a misbehaved blocking Stop doesn't
                         // completely hang Terraform.
                         walker.providerLock.Lock()
-                        ps := make([]ResourceProvider, 0, len(walker.providerCache))
+                        ps := make([]providers.Interface, 0, len(walker.providerCache))
                         for _, p := range walker.providerCache {
                                 ps = append(ps, p)
                         }
@@ -885,7 +832,7 @@ func (c *Context) watchStop(walker *ContextGraphWalker) (chan struct{}, <-chan s
                 {
                         // Call stop on all the provisioners
                         walker.provisionerLock.Lock()
-                        ps := make([]ResourceProvisioner, 0, len(walker.provisionerCache))
+                        ps := make([]provisioners.Interface, 0, len(walker.provisionerCache))
                         for _, p := range walker.provisionerCache {
                                 ps = append(ps, p)
                         }
@@ -955,3 +902,37 @@ func parseVariableAsHCL(name string, input string, targetType config.VariableTyp
                 panic(fmt.Errorf("unknown type %s", targetType.Printable()))
         }
 }
+
+// ShimLegacyState is a helper that takes the legacy state type and
+// converts it to the new state type.
+//
+// This is implemented as a state file upgrade, so it will not preserve
+// parts of the state structure that are not included in a serialized state,
+// such as the resolved results of any local values, outputs in non-root
+// modules, etc.
+func ShimLegacyState(legacy *State) (*states.State, error) {
+        if legacy == nil {
+                return nil, nil
+        }
+        var buf bytes.Buffer
+        err := WriteState(legacy, &buf)
+        if err != nil {
+                return nil, err
+        }
+        f, err := statefile.Read(&buf)
+        if err != nil {
+                return nil, err
+        }
+        return f.State, err
+}
+
+// MustShimLegacyState is a wrapper around ShimLegacyState that panics if
+// the conversion does not succeed. This is primarily intended for tests where
+// the given legacy state is an object constructed within the test.
+func MustShimLegacyState(legacy *State) *states.State {
+        ret, err := ShimLegacyState(legacy)
+        if err != nil {
+                panic(err)
+        }
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/context_components.go b/vendor/github.com/hashicorp/terraform/terraform/context_components.go
index 6f50744..26ec995 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/context_components.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/context_components.go
@@ -2,6 +2,9 @@ package terraform
 
 import (
         "fmt"
+
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
 )
 
 // contextComponentFactory is the interface that Context uses
@@ -12,25 +15,25 @@ type contextComponentFactory interface {
         // ResourceProvider creates a new ResourceProvider with the given
         // type. The "uid" is a unique identifier for this provider being
         // initialized that can be used for internal tracking.
-        ResourceProvider(typ, uid string) (ResourceProvider, error)
+        ResourceProvider(typ, uid string) (providers.Interface, error)
         ResourceProviders() []string
 
         // ResourceProvisioner creates a new ResourceProvisioner with the
         // given type. The "uid" is a unique identifier for this provisioner
         // being initialized that can be used for internal tracking.
-        ResourceProvisioner(typ, uid string) (ResourceProvisioner, error)
+        ResourceProvisioner(typ, uid string) (provisioners.Interface, error)
         ResourceProvisioners() []string
 }
 
 // basicComponentFactory just calls a factory from a map directly.
 type basicComponentFactory struct {
-        providers    map[string]ResourceProviderFactory
-        provisioners map[string]ResourceProvisionerFactory
+        providers    map[string]providers.Factory
+        provisioners map[string]ProvisionerFactory
 }
 
 func (c *basicComponentFactory) ResourceProviders() []string {
         result := make([]string, len(c.providers))
-        for k, _ := range c.providers {
+        for k := range c.providers {
                 result = append(result, k)
         }
 
@@ -39,14 +42,14 @@ func (c *basicComponentFactory) ResourceProviders() []string {
 
 func (c *basicComponentFactory) ResourceProvisioners() []string {
         result := make([]string, len(c.provisioners))
-        for k, _ := range c.provisioners {
+        for k := range c.provisioners {
                 result = append(result, k)
         }
 
         return result
 }
 
-func (c *basicComponentFactory) ResourceProvider(typ, uid string) (ResourceProvider, error) {
+func (c *basicComponentFactory) ResourceProvider(typ, uid string) (providers.Interface, error) {
         f, ok := c.providers[typ]
         if !ok {
                 return nil, fmt.Errorf("unknown provider %q", typ)
@@ -55,7 +58,7 @@ func (c *basicComponentFactory) ResourceProvider(typ, uid string) (ResourceProvi
         return f()
 }
 
-func (c *basicComponentFactory) ResourceProvisioner(typ, uid string) (ResourceProvisioner, error) {
+func (c *basicComponentFactory) ResourceProvisioner(typ, uid string) (provisioners.Interface, error) {
         f, ok := c.provisioners[typ]
         if !ok {
                 return nil, fmt.Errorf("unknown provisioner %q", typ)
diff --git a/vendor/github.com/hashicorp/terraform/terraform/context_graph_type.go b/vendor/github.com/hashicorp/terraform/terraform/context_graph_type.go
index 084f010..0a424a0 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/context_graph_type.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/context_graph_type.go
@@ -14,8 +14,8 @@ const (
         GraphTypePlan
         GraphTypePlanDestroy
         GraphTypeApply
-        GraphTypeInput
         GraphTypeValidate
+        GraphTypeEval // only visits in-memory elements such as variables, locals, and outputs.
 )
 
 // GraphTypeMap is a mapping of human-readable string to GraphType. This
@@ -23,10 +23,10 @@ const (
 // graph types.
 var GraphTypeMap = map[string]GraphType{
         "apply":        GraphTypeApply,
-        "input":        GraphTypeInput,
         "plan":         GraphTypePlan,
         "plan-destroy": GraphTypePlanDestroy,
         "refresh":      GraphTypeRefresh,
         "legacy":       GraphTypeLegacy,
         "validate":     GraphTypeValidate,
+        "eval":         GraphTypeEval,
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/context_import.go b/vendor/github.com/hashicorp/terraform/terraform/context_import.go
index e940143..313e909 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/context_import.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/context_import.go
@@ -1,7 +1,10 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ImportOpts are used as the configuration for Import.
@@ -9,23 +12,23 @@ type ImportOpts struct {
         // Targets are the targets to import
         Targets []*ImportTarget
 
-        // Module is optional, and specifies a config module that is loaded
-        // into the graph and evaluated. The use case for this is to provide
-        // provider configuration.
-        Module *module.Tree
+        // Config is optional, and specifies a config tree that will be loaded
+        // into the graph and evaluated. This is the source for provider
+        // configurations.
+        Config *configs.Config
 }
 
 // ImportTarget is a single resource to import.
 type ImportTarget struct {
-        // Addr is the full resource address of the resource to import.
-        // Example: "module.foo.aws_instance.bar"
-        Addr string
+        // Addr is the address for the resource instance that the new object should
+        // be imported into.
+        Addr addrs.AbsResourceInstance
 
         // ID is the ID of the resource to import. This is resource-specific.
         ID string
 
-        // Provider string
-        Provider string
+        // ProviderAddr is the address of the provider that should handle the import.
+        ProviderAddr addrs.AbsProviderConfig
 }
 
 // Import takes already-created external resources and brings them
@@ -38,7 +41,9 @@ type ImportTarget struct {
 // Further, this operation also gracefully handles partial state. If during
 // an import there is a failure, all previously imported resources remain
 // imported.
-func (c *Context) Import(opts *ImportOpts) (*State, error) {
+func (c *Context) Import(opts *ImportOpts) (*states.State, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
         // Hold a lock since we can modify our own state here
         defer c.acquireRun("import")()
 
@@ -47,31 +52,32 @@ func (c *Context) Import(opts *ImportOpts) (*State, error) {
 
         // If no module is given, default to the module configured with
         // the Context.
-        module := opts.Module
-        if module == nil {
-                module = c.module
+        config := opts.Config
+        if config == nil {
+                config = c.config
         }
 
         // Initialize our graph builder
         builder := &ImportGraphBuilder{
                 ImportTargets: opts.Targets,
-                Module:        module,
-                Providers:     c.components.ResourceProviders(),
+                Config:        config,
+                Components:    c.components,
+                Schemas:       c.schemas,
         }
 
         // Build the graph!
-        graph, err := builder.Build(RootModulePath)
-        if err != nil {
-                return c.state, err
+        graph, graphDiags := builder.Build(addrs.RootModuleInstance)
+        diags = diags.Append(graphDiags)
+        if graphDiags.HasErrors() {
+                return c.state, diags
         }
 
         // Walk it
-        if _, err := c.walk(graph, walkImport); err != nil {
-                return c.state, err
+        _, walkDiags := c.walk(graph, walkImport)
+        diags = diags.Append(walkDiags)
+        if walkDiags.HasErrors() {
+                return c.state, diags
         }
 
-        // Clean the state
-        c.state.prune()
-
-        return c.state, nil
+        return c.state, diags
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/context_input.go b/vendor/github.com/hashicorp/terraform/terraform/context_input.go
new file mode 100644
index 0000000..6c7be88
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/context_input.go
@@ -0,0 +1,251 @@
+package terraform
+
+import (
+        "context"
+        "fmt"
+        "log"
+        "sort"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// Input asks for input to fill variables and provider configurations.
+// This modifies the configuration in-place, so asking for Input twice
+// may result in different UI output showing different current values.
+func (c *Context) Input(mode InputMode) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+        defer c.acquireRun("input")()
+
+        if c.uiInput == nil {
+                log.Printf("[TRACE] Context.Input: uiInput is nil, so skipping")
+                return diags
+        }
+
+        ctx := context.Background()
+
+        if mode&InputModeVar != 0 {
+                log.Printf("[TRACE] Context.Input: Prompting for variables")
+
+                // Walk the variables first for the root module. We walk them in
+                // alphabetical order for UX reasons.
+                configs := c.config.Module.Variables
+                names := make([]string, 0, len(configs))
+                for name := range configs {
+                        names = append(names, name)
+                }
+                sort.Strings(names)
+        Variables:
+                for _, n := range names {
+                        v := configs[n]
+
+                        // If we only care about unset variables, then we should set any
+                        // variable that is already set.
+                        if mode&InputModeVarUnset != 0 {
+                                if _, isSet := c.variables[n]; isSet {
+                                        continue
+                                }
+                        }
+
+                        // this should only happen during tests
+                        if c.uiInput == nil {
+                                log.Println("[WARN] Context.uiInput is nil during input walk")
+                                continue
+                        }
+
+                        // Ask the user for a value for this variable
+                        var rawValue string
+                        retry := 0
+                        for {
+                                var err error
+                                rawValue, err = c.uiInput.Input(ctx, &InputOpts{
+                                        Id:          fmt.Sprintf("var.%s", n),
+                                        Query:       fmt.Sprintf("var.%s", n),
+                                        Description: v.Description,
+                                })
+                                if err != nil {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Failed to request interactive input",
+                                                fmt.Sprintf("Terraform attempted to request a value for var.%s interactively, but encountered an error: %s.", n, err),
+                                        ))
+                                        return diags
+                                }
+
+                                if rawValue == "" && v.Default == cty.NilVal {
+                                        // Redo if it is required, but abort if we keep getting
+                                        // blank entries
+                                        if retry > 2 {
+                                                diags = diags.Append(tfdiags.Sourceless(
+                                                        tfdiags.Error,
+                                                        "Required variable not assigned",
+                                                        fmt.Sprintf("The variable %q is required, so Terraform cannot proceed without a defined value for it.", n),
+                                                ))
+                                                continue Variables
+                                        }
+                                        retry++
+                                        continue
+                                }
+
+                                break
+                        }
+
+                        val, valDiags := v.ParsingMode.Parse(n, rawValue)
+                        diags = diags.Append(valDiags)
+                        if diags.HasErrors() {
+                                continue
+                        }
+
+                        c.variables[n] = &InputValue{
+                                Value:      val,
+                                SourceType: ValueFromInput,
+                        }
+                }
+        }
+
+        if mode&InputModeProvider != 0 {
+                log.Printf("[TRACE] Context.Input: Prompting for provider arguments")
+
+                // We prompt for input only for provider configurations defined in
+                // the root module. At the time of writing that is an arbitrary
+                // restriction, but we have future plans to support "count" and
+                // "for_each" on modules that will then prevent us from supporting
+                // input for child module configurations anyway (since we'd need to
+                // dynamic-expand first), and provider configurations in child modules
+                // are not recommended since v0.11 anyway, so this restriction allows
+                // us to keep this relatively simple without significant hardship.
+
+                pcs := make(map[string]*configs.Provider)
+                pas := make(map[string]addrs.ProviderConfig)
+                for _, pc := range c.config.Module.ProviderConfigs {
+                        addr := pc.Addr()
+                        pcs[addr.String()] = pc
+                        pas[addr.String()] = addr
+                        log.Printf("[TRACE] Context.Input: Provider %s declared at %s", addr, pc.DeclRange)
+                }
+                // We also need to detect _implied_ provider configs from resources.
+                // These won't have *configs.Provider objects, but they will still
+                // exist in the map and we'll just treat them as empty below.
+                for _, rc := range c.config.Module.ManagedResources {
+                        pa := rc.ProviderConfigAddr()
+                        if pa.Alias != "" {
+                                continue // alias configurations cannot be implied
+                        }
+                        if _, exists := pcs[pa.String()]; !exists {
+                                pcs[pa.String()] = nil
+                                pas[pa.String()] = pa
+                                log.Printf("[TRACE] Context.Input: Provider %s implied by resource block at %s", pa, rc.DeclRange)
+                        }
+                }
+                for _, rc := range c.config.Module.DataResources {
+                        pa := rc.ProviderConfigAddr()
+                        if pa.Alias != "" {
+                                continue // alias configurations cannot be implied
+                        }
+                        if _, exists := pcs[pa.String()]; !exists {
+                                pcs[pa.String()] = nil
+                                pas[pa.String()] = pa
+                                log.Printf("[TRACE] Context.Input: Provider %s implied by data block at %s", pa, rc.DeclRange)
+                        }
+                }
+
+                for pk, pa := range pas {
+                        pc := pcs[pk] // will be nil if this is an implied config
+
+                        // Wrap the input into a namespace
+                        input := &PrefixUIInput{
+                                IdPrefix:    pk,
+                                QueryPrefix: pk + ".",
+                                UIInput:     c.uiInput,
+                        }
+
+                        schema := c.schemas.ProviderConfig(pa.Type)
+                        if schema == nil {
+                                // Could either be an incorrect config or just an incomplete
+                                // mock in tests. We'll let a later pass decide, and just
+                                // ignore this for the purposes of gathering input.
+                                log.Printf("[TRACE] Context.Input: No schema available for provider type %q", pa.Type)
+                                continue
+                        }
+
+                        // For our purposes here we just want to detect if attrbutes are
+                        // set in config at all, so rather than doing a full decode
+                        // (which would require us to prepare an evalcontext, etc) we'll
+                        // use the low-level HCL API to process only the top-level
+                        // structure.
+                        var attrExprs hcl.Attributes // nil if there is no config
+                        if pc != nil && pc.Config != nil {
+                                lowLevelSchema := schemaForInputSniffing(hcldec.ImpliedSchema(schema.DecoderSpec()))
+                                content, _, diags := pc.Config.PartialContent(lowLevelSchema)
+                                if diags.HasErrors() {
+                                        log.Printf("[TRACE] Context.Input: %s has decode error, so ignoring: %s", pa, diags.Error())
+                                        continue
+                                }
+                                attrExprs = content.Attributes
+                        }
+
+                        keys := make([]string, 0, len(schema.Attributes))
+                        for key := range schema.Attributes {
+                                keys = append(keys, key)
+                        }
+                        sort.Strings(keys)
+
+                        vals := map[string]cty.Value{}
+                        for _, key := range keys {
+                                attrS := schema.Attributes[key]
+                                if attrS.Optional {
+                                        continue
+                                }
+                                if attrExprs != nil {
+                                        if _, exists := attrExprs[key]; exists {
+                                                continue
+                                        }
+                                }
+                                if !attrS.Type.Equals(cty.String) {
+                                        continue
+                                }
+
+                                log.Printf("[TRACE] Context.Input: Prompting for %s argument %s", pa, key)
+                                rawVal, err := input.Input(ctx, &InputOpts{
+                                        Id:          key,
+                                        Query:       key,
+                                        Description: attrS.Description,
+                                })
+                                if err != nil {
+                                        log.Printf("[TRACE] Context.Input: Failed to prompt for %s argument %s: %s", pa, key, err)
+                                        continue
+                                }
+
+                                vals[key] = cty.StringVal(rawVal)
+                        }
+
+                        c.providerInputConfig[pk] = vals
+                        log.Printf("[TRACE] Context.Input: Input for %s: %#v", pk, vals)
+                }
+        }
+
+        return diags
+}
+
+// schemaForInputSniffing returns a transformed version of a given schema
+// that marks all attributes as optional, which the Context.Input method can
+// use to detect whether a required argument is set without missing arguments
+// themselves generating errors.
+func schemaForInputSniffing(schema *hcl.BodySchema) *hcl.BodySchema {
+        ret := &hcl.BodySchema{
+                Attributes: make([]hcl.AttributeSchema, len(schema.Attributes)),
+                Blocks:     schema.Blocks,
+        }
+
+        for i, attrS := range schema.Attributes {
+                ret.Attributes[i] = attrS
+                ret.Attributes[i].Required = false
+        }
+
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/debug.go b/vendor/github.com/hashicorp/terraform/terraform/debug.go
deleted file mode 100644
index 265339f..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/debug.go
+++ /dev/null
@@ -1,523 +0,0 @@
-package terraform
-
-import (
-        "archive/tar"
-        "bytes"
-        "compress/gzip"
-        "encoding/json"
-        "fmt"
-        "io"
-        "os"
-        "path/filepath"
-        "sync"
-        "time"
-)
-
-// DebugInfo is the global handler for writing the debug archive. All methods
-// are safe to call concurrently. Setting DebugInfo to nil will disable writing
-// the debug archive. All methods are safe to call on the nil value.
-var dbug *debugInfo
-
-// SetDebugInfo initializes the debug handler with a backing file in the
-// provided directory. This must be called before any other terraform package
-// operations or not at all. Once his is called, CloseDebugInfo should be
-// called before program exit.
-func SetDebugInfo(path string) error {
-        if os.Getenv("TF_DEBUG") == "" {
-                return nil
-        }
-
-        di, err := newDebugInfoFile(path)
-        if err != nil {
-                return err
-        }
-
-        dbug = di
-        return nil
-}
-
-// CloseDebugInfo is the exported interface to Close the debug info handler.
-// The debug handler needs to be closed before program exit, so we export this
-// function to be deferred in the appropriate entrypoint for our executable.
-func CloseDebugInfo() error {
-        return dbug.Close()
-}
-
-// newDebugInfoFile initializes the global debug handler with a backing file in
-// the provided directory.
-func newDebugInfoFile(dir string) (*debugInfo, error) {
-        err := os.MkdirAll(dir, 0755)
-        if err != nil {
-                return nil, err
-        }
-
-        // FIXME: not guaranteed unique, but good enough for now
-        name := fmt.Sprintf("debug-%s", time.Now().Format("2006-01-02-15-04-05.999999999"))
-        archivePath := filepath.Join(dir, name+".tar.gz")
-
-        f, err := os.OpenFile(archivePath, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0666)
-        if err != nil {
-                return nil, err
-        }
-        return newDebugInfo(name, f)
-}
-
-// newDebugInfo initializes the global debug handler.
-func newDebugInfo(name string, w io.Writer) (*debugInfo, error) {
-        gz := gzip.NewWriter(w)
-
-        d := &debugInfo{
-                name: name,
-                w:    w,
-                gz:   gz,
-                tar:  tar.NewWriter(gz),
-        }
-
-        // create the subdirs we need
-        topHdr := &tar.Header{
-                Name:     name,
-                Typeflag: tar.TypeDir,
-                Mode:     0755,
-        }
-        graphsHdr := &tar.Header{
-                Name:     name + "/graphs",
-                Typeflag: tar.TypeDir,
-                Mode:     0755,
-        }
-        err := d.tar.WriteHeader(topHdr)
-        // if the first errors, the second will too
-        err = d.tar.WriteHeader(graphsHdr)
-        if err != nil {
-                return nil, err
-        }
-
-        return d, nil
-}
-
-// debugInfo provides various methods for writing debug information to a
-// central archive. The debugInfo struct should be initialized once before any
-// output is written, and Close should be called before program exit. All
-// exported methods on debugInfo will be safe for concurrent use. The exported
-// methods are also all safe to call on a nil pointer, so that there is no need
-// for conditional blocks before writing debug information.
-//
-// Each write operation done by the debugInfo will flush the gzip.Writer and
-// tar.Writer, and call Sync() or Flush() on the output writer as needed. This
-// ensures that as much data as possible is written to storage in the event of
-// a crash. The append format of the tar file, and the stream format of the
-// gzip writer allow easy recovery f the data in the event that the debugInfo
-// is not closed before program exit.
-type debugInfo struct {
-        sync.Mutex
-
-        // archive root directory name
-        name string
-
-        // current operation phase
-        phase string
-
-        // step is monotonic counter for for recording the order of operations
-        step int
-
-        // flag to protect Close()
-        closed bool
-
-        // the debug log output is in a tar.gz format, written to the io.Writer w
-        w   io.Writer
-        gz  *gzip.Writer
-        tar *tar.Writer
-}
-
-// Set the name of the current operational phase in the debug handler. Each file
-// in the archive will contain the name of the phase in which it was created,
-// i.e. "input", "apply", "plan", "refresh", "validate"
-func (d *debugInfo) SetPhase(phase string) {
-        if d == nil {
-                return
-        }
-        d.Lock()
-        defer d.Unlock()
-
-        d.phase = phase
-}
-
-// Close the debugInfo, finalizing the data in storage. This closes the
-// tar.Writer, the gzip.Wrtier, and if the output writer is an io.Closer, it is
-// also closed.
-func (d *debugInfo) Close() error {
-        if d == nil {
-                return nil
-        }
-
-        d.Lock()
-        defer d.Unlock()
-
-        if d.closed {
-                return nil
-        }
-        d.closed = true
-
-        d.tar.Close()
-        d.gz.Close()
-
-        if c, ok := d.w.(io.Closer); ok {
-                return c.Close()
-        }
-        return nil
-}
-
-// debug buffer is an io.WriteCloser that will write itself to the debug
-// archive when closed.
-type debugBuffer struct {
-        debugInfo *debugInfo
-        name      string
-        buf       bytes.Buffer
-}
-
-func (b *debugBuffer) Write(d []byte) (int, error) {
-        return b.buf.Write(d)
-}
-
-func (b *debugBuffer) Close() error {
-        return b.debugInfo.WriteFile(b.name, b.buf.Bytes())
-}
-
-// ioutils only has a noop ReadCloser
-type nopWriteCloser struct{}
-
-func (nopWriteCloser) Write([]byte) (int, error) { return 0, nil }
-func (nopWriteCloser) Close() error              { return nil }
-
-// NewFileWriter returns an io.WriteClose that will be buffered and written to
-// the debug archive when closed.
-func (d *debugInfo) NewFileWriter(name string) io.WriteCloser {
-        if d == nil {
-                return nopWriteCloser{}
-        }
-
-        return &debugBuffer{
-                debugInfo: d,
-                name:      name,
-        }
-}
-
-type syncer interface {
-        Sync() error
-}
-
-type flusher interface {
-        Flush() error
-}
-
-// Flush the tar.Writer and the gzip.Writer. Flush() or Sync() will be called
-// on the output writer if they are available.
-func (d *debugInfo) flush() {
-        d.tar.Flush()
-        d.gz.Flush()
-
-        if f, ok := d.w.(flusher); ok {
-                f.Flush()
-        }
-
-        if s, ok := d.w.(syncer); ok {
-                s.Sync()
-        }
-}
-
-// WriteFile writes data as a single file to the debug arhive.
-func (d *debugInfo) WriteFile(name string, data []byte) error {
-        if d == nil {
-                return nil
-        }
-
-        d.Lock()
-        defer d.Unlock()
-        return d.writeFile(name, data)
-}
-
-func (d *debugInfo) writeFile(name string, data []byte) error {
-        defer d.flush()
-        path := fmt.Sprintf("%s/%d-%s-%s", d.name, d.step, d.phase, name)
-        d.step++
-
-        hdr := &tar.Header{
-                Name: path,
-                Mode: 0644,
-                Size: int64(len(data)),
-        }
-        err := d.tar.WriteHeader(hdr)
-        if err != nil {
-                return err
-        }
-
-        _, err = d.tar.Write(data)
-        return err
-}
-
-// DebugHook implements all methods of the terraform.Hook interface, and writes
-// the arguments to a file in the archive. When a suitable format for the
-// argument isn't available, the argument is encoded using json.Marshal. If the
-// debug handler is nil, all DebugHook methods are noop, so no time is spent in
-// marshaling the data structures.
-type DebugHook struct{}
-
-func (*DebugHook) PreApply(ii *InstanceInfo, is *InstanceState, id *InstanceDiff) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String() + "\n")
-        }
-
-        idCopy, err := id.Copy()
-        if err != nil {
-                return HookActionContinue, err
-        }
-        js, err := json.MarshalIndent(idCopy, "", "  ")
-        if err != nil {
-                return HookActionContinue, err
-        }
-        buf.Write(js)
-
-        dbug.WriteFile("hook-PreApply", buf.Bytes())
-
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PostApply(ii *InstanceInfo, is *InstanceState, err error) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String() + "\n")
-        }
-
-        if err != nil {
-                buf.WriteString(err.Error())
-        }
-
-        dbug.WriteFile("hook-PostApply", buf.Bytes())
-
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PreDiff(ii *InstanceInfo, is *InstanceState) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String())
-                buf.WriteString("\n")
-        }
-        dbug.WriteFile("hook-PreDiff", buf.Bytes())
-
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PostDiff(ii *InstanceInfo, id *InstanceDiff) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        idCopy, err := id.Copy()
-        if err != nil {
-                return HookActionContinue, err
-        }
-        js, err := json.MarshalIndent(idCopy, "", "  ")
-        if err != nil {
-                return HookActionContinue, err
-        }
-        buf.Write(js)
-
-        dbug.WriteFile("hook-PostDiff", buf.Bytes())
-
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PreProvisionResource(ii *InstanceInfo, is *InstanceState) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String())
-                buf.WriteString("\n")
-        }
-        dbug.WriteFile("hook-PreProvisionResource", buf.Bytes())
-
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PostProvisionResource(ii *InstanceInfo, is *InstanceState) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId())
-                buf.WriteString("\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String())
-                buf.WriteString("\n")
-        }
-        dbug.WriteFile("hook-PostProvisionResource", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PreProvision(ii *InstanceInfo, s string) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId())
-                buf.WriteString("\n")
-        }
-        buf.WriteString(s + "\n")
-
-        dbug.WriteFile("hook-PreProvision", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PostProvision(ii *InstanceInfo, s string, err error) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-        buf.WriteString(s + "\n")
-
-        dbug.WriteFile("hook-PostProvision", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) ProvisionOutput(ii *InstanceInfo, s1 string, s2 string) {
-        if dbug == nil {
-                return
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId())
-                buf.WriteString("\n")
-        }
-        buf.WriteString(s1 + "\n")
-        buf.WriteString(s2 + "\n")
-
-        dbug.WriteFile("hook-ProvisionOutput", buf.Bytes())
-}
-
-func (*DebugHook) PreRefresh(ii *InstanceInfo, is *InstanceState) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String())
-                buf.WriteString("\n")
-        }
-        dbug.WriteFile("hook-PreRefresh", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PostRefresh(ii *InstanceInfo, is *InstanceState) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId())
-                buf.WriteString("\n")
-        }
-
-        if is != nil {
-                buf.WriteString(is.String())
-                buf.WriteString("\n")
-        }
-        dbug.WriteFile("hook-PostRefresh", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PreImportState(ii *InstanceInfo, s string) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-        if ii != nil {
-                buf.WriteString(ii.HumanId())
-                buf.WriteString("\n")
-        }
-        buf.WriteString(s + "\n")
-
-        dbug.WriteFile("hook-PreImportState", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-func (*DebugHook) PostImportState(ii *InstanceInfo, iss []*InstanceState) (HookAction, error) {
-        if dbug == nil {
-                return HookActionContinue, nil
-        }
-
-        var buf bytes.Buffer
-
-        if ii != nil {
-                buf.WriteString(ii.HumanId() + "\n")
-        }
-
-        for _, is := range iss {
-                if is != nil {
-                        buf.WriteString(is.String() + "\n")
-                }
-        }
-        dbug.WriteFile("hook-PostImportState", buf.Bytes())
-        return HookActionContinue, nil
-}
-
-// skip logging this for now, since it could be huge
-func (*DebugHook) PostStateUpdate(*State) (HookAction, error) {
-        return HookActionContinue, nil
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/diff.go b/vendor/github.com/hashicorp/terraform/terraform/diff.go
index d6dc550..7a6ef3d 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/diff.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/diff.go
@@ -4,12 +4,20 @@ import (
         "bufio"
         "bytes"
         "fmt"
+        "log"
         "reflect"
         "regexp"
         "sort"
+        "strconv"
         "strings"
         "sync"
 
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+
         "github.com/mitchellh/copystructure"
 )
 
@@ -69,8 +77,24 @@ func (d *Diff) Prune() {
 //
 // This should be the preferred method to add module diffs since it
 // allows us to optimize lookups later as well as control sorting.
-func (d *Diff) AddModule(path []string) *ModuleDiff {
-        m := &ModuleDiff{Path: path}
+func (d *Diff) AddModule(path addrs.ModuleInstance) *ModuleDiff {
+        // Lower the new-style address into a legacy-style address.
+        // This requires that none of the steps have instance keys, which is
+        // true for all addresses at the time of implementing this because
+        // "count" and "for_each" are not yet implemented for modules.
+        legacyPath := make([]string, len(path))
+        for i, step := range path {
+                if step.InstanceKey != addrs.NoKey {
+                        // FIXME: Once the rest of Terraform is ready to use count and
+                        // for_each, remove all of this and just write the addrs.ModuleInstance
+                        // value itself into the ModuleState.
+                        panic("diff cannot represent modules with count or for_each keys")
+                }
+
+                legacyPath[i] = step.Name
+        }
+
+        m := &ModuleDiff{Path: legacyPath}
         m.init()
         d.Modules = append(d.Modules, m)
         return m
@@ -79,7 +103,7 @@ func (d *Diff) AddModule(path []string) *ModuleDiff {
 // ModuleByPath is used to lookup the module diff for the given path.
 // This should be the preferred lookup mechanism as it allows for future
 // lookup optimizations.
-func (d *Diff) ModuleByPath(path []string) *ModuleDiff {
+func (d *Diff) ModuleByPath(path addrs.ModuleInstance) *ModuleDiff {
         if d == nil {
                 return nil
         }
@@ -87,7 +111,8 @@ func (d *Diff) ModuleByPath(path []string) *ModuleDiff {
                 if mod.Path == nil {
                         panic("missing module path")
                 }
-                if reflect.DeepEqual(mod.Path, path) {
+                modPath := normalizeModulePath(mod.Path)
+                if modPath.String() == path.String() {
                         return mod
                 }
         }
@@ -96,7 +121,7 @@ func (d *Diff) ModuleByPath(path []string) *ModuleDiff {
 
 // RootModule returns the ModuleState for the root module
 func (d *Diff) RootModule() *ModuleDiff {
-        root := d.ModuleByPath(rootModulePath)
+        root := d.ModuleByPath(addrs.RootModuleInstance)
         if root == nil {
                 panic("missing root module")
         }
@@ -166,7 +191,8 @@ func (d *Diff) String() string {
         keys := make([]string, 0, len(d.Modules))
         lookup := make(map[string]*ModuleDiff)
         for _, m := range d.Modules {
-                key := fmt.Sprintf("module.%s", strings.Join(m.Path[1:], "."))
+                addr := normalizeModulePath(m.Path)
+                key := addr.String()
                 keys = append(keys, key)
                 lookup[key] = m
         }
@@ -384,6 +410,541 @@ type InstanceDiff struct {
 func (d *InstanceDiff) Lock()   { d.mu.Lock() }
 func (d *InstanceDiff) Unlock() { d.mu.Unlock() }
 
+// ApplyToValue merges the receiver into the given base value, returning a
+// new value that incorporates the planned changes. The given value must
+// conform to the given schema, or this method will panic.
+//
+// This method is intended for shimming old subsystems that still use this
+// legacy diff type to work with the new-style types.
+func (d *InstanceDiff) ApplyToValue(base cty.Value, schema *configschema.Block) (cty.Value, error) {
+        // Create an InstanceState attributes from our existing state.
+        // We can use this to more easily apply the diff changes.
+        attrs := hcl2shim.FlatmapValueFromHCL2(base)
+        applied, err := d.Apply(attrs, schema)
+        if err != nil {
+                return base, err
+        }
+
+        val, err := hcl2shim.HCL2ValueFromFlatmap(applied, schema.ImpliedType())
+        if err != nil {
+                return base, err
+        }
+
+        return schema.CoerceValue(val)
+}
+
+// Apply applies the diff to the provided flatmapped attributes,
+// returning the new instance attributes.
+//
+// This method is intended for shimming old subsystems that still use this
+// legacy diff type to work with the new-style types.
+func (d *InstanceDiff) Apply(attrs map[string]string, schema *configschema.Block) (map[string]string, error) {
+        // We always build a new value here, even if the given diff is "empty",
+        // because we might be planning to create a new instance that happens
+        // to have no attributes set, and so we want to produce an empty object
+        // rather than just echoing back the null old value.
+        if attrs == nil {
+                attrs = map[string]string{}
+        }
+
+        // Rather applying the diff to mutate the attrs, we'll copy new values into
+        // here to avoid the possibility of leaving stale values.
+        result := map[string]string{}
+
+        if d.Destroy || d.DestroyDeposed || d.DestroyTainted {
+                return result, nil
+        }
+
+        return d.applyBlockDiff(nil, attrs, schema)
+}
+
+func (d *InstanceDiff) applyBlockDiff(path []string, attrs map[string]string, schema *configschema.Block) (map[string]string, error) {
+        result := map[string]string{}
+        name := ""
+        if len(path) > 0 {
+                name = path[len(path)-1]
+        }
+
+        // localPrefix is used to build the local result map
+        localPrefix := ""
+        if name != "" {
+                localPrefix = name + "."
+        }
+
+        // iterate over the schema rather than the attributes, so we can handle
+        // different block types separately from plain attributes
+        for n, attrSchema := range schema.Attributes {
+                var err error
+                newAttrs, err := d.applyAttrDiff(append(path, n), attrs, attrSchema)
+
+                if err != nil {
+                        return result, err
+                }
+
+                for k, v := range newAttrs {
+                        result[localPrefix+k] = v
+                }
+        }
+
+        blockPrefix := strings.Join(path, ".")
+        if blockPrefix != "" {
+                blockPrefix += "."
+        }
+        for n, block := range schema.BlockTypes {
+                // we need to find the set of all keys that traverse this block
+                candidateKeys := map[string]bool{}
+                blockKey := blockPrefix + n + "."
+                localBlockPrefix := localPrefix + n + "."
+
+                // we can only trust the diff for sets, since the path changes, so don't
+                // count existing values as candidate keys. If it turns out we're
+                // keeping the attributes, we will catch it down below with "keepBlock"
+                // after we check the set count.
+                if block.Nesting != configschema.NestingSet {
+                        for k := range attrs {
+                                if strings.HasPrefix(k, blockKey) {
+                                        nextDot := strings.Index(k[len(blockKey):], ".")
+                                        if nextDot < 0 {
+                                                continue
+                                        }
+                                        nextDot += len(blockKey)
+                                        candidateKeys[k[len(blockKey):nextDot]] = true
+                                }
+                        }
+                }
+
+                for k, diff := range d.Attributes {
+                        if strings.HasPrefix(k, blockKey) {
+                                nextDot := strings.Index(k[len(blockKey):], ".")
+                                if nextDot < 0 {
+                                        continue
+                                }
+
+                                if diff.NewRemoved {
+                                        continue
+                                }
+
+                                nextDot += len(blockKey)
+                                candidateKeys[k[len(blockKey):nextDot]] = true
+                        }
+                }
+
+                // check each set candidate to see if it was removed.
+                // we need to do this, because when entire sets are removed, they may
+                // have the wrong key, and ony show diffs going to ""
+                if block.Nesting == configschema.NestingSet {
+                        for k := range candidateKeys {
+                                indexPrefix := strings.Join(append(path, n, k), ".") + "."
+                                keep := false
+                                // now check each set element to see if it's a new diff, or one
+                                // that we're dropping. Since we're only applying the "New"
+                                // portion of the set, we can ignore diffs that only contain "Old"
+                                for attr, diff := range d.Attributes {
+                                        if !strings.HasPrefix(attr, indexPrefix) {
+                                                continue
+                                        }
+
+                                        // check for empty "count" keys
+                                        if (strings.HasSuffix(attr, ".#") || strings.HasSuffix(attr, ".%")) && diff.New == "0" {
+                                                continue
+                                        }
+
+                                        // removed items don't count either
+                                        if diff.NewRemoved {
+                                                continue
+                                        }
+
+                                        // this must be a diff to keep
+                                        keep = true
+                                        break
+                                }
+                                if !keep {
+                                        delete(candidateKeys, k)
+                                }
+                        }
+                }
+
+                for k := range candidateKeys {
+                        newAttrs, err := d.applyBlockDiff(append(path, n, k), attrs, &block.Block)
+                        if err != nil {
+                                return result, err
+                        }
+
+                        for attr, v := range newAttrs {
+                                result[localBlockPrefix+attr] = v
+                        }
+                }
+
+                keepBlock := true
+                // check this block's count diff directly first, since we may not
+                // have candidates because it was removed and only set to "0"
+                if diff, ok := d.Attributes[blockKey+"#"]; ok {
+                        if diff.New == "0" || diff.NewRemoved {
+                                keepBlock = false
+                        }
+                }
+
+                // if there was no diff at all, then we need to keep the block attributes
+                if len(candidateKeys) == 0 && keepBlock {
+                        for k, v := range attrs {
+                                if strings.HasPrefix(k, blockKey) {
+                                        // we need the key relative to this block, so remove the
+                                        // entire prefix, then re-insert the block name.
+                                        localKey := localBlockPrefix + k[len(blockKey):]
+                                        result[localKey] = v
+                                }
+                        }
+                }
+
+                countAddr := strings.Join(append(path, n, "#"), ".")
+                if countDiff, ok := d.Attributes[countAddr]; ok {
+                        if countDiff.NewComputed {
+                                result[localBlockPrefix+"#"] = hcl2shim.UnknownVariableValue
+                        } else {
+                                result[localBlockPrefix+"#"] = countDiff.New
+
+                                // While sets are complete, list are not, and we may not have all the
+                                // information to track removals. If the list was truncated, we need to
+                                // remove the extra items from the result.
+                                if block.Nesting == configschema.NestingList &&
+                                        countDiff.New != "" && countDiff.New != hcl2shim.UnknownVariableValue {
+                                        length, _ := strconv.Atoi(countDiff.New)
+                                        for k := range result {
+                                                if !strings.HasPrefix(k, localBlockPrefix) {
+                                                        continue
+                                                }
+
+                                                index := k[len(localBlockPrefix):]
+                                                nextDot := strings.Index(index, ".")
+                                                if nextDot < 1 {
+                                                        continue
+                                                }
+                                                index = index[:nextDot]
+                                                i, err := strconv.Atoi(index)
+                                                if err != nil {
+                                                        // this shouldn't happen since we added these
+                                                        // ourself, but make note of it just in case.
+                                                        log.Printf("[ERROR] bad list index in %q: %s", k, err)
+                                                        continue
+                                                }
+                                                if i >= length {
+                                                        delete(result, k)
+                                                }
+                                        }
+                                }
+                        }
+                } else if origCount, ok := attrs[countAddr]; ok && keepBlock {
+                        result[localBlockPrefix+"#"] = origCount
+                } else {
+                        result[localBlockPrefix+"#"] = countFlatmapContainerValues(localBlockPrefix+"#", result)
+                }
+        }
+
+        return result, nil
+}
+
+func (d *InstanceDiff) applyAttrDiff(path []string, attrs map[string]string, attrSchema *configschema.Attribute) (map[string]string, error) {
+        ty := attrSchema.Type
+        switch {
+        case ty.IsListType(), ty.IsTupleType(), ty.IsMapType():
+                return d.applyCollectionDiff(path, attrs, attrSchema)
+        case ty.IsSetType():
+                return d.applySetDiff(path, attrs, attrSchema)
+        default:
+                return d.applySingleAttrDiff(path, attrs, attrSchema)
+        }
+}
+
+func (d *InstanceDiff) applySingleAttrDiff(path []string, attrs map[string]string, attrSchema *configschema.Attribute) (map[string]string, error) {
+        currentKey := strings.Join(path, ".")
+
+        attr := path[len(path)-1]
+
+        result := map[string]string{}
+        diff := d.Attributes[currentKey]
+        old, exists := attrs[currentKey]
+
+        if diff != nil && diff.NewComputed {
+                result[attr] = config.UnknownVariableValue
+                return result, nil
+        }
+
+        // "id" must exist and not be an empty string, or it must be unknown.
+        // This only applied to top-level "id" fields.
+        if attr == "id" && len(path) == 1 {
+                if old == "" {
+                        result[attr] = config.UnknownVariableValue
+                } else {
+                        result[attr] = old
+                }
+                return result, nil
+        }
+
+        // attribute diffs are sometimes missed, so assume no diff means keep the
+        // old value
+        if diff == nil {
+                if exists {
+                        result[attr] = old
+                } else {
+                        // We need required values, so set those with an empty value. It
+                        // must be set in the config, since if it were missing it would have
+                        // failed validation.
+                        if attrSchema.Required {
+                                // we only set a missing string here, since bool or number types
+                                // would have distinct zero value which shouldn't have been
+                                // lost.
+                                if attrSchema.Type == cty.String {
+                                        result[attr] = ""
+                                }
+                        }
+                }
+                return result, nil
+        }
+
+        // check for missmatched diff values
+        if exists &&
+                old != diff.Old &&
+                old != config.UnknownVariableValue &&
+                diff.Old != config.UnknownVariableValue {
+                return result, fmt.Errorf("diff apply conflict for %s: diff expects %q, but prior value has %q", attr, diff.Old, old)
+        }
+
+        if diff.NewRemoved {
+                // don't set anything in the new value
+                return map[string]string{}, nil
+        }
+
+        if diff.Old == diff.New && diff.New == "" {
+                // this can only be a valid empty string
+                if attrSchema.Type == cty.String {
+                        result[attr] = ""
+                }
+                return result, nil
+        }
+
+        if attrSchema.Computed && diff.NewComputed {
+                result[attr] = config.UnknownVariableValue
+                return result, nil
+        }
+
+        result[attr] = diff.New
+
+        return result, nil
+}
+
+func (d *InstanceDiff) applyCollectionDiff(path []string, attrs map[string]string, attrSchema *configschema.Attribute) (map[string]string, error) {
+        result := map[string]string{}
+
+        prefix := ""
+        if len(path) > 1 {
+                prefix = strings.Join(path[:len(path)-1], ".") + "."
+        }
+
+        name := ""
+        if len(path) > 0 {
+                name = path[len(path)-1]
+        }
+
+        currentKey := prefix + name
+
+        // check the index first for special handling
+        for k, diff := range d.Attributes {
+                // check the index value, which can be set, and 0
+                if k == currentKey+".#" || k == currentKey+".%" || k == currentKey {
+                        if diff.NewRemoved {
+                                return result, nil
+                        }
+
+                        if diff.NewComputed {
+                                result[k[len(prefix):]] = config.UnknownVariableValue
+                                return result, nil
+                        }
+
+                        // do what the diff tells us to here, so that it's consistent with applies
+                        if diff.New == "0" {
+                                result[k[len(prefix):]] = "0"
+                                return result, nil
+                        }
+                }
+        }
+
+        // collect all the keys from the diff and the old state
+        noDiff := true
+        keys := map[string]bool{}
+        for k := range d.Attributes {
+                if !strings.HasPrefix(k, currentKey+".") {
+                        continue
+                }
+                noDiff = false
+                keys[k] = true
+        }
+
+        noAttrs := true
+        for k := range attrs {
+                if !strings.HasPrefix(k, currentKey+".") {
+                        continue
+                }
+                noAttrs = false
+                keys[k] = true
+        }
+
+        // If there's no diff and no attrs, then there's no value at all.
+        // This prevents an unexpected zero-count attribute in the attributes.
+        if noDiff && noAttrs {
+                return result, nil
+        }
+
+        idx := "#"
+        if attrSchema.Type.IsMapType() {
+                idx = "%"
+        }
+
+        for k := range keys {
+                // generate an schema placeholder for the values
+                elSchema := &configschema.Attribute{
+                        Type: attrSchema.Type.ElementType(),
+                }
+
+                res, err := d.applySingleAttrDiff(append(path, k[len(currentKey)+1:]), attrs, elSchema)
+                if err != nil {
+                        return result, err
+                }
+
+                for k, v := range res {
+                        result[name+"."+k] = v
+                }
+        }
+
+        // Just like in nested list blocks, for simple lists we may need to fill in
+        // missing empty strings.
+        countKey := name + "." + idx
+        count := result[countKey]
+        length, _ := strconv.Atoi(count)
+
+        if count != "" && count != hcl2shim.UnknownVariableValue &&
+                attrSchema.Type.Equals(cty.List(cty.String)) {
+                // insert empty strings into missing indexes
+                for i := 0; i < length; i++ {
+                        key := fmt.Sprintf("%s.%d", name, i)
+                        if _, ok := result[key]; !ok {
+                                result[key] = ""
+                        }
+                }
+        }
+
+        // now check for truncation in any type of list
+        if attrSchema.Type.IsListType() {
+                for key := range result {
+                        if key == countKey {
+                                continue
+                        }
+
+                        if len(key) <= len(name)+1 {
+                                // not sure what this is, but don't panic
+                                continue
+                        }
+
+                        index := key[len(name)+1:]
+
+                        // It is possible to have nested sets or maps, so look for another dot
+                        dot := strings.Index(index, ".")
+                        if dot > 0 {
+                                index = index[:dot]
+                        }
+
+                        // This shouldn't have any more dots, since the element type is only string.
+                        num, err := strconv.Atoi(index)
+                        if err != nil {
+                                log.Printf("[ERROR] bad list index in %q: %s", currentKey, err)
+                                continue
+                        }
+
+                        if num >= length {
+                                delete(result, key)
+                        }
+                }
+        }
+
+        // Fill in the count value if it wasn't present in the diff for some reason,
+        // or if there is no count at all.
+        _, countDiff := d.Attributes[countKey]
+        if result[countKey] == "" || (!countDiff && len(keys) != len(result)) {
+                result[countKey] = countFlatmapContainerValues(countKey, result)
+        }
+
+        return result, nil
+}
+
+func (d *InstanceDiff) applySetDiff(path []string, attrs map[string]string, attrSchema *configschema.Attribute) (map[string]string, error) {
+        // We only need this special behavior for sets of object.
+        if !attrSchema.Type.ElementType().IsObjectType() {
+                // The normal collection apply behavior will work okay for this one, then.
+                return d.applyCollectionDiff(path, attrs, attrSchema)
+        }
+
+        // When we're dealing with a set of an object type we actually want to
+        // use our normal _block type_ apply behaviors, so we'll construct ourselves
+        // a synthetic schema that treats the object type as a block type and
+        // then delegate to our block apply method.
+        synthSchema := &configschema.Block{
+                Attributes: make(map[string]*configschema.Attribute),
+        }
+
+        for name, ty := range attrSchema.Type.ElementType().AttributeTypes() {
+                // We can safely make everything into an attribute here because in the
+                // event that there are nested set attributes we'll end up back in
+                // here again recursively and can then deal with the next level of
+                // expansion.
+                synthSchema.Attributes[name] = &configschema.Attribute{
+                        Type:     ty,
+                        Optional: true,
+                }
+        }
+
+        parentPath := path[:len(path)-1]
+        childName := path[len(path)-1]
+        containerSchema := &configschema.Block{
+                BlockTypes: map[string]*configschema.NestedBlock{
+                        childName: {
+                                Nesting: configschema.NestingSet,
+                                Block:   *synthSchema,
+                        },
+                },
+        }
+
+        return d.applyBlockDiff(parentPath, attrs, containerSchema)
+}
+
+// countFlatmapContainerValues returns the number of values in the flatmapped container
+// (set, map, list) indexed by key. The key argument is expected to include the
+// trailing ".#", or ".%".
+func countFlatmapContainerValues(key string, attrs map[string]string) string {
+        if len(key) < 3 || !(strings.HasSuffix(key, ".#") || strings.HasSuffix(key, ".%")) {
+                panic(fmt.Sprintf("invalid index value %q", key))
+        }
+
+        prefix := key[:len(key)-1]
+        items := map[string]int{}
+
+        for k := range attrs {
+                if k == key {
+                        continue
+                }
+                if !strings.HasPrefix(k, prefix) {
+                        continue
+                }
+
+                suffix := k[len(prefix):]
+                dot := strings.Index(suffix, ".")
+                if dot > 0 {
+                        suffix = suffix[:dot]
+                }
+
+                items[suffix]++
+        }
+        return strconv.Itoa(len(items))
+}
+
 // ResourceAttrDiff is the diff of a single attribute of a resource.
 type ResourceAttrDiff struct {
         Old         string      // Old Value
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval.go b/vendor/github.com/hashicorp/terraform/terraform/eval.go
index 10d9c22..48ed353 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval.go
@@ -2,7 +2,8 @@ package terraform
 
 import (
         "log"
-        "strings"
+
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalNode is the interface that must be implemented by graph nodes to
@@ -46,15 +47,21 @@ func Eval(n EvalNode, ctx EvalContext) (interface{}, error) {
 func EvalRaw(n EvalNode, ctx EvalContext) (interface{}, error) {
         path := "unknown"
         if ctx != nil {
-                path = strings.Join(ctx.Path(), ".")
+                path = ctx.Path().String()
+        }
+        if path == "" {
+                path = "<root>"
         }
 
         log.Printf("[TRACE] %s: eval: %T", path, n)
         output, err := n.Eval(ctx)
         if err != nil {
-                if _, ok := err.(EvalEarlyExitError); ok {
-                        log.Printf("[TRACE] %s: eval: %T, err: %s", path, n, err)
-                } else {
+                switch err.(type) {
+                case EvalEarlyExitError:
+                        log.Printf("[TRACE] %s: eval: %T, early exit err: %s", path, n, err)
+                case tfdiags.NonFatalError:
+                        log.Printf("[WARN] %s: eval: %T, non-fatal err: %s", path, n, err)
+                default:
                         log.Printf("[ERROR] %s: eval: %T, err: %s", path, n, err)
                 }
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go b/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go
index b9b4806..09313f7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go
@@ -3,119 +3,316 @@ package terraform
 import (
         "fmt"
         "log"
-        "strconv"
+        "strings"
 
         "github.com/hashicorp/go-multierror"
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/plans/objchange"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalApply is an EvalNode implementation that writes the diff to
 // the full diff.
 type EvalApply struct {
-        Info      *InstanceInfo
-        State     **InstanceState
-        Diff      **InstanceDiff
-        Provider  *ResourceProvider
-        Output    **InstanceState
-        CreateNew *bool
-        Error     *error
+        Addr           addrs.ResourceInstance
+        Config         *configs.Resource
+        Dependencies   []addrs.Referenceable
+        State          **states.ResourceInstanceObject
+        Change         **plans.ResourceInstanceChange
+        ProviderAddr   addrs.AbsProviderConfig
+        Provider       *providers.Interface
+        ProviderSchema **ProviderSchema
+        Output         **states.ResourceInstanceObject
+        CreateNew      *bool
+        Error          *error
 }
 
 // TODO: test
 func (n *EvalApply) Eval(ctx EvalContext) (interface{}, error) {
-        diff := *n.Diff
+        var diags tfdiags.Diagnostics
+
+        change := *n.Change
         provider := *n.Provider
         state := *n.State
+        absAddr := n.Addr.Absolute(ctx.Path())
 
-        // If we have no diff, we have nothing to do!
-        if diff.Empty() {
-                log.Printf(
-                        "[DEBUG] apply: %s: diff is empty, doing nothing.", n.Info.Id)
-                return nil, nil
+        if state == nil {
+                state = &states.ResourceInstanceObject{}
+        }
+
+        schema, _ := (*n.ProviderSchema).SchemaForResourceType(n.Addr.Resource.Mode, n.Addr.Resource.Type)
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support resource type %q", n.Addr.Resource.Type)
+        }
+
+        if n.CreateNew != nil {
+                *n.CreateNew = (change.Action == plans.Create || change.Action.IsReplace())
         }
 
-        // Remove any output values from the diff
-        for k, ad := range diff.CopyAttributes() {
-                if ad.Type == DiffAttrOutput {
-                        diff.DelAttribute(k)
+        configVal := cty.NullVal(cty.DynamicPseudoType)
+        if n.Config != nil {
+                var configDiags tfdiags.Diagnostics
+                keyData := EvalDataForInstanceKey(n.Addr.Key)
+                configVal, _, configDiags = ctx.EvaluateBlock(n.Config.Config, schema, nil, keyData)
+                diags = diags.Append(configDiags)
+                if configDiags.HasErrors() {
+                        return nil, diags.Err()
                 }
         }
 
-        // If the state is nil, make it non-nil
-        if state == nil {
-                state = new(InstanceState)
+        log.Printf("[DEBUG] %s: applying the planned %s change", n.Addr.Absolute(ctx.Path()), change.Action)
+        resp := provider.ApplyResourceChange(providers.ApplyResourceChangeRequest{
+                TypeName:       n.Addr.Resource.Type,
+                PriorState:     change.Before,
+                Config:         configVal,
+                PlannedState:   change.After,
+                PlannedPrivate: change.Private,
+        })
+        applyDiags := resp.Diagnostics
+        if n.Config != nil {
+                applyDiags = applyDiags.InConfigBody(n.Config.Config)
         }
-        state.init()
+        diags = diags.Append(applyDiags)
+
+        // Even if there are errors in the returned diagnostics, the provider may
+        // have returned a _partial_ state for an object that already exists but
+        // failed to fully configure, and so the remaining code must always run
+        // to completion but must be defensive against the new value being
+        // incomplete.
+        newVal := resp.NewState
+
+        if newVal == cty.NilVal {
+                // Providers are supposed to return a partial new value even when errors
+                // occur, but sometimes they don't and so in that case we'll patch that up
+                // by just using the prior state, so we'll at least keep track of the
+                // object for the user to retry.
+                newVal = change.Before
+
+                // As a special case, we'll set the new value to null if it looks like
+                // we were trying to execute a delete, because the provider in this case
+                // probably left the newVal unset intending it to be interpreted as "null".
+                if change.After.IsNull() {
+                        newVal = cty.NullVal(schema.ImpliedType())
+                }
 
-        // Flag if we're creating a new instance
-        if n.CreateNew != nil {
-                *n.CreateNew = state.ID == "" && !diff.GetDestroy() || diff.RequiresNew()
+                // Ideally we'd produce an error or warning here if newVal is nil and
+                // there are no errors in diags, because that indicates a buggy
+                // provider not properly reporting its result, but unfortunately many
+                // of our historical test mocks behave in this way and so producing
+                // a diagnostic here fails hundreds of tests. Instead, we must just
+                // silently retain the old value for now. Returning a nil value with
+                // no errors is still always considered a bug in the provider though,
+                // and should be fixed for any "real" providers that do it.
         }
 
-        // With the completed diff, apply!
-        log.Printf("[DEBUG] apply: %s: executing Apply", n.Info.Id)
-        state, err := provider.Apply(n.Info, state, diff)
-        if state == nil {
-                state = new(InstanceState)
+        var conformDiags tfdiags.Diagnostics
+        for _, err := range newVal.Type().TestConformance(schema.ImpliedType()) {
+                conformDiags = conformDiags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced invalid object",
+                        fmt.Sprintf(
+                                "Provider %q produced an invalid value after apply for %s. The result cannot not be saved in the Terraform state.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatErrorPrefixed(err, absAddr.String()),
+                        ),
+                ))
+        }
+        diags = diags.Append(conformDiags)
+        if conformDiags.HasErrors() {
+                // Bail early in this particular case, because an object that doesn't
+                // conform to the schema can't be saved in the state anyway -- the
+                // serializer will reject it.
+                return nil, diags.Err()
+        }
+
+        // After this point we have a type-conforming result object and so we
+        // must always run to completion to ensure it can be saved. If n.Error
+        // is set then we must not return a non-nil error, in order to allow
+        // evaluation to continue to a later point where our state object will
+        // be saved.
+
+        // By this point there must not be any unknown values remaining in our
+        // object, because we've applied the change and we can't save unknowns
+        // in our persistent state. If any are present then we will indicate an
+        // error (which is always a bug in the provider) but we will also replace
+        // them with nulls so that we can successfully save the portions of the
+        // returned value that are known.
+        if !newVal.IsWhollyKnown() {
+                // To generate better error messages, we'll go for a walk through the
+                // value and make a separate diagnostic for each unknown value we
+                // find.
+                cty.Walk(newVal, func(path cty.Path, val cty.Value) (bool, error) {
+                        if !val.IsKnown() {
+                                pathStr := tfdiags.FormatCtyPath(path)
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Provider returned invalid result object after apply",
+                                        fmt.Sprintf(
+                                                "After the apply operation, the provider still indicated an unknown value for %s%s. All values must be known after apply, so this is always a bug in the provider and should be reported in the provider's own repository. Terraform will still save the other known object values in the state.",
+                                                n.Addr.Absolute(ctx.Path()), pathStr,
+                                        ),
+                                ))
+                        }
+                        return true, nil
+                })
+
+                // NOTE: This operation can potentially be lossy if there are multiple
+                // elements in a set that differ only by unknown values: after
+                // replacing with null these will be merged together into a single set
+                // element. Since we can only get here in the presence of a provider
+                // bug, we accept this because storing a result here is always a
+                // best-effort sort of thing.
+                newVal = cty.UnknownAsNull(newVal)
+        }
+
+        if change.Action != plans.Delete && !diags.HasErrors() {
+                // Only values that were marked as unknown in the planned value are allowed
+                // to change during the apply operation. (We do this after the unknown-ness
+                // check above so that we also catch anything that became unknown after
+                // being known during plan.)
+                //
+                // If we are returning other errors anyway then we'll give this
+                // a pass since the other errors are usually the explanation for
+                // this one and so it's more helpful to let the user focus on the
+                // root cause rather than distract with this extra problem.
+                if errs := objchange.AssertObjectCompatible(schema, change.After, newVal); len(errs) > 0 {
+                        if resp.LegacyTypeSystem {
+                                // The shimming of the old type system in the legacy SDK is not precise
+                                // enough to pass this consistency check, so we'll give it a pass here,
+                                // but we will generate a warning about it so that we are more likely
+                                // to notice in the logs if an inconsistency beyond the type system
+                                // leads to a downstream provider failure.
+                                var buf strings.Builder
+                                fmt.Fprintf(&buf, "[WARN] Provider %q produced an unexpected new value for %s, but we are tolerating it because it is using the legacy plugin SDK.\n    The following problems may be the cause of any confusing errors from downstream operations:", n.ProviderAddr.ProviderConfig.Type, absAddr)
+                                for _, err := range errs {
+                                        fmt.Fprintf(&buf, "\n      - %s", tfdiags.FormatError(err))
+                                }
+                                log.Print(buf.String())
+
+                                // The sort of inconsistency we won't catch here is if a known value
+                                // in the plan is changed during apply. That can cause downstream
+                                // problems because a dependent resource would make its own plan based
+                                // on the planned value, and thus get a different result during the
+                                // apply phase. This will usually lead to a "Provider produced invalid plan"
+                                // error that incorrectly blames the downstream resource for the change.
+
+                        } else {
+                                for _, err := range errs {
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Provider produced inconsistent result after apply",
+                                                fmt.Sprintf(
+                                                        "When applying changes to %s, provider %q produced an unexpected new value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                                        absAddr, n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatError(err),
+                                                ),
+                                        ))
+                                }
+                        }
+                }
+        }
+
+        // If a provider returns a null or non-null object at the wrong time then
+        // we still want to save that but it often causes some confusing behaviors
+        // where it seems like Terraform is failing to take any action at all,
+        // so we'll generate some errors to draw attention to it.
+        if !diags.HasErrors() {
+                if change.Action == plans.Delete && !newVal.IsNull() {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Provider returned invalid result object after apply",
+                                fmt.Sprintf(
+                                        "After applying a %s plan, the provider returned a non-null object for %s. Destroying should always produce a null value, so this is always a bug in the provider and should be reported in the provider's own repository. Terraform will still save this errant object in the state for debugging and recovery.",
+                                        change.Action, n.Addr.Absolute(ctx.Path()),
+                                ),
+                        ))
+                }
+                if change.Action != plans.Delete && newVal.IsNull() {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Provider returned invalid result object after apply",
+                                fmt.Sprintf(
+                                        "After applying a %s plan, the provider returned a null object for %s. Only destroying should always produce a null value, so this is always a bug in the provider and should be reported in the provider's own repository.",
+                                        change.Action, n.Addr.Absolute(ctx.Path()),
+                                ),
+                        ))
+                }
         }
-        state.init()
 
-        // Force the "id" attribute to be our ID
-        if state.ID != "" {
-                state.Attributes["id"] = state.ID
+        // Sometimes providers return a null value when an operation fails for some
+        // reason, but we'd rather keep the prior state so that the error can be
+        // corrected on a subsequent run. We must only do this for null new value
+        // though, or else we may discard partial updates the provider was able to
+        // complete.
+        if diags.HasErrors() && newVal.IsNull() {
+                // Otherwise, we'll continue but using the prior state as the new value,
+                // making this effectively a no-op. If the item really _has_ been
+                // deleted then our next refresh will detect that and fix it up.
+                // If change.Action is Create then change.Before will also be null,
+                // which is fine.
+                newVal = change.Before
         }
 
-        // If the value is the unknown variable value, then it is an error.
-        // In this case we record the error and remove it from the state
-        for ak, av := range state.Attributes {
-                if av == config.UnknownVariableValue {
-                        err = multierror.Append(err, fmt.Errorf(
-                                "Attribute with unknown value: %s", ak))
-                        delete(state.Attributes, ak)
+        var newState *states.ResourceInstanceObject
+        if !newVal.IsNull() { // null value indicates that the object is deleted, so we won't set a new state in that case
+                newState = &states.ResourceInstanceObject{
+                        Status:       states.ObjectReady,
+                        Value:        newVal,
+                        Private:      resp.Private,
+                        Dependencies: n.Dependencies, // Should be populated by the caller from the StateDependencies method on the resource instance node
                 }
         }
 
         // Write the final state
         if n.Output != nil {
-                *n.Output = state
+                *n.Output = newState
         }
 
-        // If there are no errors, then we append it to our output error
-        // if we have one, otherwise we just output it.
-        if err != nil {
+        if diags.HasErrors() {
+                // If the caller provided an error pointer then they are expected to
+                // handle the error some other way and we treat our own result as
+                // success.
                 if n.Error != nil {
-                        helpfulErr := fmt.Errorf("%s: %s", n.Info.Id, err.Error())
-                        *n.Error = multierror.Append(*n.Error, helpfulErr)
-                } else {
-                        return nil, err
+                        err := diags.Err()
+                        *n.Error = err
+                        log.Printf("[DEBUG] %s: apply errored, but we're indicating that via the Error pointer rather than returning it: %s", n.Addr.Absolute(ctx.Path()), err)
+                        return nil, nil
                 }
         }
 
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
 
 // EvalApplyPre is an EvalNode implementation that does the pre-Apply work
 type EvalApplyPre struct {
-        Info  *InstanceInfo
-        State **InstanceState
-        Diff  **InstanceDiff
+        Addr   addrs.ResourceInstance
+        Gen    states.Generation
+        State  **states.ResourceInstanceObject
+        Change **plans.ResourceInstanceChange
 }
 
 // TODO: test
 func (n *EvalApplyPre) Eval(ctx EvalContext) (interface{}, error) {
-        state := *n.State
-        diff := *n.Diff
+        change := *n.Change
+        absAddr := n.Addr.Absolute(ctx.Path())
 
-        // If the state is nil, make it non-nil
-        if state == nil {
-                state = new(InstanceState)
+        if change == nil {
+                panic(fmt.Sprintf("EvalApplyPre for %s called with nil Change", absAddr))
         }
-        state.init()
 
-        if resourceHasUserVisibleApply(n.Info) {
-                // Call post-apply hook
+        if resourceHasUserVisibleApply(n.Addr) {
+                priorState := change.Before
+                plannedNewState := change.After
+
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PreApply(n.Info, state, diff)
+                        return h.PreApply(absAddr, n.Gen, change.Action, priorState, plannedNewState)
                 })
                 if err != nil {
                         return nil, err
@@ -127,8 +324,9 @@ func (n *EvalApplyPre) Eval(ctx EvalContext) (interface{}, error) {
 
 // EvalApplyPost is an EvalNode implementation that does the post-Apply work
 type EvalApplyPost struct {
-        Info  *InstanceInfo
-        State **InstanceState
+        Addr  addrs.ResourceInstance
+        Gen   states.Generation
+        State **states.ResourceInstanceObject
         Error *error
 }
 
@@ -136,33 +334,93 @@ type EvalApplyPost struct {
 func (n *EvalApplyPost) Eval(ctx EvalContext) (interface{}, error) {
         state := *n.State
 
-        if resourceHasUserVisibleApply(n.Info) {
-                // Call post-apply hook
-                err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PostApply(n.Info, state, *n.Error)
+        if resourceHasUserVisibleApply(n.Addr) {
+                absAddr := n.Addr.Absolute(ctx.Path())
+                var newState cty.Value
+                if state != nil {
+                        newState = state.Value
+                } else {
+                        newState = cty.NullVal(cty.DynamicPseudoType)
+                }
+                var err error
+                if n.Error != nil {
+                        err = *n.Error
+                }
+
+                hookErr := ctx.Hook(func(h Hook) (HookAction, error) {
+                        return h.PostApply(absAddr, n.Gen, newState, err)
                 })
-                if err != nil {
-                        return nil, err
+                if hookErr != nil {
+                        return nil, hookErr
                 }
         }
 
         return nil, *n.Error
 }
 
+// EvalMaybeTainted is an EvalNode that takes the planned change, new value,
+// and possible error from an apply operation and produces a new instance
+// object marked as tainted if it appears that a create operation has failed.
+//
+// This EvalNode never returns an error, to ensure that a subsequent EvalNode
+// can still record the possibly-tainted object in the state.
+type EvalMaybeTainted struct {
+        Addr   addrs.ResourceInstance
+        Gen    states.Generation
+        Change **plans.ResourceInstanceChange
+        State  **states.ResourceInstanceObject
+        Error  *error
+
+        // If StateOutput is not nil, its referent will be assigned either the same
+        // pointer as State or a new object with its status set as Tainted,
+        // depending on whether an error is given and if this was a create action.
+        StateOutput **states.ResourceInstanceObject
+}
+
+// TODO: test
+func (n *EvalMaybeTainted) Eval(ctx EvalContext) (interface{}, error) {
+        state := *n.State
+        change := *n.Change
+        err := *n.Error
+
+        if state != nil && state.Status == states.ObjectTainted {
+                log.Printf("[TRACE] EvalMaybeTainted: %s was already tainted, so nothing to do", n.Addr.Absolute(ctx.Path()))
+                return nil, nil
+        }
+
+        if n.StateOutput != nil {
+                if err != nil && change.Action == plans.Create {
+                        // If there are errors during a _create_ then the object is
+                        // in an undefined state, and so we'll mark it as tainted so
+                        // we can try again on the next run.
+                        //
+                        // We don't do this for other change actions because errors
+                        // during updates will often not change the remote object at all.
+                        // If there _were_ changes prior to the error, it's the provider's
+                        // responsibility to record the effect of those changes in the
+                        // object value it returned.
+                        log.Printf("[TRACE] EvalMaybeTainted: %s encountered an error during creation, so it is now marked as tainted", n.Addr.Absolute(ctx.Path()))
+                        *n.StateOutput = state.AsTainted()
+                } else {
+                        *n.StateOutput = state
+                }
+        }
+
+        return nil, nil
+}
+
 // resourceHasUserVisibleApply returns true if the given resource is one where
 // apply actions should be exposed to the user.
 //
 // Certain resources do apply actions only as an implementation detail, so
 // these should not be advertised to code outside of this package.
-func resourceHasUserVisibleApply(info *InstanceInfo) bool {
-        addr := info.ResourceAddress()
-
+func resourceHasUserVisibleApply(addr addrs.ResourceInstance) bool {
         // Only managed resources have user-visible apply actions.
         // In particular, this excludes data resources since we "apply" these
         // only as an implementation detail of removing them from state when
         // they are destroyed. (When reading, they don't get here at all because
         // we present them as "Refresh" actions.)
-        return addr.Mode == config.ManagedResourceMode
+        return addr.ContainingResource().Mode == addrs.ManagedResourceMode
 }
 
 // EvalApplyProvisioners is an EvalNode implementation that executes
@@ -171,23 +429,33 @@ func resourceHasUserVisibleApply(info *InstanceInfo) bool {
 // TODO(mitchellh): This should probably be split up into a more fine-grained
 // ApplyProvisioner (single) that is looped over.
 type EvalApplyProvisioners struct {
-        Info           *InstanceInfo
-        State          **InstanceState
-        Resource       *config.Resource
-        InterpResource *Resource
+        Addr           addrs.ResourceInstance
+        State          **states.ResourceInstanceObject
+        ResourceConfig *configs.Resource
         CreateNew      *bool
         Error          *error
 
         // When is the type of provisioner to run at this point
-        When config.ProvisionerWhen
+        When configs.ProvisionerWhen
 }
 
 // TODO: test
 func (n *EvalApplyProvisioners) Eval(ctx EvalContext) (interface{}, error) {
+        absAddr := n.Addr.Absolute(ctx.Path())
         state := *n.State
-
-        if n.CreateNew != nil && !*n.CreateNew {
+        if state == nil {
+                log.Printf("[TRACE] EvalApplyProvisioners: %s has no state, so skipping provisioners", n.Addr)
+                return nil, nil
+        }
+        if n.When == configs.ProvisionerWhenCreate && n.CreateNew != nil && !*n.CreateNew {
                 // If we're not creating a new resource, then don't run provisioners
+                log.Printf("[TRACE] EvalApplyProvisioners: %s is not freshly-created, so no provisioning is required", n.Addr)
+                return nil, nil
+        }
+        if state.Status == states.ObjectTainted {
+                // No point in provisioning an object that is already tainted, since
+                // it's going to get recreated on the next apply anyway.
+                log.Printf("[TRACE] EvalApplyProvisioners: %s is tainted, so skipping provisioning", n.Addr)
                 return nil, nil
         }
 
@@ -197,14 +465,7 @@ func (n *EvalApplyProvisioners) Eval(ctx EvalContext) (interface{}, error) {
                 return nil, nil
         }
 
-        // taint tells us whether to enable tainting.
-        taint := n.When == config.ProvisionerWhenCreate
-
         if n.Error != nil && *n.Error != nil {
-                if taint {
-                        state.Tainted = true
-                }
-
                 // We're already tainted, so just return out
                 return nil, nil
         }
@@ -212,7 +473,7 @@ func (n *EvalApplyProvisioners) Eval(ctx EvalContext) (interface{}, error) {
         {
                 // Call pre hook
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PreProvisionResource(n.Info, state)
+                        return h.PreProvisionInstance(absAddr, state.Value)
                 })
                 if err != nil {
                         return nil, err
@@ -223,18 +484,19 @@ func (n *EvalApplyProvisioners) Eval(ctx EvalContext) (interface{}, error) {
         // if we have one, otherwise we just output it.
         err := n.apply(ctx, provs)
         if err != nil {
-                if taint {
-                        state.Tainted = true
-                }
-
                 *n.Error = multierror.Append(*n.Error, err)
-                return nil, err
+                if n.Error == nil {
+                        return nil, err
+                } else {
+                        log.Printf("[TRACE] EvalApplyProvisioners: %s provisioning failed, but we will continue anyway at the caller's request", absAddr)
+                        return nil, nil
+                }
         }
 
         {
                 // Call post hook
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PostProvisionResource(n.Info, state)
+                        return h.PostProvisionInstance(absAddr, state.Value)
                 })
                 if err != nil {
                         return nil, err
@@ -246,18 +508,18 @@ func (n *EvalApplyProvisioners) Eval(ctx EvalContext) (interface{}, error) {
 
 // filterProvisioners filters the provisioners on the resource to only
 // the provisioners specified by the "when" option.
-func (n *EvalApplyProvisioners) filterProvisioners() []*config.Provisioner {
+func (n *EvalApplyProvisioners) filterProvisioners() []*configs.Provisioner {
         // Fast path the zero case
-        if n.Resource == nil {
+        if n.ResourceConfig == nil || n.ResourceConfig.Managed == nil {
                 return nil
         }
 
-        if len(n.Resource.Provisioners) == 0 {
+        if len(n.ResourceConfig.Managed.Provisioners) == 0 {
                 return nil
         }
 
-        result := make([]*config.Provisioner, 0, len(n.Resource.Provisioners))
-        for _, p := range n.Resource.Provisioners {
+        result := make([]*configs.Provisioner, 0, len(n.ResourceConfig.Managed.Provisioners))
+        for _, p := range n.ResourceConfig.Managed.Provisioners {
                 if p.When == n.When {
                         result = append(result, p)
                 }
@@ -266,64 +528,71 @@ func (n *EvalApplyProvisioners) filterProvisioners() []*config.Provisioner {
         return result
 }
 
-func (n *EvalApplyProvisioners) apply(ctx EvalContext, provs []*config.Provisioner) error {
-        state := *n.State
-
-        // Store the original connection info, restore later
-        origConnInfo := state.Ephemeral.ConnInfo
-        defer func() {
-                state.Ephemeral.ConnInfo = origConnInfo
-        }()
+func (n *EvalApplyProvisioners) apply(ctx EvalContext, provs []*configs.Provisioner) error {
+        var diags tfdiags.Diagnostics
+        instanceAddr := n.Addr
+        absAddr := instanceAddr.Absolute(ctx.Path())
+
+        // If there's a connection block defined directly inside the resource block
+        // then it'll serve as a base connection configuration for all of the
+        // provisioners.
+        var baseConn hcl.Body
+        if n.ResourceConfig.Managed != nil && n.ResourceConfig.Managed.Connection != nil {
+                baseConn = n.ResourceConfig.Managed.Connection.Config
+        }
 
         for _, prov := range provs {
+                log.Printf("[TRACE] EvalApplyProvisioners: provisioning %s with %q", absAddr, prov.Type)
+
                 // Get the provisioner
                 provisioner := ctx.Provisioner(prov.Type)
+                schema := ctx.ProvisionerSchema(prov.Type)
 
-                // Interpolate the provisioner config
-                provConfig, err := ctx.Interpolate(prov.RawConfig.Copy(), n.InterpResource)
-                if err != nil {
-                        return err
-                }
+                keyData := EvalDataForInstanceKey(instanceAddr.Key)
 
-                // Interpolate the conn info, since it may contain variables
-                connInfo, err := ctx.Interpolate(prov.ConnInfo.Copy(), n.InterpResource)
-                if err != nil {
-                        return err
+                // Evaluate the main provisioner configuration.
+                config, _, configDiags := ctx.EvaluateBlock(prov.Config, schema, instanceAddr, keyData)
+                diags = diags.Append(configDiags)
+
+                // If the provisioner block contains a connection block of its own then
+                // it can override the base connection configuration, if any.
+                var localConn hcl.Body
+                if prov.Connection != nil {
+                        localConn = prov.Connection.Config
                 }
 
-                // Merge the connection information
-                overlay := make(map[string]string)
-                if origConnInfo != nil {
-                        for k, v := range origConnInfo {
-                                overlay[k] = v
-                        }
+                var connBody hcl.Body
+                switch {
+                case baseConn != nil && localConn != nil:
+                        // Our standard merging logic applies here, similar to what we do
+                        // with _override.tf configuration files: arguments from the
+                        // base connection block will be masked by any arguments of the
+                        // same name in the local connection block.
+                        connBody = configs.MergeBodies(baseConn, localConn)
+                case baseConn != nil:
+                        connBody = baseConn
+                case localConn != nil:
+                        connBody = localConn
                 }
-                for k, v := range connInfo.Config {
-                        switch vt := v.(type) {
-                        case string:
-                                overlay[k] = vt
-                        case int64:
-                                overlay[k] = strconv.FormatInt(vt, 10)
-                        case int32:
-                                overlay[k] = strconv.FormatInt(int64(vt), 10)
-                        case int:
-                                overlay[k] = strconv.FormatInt(int64(vt), 10)
-                        case float32:
-                                overlay[k] = strconv.FormatFloat(float64(vt), 'f', 3, 32)
-                        case float64:
-                                overlay[k] = strconv.FormatFloat(vt, 'f', 3, 64)
-                        case bool:
-                                overlay[k] = strconv.FormatBool(vt)
-                        default:
-                                overlay[k] = fmt.Sprintf("%v", vt)
+
+                // start with an empty connInfo
+                connInfo := cty.NullVal(connectionBlockSupersetSchema.ImpliedType())
+
+                if connBody != nil {
+                        var connInfoDiags tfdiags.Diagnostics
+                        connInfo, _, connInfoDiags = ctx.EvaluateBlock(connBody, connectionBlockSupersetSchema, instanceAddr, keyData)
+                        diags = diags.Append(connInfoDiags)
+                        if diags.HasErrors() {
+                                // "on failure continue" setting only applies to failures of the
+                                // provisioner itself, not to invalid configuration.
+                                return diags.Err()
                         }
                 }
-                state.Ephemeral.ConnInfo = overlay
 
                 {
                         // Call pre hook
                         err := ctx.Hook(func(h Hook) (HookAction, error) {
-                                return h.PreProvision(n.Info, prov.Type)
+                                return h.PreProvisionInstanceStep(absAddr, prov.Type)
                         })
                         if err != nil {
                                 return err
@@ -333,31 +602,37 @@ func (n *EvalApplyProvisioners) apply(ctx EvalContext, provs []*config.Provision
                 // The output function
                 outputFn := func(msg string) {
                         ctx.Hook(func(h Hook) (HookAction, error) {
-                                h.ProvisionOutput(n.Info, prov.Type, msg)
+                                h.ProvisionOutput(absAddr, prov.Type, msg)
                                 return HookActionContinue, nil
                         })
                 }
 
-                // Invoke the Provisioner
                 output := CallbackUIOutput{OutputFn: outputFn}
-                applyErr := provisioner.Apply(&output, state, provConfig)
+                resp := provisioner.ProvisionResource(provisioners.ProvisionResourceRequest{
+                        Config:     config,
+                        Connection: connInfo,
+                        UIOutput:   &output,
+                })
+                applyDiags := resp.Diagnostics.InConfigBody(prov.Config)
 
                 // Call post hook
                 hookErr := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PostProvision(n.Info, prov.Type, applyErr)
+                        return h.PostProvisionInstanceStep(absAddr, prov.Type, applyDiags.Err())
                 })
 
-                // Handle the error before we deal with the hook
-                if applyErr != nil {
-                        // Determine failure behavior
-                        switch prov.OnFailure {
-                        case config.ProvisionerOnFailureContinue:
-                                log.Printf(
-                                        "[INFO] apply: %s [%s]: error during provision, continue requested",
-                                        n.Info.Id, prov.Type)
-
-                        case config.ProvisionerOnFailureFail:
-                                return applyErr
+                switch prov.OnFailure {
+                case configs.ProvisionerOnFailureContinue:
+                        if applyDiags.HasErrors() {
+                                log.Printf("[WARN] Errors while provisioning %s with %q, but continuing as requested in configuration", n.Addr, prov.Type)
+                        } else {
+                                // Maybe there are warnings that we still want to see
+                                diags = diags.Append(applyDiags)
+                        }
+                default:
+                        diags = diags.Append(applyDiags)
+                        if applyDiags.HasErrors() {
+                                log.Printf("[WARN] Errors while provisioning %s with %q, so aborting", n.Addr, prov.Type)
+                                return diags.Err()
                         }
                 }
 
@@ -367,6 +642,5 @@ func (n *EvalApplyProvisioners) apply(ctx EvalContext, provs []*config.Provision
                 }
         }
 
-        return nil
-
+        return diags.ErrWithWarnings()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_check_prevent_destroy.go b/vendor/github.com/hashicorp/terraform/terraform/eval_check_prevent_destroy.go
index 715e79e..4dff0c8 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_check_prevent_destroy.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_check_prevent_destroy.go
@@ -3,33 +3,44 @@ package terraform
 import (
         "fmt"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/plans"
+
+        "github.com/hashicorp/hcl2/hcl"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalPreventDestroy is an EvalNode implementation that returns an
 // error if a resource has PreventDestroy configured and the diff
 // would destroy the resource.
 type EvalCheckPreventDestroy struct {
-        Resource   *config.Resource
-        ResourceId string
-        Diff       **InstanceDiff
+        Addr   addrs.ResourceInstance
+        Config *configs.Resource
+        Change **plans.ResourceInstanceChange
 }
 
 func (n *EvalCheckPreventDestroy) Eval(ctx EvalContext) (interface{}, error) {
-        if n.Diff == nil || *n.Diff == nil || n.Resource == nil {
+        if n.Change == nil || *n.Change == nil || n.Config == nil || n.Config.Managed == nil {
                 return nil, nil
         }
 
-        diff := *n.Diff
-        preventDestroy := n.Resource.Lifecycle.PreventDestroy
-
-        if diff.GetDestroy() && preventDestroy {
-                resourceId := n.ResourceId
-                if resourceId == "" {
-                        resourceId = n.Resource.Id()
-                }
-
-                return nil, fmt.Errorf(preventDestroyErrStr, resourceId)
+        change := *n.Change
+        preventDestroy := n.Config.Managed.PreventDestroy
+
+        if (change.Action == plans.Delete || change.Action.IsReplace()) && preventDestroy {
+                var diags tfdiags.Diagnostics
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Instance cannot be destroyed",
+                        Detail: fmt.Sprintf(
+                                "Resource %s has lifecycle.prevent_destroy set, but the plan calls for this resource to be destroyed. To avoid this error and continue with the plan, either disable lifecycle.prevent_destroy or reduce the scope of the plan using the -target flag.",
+                                n.Addr.Absolute(ctx.Path()).String(),
+                        ),
+                        Subject: &n.Config.DeclRange,
+                })
+                return nil, diags.Err()
         }
 
         return nil, nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_context.go b/vendor/github.com/hashicorp/terraform/terraform/eval_context.go
index 86481de..08f3059 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_context.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_context.go
@@ -1,9 +1,16 @@
 package terraform
 
 import (
-        "sync"
-
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // EvalContext is the interface that is given to eval nodes to execute.
@@ -13,7 +20,7 @@ type EvalContext interface {
         Stopped() <-chan struct{}
 
         // Path is the current module path.
-        Path() []string
+        Path() addrs.ModuleInstance
 
         // Hook is used to call hook methods. The callback is called for each
         // hook and should return the hook action to take and the error.
@@ -22,68 +29,105 @@ type EvalContext interface {
         // Input is the UIInput object for interacting with the UI.
         Input() UIInput
 
-        // InitProvider initializes the provider with the given type and name, and
+        // InitProvider initializes the provider with the given type and address, and
         // returns the implementation of the resource provider or an error.
         //
         // It is an error to initialize the same provider more than once.
-        InitProvider(typ string, name string) (ResourceProvider, error)
+        InitProvider(typ string, addr addrs.ProviderConfig) (providers.Interface, error)
 
-        // Provider gets the provider instance with the given name (already
+        // Provider gets the provider instance with the given address (already
         // initialized) or returns nil if the provider isn't initialized.
-        Provider(string) ResourceProvider
+        //
+        // This method expects an _absolute_ provider configuration address, since
+        // resources in one module are able to use providers from other modules.
+        // InitProvider must've been called on the EvalContext of the module
+        // that owns the given provider before calling this method.
+        Provider(addrs.AbsProviderConfig) providers.Interface
+
+        // ProviderSchema retrieves the schema for a particular provider, which
+        // must have already been initialized with InitProvider.
+        //
+        // This method expects an _absolute_ provider configuration address, since
+        // resources in one module are able to use providers from other modules.
+        ProviderSchema(addrs.AbsProviderConfig) *ProviderSchema
 
         // CloseProvider closes provider connections that aren't needed anymore.
-        CloseProvider(string) error
+        CloseProvider(addrs.ProviderConfig) error
 
         // ConfigureProvider configures the provider with the given
         // configuration. This is a separate context call because this call
         // is used to store the provider configuration for inheritance lookups
         // with ParentProviderConfig().
-        ConfigureProvider(string, *ResourceConfig) error
+        ConfigureProvider(addrs.ProviderConfig, cty.Value) tfdiags.Diagnostics
 
         // ProviderInput and SetProviderInput are used to configure providers
         // from user input.
-        ProviderInput(string) map[string]interface{}
-        SetProviderInput(string, map[string]interface{})
+        ProviderInput(addrs.ProviderConfig) map[string]cty.Value
+        SetProviderInput(addrs.ProviderConfig, map[string]cty.Value)
 
         // InitProvisioner initializes the provisioner with the given name and
         // returns the implementation of the resource provisioner or an error.
         //
         // It is an error to initialize the same provisioner more than once.
-        InitProvisioner(string) (ResourceProvisioner, error)
+        InitProvisioner(string) (provisioners.Interface, error)
 
         // Provisioner gets the provisioner instance with the given name (already
         // initialized) or returns nil if the provisioner isn't initialized.
-        Provisioner(string) ResourceProvisioner
+        Provisioner(string) provisioners.Interface
+
+        // ProvisionerSchema retrieves the main configuration schema for a
+        // particular provisioner, which must have already been initialized with
+        // InitProvisioner.
+        ProvisionerSchema(string) *configschema.Block
 
         // CloseProvisioner closes provisioner connections that aren't needed
         // anymore.
         CloseProvisioner(string) error
 
-        // Interpolate takes the given raw configuration and completes
-        // the interpolations, returning the processed ResourceConfig.
+        // EvaluateBlock takes the given raw configuration block and associated
+        // schema and evaluates it to produce a value of an object type that
+        // conforms to the implied type of the schema.
+        //
+        // The "self" argument is optional. If given, it is the referenceable
+        // address that the name "self" should behave as an alias for when
+        // evaluating. Set this to nil if the "self" object should not be available.
+        //
+        // The "key" argument is also optional. If given, it is the instance key
+        // of the current object within the multi-instance container it belongs
+        // to. For example, on a resource block with "count" set this should be
+        // set to a different addrs.IntKey for each instance created from that
+        // block. Set this to addrs.NoKey if not appropriate.
+        //
+        // The returned body is an expanded version of the given body, with any
+        // "dynamic" blocks replaced with zero or more static blocks. This can be
+        // used to extract correct source location information about attributes of
+        // the returned object value.
+        EvaluateBlock(body hcl.Body, schema *configschema.Block, self addrs.Referenceable, keyData InstanceKeyEvalData) (cty.Value, hcl.Body, tfdiags.Diagnostics)
+
+        // EvaluateExpr takes the given HCL expression and evaluates it to produce
+        // a value.
+        //
+        // The "self" argument is optional. If given, it is the referenceable
+        // address that the name "self" should behave as an alias for when
+        // evaluating. Set this to nil if the "self" object should not be available.
+        EvaluateExpr(expr hcl.Expression, wantType cty.Type, self addrs.Referenceable) (cty.Value, tfdiags.Diagnostics)
+
+        // EvaluationScope returns a scope that can be used to evaluate reference
+        // addresses in this context.
+        EvaluationScope(self addrs.Referenceable, keyData InstanceKeyEvalData) *lang.Scope
+
+        // SetModuleCallArguments defines values for the variables of a particular
+        // child module call.
         //
-        // The resource argument is optional. If given, it is the resource
-        // that is currently being acted upon.
-        Interpolate(*config.RawConfig, *Resource) (*ResourceConfig, error)
-
-        // InterpolateProvider takes a ProviderConfig and interpolates it with the
-        // stored interpolation scope. Since provider configurations can be
-        // inherited, the interpolation scope may be different from the current
-        // context path. Interplation is otherwise executed the same as in the
-        // Interpolation method.
-        InterpolateProvider(*config.ProviderConfig, *Resource) (*ResourceConfig, error)
-
-        // SetVariables sets the variables for the module within
-        // this context with the name n. This function call is additive:
-        // the second parameter is merged with any previous call.
-        SetVariables(string, map[string]interface{})
-
-        // Diff returns the global diff as well as the lock that should
-        // be used to modify that diff.
-        Diff() (*Diff, *sync.RWMutex)
-
-        // State returns the global state as well as the lock that should
-        // be used to modify that state.
-        State() (*State, *sync.RWMutex)
+        // Calling this function multiple times has merging behavior, keeping any
+        // previously-set keys that are not present in the new map.
+        SetModuleCallArguments(addrs.ModuleCallInstance, map[string]cty.Value)
+
+        // Changes returns the writer object that can be used to write new proposed
+        // changes into the global changes set.
+        Changes() *plans.ChangesSync
+
+        // State returns a wrapper object that provides safe concurrent access to
+        // the global state.
+        State() *states.SyncState
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_context_builtin.go b/vendor/github.com/hashicorp/terraform/terraform/eval_context_builtin.go
index 1b6ee5a..20b3793 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_context_builtin.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_context_builtin.go
@@ -6,7 +6,20 @@ import (
         "log"
         "sync"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/version"
+
+        "github.com/hashicorp/terraform/states"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/tfdiags"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // BuiltinEvalContext is an EvalContext implementation that is used by
@@ -16,35 +29,47 @@ type BuiltinEvalContext struct {
         StopContext context.Context
 
         // PathValue is the Path that this context is operating within.
-        PathValue []string
+        PathValue addrs.ModuleInstance
 
-        // Interpolater setting below affect the interpolation of variables.
+        // Evaluator is used for evaluating expressions within the scope of this
+        // eval context.
+        Evaluator *Evaluator
+
+        // Schemas is a repository of all of the schemas we should need to
+        // decode configuration blocks and expressions. This must be constructed by
+        // the caller to include schemas for all of the providers, resource types,
+        // data sources and provisioners used by the given configuration and
+        // state.
         //
-        // The InterpolaterVars are the exact value for ${var.foo} values.
-        // The map is shared between all contexts and is a mapping of
-        // PATH to KEY to VALUE. Because it is shared by all contexts as well
-        // as the Interpolater itself, it is protected by InterpolaterVarLock
-        // which must be locked during any access to the map.
-        Interpolater        *Interpolater
-        InterpolaterVars    map[string]map[string]interface{}
-        InterpolaterVarLock *sync.Mutex
+        // This must not be mutated during evaluation.
+        Schemas *Schemas
+
+        // VariableValues contains the variable values across all modules. This
+        // structure is shared across the entire containing context, and so it
+        // may be accessed only when holding VariableValuesLock.
+        // The keys of the first level of VariableValues are the string
+        // representations of addrs.ModuleInstance values. The second-level keys
+        // are variable names within each module instance.
+        VariableValues     map[string]map[string]cty.Value
+        VariableValuesLock *sync.Mutex
 
         Components          contextComponentFactory
         Hooks               []Hook
         InputValue          UIInput
-        ProviderCache       map[string]ResourceProvider
-        ProviderInputConfig map[string]map[string]interface{}
+        ProviderCache       map[string]providers.Interface
+        ProviderInputConfig map[string]map[string]cty.Value
         ProviderLock        *sync.Mutex
-        ProvisionerCache    map[string]ResourceProvisioner
+        ProvisionerCache    map[string]provisioners.Interface
         ProvisionerLock     *sync.Mutex
-        DiffValue           *Diff
-        DiffLock            *sync.RWMutex
-        StateValue          *State
-        StateLock           *sync.RWMutex
+        ChangesValue        *plans.ChangesSync
+        StateValue          *states.SyncState
 
         once sync.Once
 }
 
+// BuiltinEvalContext implements EvalContext
+var _ EvalContext = (*BuiltinEvalContext)(nil)
+
 func (ctx *BuiltinEvalContext) Stopped() <-chan struct{} {
         // This can happen during tests. During tests, we just block forever.
         if ctx.StopContext == nil {
@@ -78,12 +103,13 @@ func (ctx *BuiltinEvalContext) Input() UIInput {
         return ctx.InputValue
 }
 
-func (ctx *BuiltinEvalContext) InitProvider(typeName, name string) (ResourceProvider, error) {
+func (ctx *BuiltinEvalContext) InitProvider(typeName string, addr addrs.ProviderConfig) (providers.Interface, error) {
         ctx.once.Do(ctx.init)
+        absAddr := addr.Absolute(ctx.Path())
 
         // If we already initialized, it is an error
-        if p := ctx.Provider(name); p != nil {
-                return nil, fmt.Errorf("Provider '%s' already initialized", name)
+        if p := ctx.Provider(absAddr); p != nil {
+                return nil, fmt.Errorf("%s is already initialized", addr)
         }
 
         // Warning: make sure to acquire these locks AFTER the call to Provider
@@ -91,85 +117,102 @@ func (ctx *BuiltinEvalContext) InitProvider(typeName, name string) (ResourceProv
         ctx.ProviderLock.Lock()
         defer ctx.ProviderLock.Unlock()
 
-        p, err := ctx.Components.ResourceProvider(typeName, name)
+        key := absAddr.String()
+
+        p, err := ctx.Components.ResourceProvider(typeName, key)
         if err != nil {
                 return nil, err
         }
 
-        ctx.ProviderCache[name] = p
+        log.Printf("[TRACE] BuiltinEvalContext: Initialized %q provider for %s", typeName, absAddr)
+        ctx.ProviderCache[key] = p
+
         return p, nil
 }
 
-func (ctx *BuiltinEvalContext) Provider(n string) ResourceProvider {
+func (ctx *BuiltinEvalContext) Provider(addr addrs.AbsProviderConfig) providers.Interface {
         ctx.once.Do(ctx.init)
 
         ctx.ProviderLock.Lock()
         defer ctx.ProviderLock.Unlock()
 
-        return ctx.ProviderCache[n]
+        return ctx.ProviderCache[addr.String()]
+}
+
+func (ctx *BuiltinEvalContext) ProviderSchema(addr addrs.AbsProviderConfig) *ProviderSchema {
+        ctx.once.Do(ctx.init)
+
+        return ctx.Schemas.ProviderSchema(addr.ProviderConfig.Type)
 }
 
-func (ctx *BuiltinEvalContext) CloseProvider(n string) error {
+func (ctx *BuiltinEvalContext) CloseProvider(addr addrs.ProviderConfig) error {
         ctx.once.Do(ctx.init)
 
         ctx.ProviderLock.Lock()
         defer ctx.ProviderLock.Unlock()
 
-        var provider interface{}
-        provider = ctx.ProviderCache[n]
+        key := addr.Absolute(ctx.Path()).String()
+        provider := ctx.ProviderCache[key]
         if provider != nil {
-                if p, ok := provider.(ResourceProviderCloser); ok {
-                        delete(ctx.ProviderCache, n)
-                        return p.Close()
-                }
+                delete(ctx.ProviderCache, key)
+                return provider.Close()
         }
 
         return nil
 }
 
-func (ctx *BuiltinEvalContext) ConfigureProvider(
-        n string, cfg *ResourceConfig) error {
-        p := ctx.Provider(n)
+func (ctx *BuiltinEvalContext) ConfigureProvider(addr addrs.ProviderConfig, cfg cty.Value) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+        absAddr := addr.Absolute(ctx.Path())
+        p := ctx.Provider(absAddr)
         if p == nil {
-                return fmt.Errorf("Provider '%s' not initialized", n)
+                diags = diags.Append(fmt.Errorf("%s not initialized", addr))
+                return diags
         }
-        return p.Configure(cfg)
+
+        providerSchema := ctx.ProviderSchema(absAddr)
+        if providerSchema == nil {
+                diags = diags.Append(fmt.Errorf("schema for %s is not available", absAddr))
+                return diags
+        }
+
+        req := providers.ConfigureRequest{
+                TerraformVersion: version.String(),
+                Config:           cfg,
+        }
+
+        resp := p.Configure(req)
+        return resp.Diagnostics
 }
 
-func (ctx *BuiltinEvalContext) ProviderInput(n string) map[string]interface{} {
+func (ctx *BuiltinEvalContext) ProviderInput(pc addrs.ProviderConfig) map[string]cty.Value {
         ctx.ProviderLock.Lock()
         defer ctx.ProviderLock.Unlock()
 
-        // Make a copy of the path so we can safely edit it
-        path := ctx.Path()
-        pathCopy := make([]string, len(path)+1)
-        copy(pathCopy, path)
-
-        // Go up the tree.
-        for i := len(path) - 1; i >= 0; i-- {
-                pathCopy[i+1] = n
-                k := PathCacheKey(pathCopy[:i+2])
-                if v, ok := ctx.ProviderInputConfig[k]; ok {
-                        return v
-                }
+        if !ctx.Path().IsRoot() {
+                // Only root module provider configurations can have input.
+                return nil
         }
 
-        return nil
+        return ctx.ProviderInputConfig[pc.String()]
 }
 
-func (ctx *BuiltinEvalContext) SetProviderInput(n string, c map[string]interface{}) {
-        providerPath := make([]string, len(ctx.Path())+1)
-        copy(providerPath, ctx.Path())
-        providerPath[len(providerPath)-1] = n
+func (ctx *BuiltinEvalContext) SetProviderInput(pc addrs.ProviderConfig, c map[string]cty.Value) {
+        absProvider := pc.Absolute(ctx.Path())
+
+        if !ctx.Path().IsRoot() {
+                // Only root module provider configurations can have input.
+                log.Printf("[WARN] BuiltinEvalContext: attempt to SetProviderInput for non-root module")
+                return
+        }
 
         // Save the configuration
         ctx.ProviderLock.Lock()
-        ctx.ProviderInputConfig[PathCacheKey(providerPath)] = c
+        ctx.ProviderInputConfig[absProvider.String()] = c
         ctx.ProviderLock.Unlock()
 }
 
-func (ctx *BuiltinEvalContext) InitProvisioner(
-        n string) (ResourceProvisioner, error) {
+func (ctx *BuiltinEvalContext) InitProvisioner(n string) (provisioners.Interface, error) {
         ctx.once.Do(ctx.init)
 
         // If we already initialized, it is an error
@@ -182,10 +225,7 @@ func (ctx *BuiltinEvalContext) InitProvisioner(
         ctx.ProvisionerLock.Lock()
         defer ctx.ProvisionerLock.Unlock()
 
-        provPath := make([]string, len(ctx.Path())+1)
-        copy(provPath, ctx.Path())
-        provPath[len(provPath)-1] = n
-        key := PathCacheKey(provPath)
+        key := PathObjectCacheKey(ctx.Path(), n)
 
         p, err := ctx.Components.ResourceProvisioner(n, key)
         if err != nil {
@@ -193,20 +233,24 @@ func (ctx *BuiltinEvalContext) InitProvisioner(
         }
 
         ctx.ProvisionerCache[key] = p
+
         return p, nil
 }
 
-func (ctx *BuiltinEvalContext) Provisioner(n string) ResourceProvisioner {
+func (ctx *BuiltinEvalContext) Provisioner(n string) provisioners.Interface {
         ctx.once.Do(ctx.init)
 
         ctx.ProvisionerLock.Lock()
         defer ctx.ProvisionerLock.Unlock()
 
-        provPath := make([]string, len(ctx.Path())+1)
-        copy(provPath, ctx.Path())
-        provPath[len(provPath)-1] = n
+        key := PathObjectCacheKey(ctx.Path(), n)
+        return ctx.ProvisionerCache[key]
+}
+
+func (ctx *BuiltinEvalContext) ProvisionerSchema(n string) *configschema.Block {
+        ctx.once.Do(ctx.init)
 
-        return ctx.ProvisionerCache[PathCacheKey(provPath)]
+        return ctx.Schemas.ProvisionerConfig(n)
 }
 
 func (ctx *BuiltinEvalContext) CloseProvisioner(n string) error {
@@ -215,106 +259,70 @@ func (ctx *BuiltinEvalContext) CloseProvisioner(n string) error {
         ctx.ProvisionerLock.Lock()
         defer ctx.ProvisionerLock.Unlock()
 
-        provPath := make([]string, len(ctx.Path())+1)
-        copy(provPath, ctx.Path())
-        provPath[len(provPath)-1] = n
+        key := PathObjectCacheKey(ctx.Path(), n)
 
-        var prov interface{}
-        prov = ctx.ProvisionerCache[PathCacheKey(provPath)]
+        prov := ctx.ProvisionerCache[key]
         if prov != nil {
-                if p, ok := prov.(ResourceProvisionerCloser); ok {
-                        delete(ctx.ProvisionerCache, PathCacheKey(provPath))
-                        return p.Close()
-                }
+                return prov.Close()
         }
 
         return nil
 }
 
-func (ctx *BuiltinEvalContext) Interpolate(
-        cfg *config.RawConfig, r *Resource) (*ResourceConfig, error) {
-
-        if cfg != nil {
-                scope := &InterpolationScope{
-                        Path:     ctx.Path(),
-                        Resource: r,
-                }
-
-                vs, err := ctx.Interpolater.Values(scope, cfg.Variables)
-                if err != nil {
-                        return nil, err
-                }
-
-                // Do the interpolation
-                if err := cfg.Interpolate(vs); err != nil {
-                        return nil, err
-                }
-        }
-
-        result := NewResourceConfig(cfg)
-        result.interpolateForce()
-        return result, nil
+func (ctx *BuiltinEvalContext) EvaluateBlock(body hcl.Body, schema *configschema.Block, self addrs.Referenceable, keyData InstanceKeyEvalData) (cty.Value, hcl.Body, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        scope := ctx.EvaluationScope(self, keyData)
+        body, evalDiags := scope.ExpandBlock(body, schema)
+        diags = diags.Append(evalDiags)
+        val, evalDiags := scope.EvalBlock(body, schema)
+        diags = diags.Append(evalDiags)
+        return val, body, diags
 }
 
-func (ctx *BuiltinEvalContext) InterpolateProvider(
-        pc *config.ProviderConfig, r *Resource) (*ResourceConfig, error) {
-
-        var cfg *config.RawConfig
-
-        if pc != nil && pc.RawConfig != nil {
-                scope := &InterpolationScope{
-                        Path:     ctx.Path(),
-                        Resource: r,
-                }
-
-                cfg = pc.RawConfig
-
-                vs, err := ctx.Interpolater.Values(scope, cfg.Variables)
-                if err != nil {
-                        return nil, err
-                }
+func (ctx *BuiltinEvalContext) EvaluateExpr(expr hcl.Expression, wantType cty.Type, self addrs.Referenceable) (cty.Value, tfdiags.Diagnostics) {
+        scope := ctx.EvaluationScope(self, EvalDataForNoInstanceKey)
+        return scope.EvalExpr(expr, wantType)
+}
 
-                // Do the interpolation
-                if err := cfg.Interpolate(vs); err != nil {
-                        return nil, err
-                }
+func (ctx *BuiltinEvalContext) EvaluationScope(self addrs.Referenceable, keyData InstanceKeyEvalData) *lang.Scope {
+        data := &evaluationStateData{
+                Evaluator:       ctx.Evaluator,
+                ModulePath:      ctx.PathValue,
+                InstanceKeyData: keyData,
+                Operation:       ctx.Evaluator.Operation,
         }
-
-        result := NewResourceConfig(cfg)
-        result.interpolateForce()
-        return result, nil
+        return ctx.Evaluator.Scope(data, self)
 }
 
-func (ctx *BuiltinEvalContext) Path() []string {
+func (ctx *BuiltinEvalContext) Path() addrs.ModuleInstance {
         return ctx.PathValue
 }
 
-func (ctx *BuiltinEvalContext) SetVariables(n string, vs map[string]interface{}) {
-        ctx.InterpolaterVarLock.Lock()
-        defer ctx.InterpolaterVarLock.Unlock()
+func (ctx *BuiltinEvalContext) SetModuleCallArguments(n addrs.ModuleCallInstance, vals map[string]cty.Value) {
+        ctx.VariableValuesLock.Lock()
+        defer ctx.VariableValuesLock.Unlock()
 
-        path := make([]string, len(ctx.Path())+1)
-        copy(path, ctx.Path())
-        path[len(path)-1] = n
-        key := PathCacheKey(path)
+        childPath := n.ModuleInstance(ctx.PathValue)
+        key := childPath.String()
 
-        vars := ctx.InterpolaterVars[key]
-        if vars == nil {
-                vars = make(map[string]interface{})
-                ctx.InterpolaterVars[key] = vars
+        args := ctx.VariableValues[key]
+        if args == nil {
+                args = make(map[string]cty.Value)
+                ctx.VariableValues[key] = vals
+                return
         }
 
-        for k, v := range vs {
-                vars[k] = v
+        for k, v := range vals {
+                args[k] = v
         }
 }
 
-func (ctx *BuiltinEvalContext) Diff() (*Diff, *sync.RWMutex) {
-        return ctx.DiffValue, ctx.DiffLock
+func (ctx *BuiltinEvalContext) Changes() *plans.ChangesSync {
+        return ctx.ChangesValue
 }
 
-func (ctx *BuiltinEvalContext) State() (*State, *sync.RWMutex) {
-        return ctx.StateValue, ctx.StateLock
+func (ctx *BuiltinEvalContext) State() *states.SyncState {
+        return ctx.StateValue
 }
 
 func (ctx *BuiltinEvalContext) init() {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_context_mock.go b/vendor/github.com/hashicorp/terraform/terraform/eval_context_mock.go
index 6464517..195ecc5 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_context_mock.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_context_mock.go
@@ -1,9 +1,20 @@
 package terraform
 
 import (
-        "sync"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
 
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // MockEvalContext is a mock version of EvalContext that can be used
@@ -20,43 +31,84 @@ type MockEvalContext struct {
         InputInput  UIInput
 
         InitProviderCalled   bool
-        InitProviderName     string
-        InitProviderProvider ResourceProvider
+        InitProviderType     string
+        InitProviderAddr     addrs.ProviderConfig
+        InitProviderProvider providers.Interface
         InitProviderError    error
 
         ProviderCalled   bool
-        ProviderName     string
-        ProviderProvider ResourceProvider
+        ProviderAddr     addrs.AbsProviderConfig
+        ProviderProvider providers.Interface
+
+        ProviderSchemaCalled bool
+        ProviderSchemaAddr   addrs.AbsProviderConfig
+        ProviderSchemaSchema *ProviderSchema
 
         CloseProviderCalled   bool
-        CloseProviderName     string
-        CloseProviderProvider ResourceProvider
+        CloseProviderAddr     addrs.ProviderConfig
+        CloseProviderProvider providers.Interface
 
         ProviderInputCalled bool
-        ProviderInputName   string
-        ProviderInputConfig map[string]interface{}
+        ProviderInputAddr   addrs.ProviderConfig
+        ProviderInputValues map[string]cty.Value
 
         SetProviderInputCalled bool
-        SetProviderInputName   string
-        SetProviderInputConfig map[string]interface{}
+        SetProviderInputAddr   addrs.ProviderConfig
+        SetProviderInputValues map[string]cty.Value
 
         ConfigureProviderCalled bool
-        ConfigureProviderName   string
-        ConfigureProviderConfig *ResourceConfig
-        ConfigureProviderError  error
+        ConfigureProviderAddr   addrs.ProviderConfig
+        ConfigureProviderConfig cty.Value
+        ConfigureProviderDiags  tfdiags.Diagnostics
 
         InitProvisionerCalled      bool
         InitProvisionerName        string
-        InitProvisionerProvisioner ResourceProvisioner
+        InitProvisionerProvisioner provisioners.Interface
         InitProvisionerError       error
 
         ProvisionerCalled      bool
         ProvisionerName        string
-        ProvisionerProvisioner ResourceProvisioner
+        ProvisionerProvisioner provisioners.Interface
+
+        ProvisionerSchemaCalled bool
+        ProvisionerSchemaName   string
+        ProvisionerSchemaSchema *configschema.Block
 
         CloseProvisionerCalled      bool
         CloseProvisionerName        string
-        CloseProvisionerProvisioner ResourceProvisioner
+        CloseProvisionerProvisioner provisioners.Interface
+
+        EvaluateBlockCalled     bool
+        EvaluateBlockBody       hcl.Body
+        EvaluateBlockSchema     *configschema.Block
+        EvaluateBlockSelf       addrs.Referenceable
+        EvaluateBlockKeyData    InstanceKeyEvalData
+        EvaluateBlockResultFunc func(
+                body hcl.Body,
+                schema *configschema.Block,
+                self addrs.Referenceable,
+                keyData InstanceKeyEvalData,
+        ) (cty.Value, hcl.Body, tfdiags.Diagnostics) // overrides the other values below, if set
+        EvaluateBlockResult       cty.Value
+        EvaluateBlockExpandedBody hcl.Body
+        EvaluateBlockDiags        tfdiags.Diagnostics
+
+        EvaluateExprCalled     bool
+        EvaluateExprExpr       hcl.Expression
+        EvaluateExprWantType   cty.Type
+        EvaluateExprSelf       addrs.Referenceable
+        EvaluateExprResultFunc func(
+                expr hcl.Expression,
+                wantType cty.Type,
+                self addrs.Referenceable,
+        ) (cty.Value, tfdiags.Diagnostics) // overrides the other values below, if set
+        EvaluateExprResult cty.Value
+        EvaluateExprDiags  tfdiags.Diagnostics
+
+        EvaluationScopeCalled  bool
+        EvaluationScopeSelf    addrs.Referenceable
+        EvaluationScopeKeyData InstanceKeyEvalData
+        EvaluationScopeScope   *lang.Scope
 
         InterpolateCalled       bool
         InterpolateConfig       *config.RawConfig
@@ -71,21 +123,22 @@ type MockEvalContext struct {
         InterpolateProviderError        error
 
         PathCalled bool
-        PathPath   []string
+        PathPath   addrs.ModuleInstance
 
-        SetVariablesCalled    bool
-        SetVariablesModule    string
-        SetVariablesVariables map[string]interface{}
+        SetModuleCallArgumentsCalled bool
+        SetModuleCallArgumentsModule addrs.ModuleCallInstance
+        SetModuleCallArgumentsValues map[string]cty.Value
 
-        DiffCalled bool
-        DiffDiff   *Diff
-        DiffLock   *sync.RWMutex
+        ChangesCalled  bool
+        ChangesChanges *plans.ChangesSync
 
         StateCalled bool
-        StateState  *State
-        StateLock   *sync.RWMutex
+        StateState  *states.SyncState
 }
 
+// MockEvalContext implements EvalContext
+var _ EvalContext = (*MockEvalContext)(nil)
+
 func (c *MockEvalContext) Stopped() <-chan struct{} {
         c.StoppedCalled = true
         return c.StoppedValue
@@ -107,61 +160,157 @@ func (c *MockEvalContext) Input() UIInput {
         return c.InputInput
 }
 
-func (c *MockEvalContext) InitProvider(t, n string) (ResourceProvider, error) {
+func (c *MockEvalContext) InitProvider(t string, addr addrs.ProviderConfig) (providers.Interface, error) {
         c.InitProviderCalled = true
-        c.InitProviderName = n
+        c.InitProviderType = t
+        c.InitProviderAddr = addr
         return c.InitProviderProvider, c.InitProviderError
 }
 
-func (c *MockEvalContext) Provider(n string) ResourceProvider {
+func (c *MockEvalContext) Provider(addr addrs.AbsProviderConfig) providers.Interface {
         c.ProviderCalled = true
-        c.ProviderName = n
+        c.ProviderAddr = addr
         return c.ProviderProvider
 }
 
-func (c *MockEvalContext) CloseProvider(n string) error {
+func (c *MockEvalContext) ProviderSchema(addr addrs.AbsProviderConfig) *ProviderSchema {
+        c.ProviderSchemaCalled = true
+        c.ProviderSchemaAddr = addr
+        return c.ProviderSchemaSchema
+}
+
+func (c *MockEvalContext) CloseProvider(addr addrs.ProviderConfig) error {
         c.CloseProviderCalled = true
-        c.CloseProviderName = n
+        c.CloseProviderAddr = addr
         return nil
 }
 
-func (c *MockEvalContext) ConfigureProvider(n string, cfg *ResourceConfig) error {
+func (c *MockEvalContext) ConfigureProvider(addr addrs.ProviderConfig, cfg cty.Value) tfdiags.Diagnostics {
         c.ConfigureProviderCalled = true
-        c.ConfigureProviderName = n
+        c.ConfigureProviderAddr = addr
         c.ConfigureProviderConfig = cfg
-        return c.ConfigureProviderError
+        return c.ConfigureProviderDiags
 }
 
-func (c *MockEvalContext) ProviderInput(n string) map[string]interface{} {
+func (c *MockEvalContext) ProviderInput(addr addrs.ProviderConfig) map[string]cty.Value {
         c.ProviderInputCalled = true
-        c.ProviderInputName = n
-        return c.ProviderInputConfig
+        c.ProviderInputAddr = addr
+        return c.ProviderInputValues
 }
 
-func (c *MockEvalContext) SetProviderInput(n string, cfg map[string]interface{}) {
+func (c *MockEvalContext) SetProviderInput(addr addrs.ProviderConfig, vals map[string]cty.Value) {
         c.SetProviderInputCalled = true
-        c.SetProviderInputName = n
-        c.SetProviderInputConfig = cfg
+        c.SetProviderInputAddr = addr
+        c.SetProviderInputValues = vals
 }
 
-func (c *MockEvalContext) InitProvisioner(n string) (ResourceProvisioner, error) {
+func (c *MockEvalContext) InitProvisioner(n string) (provisioners.Interface, error) {
         c.InitProvisionerCalled = true
         c.InitProvisionerName = n
         return c.InitProvisionerProvisioner, c.InitProvisionerError
 }
 
-func (c *MockEvalContext) Provisioner(n string) ResourceProvisioner {
+func (c *MockEvalContext) Provisioner(n string) provisioners.Interface {
         c.ProvisionerCalled = true
         c.ProvisionerName = n
         return c.ProvisionerProvisioner
 }
 
+func (c *MockEvalContext) ProvisionerSchema(n string) *configschema.Block {
+        c.ProvisionerSchemaCalled = true
+        c.ProvisionerSchemaName = n
+        return c.ProvisionerSchemaSchema
+}
+
 func (c *MockEvalContext) CloseProvisioner(n string) error {
         c.CloseProvisionerCalled = true
         c.CloseProvisionerName = n
         return nil
 }
 
+func (c *MockEvalContext) EvaluateBlock(body hcl.Body, schema *configschema.Block, self addrs.Referenceable, keyData InstanceKeyEvalData) (cty.Value, hcl.Body, tfdiags.Diagnostics) {
+        c.EvaluateBlockCalled = true
+        c.EvaluateBlockBody = body
+        c.EvaluateBlockSchema = schema
+        c.EvaluateBlockSelf = self
+        c.EvaluateBlockKeyData = keyData
+        if c.EvaluateBlockResultFunc != nil {
+                return c.EvaluateBlockResultFunc(body, schema, self, keyData)
+        }
+        return c.EvaluateBlockResult, c.EvaluateBlockExpandedBody, c.EvaluateBlockDiags
+}
+
+func (c *MockEvalContext) EvaluateExpr(expr hcl.Expression, wantType cty.Type, self addrs.Referenceable) (cty.Value, tfdiags.Diagnostics) {
+        c.EvaluateExprCalled = true
+        c.EvaluateExprExpr = expr
+        c.EvaluateExprWantType = wantType
+        c.EvaluateExprSelf = self
+        if c.EvaluateExprResultFunc != nil {
+                return c.EvaluateExprResultFunc(expr, wantType, self)
+        }
+        return c.EvaluateExprResult, c.EvaluateExprDiags
+}
+
+// installSimpleEval is a helper to install a simple mock implementation of
+// both EvaluateBlock and EvaluateExpr into the receiver.
+//
+// These default implementations will either evaluate the given input against
+// the scope in field EvaluationScopeScope or, if it is nil, with no eval
+// context at all so that only constant values may be used.
+//
+// This function overwrites any existing functions installed in fields
+// EvaluateBlockResultFunc and EvaluateExprResultFunc.
+func (c *MockEvalContext) installSimpleEval() {
+        c.EvaluateBlockResultFunc = func(body hcl.Body, schema *configschema.Block, self addrs.Referenceable, keyData InstanceKeyEvalData) (cty.Value, hcl.Body, tfdiags.Diagnostics) {
+                if scope := c.EvaluationScopeScope; scope != nil {
+                        // Fully-functional codepath.
+                        var diags tfdiags.Diagnostics
+                        body, diags = scope.ExpandBlock(body, schema)
+                        if diags.HasErrors() {
+                                return cty.DynamicVal, body, diags
+                        }
+                        val, evalDiags := c.EvaluationScopeScope.EvalBlock(body, schema)
+                        diags = diags.Append(evalDiags)
+                        if evalDiags.HasErrors() {
+                                return cty.DynamicVal, body, diags
+                        }
+                        return val, body, diags
+                }
+
+                // Fallback codepath supporting constant values only.
+                val, hclDiags := hcldec.Decode(body, schema.DecoderSpec(), nil)
+                return val, body, tfdiags.Diagnostics(nil).Append(hclDiags)
+        }
+        c.EvaluateExprResultFunc = func(expr hcl.Expression, wantType cty.Type, self addrs.Referenceable) (cty.Value, tfdiags.Diagnostics) {
+                if scope := c.EvaluationScopeScope; scope != nil {
+                        // Fully-functional codepath.
+                        return scope.EvalExpr(expr, wantType)
+                }
+
+                // Fallback codepath supporting constant values only.
+                var diags tfdiags.Diagnostics
+                val, hclDiags := expr.Value(nil)
+                diags = diags.Append(hclDiags)
+                if hclDiags.HasErrors() {
+                        return cty.DynamicVal, diags
+                }
+                var err error
+                val, err = convert.Convert(val, wantType)
+                if err != nil {
+                        diags = diags.Append(err)
+                        return cty.DynamicVal, diags
+                }
+                return val, diags
+        }
+}
+
+func (c *MockEvalContext) EvaluationScope(self addrs.Referenceable, keyData InstanceKeyEvalData) *lang.Scope {
+        c.EvaluationScopeCalled = true
+        c.EvaluationScopeSelf = self
+        c.EvaluationScopeKeyData = keyData
+        return c.EvaluationScopeScope
+}
+
 func (c *MockEvalContext) Interpolate(
         config *config.RawConfig, resource *Resource) (*ResourceConfig, error) {
         c.InterpolateCalled = true
@@ -178,23 +327,23 @@ func (c *MockEvalContext) InterpolateProvider(
         return c.InterpolateProviderConfigResult, c.InterpolateError
 }
 
-func (c *MockEvalContext) Path() []string {
+func (c *MockEvalContext) Path() addrs.ModuleInstance {
         c.PathCalled = true
         return c.PathPath
 }
 
-func (c *MockEvalContext) SetVariables(n string, vs map[string]interface{}) {
-        c.SetVariablesCalled = true
-        c.SetVariablesModule = n
-        c.SetVariablesVariables = vs
+func (c *MockEvalContext) SetModuleCallArguments(n addrs.ModuleCallInstance, values map[string]cty.Value) {
+        c.SetModuleCallArgumentsCalled = true
+        c.SetModuleCallArgumentsModule = n
+        c.SetModuleCallArgumentsValues = values
 }
 
-func (c *MockEvalContext) Diff() (*Diff, *sync.RWMutex) {
-        c.DiffCalled = true
-        return c.DiffDiff, c.DiffLock
+func (c *MockEvalContext) Changes() *plans.ChangesSync {
+        c.ChangesCalled = true
+        return c.ChangesChanges
 }
 
-func (c *MockEvalContext) State() (*State, *sync.RWMutex) {
+func (c *MockEvalContext) State() *states.SyncState {
         c.StateCalled = true
-        return c.StateState, c.StateLock
+        return c.StateState
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_count.go b/vendor/github.com/hashicorp/terraform/terraform/eval_count.go
index 2ae56a7..8083105 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_count.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_count.go
@@ -1,58 +1,120 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config"
+        "fmt"
+        "log"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/gocty"
 )
 
-// EvalCountFixZeroOneBoundary is an EvalNode that fixes up the state
-// when there is a resource count with zero/one boundary, i.e. fixing
-// a resource named "aws_instance.foo" to "aws_instance.foo.0" and vice-versa.
-type EvalCountFixZeroOneBoundary struct {
-        Resource *config.Resource
+// evaluateResourceCountExpression is our standard mechanism for interpreting an
+// expression given for a "count" argument on a resource. This should be called
+// from the DynamicExpand of a node representing a resource in order to
+// determine the final count value.
+//
+// If the result is zero or positive and no error diagnostics are returned, then
+// the result is the literal count value to use.
+//
+// If the result is -1, this indicates that the given expression is nil and so
+// the "count" behavior should not be enabled for this resource at all.
+//
+// If error diagnostics are returned then the result is always the meaningless
+// placeholder value -1.
+func evaluateResourceCountExpression(expr hcl.Expression, ctx EvalContext) (int, tfdiags.Diagnostics) {
+        count, known, diags := evaluateResourceCountExpressionKnown(expr, ctx)
+        if !known {
+                // Currently this is a rather bad outcome from a UX standpoint, since we have
+                // no real mechanism to deal with this situation and all we can do is produce
+                // an error message.
+                // FIXME: In future, implement a built-in mechanism for deferring changes that
+                // can't yet be predicted, and use it to guide the user through several
+                // plan/apply steps until the desired configuration is eventually reached.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   `The "count" value depends on resource attributes that cannot be determined until apply, so Terraform cannot predict how many instances will be created. To work around this, use the -target argument to first apply only the resources that the count depends on.`,
+                        Subject:  expr.Range().Ptr(),
+                })
+        }
+        return count, diags
 }
 
-// TODO: test
-func (n *EvalCountFixZeroOneBoundary) Eval(ctx EvalContext) (interface{}, error) {
-        // Get the count, important for knowing whether we're supposed to
-        // be adding the zero, or trimming it.
-        count, err := n.Resource.Count()
-        if err != nil {
-                return nil, err
+// evaluateResourceCountExpressionKnown is like evaluateResourceCountExpression
+// except that it handles an unknown result by returning count = 0 and
+// a known = false, rather than by reporting the unknown value as an error
+// diagnostic.
+func evaluateResourceCountExpressionKnown(expr hcl.Expression, ctx EvalContext) (count int, known bool, diags tfdiags.Diagnostics) {
+        if expr == nil {
+                return -1, true, nil
         }
 
-        // Figure what to look for and what to replace it with
-        hunt := n.Resource.Id()
-        replace := hunt + ".0"
-        if count < 2 {
-                hunt, replace = replace, hunt
+        countVal, countDiags := ctx.EvaluateExpr(expr, cty.Number, nil)
+        diags = diags.Append(countDiags)
+        if diags.HasErrors() {
+                return -1, true, diags
         }
 
-        state, lock := ctx.State()
-
-        // Get a lock so we can access this instance and potentially make
-        // changes to it.
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Look for the module state. If we don't have one, then it doesn't matter.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                return nil, nil
+        switch {
+        case countVal.IsNull():
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   `The given "count" argument value is null. An integer is required.`,
+                        Subject:  expr.Range().Ptr(),
+                })
+                return -1, true, diags
+        case !countVal.IsKnown():
+                return 0, false, diags
         }
 
-        // Look for the resource state. If we don't have one, then it is okay.
-        rs, ok := mod.Resources[hunt]
-        if !ok {
-                return nil, nil
+        err := gocty.FromCtyValue(countVal, &count)
+        if err != nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   fmt.Sprintf(`The given "count" argument value is unsuitable: %s.`, err),
+                        Subject:  expr.Range().Ptr(),
+                })
+                return -1, true, diags
         }
-
-        // If the replacement key exists, we just keep both
-        if _, ok := mod.Resources[replace]; ok {
-                return nil, nil
+        if count < 0 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   `The given "count" argument value is unsuitable: negative numbers are not supported.`,
+                        Subject:  expr.Range().Ptr(),
+                })
+                return -1, true, diags
         }
 
-        mod.Resources[replace] = rs
-        delete(mod.Resources, hunt)
+        return count, true, diags
+}
 
-        return nil, nil
+// fixResourceCountSetTransition is a helper function to fix up the state when a
+// resource transitions its "count" from being set to unset or vice-versa,
+// treating a 0-key and a no-key instance as aliases for one another across
+// the transition.
+//
+// The correct time to call this function is in the DynamicExpand method for
+// a node representing a resource, just after evaluating the count with
+// evaluateResourceCountExpression, and before any other analysis of the
+// state such as orphan detection.
+//
+// This function calls methods on the given EvalContext to update the current
+// state in-place, if necessary. It is a no-op if there is no count transition
+// taking place.
+//
+// Since the state is modified in-place, this function must take a writer lock
+// on the state. The caller must therefore not also be holding a state lock,
+// or this function will block forever awaiting the lock.
+func fixResourceCountSetTransition(ctx EvalContext, addr addrs.AbsResource, countEnabled bool) {
+        state := ctx.State()
+        changed := state.MaybeFixUpResourceInstanceAddressForCount(addr, countEnabled)
+        if changed {
+                log.Printf("[TRACE] renamed first %s instance in transient state due to count argument change", addr)
+        }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_count_boundary.go b/vendor/github.com/hashicorp/terraform/terraform/eval_count_boundary.go
index 91e2b90..647c58d 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_count_boundary.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_count_boundary.go
@@ -1,7 +1,11 @@
 package terraform
 
 import (
+        "fmt"
         "log"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
 )
 
 // EvalCountFixZeroOneBoundaryGlobal is an EvalNode that fixes up the state
@@ -9,22 +13,34 @@ import (
 // a resource named "aws_instance.foo" to "aws_instance.foo.0" and vice-versa.
 //
 // This works on the global state.
-type EvalCountFixZeroOneBoundaryGlobal struct{}
+type EvalCountFixZeroOneBoundaryGlobal struct {
+        Config *configs.Config
+}
 
 // TODO: test
 func (n *EvalCountFixZeroOneBoundaryGlobal) Eval(ctx EvalContext) (interface{}, error) {
-        // Get the state and lock it since we'll potentially modify it
-        state, lock := ctx.State()
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Prune the state since we require a clean state to work
-        state.prune()
-
-        // Go through each modules since the boundaries are restricted to a
-        // module scope.
+        // We'll temporarily lock the state to grab the modules, then work on each
+        // one separately while taking a lock again for each separate resource.
+        // This means that if another caller concurrently adds a module here while
+        // we're working then we won't update it, but that's no worse than the
+        // concurrent writer blocking for our entire fixup process and _then_
+        // adding a new module, and in practice the graph node associated with
+        // this eval depends on everything else in the graph anyway, so there
+        // should not be concurrent writers.
+        state := ctx.State().Lock()
+        moduleAddrs := make([]addrs.ModuleInstance, 0, len(state.Modules))
         for _, m := range state.Modules {
-                if err := n.fixModule(m); err != nil {
+                moduleAddrs = append(moduleAddrs, m.Addr)
+        }
+        ctx.State().Unlock()
+
+        for _, addr := range moduleAddrs {
+                cfg := n.Config.DescendentForInstance(addr)
+                if cfg == nil {
+                        log.Printf("[WARN] Not fixing up EachModes for %s because it has no config", addr)
+                        continue
+                }
+                if err := n.fixModule(ctx, addr); err != nil {
                         return nil, err
                 }
         }
@@ -32,46 +48,29 @@ func (n *EvalCountFixZeroOneBoundaryGlobal) Eval(ctx EvalContext) (interface{},
         return nil, nil
 }
 
-func (n *EvalCountFixZeroOneBoundaryGlobal) fixModule(m *ModuleState) error {
-        // Counts keeps track of keys and their counts
-        counts := make(map[string]int)
-        for k, _ := range m.Resources {
-                // Parse the key
-                key, err := ParseResourceStateKey(k)
-                if err != nil {
-                        return err
-                }
-
-                // Set the index to -1 so that we can keep count
-                key.Index = -1
-
-                // Increment
-                counts[key.String()]++
+func (n *EvalCountFixZeroOneBoundaryGlobal) fixModule(ctx EvalContext, moduleAddr addrs.ModuleInstance) error {
+        ms := ctx.State().Module(moduleAddr)
+        cfg := n.Config.DescendentForInstance(moduleAddr)
+        if ms == nil {
+                // Theoretically possible for a concurrent writer to delete a module
+                // while we're running, but in practice the graph node that called us
+                // depends on everything else in the graph and so there can never
+                // be a concurrent writer.
+                return fmt.Errorf("[WARN] no state found for %s while trying to fix up EachModes", moduleAddr)
+        }
+        if cfg == nil {
+                return fmt.Errorf("[WARN] no config found for %s while trying to fix up EachModes", moduleAddr)
         }
 
-        // Go through the counts and do the fixup for each resource
-        for raw, count := range counts {
-                // Search and replace this resource
-                search := raw
-                replace := raw + ".0"
-                if count < 2 {
-                        search, replace = replace, search
-                }
-                log.Printf("[TRACE] EvalCountFixZeroOneBoundaryGlobal: count %d, search %q, replace %q", count, search, replace)
-
-                // Look for the resource state. If we don't have one, then it is okay.
-                rs, ok := m.Resources[search]
-                if !ok {
-                        continue
-                }
-
-                // If the replacement key exists, we just keep both
-                if _, ok := m.Resources[replace]; ok {
+        for _, r := range ms.Resources {
+                addr := r.Addr.Absolute(moduleAddr)
+                rCfg := cfg.Module.ResourceByAddr(r.Addr)
+                if rCfg == nil {
+                        log.Printf("[WARN] Not fixing up EachModes for %s because it has no config", addr)
                         continue
                 }
-
-                m.Resources[replace] = rs
-                delete(m.Resources, search)
+                hasCount := rCfg.Count != nil
+                fixResourceCountSetTransition(ctx, addr, hasCount)
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go b/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
index 26205ce..b7acfb0 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
@@ -1,92 +1,114 @@
 package terraform
 
 import (
+        "bytes"
         "fmt"
         "log"
+        "reflect"
         "strings"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/plans/objchange"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
-// EvalCompareDiff is an EvalNode implementation that compares two diffs
-// and errors if the diffs are not equal.
-type EvalCompareDiff struct {
-        Info     *InstanceInfo
-        One, Two **InstanceDiff
+// EvalCheckPlannedChange is an EvalNode implementation that produces errors
+// if the _actual_ expected value is not compatible with what was recorded
+// in the plan.
+//
+// Errors here are most often indicative of a bug in the provider, so our
+// error messages will report with that in mind. It's also possible that
+// there's a bug in Terraform's Core's own "proposed new value" code in
+// EvalDiff.
+type EvalCheckPlannedChange struct {
+        Addr           addrs.ResourceInstance
+        ProviderAddr   addrs.AbsProviderConfig
+        ProviderSchema **ProviderSchema
+
+        // We take ResourceInstanceChange objects here just because that's what's
+        // convenient to pass in from the evaltree implementation, but we really
+        // only look at the "After" value of each change.
+        Planned, Actual **plans.ResourceInstanceChange
 }
 
-// TODO: test
-func (n *EvalCompareDiff) Eval(ctx EvalContext) (interface{}, error) {
-        one, two := *n.One, *n.Two
-
-        // If either are nil, let them be empty
-        if one == nil {
-                one = new(InstanceDiff)
-                one.init()
-        }
-        if two == nil {
-                two = new(InstanceDiff)
-                two.init()
-        }
-        oneId, _ := one.GetAttribute("id")
-        twoId, _ := two.GetAttribute("id")
-        one.DelAttribute("id")
-        two.DelAttribute("id")
-        defer func() {
-                if oneId != nil {
-                        one.SetAttribute("id", oneId)
-                }
-                if twoId != nil {
-                        two.SetAttribute("id", twoId)
-                }
-        }()
-
-        if same, reason := one.Same(two); !same {
-                log.Printf("[ERROR] %s: diffs didn't match", n.Info.Id)
-                log.Printf("[ERROR] %s: reason: %s", n.Info.Id, reason)
-                log.Printf("[ERROR] %s: diff one: %#v", n.Info.Id, one)
-                log.Printf("[ERROR] %s: diff two: %#v", n.Info.Id, two)
-                return nil, fmt.Errorf(
-                        "%s: diffs didn't match during apply. This is a bug with "+
-                                "Terraform and should be reported as a GitHub Issue.\n"+
-                                "\n"+
-                                "Please include the following information in your report:\n"+
-                                "\n"+
-                                "    Terraform Version: %s\n"+
-                                "    Resource ID: %s\n"+
-                                "    Mismatch reason: %s\n"+
-                                "    Diff One (usually from plan): %#v\n"+
-                                "    Diff Two (usually from apply): %#v\n"+
-                                "\n"+
-                                "Also include as much context as you can about your config, state, "+
-                                "and the steps you performed to trigger this error.\n",
-                        n.Info.Id, version.Version, n.Info.Id, reason, one, two)
+func (n *EvalCheckPlannedChange) Eval(ctx EvalContext) (interface{}, error) {
+        providerSchema := *n.ProviderSchema
+        plannedChange := *n.Planned
+        actualChange := *n.Actual
+
+        schema, _ := providerSchema.SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support %q", n.Addr.Resource.Type)
+        }
+
+        var diags tfdiags.Diagnostics
+        absAddr := n.Addr.Absolute(ctx.Path())
+
+        log.Printf("[TRACE] EvalCheckPlannedChange: Verifying that actual change (action %s) matches planned change (action %s)", actualChange.Action, plannedChange.Action)
+
+        if plannedChange.Action != actualChange.Action {
+                switch {
+                case plannedChange.Action == plans.Update && actualChange.Action == plans.NoOp:
+                        // It's okay for an update to become a NoOp once we've filled in
+                        // all of the unknown values, since the final values might actually
+                        // match what was there before after all.
+                        log.Printf("[DEBUG] After incorporating new values learned so far during apply, %s change has become NoOp", absAddr)
+                default:
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Provider produced inconsistent final plan",
+                                fmt.Sprintf(
+                                        "When expanding the plan for %s to include new values learned so far during apply, provider %q changed the planned action from %s to %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                        absAddr, n.ProviderAddr.ProviderConfig.Type,
+                                        plannedChange.Action, actualChange.Action,
+                                ),
+                        ))
+                }
         }
 
-        return nil, nil
+        errs := objchange.AssertObjectCompatible(schema, plannedChange.After, actualChange.After)
+        for _, err := range errs {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced inconsistent final plan",
+                        fmt.Sprintf(
+                                "When expanding the plan for %s to include new values learned so far during apply, provider %q produced an invalid new value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                absAddr, n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatError(err),
+                        ),
+                ))
+        }
+        return nil, diags.Err()
 }
 
-// EvalDiff is an EvalNode implementation that does a refresh for
-// a resource.
+// EvalDiff is an EvalNode implementation that detects changes for a given
+// resource instance.
 type EvalDiff struct {
-        Name        string
-        Info        *InstanceInfo
-        Config      **ResourceConfig
-        Provider    *ResourceProvider
-        Diff        **InstanceDiff
-        State       **InstanceState
-        OutputDiff  **InstanceDiff
-        OutputState **InstanceState
-
-        // Resource is needed to fetch the ignore_changes list so we can
-        // filter user-requested ignored attributes from the diff.
-        Resource *config.Resource
-
-        // Stub is used to flag the generated InstanceDiff as a stub. This is used to
-        // ensure that the node exists to perform interpolations and generate
-        // computed paths off of, but not as an actual diff where resouces should be
-        // counted, and not as a diff that should be acted on.
+        Addr           addrs.ResourceInstance
+        Config         *configs.Resource
+        Provider       *providers.Interface
+        ProviderAddr   addrs.AbsProviderConfig
+        ProviderSchema **ProviderSchema
+        State          **states.ResourceInstanceObject
+        PreviousDiff   **plans.ResourceInstanceChange
+
+        // CreateBeforeDestroy is set if either the resource's own config sets
+        // create_before_destroy explicitly or if dependencies have forced the
+        // resource to be handled as create_before_destroy in order to avoid
+        // a dependency cycle.
+        CreateBeforeDestroy bool
+
+        OutputChange **plans.ResourceInstanceChange
+        OutputValue  *cty.Value
+        OutputState  **states.ResourceInstanceObject
+
         Stub bool
 }
 
@@ -95,81 +117,303 @@ func (n *EvalDiff) Eval(ctx EvalContext) (interface{}, error) {
         state := *n.State
         config := *n.Config
         provider := *n.Provider
+        providerSchema := *n.ProviderSchema
+
+        if providerSchema == nil {
+                return nil, fmt.Errorf("provider schema is unavailable for %s", n.Addr)
+        }
+        if n.ProviderAddr.ProviderConfig.Type == "" {
+                panic(fmt.Sprintf("EvalDiff for %s does not have ProviderAddr set", n.Addr.Absolute(ctx.Path())))
+        }
+
+        var diags tfdiags.Diagnostics
+
+        // Evaluate the configuration
+        schema, _ := providerSchema.SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support resource type %q", n.Addr.Resource.Type)
+        }
+        keyData := EvalDataForInstanceKey(n.Addr.Key)
+        configVal, _, configDiags := ctx.EvaluateBlock(config.Config, schema, nil, keyData)
+        diags = diags.Append(configDiags)
+        if configDiags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        absAddr := n.Addr.Absolute(ctx.Path())
+        var priorVal cty.Value
+        var priorValTainted cty.Value
+        var priorPrivate []byte
+        if state != nil {
+                if state.Status != states.ObjectTainted {
+                        priorVal = state.Value
+                        priorPrivate = state.Private
+                } else {
+                        // If the prior state is tainted then we'll proceed below like
+                        // we're creating an entirely new object, but then turn it into
+                        // a synthetic "Replace" change at the end, creating the same
+                        // result as if the provider had marked at least one argument
+                        // change as "requires replacement".
+                        priorValTainted = state.Value
+                        priorVal = cty.NullVal(schema.ImpliedType())
+                }
+        } else {
+                priorVal = cty.NullVal(schema.ImpliedType())
+        }
+
+        proposedNewVal := objchange.ProposedNewObject(schema, priorVal, configVal)
 
         // Call pre-diff hook
         if !n.Stub {
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PreDiff(n.Info, state)
+                        return h.PreDiff(absAddr, states.CurrentGen, priorVal, proposedNewVal)
                 })
                 if err != nil {
                         return nil, err
                 }
         }
 
-        // The state for the diff must never be nil
-        diffState := state
-        if diffState == nil {
-                diffState = new(InstanceState)
+        // The provider gets an opportunity to customize the proposed new value,
+        // which in turn produces the _planned_ new value.
+        resp := provider.PlanResourceChange(providers.PlanResourceChangeRequest{
+                TypeName:         n.Addr.Resource.Type,
+                Config:           configVal,
+                PriorState:       priorVal,
+                ProposedNewState: proposedNewVal,
+                PriorPrivate:     priorPrivate,
+        })
+        diags = diags.Append(resp.Diagnostics.InConfigBody(config.Config))
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        plannedNewVal := resp.PlannedState
+        plannedPrivate := resp.PlannedPrivate
+
+        if plannedNewVal == cty.NilVal {
+                // Should never happen. Since real-world providers return via RPC a nil
+                // is always a bug in the client-side stub. This is more likely caused
+                // by an incompletely-configured mock provider in tests, though.
+                panic(fmt.Sprintf("PlanResourceChange of %s produced nil value", absAddr.String()))
+        }
+
+        // We allow the planned new value to disagree with configuration _values_
+        // here, since that allows the provider to do special logic like a
+        // DiffSuppressFunc, but we still require that the provider produces
+        // a value whose type conforms to the schema.
+        for _, err := range plannedNewVal.Type().TestConformance(schema.ImpliedType()) {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced invalid plan",
+                        fmt.Sprintf(
+                                "Provider %q planned an invalid value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatErrorPrefixed(err, absAddr.String()),
+                        ),
+                ))
+        }
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        if errs := objchange.AssertPlanValid(schema, priorVal, configVal, plannedNewVal); len(errs) > 0 {
+                if resp.LegacyTypeSystem {
+                        // The shimming of the old type system in the legacy SDK is not precise
+                        // enough to pass this consistency check, so we'll give it a pass here,
+                        // but we will generate a warning about it so that we are more likely
+                        // to notice in the logs if an inconsistency beyond the type system
+                        // leads to a downstream provider failure.
+                        var buf strings.Builder
+                        fmt.Fprintf(&buf, "[WARN] Provider %q produced an invalid plan for %s, but we are tolerating it because it is using the legacy plugin SDK.\n    The following problems may be the cause of any confusing errors from downstream operations:", n.ProviderAddr.ProviderConfig.Type, absAddr)
+                        for _, err := range errs {
+                                fmt.Fprintf(&buf, "\n      - %s", tfdiags.FormatError(err))
+                        }
+                        log.Print(buf.String())
+                } else {
+                        for _, err := range errs {
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Provider produced invalid plan",
+                                        fmt.Sprintf(
+                                                "Provider %q planned an invalid value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                                n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatErrorPrefixed(err, absAddr.String()),
+                                        ),
+                                ))
+                        }
+                        return nil, diags.Err()
+                }
         }
-        diffState.init()
 
-        // Diff!
-        diff, err := provider.Diff(n.Info, diffState, config)
-        if err != nil {
-                return nil, err
-        }
-        if diff == nil {
-                diff = new(InstanceDiff)
+        {
+                var moreDiags tfdiags.Diagnostics
+                plannedNewVal, moreDiags = n.processIgnoreChanges(priorVal, plannedNewVal)
+                diags = diags.Append(moreDiags)
+                if moreDiags.HasErrors() {
+                        return nil, diags.Err()
+                }
         }
 
-        // Set DestroyDeposed if we have deposed instances
-        _, err = readInstanceFromState(ctx, n.Name, nil, func(rs *ResourceState) (*InstanceState, error) {
-                if len(rs.Deposed) > 0 {
-                        diff.DestroyDeposed = true
-                }
+        // The provider produces a list of paths to attributes whose changes mean
+        // that we must replace rather than update an existing remote object.
+        // However, we only need to do that if the identified attributes _have_
+        // actually changed -- particularly after we may have undone some of the
+        // changes in processIgnoreChanges -- so now we'll filter that list to
+        // include only where changes are detected.
+        reqRep := cty.NewPathSet()
+        if len(resp.RequiresReplace) > 0 {
+                for _, path := range resp.RequiresReplace {
+                        if priorVal.IsNull() {
+                                // If prior is null then we don't expect any RequiresReplace at all,
+                                // because this is a Create action.
+                                continue
+                        }
 
-                return nil, nil
-        })
-        if err != nil {
-                return nil, err
-        }
+                        priorChangedVal, priorPathDiags := hcl.ApplyPath(priorVal, path, nil)
+                        plannedChangedVal, plannedPathDiags := hcl.ApplyPath(plannedNewVal, path, nil)
+                        if plannedPathDiags.HasErrors() && priorPathDiags.HasErrors() {
+                                // This means the path was invalid in both the prior and new
+                                // values, which is an error with the provider itself.
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Provider produced invalid plan",
+                                        fmt.Sprintf(
+                                                "Provider %q has indicated \"requires replacement\" on %s for a non-existent attribute path %#v.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                                n.ProviderAddr.ProviderConfig.Type, absAddr, path,
+                                        ),
+                                ))
+                                continue
+                        }
 
-        // Preserve the DestroyTainted flag
-        if n.Diff != nil {
-                diff.SetTainted((*n.Diff).GetDestroyTainted())
-        }
+                        // Make sure we have valid Values for both values.
+                        // Note: if the opposing value was of the type
+                        // cty.DynamicPseudoType, the type assigned here may not exactly
+                        // match the schema. This is fine here, since we're only going to
+                        // check for equality, but if the NullVal is to be used, we need to
+                        // check the schema for th true type.
+                        switch {
+                        case priorChangedVal == cty.NilVal && plannedChangedVal == cty.NilVal:
+                                // this should never happen without ApplyPath errors above
+                                panic("requires replace path returned 2 nil values")
+                        case priorChangedVal == cty.NilVal:
+                                priorChangedVal = cty.NullVal(plannedChangedVal.Type())
+                        case plannedChangedVal == cty.NilVal:
+                                plannedChangedVal = cty.NullVal(priorChangedVal.Type())
+                        }
 
-        // Require a destroy if there is an ID and it requires new.
-        if diff.RequiresNew() && state != nil && state.ID != "" {
-                diff.SetDestroy(true)
+                        eqV := plannedChangedVal.Equals(priorChangedVal)
+                        if !eqV.IsKnown() || eqV.False() {
+                                reqRep.Add(path)
+                        }
+                }
+                if diags.HasErrors() {
+                        return nil, diags.Err()
+                }
         }
 
-        // If we're creating a new resource, compute its ID
-        if diff.RequiresNew() || state == nil || state.ID == "" {
-                var oldID string
-                if state != nil {
-                        oldID = state.Attributes["id"]
+        eqV := plannedNewVal.Equals(priorVal)
+        eq := eqV.IsKnown() && eqV.True()
+
+        var action plans.Action
+        switch {
+        case priorVal.IsNull():
+                action = plans.Create
+        case eq:
+                action = plans.NoOp
+        case !reqRep.Empty():
+                // If there are any "requires replace" paths left _after our filtering
+                // above_ then this is a replace action.
+                if n.CreateBeforeDestroy {
+                        action = plans.CreateThenDelete
+                } else {
+                        action = plans.DeleteThenCreate
                 }
-
-                // Add diff to compute new ID
-                diff.init()
-                diff.SetAttribute("id", &ResourceAttrDiff{
-                        Old:         oldID,
-                        NewComputed: true,
-                        RequiresNew: true,
-                        Type:        DiffAttrOutput,
+        default:
+                action = plans.Update
+                // "Delete" is never chosen here, because deletion plans are always
+                // created more directly elsewhere, such as in "orphan" handling.
+        }
+
+        if action.IsReplace() {
+                // In this strange situation we want to produce a change object that
+                // shows our real prior object but has a _new_ object that is built
+                // from a null prior object, since we're going to delete the one
+                // that has all the computed values on it.
+                //
+                // Therefore we'll ask the provider to plan again here, giving it
+                // a null object for the prior, and then we'll meld that with the
+                // _actual_ prior state to produce a correctly-shaped replace change.
+                // The resulting change should show any computed attributes changing
+                // from known prior values to unknown values, unless the provider is
+                // able to predict new values for any of these computed attributes.
+                nullPriorVal := cty.NullVal(schema.ImpliedType())
+
+                // create a new proposed value from the null state and the config
+                proposedNewVal = objchange.ProposedNewObject(schema, nullPriorVal, configVal)
+
+                resp = provider.PlanResourceChange(providers.PlanResourceChangeRequest{
+                        TypeName:         n.Addr.Resource.Type,
+                        Config:           configVal,
+                        PriorState:       nullPriorVal,
+                        ProposedNewState: proposedNewVal,
+                        PriorPrivate:     plannedPrivate,
                 })
+                // We need to tread carefully here, since if there are any warnings
+                // in here they probably also came out of our previous call to
+                // PlanResourceChange above, and so we don't want to repeat them.
+                // Consequently, we break from the usual pattern here and only
+                // append these new diagnostics if there's at least one error inside.
+                if resp.Diagnostics.HasErrors() {
+                        diags = diags.Append(resp.Diagnostics.InConfigBody(config.Config))
+                        return nil, diags.Err()
+                }
+                plannedNewVal = resp.PlannedState
+                plannedPrivate = resp.PlannedPrivate
+                for _, err := range plannedNewVal.Type().TestConformance(schema.ImpliedType()) {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Provider produced invalid plan",
+                                fmt.Sprintf(
+                                        "Provider %q planned an invalid value for %s%s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                        n.ProviderAddr.ProviderConfig.Type, absAddr, tfdiags.FormatError(err),
+                                ),
+                        ))
+                }
+                if diags.HasErrors() {
+                        return nil, diags.Err()
+                }
         }
 
-        // filter out ignored resources
-        if err := n.processIgnoreChanges(diff); err != nil {
-                return nil, err
+        // If our prior value was tainted then we actually want this to appear
+        // as a replace change, even though so far we've been treating it as a
+        // create.
+        if action == plans.Create && priorValTainted != cty.NilVal {
+                if n.CreateBeforeDestroy {
+                        action = plans.CreateThenDelete
+                } else {
+                        action = plans.DeleteThenCreate
+                }
+                priorVal = priorValTainted
+        }
+
+        // As a special case, if we have a previous diff (presumably from the plan
+        // phases, whereas we're now in the apply phase) and it was for a replace,
+        // we've already deleted the original object from state by the time we
+        // get here and so we would've ended up with a _create_ action this time,
+        // which we now need to paper over to get a result consistent with what
+        // we originally intended.
+        if n.PreviousDiff != nil {
+                prevChange := *n.PreviousDiff
+                if prevChange.Action.IsReplace() && action == plans.Create {
+                        log.Printf("[TRACE] EvalDiff: %s treating Create change as %s change to match with earlier plan", absAddr, prevChange.Action)
+                        action = prevChange.Action
+                        priorVal = prevChange.Before
+                }
         }
 
         // Call post-refresh hook
         if !n.Stub {
-                err = ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PostDiff(n.Info, diff)
+                err := ctx.Hook(func(h Hook) (HookAction, error) {
+                        return h.PostDiff(absAddr, states.CurrentGen, action, priorVal, plannedNewVal)
                 })
                 if err != nil {
                         return nil, err
@@ -177,30 +421,135 @@ func (n *EvalDiff) Eval(ctx EvalContext) (interface{}, error) {
         }
 
         // Update our output if we care
-        if n.OutputDiff != nil {
-                *n.OutputDiff = diff
+        if n.OutputChange != nil {
+                *n.OutputChange = &plans.ResourceInstanceChange{
+                        Addr:         absAddr,
+                        Private:      plannedPrivate,
+                        ProviderAddr: n.ProviderAddr,
+                        Change: plans.Change{
+                                Action: action,
+                                Before: priorVal,
+                                After:  plannedNewVal,
+                        },
+                        RequiredReplace: reqRep,
+                }
+        }
+
+        if n.OutputValue != nil {
+                *n.OutputValue = configVal
         }
 
         // Update the state if we care
         if n.OutputState != nil {
-                *n.OutputState = state
-
-                // Merge our state so that the state is updated with our plan
-                if !diff.Empty() && n.OutputState != nil {
-                        *n.OutputState = state.MergeDiff(diff)
+                *n.OutputState = &states.ResourceInstanceObject{
+                        // We use the special "planned" status here to note that this
+                        // object's value is not yet complete. Objects with this status
+                        // cannot be used during expression evaluation, so the caller
+                        // must _also_ record the returned change in the active plan,
+                        // which the expression evaluator will use in preference to this
+                        // incomplete value recorded in the state.
+                        Status: states.ObjectPlanned,
+                        Value:  plannedNewVal,
                 }
         }
 
         return nil, nil
 }
 
-func (n *EvalDiff) processIgnoreChanges(diff *InstanceDiff) error {
-        if diff == nil || n.Resource == nil || n.Resource.Id() == "" {
+func (n *EvalDiff) processIgnoreChanges(prior, proposed cty.Value) (cty.Value, tfdiags.Diagnostics) {
+        // ignore_changes only applies when an object already exists, since we
+        // can't ignore changes to a thing we've not created yet.
+        if prior.IsNull() {
+                return proposed, nil
+        }
+
+        ignoreChanges := n.Config.Managed.IgnoreChanges
+        ignoreAll := n.Config.Managed.IgnoreAllChanges
+
+        if len(ignoreChanges) == 0 && !ignoreAll {
+                return proposed, nil
+        }
+        if ignoreAll {
+                return prior, nil
+        }
+        if prior.IsNull() || proposed.IsNull() {
+                // Ignore changes doesn't apply when we're creating for the first time.
+                // Proposed should never be null here, but if it is then we'll just let it be.
+                return proposed, nil
+        }
+
+        return processIgnoreChangesIndividual(prior, proposed, ignoreChanges)
+}
+
+func processIgnoreChangesIndividual(prior, proposed cty.Value, ignoreChanges []hcl.Traversal) (cty.Value, tfdiags.Diagnostics) {
+        // When we walk below we will be using cty.Path values for comparison, so
+        // we'll convert our traversals here so we can compare more easily.
+        ignoreChangesPath := make([]cty.Path, len(ignoreChanges))
+        for i, traversal := range ignoreChanges {
+                path := make(cty.Path, len(traversal))
+                for si, step := range traversal {
+                        switch ts := step.(type) {
+                        case hcl.TraverseRoot:
+                                path[si] = cty.GetAttrStep{
+                                        Name: ts.Name,
+                                }
+                        case hcl.TraverseAttr:
+                                path[si] = cty.GetAttrStep{
+                                        Name: ts.Name,
+                                }
+                        case hcl.TraverseIndex:
+                                path[si] = cty.IndexStep{
+                                        Key: ts.Key,
+                                }
+                        default:
+                                panic(fmt.Sprintf("unsupported traversal step %#v", step))
+                        }
+                }
+                ignoreChangesPath[i] = path
+        }
+
+        var diags tfdiags.Diagnostics
+        ret, _ := cty.Transform(proposed, func(path cty.Path, v cty.Value) (cty.Value, error) {
+                // First we must see if this is a path that's being ignored at all.
+                // We're looking for an exact match here because this walk will visit
+                // leaf values first and then their containers, and we want to do
+                // the "ignore" transform once we reach the point indicated, throwing
+                // away any deeper values we already produced at that point.
+                var ignoreTraversal hcl.Traversal
+                for i, candidate := range ignoreChangesPath {
+                        if reflect.DeepEqual(path, candidate) {
+                                ignoreTraversal = ignoreChanges[i]
+                        }
+                }
+                if ignoreTraversal == nil {
+                        return v, nil
+                }
+
+                // If we're able to follow the same path through the prior value,
+                // we'll take the value there instead, effectively undoing the
+                // change that was planned.
+                priorV, diags := hcl.ApplyPath(prior, path, nil)
+                if diags.HasErrors() {
+                        // We just ignore the errors and move on here, since we assume it's
+                        // just because the prior value was a slightly-different shape.
+                        // It could potentially also be that the traversal doesn't match
+                        // the schema, but we should've caught that during the validate
+                        // walk if so.
+                        return v, nil
+                }
+                return priorV, nil
+        })
+        return ret, diags
+}
+
+func (n *EvalDiff) processIgnoreChangesOld(diff *InstanceDiff) error {
+        if diff == nil || n.Config == nil || n.Config.Managed == nil {
                 return nil
         }
-        ignoreChanges := n.Resource.Lifecycle.IgnoreChanges
+        ignoreChanges := n.Config.Managed.IgnoreChanges
+        ignoreAll := n.Config.Managed.IgnoreAllChanges
 
-        if len(ignoreChanges) == 0 {
+        if len(ignoreChanges) == 0 && !ignoreAll {
                 return nil
         }
 
@@ -220,9 +569,14 @@ func (n *EvalDiff) processIgnoreChanges(diff *InstanceDiff) error {
 
         // get the complete set of keys we want to ignore
         ignorableAttrKeys := make(map[string]bool)
-        for _, ignoredKey := range ignoreChanges {
-                for k := range attrs {
-                        if ignoredKey == "*" || strings.HasPrefix(k, ignoredKey) {
+        for k := range attrs {
+                if ignoreAll {
+                        ignorableAttrKeys[k] = true
+                        continue
+                }
+                for _, ignoredTraversal := range ignoreChanges {
+                        ignoredKey := legacyFlatmapKeyForTraversal(ignoredTraversal)
+                        if k == ignoredKey || strings.HasPrefix(k, ignoredKey+".") {
                                 ignorableAttrKeys[k] = true
                         }
                 }
@@ -285,14 +639,56 @@ func (n *EvalDiff) processIgnoreChanges(diff *InstanceDiff) error {
 
         // If we didn't hit any of our early exit conditions, we can filter the diff.
         for k := range ignorableAttrKeys {
-                log.Printf("[DEBUG] [EvalIgnoreChanges] %s - Ignoring diff attribute: %s",
-                        n.Resource.Id(), k)
+                log.Printf("[DEBUG] [EvalIgnoreChanges] %s: Ignoring diff attribute: %s", n.Addr.String(), k)
                 diff.DelAttribute(k)
         }
 
         return nil
 }
 
+// legacyFlagmapKeyForTraversal constructs a key string compatible with what
+// the flatmap package would generate for an attribute addressable by the given
+// traversal.
+//
+// This is used only to shim references to attributes within the diff and
+// state structures, which have not (at the time of writing) yet been updated
+// to use the newer HCL-based representations.
+func legacyFlatmapKeyForTraversal(traversal hcl.Traversal) string {
+        var buf bytes.Buffer
+        first := true
+        for _, step := range traversal {
+                if !first {
+                        buf.WriteByte('.')
+                }
+                switch ts := step.(type) {
+                case hcl.TraverseRoot:
+                        buf.WriteString(ts.Name)
+                case hcl.TraverseAttr:
+                        buf.WriteString(ts.Name)
+                case hcl.TraverseIndex:
+                        val := ts.Key
+                        switch val.Type() {
+                        case cty.Number:
+                                bf := val.AsBigFloat()
+                                buf.WriteString(bf.String())
+                        case cty.String:
+                                s := val.AsString()
+                                buf.WriteString(s)
+                        default:
+                                // should never happen, since no other types appear in
+                                // traversals in practice.
+                                buf.WriteByte('?')
+                        }
+                default:
+                        // should never happen, since we've covered all of the types
+                        // that show up in parsed traversals in practice.
+                        buf.WriteByte('?')
+                }
+                first = false
+        }
+        return buf.String()
+}
+
 // a group of key-*ResourceAttrDiff pairs from the same flatmapped container
 type flatAttrDiff map[string]*ResourceAttrDiff
 
@@ -343,159 +739,213 @@ func groupContainers(d *InstanceDiff) map[string]flatAttrDiff {
 // EvalDiffDestroy is an EvalNode implementation that returns a plain
 // destroy diff.
 type EvalDiffDestroy struct {
-        Info   *InstanceInfo
-        State  **InstanceState
-        Output **InstanceDiff
+        Addr         addrs.ResourceInstance
+        DeposedKey   states.DeposedKey
+        State        **states.ResourceInstanceObject
+        ProviderAddr addrs.AbsProviderConfig
+
+        Output      **plans.ResourceInstanceChange
+        OutputState **states.ResourceInstanceObject
 }
 
 // TODO: test
 func (n *EvalDiffDestroy) Eval(ctx EvalContext) (interface{}, error) {
+        absAddr := n.Addr.Absolute(ctx.Path())
         state := *n.State
 
-        // If there is no state or we don't have an ID, we're already destroyed
-        if state == nil || state.ID == "" {
+        if n.ProviderAddr.ProviderConfig.Type == "" {
+                if n.DeposedKey == "" {
+                        panic(fmt.Sprintf("EvalDiffDestroy for %s does not have ProviderAddr set", absAddr))
+                } else {
+                        panic(fmt.Sprintf("EvalDiffDestroy for %s (deposed %s) does not have ProviderAddr set", absAddr, n.DeposedKey))
+                }
+        }
+
+        // If there is no state or our attributes object is null then we're already
+        // destroyed.
+        if state == nil || state.Value.IsNull() {
                 return nil, nil
         }
 
         // Call pre-diff hook
         err := ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PreDiff(n.Info, state)
+                return h.PreDiff(
+                        absAddr, n.DeposedKey.Generation(),
+                        state.Value,
+                        cty.NullVal(cty.DynamicPseudoType),
+                )
         })
         if err != nil {
                 return nil, err
         }
 
-        // The diff
-        diff := &InstanceDiff{Destroy: true}
+        // Change is always the same for a destroy. We don't need the provider's
+        // help for this one.
+        // TODO: Should we give the provider an opportunity to veto this?
+        change := &plans.ResourceInstanceChange{
+                Addr:       absAddr,
+                DeposedKey: n.DeposedKey,
+                Change: plans.Change{
+                        Action: plans.Delete,
+                        Before: state.Value,
+                        After:  cty.NullVal(cty.DynamicPseudoType),
+                },
+                ProviderAddr: n.ProviderAddr,
+        }
 
         // Call post-diff hook
         err = ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PostDiff(n.Info, diff)
+                return h.PostDiff(
+                        absAddr,
+                        n.DeposedKey.Generation(),
+                        change.Action,
+                        change.Before,
+                        change.After,
+                )
         })
         if err != nil {
                 return nil, err
         }
 
         // Update our output
-        *n.Output = diff
-
-        return nil, nil
-}
-
-// EvalDiffDestroyModule is an EvalNode implementation that writes the diff to
-// the full diff.
-type EvalDiffDestroyModule struct {
-        Path []string
-}
-
-// TODO: test
-func (n *EvalDiffDestroyModule) Eval(ctx EvalContext) (interface{}, error) {
-        diff, lock := ctx.Diff()
-
-        // Acquire the lock so that we can do this safely concurrently
-        lock.Lock()
-        defer lock.Unlock()
+        *n.Output = change
 
-        // Write the diff
-        modDiff := diff.ModuleByPath(n.Path)
-        if modDiff == nil {
-                modDiff = diff.AddModule(n.Path)
+        if n.OutputState != nil {
+                // Record our proposed new state, which is nil because we're destroying.
+                *n.OutputState = nil
         }
-        modDiff.Destroy = true
 
         return nil, nil
 }
 
-// EvalFilterDiff is an EvalNode implementation that filters the diff
-// according to some filter.
-type EvalFilterDiff struct {
-        // Input and output
-        Diff   **InstanceDiff
-        Output **InstanceDiff
-
-        // Destroy, if true, will only include a destroy diff if it is set.
-        Destroy bool
+// EvalReduceDiff is an EvalNode implementation that takes a planned resource
+// instance change as might be produced by EvalDiff or EvalDiffDestroy and
+// "simplifies" it to a single atomic action to be performed by a specific
+// graph node.
+//
+// Callers must specify whether they are a destroy node or a regular apply
+// node.  If the result is NoOp then the given change requires no action for
+// the specific graph node calling this and so evaluation of the that graph
+// node should exit early and take no action.
+//
+// The object written to OutChange may either be identical to InChange or
+// a new change object derived from InChange. Because of the former case, the
+// caller must not mutate the object returned in OutChange.
+type EvalReduceDiff struct {
+        Addr      addrs.ResourceInstance
+        InChange  **plans.ResourceInstanceChange
+        Destroy   bool
+        OutChange **plans.ResourceInstanceChange
 }
 
-func (n *EvalFilterDiff) Eval(ctx EvalContext) (interface{}, error) {
-        if *n.Diff == nil {
-                return nil, nil
-        }
-
-        input := *n.Diff
-        result := new(InstanceDiff)
-
-        if n.Destroy {
-                if input.GetDestroy() || input.RequiresNew() {
-                        result.SetDestroy(true)
+// TODO: test
+func (n *EvalReduceDiff) Eval(ctx EvalContext) (interface{}, error) {
+        in := *n.InChange
+        out := in.Simplify(n.Destroy)
+        if n.OutChange != nil {
+                *n.OutChange = out
+        }
+        if out.Action != in.Action {
+                if n.Destroy {
+                        log.Printf("[TRACE] EvalReduceDiff: %s change simplified from %s to %s for destroy node", n.Addr, in.Action, out.Action)
+                } else {
+                        log.Printf("[TRACE] EvalReduceDiff: %s change simplified from %s to %s for apply node", n.Addr, in.Action, out.Action)
                 }
         }
-
-        if n.Output != nil {
-                *n.Output = result
-        }
-
         return nil, nil
 }
 
-// EvalReadDiff is an EvalNode implementation that writes the diff to
-// the full diff.
+// EvalReadDiff is an EvalNode implementation that retrieves the planned
+// change for a particular resource instance object.
 type EvalReadDiff struct {
-        Name string
-        Diff **InstanceDiff
+        Addr           addrs.ResourceInstance
+        DeposedKey     states.DeposedKey
+        ProviderSchema **ProviderSchema
+        Change         **plans.ResourceInstanceChange
 }
 
 func (n *EvalReadDiff) Eval(ctx EvalContext) (interface{}, error) {
-        diff, lock := ctx.Diff()
+        providerSchema := *n.ProviderSchema
+        changes := ctx.Changes()
+        addr := n.Addr.Absolute(ctx.Path())
 
-        // Acquire the lock so that we can do this safely concurrently
-        lock.Lock()
-        defer lock.Unlock()
+        schema, _ := providerSchema.SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support resource type %q", n.Addr.Resource.Type)
+        }
 
-        // Write the diff
-        modDiff := diff.ModuleByPath(ctx.Path())
-        if modDiff == nil {
+        gen := states.CurrentGen
+        if n.DeposedKey != states.NotDeposed {
+                gen = n.DeposedKey
+        }
+        csrc := changes.GetResourceInstanceChange(addr, gen)
+        if csrc == nil {
+                log.Printf("[TRACE] EvalReadDiff: No planned change recorded for %s", addr)
                 return nil, nil
         }
 
-        *n.Diff = modDiff.Resources[n.Name]
+        change, err := csrc.Decode(schema.ImpliedType())
+        if err != nil {
+                return nil, fmt.Errorf("failed to decode planned changes for %s: %s", addr, err)
+        }
+        if n.Change != nil {
+                *n.Change = change
+        }
+
+        log.Printf("[TRACE] EvalReadDiff: Read %s change from plan for %s", change.Action, addr)
 
         return nil, nil
 }
 
-// EvalWriteDiff is an EvalNode implementation that writes the diff to
-// the full diff.
+// EvalWriteDiff is an EvalNode implementation that saves a planned change
+// for an instance object into the set of global planned changes.
 type EvalWriteDiff struct {
-        Name string
-        Diff **InstanceDiff
+        Addr           addrs.ResourceInstance
+        DeposedKey     states.DeposedKey
+        ProviderSchema **ProviderSchema
+        Change         **plans.ResourceInstanceChange
 }
 
 // TODO: test
 func (n *EvalWriteDiff) Eval(ctx EvalContext) (interface{}, error) {
-        diff, lock := ctx.Diff()
-
-        // The diff to write, if its empty it should write nil
-        var diffVal *InstanceDiff
-        if n.Diff != nil {
-                diffVal = *n.Diff
+        changes := ctx.Changes()
+        addr := n.Addr.Absolute(ctx.Path())
+        if n.Change == nil || *n.Change == nil {
+                // Caller sets nil to indicate that we need to remove a change from
+                // the set of changes.
+                gen := states.CurrentGen
+                if n.DeposedKey != states.NotDeposed {
+                        gen = n.DeposedKey
+                }
+                changes.RemoveResourceInstanceChange(addr, gen)
+                return nil, nil
         }
-        if diffVal.Empty() {
-                diffVal = nil
+
+        providerSchema := *n.ProviderSchema
+        change := *n.Change
+
+        if change.Addr.String() != addr.String() || change.DeposedKey != n.DeposedKey {
+                // Should never happen, and indicates a bug in the caller.
+                panic("inconsistent address and/or deposed key in EvalWriteDiff")
         }
 
-        // Acquire the lock so that we can do this safely concurrently
-        lock.Lock()
-        defer lock.Unlock()
+        schema, _ := providerSchema.SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support resource type %q", n.Addr.Resource.Type)
+        }
 
-        // Write the diff
-        modDiff := diff.ModuleByPath(ctx.Path())
-        if modDiff == nil {
-                modDiff = diff.AddModule(ctx.Path())
+        csrc, err := change.Encode(schema.ImpliedType())
+        if err != nil {
+                return nil, fmt.Errorf("failed to encode planned changes for %s: %s", addr, err)
         }
-        if diffVal != nil {
-                modDiff.Resources[n.Name] = diffVal
+
+        changes.AppendResourceInstanceChange(csrc)
+        if n.DeposedKey == states.NotDeposed {
+                log.Printf("[TRACE] EvalWriteDiff: recorded %s change for %s", change.Action, addr)
         } else {
-                delete(modDiff.Resources, n.Name)
+                log.Printf("[TRACE] EvalWriteDiff: recorded %s change for %s deposed object %s", change.Action, addr, n.DeposedKey)
         }
 
         return nil, nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_import_state.go b/vendor/github.com/hashicorp/terraform/terraform/eval_import_state.go
index 62cc581..a60f4a0 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_import_state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_import_state.go
@@ -2,47 +2,63 @@ package terraform
 
 import (
         "fmt"
+        "log"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalImportState is an EvalNode implementation that performs an
 // ImportState operation on a provider. This will return the imported
 // states but won't modify any actual state.
 type EvalImportState struct {
-        Provider *ResourceProvider
-        Info     *InstanceInfo
-        Id       string
-        Output   *[]*InstanceState
+        Addr     addrs.ResourceInstance
+        Provider *providers.Interface
+        ID       string
+        Output   *[]providers.ImportedResource
 }
 
 // TODO: test
 func (n *EvalImportState) Eval(ctx EvalContext) (interface{}, error) {
+        absAddr := n.Addr.Absolute(ctx.Path())
         provider := *n.Provider
+        var diags tfdiags.Diagnostics
 
         {
                 // Call pre-import hook
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PreImportState(n.Info, n.Id)
+                        return h.PreImportState(absAddr, n.ID)
                 })
                 if err != nil {
                         return nil, err
                 }
         }
 
-        // Import!
-        state, err := provider.ImportState(n.Info, n.Id)
-        if err != nil {
-                return nil, fmt.Errorf(
-                        "import %s (id: %s): %s", n.Info.HumanId(), n.Id, err)
+        resp := provider.ImportResourceState(providers.ImportResourceStateRequest{
+                TypeName: n.Addr.Resource.Type,
+                ID:       n.ID,
+        })
+        diags = diags.Append(resp.Diagnostics)
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        imported := resp.ImportedResources
+
+        for _, obj := range imported {
+                log.Printf("[TRACE] EvalImportState: import %s %q produced instance object of type %s", absAddr.String(), n.ID, obj.TypeName)
         }
 
         if n.Output != nil {
-                *n.Output = state
+                *n.Output = imported
         }
 
         {
                 // Call post-import hook
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
-                        return h.PostImportState(n.Info, state)
+                        return h.PostImportState(absAddr, imported)
                 })
                 if err != nil {
                         return nil, err
@@ -55,22 +71,25 @@ func (n *EvalImportState) Eval(ctx EvalContext) (interface{}, error) {
 // EvalImportStateVerify verifies the state after ImportState and
 // after the refresh to make sure it is non-nil and valid.
 type EvalImportStateVerify struct {
-        Info  *InstanceInfo
-        Id    string
-        State **InstanceState
+        Addr  addrs.ResourceInstance
+        State **states.ResourceInstanceObject
 }
 
 // TODO: test
 func (n *EvalImportStateVerify) Eval(ctx EvalContext) (interface{}, error) {
+        var diags tfdiags.Diagnostics
+
         state := *n.State
-        if state.Empty() {
-                return nil, fmt.Errorf(
-                        "import %s (id: %s): Terraform detected a resource with this ID doesn't\n"+
-                                "exist. Please verify the ID is correct. You cannot import non-existent\n"+
-                                "resources using Terraform import.",
-                        n.Info.HumanId(),
-                        n.Id)
+        if state.Value.IsNull() {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Cannot import non-existent remote object",
+                        fmt.Sprintf(
+                                "While attempting to import an existing object to %s, the provider detected that no object exists with the given id. Only pre-existing objects can be imported; check that the id is correct and that it is associated with the provider's configured region or endpoint, or use \"terraform apply\" to create a new remote object for this resource.",
+                                n.Addr.String(),
+                        ),
+                ))
         }
 
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_interpolate.go b/vendor/github.com/hashicorp/terraform/terraform/eval_interpolate.go
deleted file mode 100644
index 6a78a6b..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_interpolate.go
+++ /dev/null
@@ -1,56 +0,0 @@
-package terraform
-
-import (
-        "log"
-
-        "github.com/hashicorp/terraform/config"
-)
-
-// EvalInterpolate is an EvalNode implementation that takes a raw
-// configuration and interpolates it.
-type EvalInterpolate struct {
-        Config        *config.RawConfig
-        Resource      *Resource
-        Output        **ResourceConfig
-        ContinueOnErr bool
-}
-
-func (n *EvalInterpolate) Eval(ctx EvalContext) (interface{}, error) {
-        rc, err := ctx.Interpolate(n.Config, n.Resource)
-        if err != nil {
-                if n.ContinueOnErr {
-                        log.Printf("[WARN] Interpolation %q failed: %s", n.Config.Key, err)
-                        return nil, EvalEarlyExitError{}
-                }
-                return nil, err
-        }
-
-        if n.Output != nil {
-                *n.Output = rc
-        }
-
-        return nil, nil
-}
-
-// EvalInterpolateProvider is an EvalNode implementation that takes a
-// ProviderConfig and interpolates it. Provider configurations are the only
-// "inherited" type of configuration we have, and the original raw config may
-// have a different interpolation scope.
-type EvalInterpolateProvider struct {
-        Config   *config.ProviderConfig
-        Resource *Resource
-        Output   **ResourceConfig
-}
-
-func (n *EvalInterpolateProvider) Eval(ctx EvalContext) (interface{}, error) {
-        rc, err := ctx.InterpolateProvider(n.Config, n.Resource)
-        if err != nil {
-                return nil, err
-        }
-
-        if n.Output != nil {
-                *n.Output = rc
-        }
-
-        return nil, nil
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_lang.go b/vendor/github.com/hashicorp/terraform/terraform/eval_lang.go
new file mode 100644
index 0000000..0c051f7
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_lang.go
@@ -0,0 +1,61 @@
+package terraform
+
+import (
+        "log"
+
+        "github.com/hashicorp/terraform/addrs"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// EvalConfigBlock is an EvalNode implementation that takes a raw
+// configuration block and evaluates any expressions within it.
+//
+// ExpandedConfig is populated with the result of expanding any "dynamic"
+// blocks in the given body, which can be useful for extracting correct source
+// location information for specific attributes in the result.
+type EvalConfigBlock struct {
+        Config         *hcl.Body
+        Schema         *configschema.Block
+        SelfAddr       addrs.Referenceable
+        Output         *cty.Value
+        ExpandedConfig *hcl.Body
+        ContinueOnErr  bool
+}
+
+func (n *EvalConfigBlock) Eval(ctx EvalContext) (interface{}, error) {
+        val, body, diags := ctx.EvaluateBlock(*n.Config, n.Schema, n.SelfAddr, EvalDataForNoInstanceKey)
+        if diags.HasErrors() && n.ContinueOnErr {
+                log.Printf("[WARN] Block evaluation failed: %s", diags.Err())
+                return nil, EvalEarlyExitError{}
+        }
+
+        if n.Output != nil {
+                *n.Output = val
+        }
+        if n.ExpandedConfig != nil {
+                *n.ExpandedConfig = body
+        }
+
+        return nil, diags.ErrWithWarnings()
+}
+
+// EvalConfigExpr is an EvalNode implementation that takes a raw configuration
+// expression and evaluates it.
+type EvalConfigExpr struct {
+        Expr     hcl.Expression
+        SelfAddr addrs.Referenceable
+        Output   *cty.Value
+}
+
+func (n *EvalConfigExpr) Eval(ctx EvalContext) (interface{}, error) {
+        val, diags := ctx.EvaluateExpr(n.Expr, cty.DynamicPseudoType, n.SelfAddr)
+
+        if n.Output != nil {
+                *n.Output = val
+        }
+
+        return nil, diags.ErrWithWarnings()
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_local.go b/vendor/github.com/hashicorp/terraform/terraform/eval_local.go
index a4b2a50..bad9ac5 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_local.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_local.go
@@ -3,56 +3,55 @@ package terraform
 import (
         "fmt"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalLocal is an EvalNode implementation that evaluates the
 // expression for a local value and writes it into a transient part of
 // the state.
 type EvalLocal struct {
-        Name  string
-        Value *config.RawConfig
+        Addr addrs.LocalValue
+        Expr hcl.Expression
 }
 
 func (n *EvalLocal) Eval(ctx EvalContext) (interface{}, error) {
-        cfg, err := ctx.Interpolate(n.Value, nil)
-        if err != nil {
-                return nil, fmt.Errorf("local.%s: %s", n.Name, err)
+        var diags tfdiags.Diagnostics
+
+        // We ignore diags here because any problems we might find will be found
+        // again in EvaluateExpr below.
+        refs, _ := lang.ReferencesInExpr(n.Expr)
+        for _, ref := range refs {
+                if ref.Subject == n.Addr {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Self-referencing local value",
+                                Detail:   fmt.Sprintf("Local value %s cannot use its own result as part of its expression.", n.Addr),
+                                Subject:  ref.SourceRange.ToHCL().Ptr(),
+                                Context:  n.Expr.Range().Ptr(),
+                        })
+                }
         }
-
-        state, lock := ctx.State()
-        if state == nil {
-                return nil, fmt.Errorf("cannot write local value to nil state")
+        if diags.HasErrors() {
+                return nil, diags.Err()
         }
 
-        // Get a write lock so we can access the state
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Look for the module state. If we don't have one, create it.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                mod = state.AddModule(ctx.Path())
+        val, moreDiags := ctx.EvaluateExpr(n.Expr, cty.DynamicPseudoType, nil)
+        diags = diags.Append(moreDiags)
+        if moreDiags.HasErrors() {
+                return nil, diags.Err()
         }
 
-        // Get the value from the config
-        var valueRaw interface{} = config.UnknownVariableValue
-        if cfg != nil {
-                var ok bool
-                valueRaw, ok = cfg.Get("value")
-                if !ok {
-                        valueRaw = ""
-                }
-                if cfg.IsComputed("value") {
-                        valueRaw = config.UnknownVariableValue
-                }
+        state := ctx.State()
+        if state == nil {
+                return nil, fmt.Errorf("cannot write local value to nil state")
         }
 
-        if mod.Locals == nil {
-                // initialize
-                mod.Locals = map[string]interface{}{}
-        }
-        mod.Locals[n.Name] = valueRaw
+        state.SetLocalValue(n.Addr.Absolute(ctx.Path()), val)
 
         return nil, nil
 }
@@ -61,26 +60,15 @@ func (n *EvalLocal) Eval(ctx EvalContext) (interface{}, error) {
 // from the state. Locals aren't persisted, but we don't need to evaluate them
 // during destroy.
 type EvalDeleteLocal struct {
-        Name string
+        Addr addrs.LocalValue
 }
 
 func (n *EvalDeleteLocal) Eval(ctx EvalContext) (interface{}, error) {
-        state, lock := ctx.State()
+        state := ctx.State()
         if state == nil {
                 return nil, nil
         }
 
-        // Get a write lock so we can access this instance
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Look for the module state. If we don't have one, create it.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                return nil, nil
-        }
-
-        delete(mod.Locals, n.Name)
-
+        state.RemoveLocalValue(n.Addr.Absolute(ctx.Path()))
         return nil, nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_output.go b/vendor/github.com/hashicorp/terraform/terraform/eval_output.go
index a834627..1057397 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_output.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_output.go
@@ -4,131 +4,132 @@ import (
         "fmt"
         "log"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/states"
 )
 
 // EvalDeleteOutput is an EvalNode implementation that deletes an output
 // from the state.
 type EvalDeleteOutput struct {
-        Name string
+        Addr addrs.OutputValue
 }
 
 // TODO: test
 func (n *EvalDeleteOutput) Eval(ctx EvalContext) (interface{}, error) {
-        state, lock := ctx.State()
+        state := ctx.State()
         if state == nil {
                 return nil, nil
         }
 
-        // Get a write lock so we can access this instance
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Look for the module state. If we don't have one, create it.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                return nil, nil
-        }
-
-        delete(mod.Outputs, n.Name)
-
+        state.RemoveOutputValue(n.Addr.Absolute(ctx.Path()))
         return nil, nil
 }
 
 // EvalWriteOutput is an EvalNode implementation that writes the output
 // for the given name to the current state.
 type EvalWriteOutput struct {
-        Name      string
+        Addr      addrs.OutputValue
         Sensitive bool
-        Value     *config.RawConfig
+        Expr      hcl.Expression
         // ContinueOnErr allows interpolation to fail during Input
         ContinueOnErr bool
 }
 
 // TODO: test
 func (n *EvalWriteOutput) Eval(ctx EvalContext) (interface{}, error) {
-        // This has to run before we have a state lock, since interpolation also
+        addr := n.Addr.Absolute(ctx.Path())
+
+        // This has to run before we have a state lock, since evaluation also
         // reads the state
-        cfg, err := ctx.Interpolate(n.Value, nil)
-        // handle the error after we have the module from the state
+        val, diags := ctx.EvaluateExpr(n.Expr, cty.DynamicPseudoType, nil)
+        // We'll handle errors below, after we have loaded the module.
 
-        state, lock := ctx.State()
+        state := ctx.State()
         if state == nil {
-                return nil, fmt.Errorf("cannot write state to nil state")
+                return nil, nil
         }
 
-        // Get a write lock so we can access this instance
-        lock.Lock()
-        defer lock.Unlock()
-        // Look for the module state. If we don't have one, create it.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                mod = state.AddModule(ctx.Path())
-        }
+        changes := ctx.Changes() // may be nil, if we're not working on a changeset
 
         // handling the interpolation error
-        if err != nil {
+        if diags.HasErrors() {
                 if n.ContinueOnErr || flagWarnOutputErrors {
-                        log.Printf("[ERROR] Output interpolation %q failed: %s", n.Name, err)
+                        log.Printf("[ERROR] Output interpolation %q failed: %s", n.Addr.Name, diags.Err())
                         // if we're continuing, make sure the output is included, and
-                        // marked as unknown
-                        mod.Outputs[n.Name] = &OutputState{
-                                Type:  "string",
-                                Value: config.UnknownVariableValue,
-                        }
+                        // marked as unknown. If the evaluator was able to find a type
+                        // for the value in spite of the error then we'll use it.
+                        n.setValue(addr, state, changes, cty.UnknownVal(val.Type()))
                         return nil, EvalEarlyExitError{}
                 }
-                return nil, err
+                return nil, diags.Err()
         }
 
-        // Get the value from the config
-        var valueRaw interface{} = config.UnknownVariableValue
-        if cfg != nil {
-                var ok bool
-                valueRaw, ok = cfg.Get("value")
-                if !ok {
-                        valueRaw = ""
-                }
-                if cfg.IsComputed("value") {
-                        valueRaw = config.UnknownVariableValue
-                }
+        n.setValue(addr, state, changes, val)
+
+        return nil, nil
+}
+
+func (n *EvalWriteOutput) setValue(addr addrs.AbsOutputValue, state *states.SyncState, changes *plans.ChangesSync, val cty.Value) {
+        if val.IsKnown() && !val.IsNull() {
+                // The state itself doesn't represent unknown values, so we null them
+                // out here and then we'll save the real unknown value in the planned
+                // changeset below, if we have one on this graph walk.
+                log.Printf("[TRACE] EvalWriteOutput: Saving value for %s in state", addr)
+                stateVal := cty.UnknownAsNull(val)
+                state.SetOutputValue(addr, stateVal, n.Sensitive)
+        } else {
+                log.Printf("[TRACE] EvalWriteOutput: Removing %s from state (it is now null)", addr)
+                state.RemoveOutputValue(addr)
         }
 
-        switch valueTyped := valueRaw.(type) {
-        case string:
-                mod.Outputs[n.Name] = &OutputState{
-                        Type:      "string",
-                        Sensitive: n.Sensitive,
-                        Value:     valueTyped,
-                }
-        case []interface{}:
-                mod.Outputs[n.Name] = &OutputState{
-                        Type:      "list",
-                        Sensitive: n.Sensitive,
-                        Value:     valueTyped,
-                }
-        case map[string]interface{}:
-                mod.Outputs[n.Name] = &OutputState{
-                        Type:      "map",
-                        Sensitive: n.Sensitive,
-                        Value:     valueTyped,
-                }
-        case []map[string]interface{}:
-                // an HCL map is multi-valued, so if this was read out of a config the
-                // map may still be in a slice.
-                if len(valueTyped) == 1 {
-                        mod.Outputs[n.Name] = &OutputState{
-                                Type:      "map",
+        // If we also have an active changeset then we'll replicate the value in
+        // there. This is used in preference to the state where present, since it
+        // *is* able to represent unknowns, while the state cannot.
+        if changes != nil {
+                // For the moment we are not properly tracking changes to output
+                // values, and just marking them always as "Create" or "Destroy"
+                // actions. A future release will rework the output lifecycle so we
+                // can track their changes properly, in a similar way to how we work
+                // with resource instances.
+
+                var change *plans.OutputChange
+                if !val.IsNull() {
+                        change = &plans.OutputChange{
+                                Addr:      addr,
                                 Sensitive: n.Sensitive,
-                                Value:     valueTyped[0],
+                                Change: plans.Change{
+                                        Action: plans.Create,
+                                        Before: cty.NullVal(cty.DynamicPseudoType),
+                                        After:  val,
+                                },
+                        }
+                } else {
+                        change = &plans.OutputChange{
+                                Addr:      addr,
+                                Sensitive: n.Sensitive,
+                                Change: plans.Change{
+                                        // This is just a weird placeholder delete action since
+                                        // we don't have an actual prior value to indicate.
+                                        // FIXME: Generate real planned changes for output values
+                                        // that include the old values.
+                                        Action: plans.Delete,
+                                        Before: cty.NullVal(cty.DynamicPseudoType),
+                                        After:  cty.NullVal(cty.DynamicPseudoType),
+                                },
                         }
-                        break
                 }
-                return nil, fmt.Errorf("output %s type (%T) with %d values not valid for type map",
-                        n.Name, valueTyped, len(valueTyped))
-        default:
-                return nil, fmt.Errorf("output %s is not a valid type (%T)\n", n.Name, valueTyped)
-        }
 
-        return nil, nil
+                cs, err := change.Encode()
+                if err != nil {
+                        // Should never happen, since we just constructed this right above
+                        panic(fmt.Sprintf("planned change for %s could not be encoded: %s", addr, err))
+                }
+                log.Printf("[TRACE] EvalWriteOutput: Saving %s change for %s in changeset", change.Action, addr)
+                changes.RemoveOutputChange(addr) // remove any existing planned change, if present
+                changes.AppendOutputChange(cs)   // add the new planned change
+        }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_provider.go b/vendor/github.com/hashicorp/terraform/terraform/eval_provider.go
index 61f6ff9..7df6584 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_provider.go
@@ -2,50 +2,86 @@ package terraform
 
 import (
         "fmt"
+        "log"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/hcl2/hcl"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
-// EvalBuildProviderConfig outputs a *ResourceConfig that is properly
-// merged with parents and inputs on top of what is configured in the file.
-type EvalBuildProviderConfig struct {
-        Provider string
-        Config   **ResourceConfig
-        Output   **ResourceConfig
-}
+func buildProviderConfig(ctx EvalContext, addr addrs.ProviderConfig, config *configs.Provider) hcl.Body {
+        var configBody hcl.Body
+        if config != nil {
+                configBody = config.Config
+        }
 
-func (n *EvalBuildProviderConfig) Eval(ctx EvalContext) (interface{}, error) {
-        cfg := *n.Config
-
-        // If we have an Input configuration set, then merge that in
-        if input := ctx.ProviderInput(n.Provider); input != nil {
-                // "input" is a map of the subset of config values that were known
-                // during the input walk, set by EvalInputProvider. Note that
-                // in particular it does *not* include attributes that had
-                // computed values at input time; those appear *only* in
-                // "cfg" here.
-                rc, err := config.NewRawConfig(input)
-                if err != nil {
-                        return nil, err
-                }
-
-                merged := rc.Merge(cfg.raw)
-                cfg = NewResourceConfig(merged)
+        var inputBody hcl.Body
+        inputConfig := ctx.ProviderInput(addr)
+        if len(inputConfig) > 0 {
+                inputBody = configs.SynthBody("<input-prompt>", inputConfig)
         }
 
-        *n.Output = cfg
-        return nil, nil
+        switch {
+        case configBody != nil && inputBody != nil:
+                log.Printf("[TRACE] buildProviderConfig for %s: merging explicit config and input", addr)
+                // Note that the inputBody is the _base_ here, because configs.MergeBodies
+                // expects the base have all of the required fields, while these are
+                // forced to be optional for the override. The input process should
+                // guarantee that we have a value for each of the required arguments and
+                // that in practice the sets of attributes in each body will be
+                // disjoint.
+                return configs.MergeBodies(inputBody, configBody)
+        case configBody != nil:
+                log.Printf("[TRACE] buildProviderConfig for %s: using explicit config only", addr)
+                return configBody
+        case inputBody != nil:
+                log.Printf("[TRACE] buildProviderConfig for %s: using input only", addr)
+                return inputBody
+        default:
+                log.Printf("[TRACE] buildProviderConfig for %s: no configuration at all", addr)
+                return hcl.EmptyBody()
+        }
 }
 
 // EvalConfigProvider is an EvalNode implementation that configures
 // a provider that is already initialized and retrieved.
 type EvalConfigProvider struct {
-        Provider string
-        Config   **ResourceConfig
+        Addr     addrs.ProviderConfig
+        Provider *providers.Interface
+        Config   *configs.Provider
 }
 
 func (n *EvalConfigProvider) Eval(ctx EvalContext) (interface{}, error) {
-        return nil, ctx.ConfigureProvider(n.Provider, *n.Config)
+        if n.Provider == nil {
+                return nil, fmt.Errorf("EvalConfigProvider Provider is nil")
+        }
+
+        var diags tfdiags.Diagnostics
+        provider := *n.Provider
+        config := n.Config
+
+        configBody := buildProviderConfig(ctx, n.Addr, config)
+
+        resp := provider.GetSchema()
+        diags = diags.Append(resp.Diagnostics)
+        if diags.HasErrors() {
+                return nil, diags.NonFatalErr()
+        }
+
+        configSchema := resp.Provider.Block
+        configVal, configBody, evalDiags := ctx.EvaluateBlock(configBody, configSchema, nil, EvalDataForNoInstanceKey)
+        diags = diags.Append(evalDiags)
+        if evalDiags.HasErrors() {
+                return nil, diags.NonFatalErr()
+        }
+
+        configDiags := ctx.ConfigureProvider(n.Addr, configVal)
+        configDiags = configDiags.InConfigBody(configBody)
+
+        return nil, configDiags.ErrWithWarnings()
 }
 
 // EvalInitProvider is an EvalNode implementation that initializes a provider
@@ -53,85 +89,59 @@ func (n *EvalConfigProvider) Eval(ctx EvalContext) (interface{}, error) {
 // EvalGetProvider node.
 type EvalInitProvider struct {
         TypeName string
-        Name     string
+        Addr     addrs.ProviderConfig
 }
 
 func (n *EvalInitProvider) Eval(ctx EvalContext) (interface{}, error) {
-        return ctx.InitProvider(n.TypeName, n.Name)
+        return ctx.InitProvider(n.TypeName, n.Addr)
 }
 
 // EvalCloseProvider is an EvalNode implementation that closes provider
 // connections that aren't needed anymore.
 type EvalCloseProvider struct {
-        Name string
+        Addr addrs.ProviderConfig
 }
 
 func (n *EvalCloseProvider) Eval(ctx EvalContext) (interface{}, error) {
-        ctx.CloseProvider(n.Name)
+        ctx.CloseProvider(n.Addr)
         return nil, nil
 }
 
 // EvalGetProvider is an EvalNode implementation that retrieves an already
 // initialized provider instance for the given name.
+//
+// Unlike most eval nodes, this takes an _absolute_ provider configuration,
+// because providers can be passed into and inherited between modules.
+// Resource nodes must therefore know the absolute path of the provider they
+// will use, which is usually accomplished by implementing
+// interface GraphNodeProviderConsumer.
 type EvalGetProvider struct {
-        Name   string
-        Output *ResourceProvider
+        Addr   addrs.AbsProviderConfig
+        Output *providers.Interface
+
+        // If non-nil, Schema will be updated after eval to refer to the
+        // schema of the provider.
+        Schema **ProviderSchema
 }
 
 func (n *EvalGetProvider) Eval(ctx EvalContext) (interface{}, error) {
-        result := ctx.Provider(n.Name)
+        if n.Addr.ProviderConfig.Type == "" {
+                // Should never happen
+                panic("EvalGetProvider used with uninitialized provider configuration address")
+        }
+
+        result := ctx.Provider(n.Addr)
         if result == nil {
-                return nil, fmt.Errorf("provider %s not initialized", n.Name)
+                return nil, fmt.Errorf("provider %s not initialized", n.Addr)
         }
 
         if n.Output != nil {
                 *n.Output = result
         }
 
-        return nil, nil
-}
-
-// EvalInputProvider is an EvalNode implementation that asks for input
-// for the given provider configurations.
-type EvalInputProvider struct {
-        Name     string
-        Provider *ResourceProvider
-        Config   **ResourceConfig
-}
-
-func (n *EvalInputProvider) Eval(ctx EvalContext) (interface{}, error) {
-        rc := *n.Config
-        orig := rc.DeepCopy()
-
-        // Wrap the input into a namespace
-        input := &PrefixUIInput{
-                IdPrefix:    fmt.Sprintf("provider.%s", n.Name),
-                QueryPrefix: fmt.Sprintf("provider.%s.", n.Name),
-                UIInput:     ctx.Input(),
-        }
-
-        // Go through each provider and capture the input necessary
-        // to satisfy it.
-        config, err := (*n.Provider).Input(input, rc)
-        if err != nil {
-                return nil, fmt.Errorf(
-                        "Error configuring %s: %s", n.Name, err)
+        if n.Schema != nil {
+                *n.Schema = ctx.ProviderSchema(n.Addr)
         }
 
-        // We only store values that have changed through Input.
-        // The goal is to cache cache input responses, not to provide a complete
-        // config for other providers.
-        confMap := make(map[string]interface{})
-        if config != nil && len(config.Config) > 0 {
-                // any values that weren't in the original ResourcConfig will be cached
-                for k, v := range config.Config {
-                        if _, ok := orig.Config[k]; !ok {
-                                confMap[k] = v
-                        }
-                }
-        }
-
-        ctx.SetProviderInput(n.Name, confMap)
-
         return nil, nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_provisioner.go b/vendor/github.com/hashicorp/terraform/terraform/eval_provisioner.go
index 89579c0..bc6b5cc 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_provisioner.go
@@ -2,6 +2,9 @@ package terraform
 
 import (
         "fmt"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/provisioners"
 )
 
 // EvalInitProvisioner is an EvalNode implementation that initializes a provisioner
@@ -30,7 +33,8 @@ func (n *EvalCloseProvisioner) Eval(ctx EvalContext) (interface{}, error) {
 // initialized provisioner instance for the given name.
 type EvalGetProvisioner struct {
         Name   string
-        Output *ResourceProvisioner
+        Output *provisioners.Interface
+        Schema **configschema.Block
 }
 
 func (n *EvalGetProvisioner) Eval(ctx EvalContext) (interface{}, error) {
@@ -43,5 +47,9 @@ func (n *EvalGetProvisioner) Eval(ctx EvalContext) (interface{}, error) {
                 *n.Output = result
         }
 
+        if n.Schema != nil {
+                *n.Schema = ctx.ProvisionerSchema(n.Name)
+        }
+
         return result, nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_read_data.go b/vendor/github.com/hashicorp/terraform/terraform/eval_read_data.go
index fb85a28..34f2d60 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_read_data.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_read_data.go
@@ -2,105 +2,320 @@ package terraform
 
 import (
         "fmt"
+        "log"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/plans/objchange"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
-// EvalReadDataDiff is an EvalNode implementation that executes a data
-// resource's ReadDataDiff method to discover what attributes it exports.
-type EvalReadDataDiff struct {
-        Provider    *ResourceProvider
-        Output      **InstanceDiff
-        OutputState **InstanceState
-        Config      **ResourceConfig
-        Info        *InstanceInfo
-
-        // Set Previous when re-evaluating diff during apply, to ensure that
-        // the "Destroy" flag is preserved.
-        Previous **InstanceDiff
+// EvalReadData is an EvalNode implementation that deals with the main part
+// of the data resource lifecycle: either actually reading from the data source
+// or generating a plan to do so.
+type EvalReadData struct {
+        Addr           addrs.ResourceInstance
+        Config         *configs.Resource
+        Dependencies   []addrs.Referenceable
+        Provider       *providers.Interface
+        ProviderAddr   addrs.AbsProviderConfig
+        ProviderSchema **ProviderSchema
+
+        // Planned is set when dealing with data resources that were deferred to
+        // the apply walk, to let us see what was planned. If this is set, the
+        // evaluation of the config is required to produce a wholly-known
+        // configuration which is consistent with the partial object included
+        // in this planned change.
+        Planned **plans.ResourceInstanceChange
+
+        // ForcePlanRead, if true, overrides the usual behavior of immediately
+        // reading from the data source where possible, instead forcing us to
+        // _always_ generate a plan. This is used during the plan walk, since we
+        // mustn't actually apply anything there. (The resulting state doesn't
+        // get persisted)
+        ForcePlanRead bool
+
+        // The result from this EvalNode has a few different possibilities
+        // depending on the input:
+        // - If Planned is nil then we assume we're aiming to _produce_ the plan,
+        //   and so the following two outcomes are possible:
+        //     - OutputChange.Action is plans.NoOp and OutputState is the complete
+        //       result of reading from the data source. This is the easy path.
+        //     - OutputChange.Action is plans.Read and OutputState is a planned
+        //       object placeholder (states.ObjectPlanned). In this case, the
+        //       returned change must be recorded in the overral changeset and
+        //       eventually passed to another instance of this struct during the
+        //       apply walk.
+        // - If Planned is non-nil then we assume we're aiming to complete a
+        //   planned read from an earlier plan walk. In this case the only possible
+        //   non-error outcome is to set Output.Action (if non-nil) to a plans.NoOp
+        //   change and put the complete resulting state in OutputState, ready to
+        //   be saved in the overall state and used for expression evaluation.
+        OutputChange      **plans.ResourceInstanceChange
+        OutputValue       *cty.Value
+        OutputConfigValue *cty.Value
+        OutputState       **states.ResourceInstanceObject
 }
 
-func (n *EvalReadDataDiff) Eval(ctx EvalContext) (interface{}, error) {
-        // TODO: test
+func (n *EvalReadData) Eval(ctx EvalContext) (interface{}, error) {
+        absAddr := n.Addr.Absolute(ctx.Path())
+        log.Printf("[TRACE] EvalReadData: working on %s", absAddr)
 
-        err := ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PreDiff(n.Info, nil)
-        })
-        if err != nil {
-                return nil, err
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                return nil, fmt.Errorf("provider schema not available for %s", n.Addr)
         }
 
-        var diff *InstanceDiff
+        var diags tfdiags.Diagnostics
+        var change *plans.ResourceInstanceChange
+        var configVal cty.Value
 
-        if n.Previous != nil && *n.Previous != nil && (*n.Previous).GetDestroy() {
-                // If we're re-diffing for a diff that was already planning to
-                // destroy, then we'll just continue with that plan.
-                diff = &InstanceDiff{Destroy: true}
-        } else {
-                provider := *n.Provider
-                config := *n.Config
+        // TODO: Do we need to handle Delete changes here? EvalReadDataDiff and
+        // EvalReadDataApply did, but it seems like we should handle that via a
+        // separate mechanism since it boils down to just deleting the object from
+        // the state... and we do that on every plan anyway, forcing the data
+        // resource to re-read.
 
-                var err error
-                diff, err = provider.ReadDataDiff(n.Info, config)
+        config := *n.Config
+        provider := *n.Provider
+        providerSchema := *n.ProviderSchema
+        schema, _ := providerSchema.SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider %q does not support data source %q", n.ProviderAddr.ProviderConfig.Type, n.Addr.Resource.Type)
+        }
+
+        // We'll always start by evaluating the configuration. What we do after
+        // that will depend on the evaluation result along with what other inputs
+        // we were given.
+        objTy := schema.ImpliedType()
+        priorVal := cty.NullVal(objTy) // for data resources, prior is always null because we start fresh every time
+
+        keyData := EvalDataForInstanceKey(n.Addr.Key)
+
+        var configDiags tfdiags.Diagnostics
+        configVal, _, configDiags = ctx.EvaluateBlock(config.Config, schema, nil, keyData)
+        diags = diags.Append(configDiags)
+        if configDiags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        proposedNewVal := objchange.PlannedDataResourceObject(schema, configVal)
+
+        // If our configuration contains any unknown values then we must defer the
+        // read to the apply phase by producing a "Read" change for this resource,
+        // and a placeholder value for it in the state.
+        if n.ForcePlanRead || !configVal.IsWhollyKnown() {
+                // If the configuration is still unknown when we're applying a planned
+                // change then that indicates a bug in Terraform, since we should have
+                // everything resolved by now.
+                if n.Planned != nil && *n.Planned != nil {
+                        return nil, fmt.Errorf(
+                                "configuration for %s still contains unknown values during apply (this is a bug in Terraform; please report it!)",
+                                absAddr,
+                        )
+                }
+                if n.ForcePlanRead {
+                        log.Printf("[TRACE] EvalReadData: %s configuration is fully known, but we're forcing a read plan to be created", absAddr)
+                } else {
+                        log.Printf("[TRACE] EvalReadData: %s configuration not fully known yet, so deferring to apply phase", absAddr)
+                }
+
+                err := ctx.Hook(func(h Hook) (HookAction, error) {
+                        return h.PreDiff(absAddr, states.CurrentGen, priorVal, proposedNewVal)
+                })
                 if err != nil {
                         return nil, err
                 }
-                if diff == nil {
-                        diff = new(InstanceDiff)
+
+                change = &plans.ResourceInstanceChange{
+                        Addr:         absAddr,
+                        ProviderAddr: n.ProviderAddr,
+                        Change: plans.Change{
+                                Action: plans.Read,
+                                Before: priorVal,
+                                After:  proposedNewVal,
+                        },
                 }
 
-                // if id isn't explicitly set then it's always computed, because we're
-                // always "creating a new resource".
-                diff.init()
-                if _, ok := diff.Attributes["id"]; !ok {
-                        diff.SetAttribute("id", &ResourceAttrDiff{
-                                Old:         "",
-                                NewComputed: true,
-                                RequiresNew: true,
-                                Type:        DiffAttrOutput,
-                        })
+                err = ctx.Hook(func(h Hook) (HookAction, error) {
+                        return h.PostDiff(absAddr, states.CurrentGen, change.Action, priorVal, proposedNewVal)
+                })
+                if err != nil {
+                        return nil, err
+                }
+
+                if n.OutputChange != nil {
+                        *n.OutputChange = change
+                }
+                if n.OutputValue != nil {
+                        *n.OutputValue = change.After
+                }
+                if n.OutputConfigValue != nil {
+                        *n.OutputConfigValue = configVal
                 }
+                if n.OutputState != nil {
+                        state := &states.ResourceInstanceObject{
+                                Value:        change.After,
+                                Status:       states.ObjectPlanned, // because the partial value in the plan must be used for now
+                                Dependencies: n.Dependencies,
+                        }
+                        *n.OutputState = state
+                }
+
+                return nil, diags.ErrWithWarnings()
         }
 
-        err = ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PostDiff(n.Info, diff)
+        if n.Planned != nil && *n.Planned != nil && (*n.Planned).Action != plans.Read {
+                // If any other action gets in here then that's always a bug; this
+                // EvalNode only deals with reading.
+                return nil, fmt.Errorf(
+                        "invalid action %s for %s: only Read is supported (this is a bug in Terraform; please report it!)",
+                        (*n.Planned).Action, absAddr,
+                )
+        }
+
+        // If we get down here then our configuration is complete and we're read
+        // to actually call the provider to read the data.
+        log.Printf("[TRACE] EvalReadData: %s configuration is complete, so reading from provider", absAddr)
+
+        err := ctx.Hook(func(h Hook) (HookAction, error) {
+                // We don't have a state yet, so we'll just give the hook an
+                // empty one to work with.
+                return h.PreRefresh(absAddr, states.CurrentGen, cty.NullVal(cty.DynamicPseudoType))
         })
         if err != nil {
                 return nil, err
         }
 
-        *n.Output = diff
+        resp := provider.ReadDataSource(providers.ReadDataSourceRequest{
+                TypeName: n.Addr.Resource.Type,
+                Config:   configVal,
+        })
+        diags = diags.Append(resp.Diagnostics.InConfigBody(n.Config.Config))
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+        newVal := resp.State
+        if newVal == cty.NilVal {
+                // This can happen with incompletely-configured mocks. We'll allow it
+                // and treat it as an alias for a properly-typed null value.
+                newVal = cty.NullVal(schema.ImpliedType())
+        }
+
+        for _, err := range newVal.Type().TestConformance(schema.ImpliedType()) {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced invalid object",
+                        fmt.Sprintf(
+                                "Provider %q produced an invalid value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatErrorPrefixed(err, absAddr.String()),
+                        ),
+                ))
+        }
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        if newVal.IsNull() {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced null object",
+                        fmt.Sprintf(
+                                "Provider %q produced a null value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, absAddr,
+                        ),
+                ))
+        }
+        if !newVal.IsWhollyKnown() {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced invalid object",
+                        fmt.Sprintf(
+                                "Provider %q produced a value for %s that is not wholly known.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, absAddr,
+                        ),
+                ))
+
+                // We'll still save the object, but we need to eliminate any unknown
+                // values first because we can't serialize them in the state file.
+                // Note that this may cause set elements to be coalesced if they
+                // differed only by having unknown values, but we don't worry about
+                // that here because we're saving the value only for inspection
+                // purposes; the error we added above will halt the graph walk.
+                newVal = cty.UnknownAsNull(newVal)
+        }
+
+        // Since we've completed the read, we actually have no change to make, but
+        // we'll produce a NoOp one anyway to preserve the usual flow of the
+        // plan phase and allow it to produce a complete plan.
+        change = &plans.ResourceInstanceChange{
+                Addr:         absAddr,
+                ProviderAddr: n.ProviderAddr,
+                Change: plans.Change{
+                        Action: plans.NoOp,
+                        Before: newVal,
+                        After:  newVal,
+                },
+        }
+        state := &states.ResourceInstanceObject{
+                Value:        change.After,
+                Status:       states.ObjectReady, // because we completed the read from the provider
+                Dependencies: n.Dependencies,
+        }
+
+        err = ctx.Hook(func(h Hook) (HookAction, error) {
+                return h.PostRefresh(absAddr, states.CurrentGen, change.Before, newVal)
+        })
+        if err != nil {
+                return nil, err
+        }
 
+        if n.OutputChange != nil {
+                *n.OutputChange = change
+        }
+        if n.OutputValue != nil {
+                *n.OutputValue = change.After
+        }
+        if n.OutputConfigValue != nil {
+                *n.OutputConfigValue = configVal
+        }
         if n.OutputState != nil {
-                state := &InstanceState{}
                 *n.OutputState = state
-
-                // Apply the diff to the returned state, so the state includes
-                // any attribute values that are not computed.
-                if !diff.Empty() && n.OutputState != nil {
-                        *n.OutputState = state.MergeDiff(diff)
-                }
         }
 
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
 
 // EvalReadDataApply is an EvalNode implementation that executes a data
 // resource's ReadDataApply method to read data from the data source.
 type EvalReadDataApply struct {
-        Provider *ResourceProvider
-        Output   **InstanceState
-        Diff     **InstanceDiff
-        Info     *InstanceInfo
+        Addr            addrs.ResourceInstance
+        Provider        *providers.Interface
+        ProviderAddr    addrs.AbsProviderConfig
+        ProviderSchema  **ProviderSchema
+        Output          **states.ResourceInstanceObject
+        Config          *configs.Resource
+        Change          **plans.ResourceInstanceChange
+        StateReferences []addrs.Referenceable
 }
 
 func (n *EvalReadDataApply) Eval(ctx EvalContext) (interface{}, error) {
-        // TODO: test
         provider := *n.Provider
-        diff := *n.Diff
+        change := *n.Change
+        providerSchema := *n.ProviderSchema
+        absAddr := n.Addr.Absolute(ctx.Path())
+
+        var diags tfdiags.Diagnostics
 
         // If the diff is for *destroying* this resource then we'll
         // just drop its state and move on, since data resources don't
         // support an actual "destroy" action.
-        if diff != nil && diff.GetDestroy() {
+        if change != nil && change.Action == plans.Delete {
                 if n.Output != nil {
                         *n.Output = nil
                 }
@@ -113,27 +328,56 @@ func (n *EvalReadDataApply) Eval(ctx EvalContext) (interface{}, error) {
         err := ctx.Hook(func(h Hook) (HookAction, error) {
                 // We don't have a state yet, so we'll just give the hook an
                 // empty one to work with.
-                return h.PreRefresh(n.Info, &InstanceState{})
+                return h.PreRefresh(absAddr, states.CurrentGen, cty.NullVal(cty.DynamicPseudoType))
         })
         if err != nil {
                 return nil, err
         }
 
-        state, err := provider.ReadDataApply(n.Info, diff)
-        if err != nil {
-                return nil, fmt.Errorf("%s: %s", n.Info.Id, err)
+        resp := provider.ReadDataSource(providers.ReadDataSourceRequest{
+                TypeName: n.Addr.Resource.Type,
+                Config:   change.After,
+        })
+        diags = diags.Append(resp.Diagnostics.InConfigBody(n.Config.Config))
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        schema, _ := providerSchema.SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support data source %q", n.Addr.Resource.Type)
+        }
+
+        newVal := resp.State
+        for _, err := range newVal.Type().TestConformance(schema.ImpliedType()) {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced invalid object",
+                        fmt.Sprintf(
+                                "Provider %q planned an invalid value for %s. The result could not be saved.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatErrorPrefixed(err, absAddr.String()),
+                        ),
+                ))
+        }
+        if diags.HasErrors() {
+                return nil, diags.Err()
         }
 
         err = ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PostRefresh(n.Info, state)
+                return h.PostRefresh(absAddr, states.CurrentGen, change.Before, newVal)
         })
         if err != nil {
                 return nil, err
         }
 
         if n.Output != nil {
-                *n.Output = state
+                *n.Output = &states.ResourceInstanceObject{
+                        Value:        newVal,
+                        Status:       states.ObjectReady,
+                        Dependencies: n.StateReferences,
+                }
         }
 
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/eval_refresh.go
index fa2b812..03bc948 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_refresh.go
@@ -3,53 +3,102 @@ package terraform
 import (
         "fmt"
         "log"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalRefresh is an EvalNode implementation that does a refresh for
 // a resource.
 type EvalRefresh struct {
-        Provider *ResourceProvider
-        State    **InstanceState
-        Info     *InstanceInfo
-        Output   **InstanceState
+        Addr           addrs.ResourceInstance
+        ProviderAddr   addrs.AbsProviderConfig
+        Provider       *providers.Interface
+        ProviderSchema **ProviderSchema
+        State          **states.ResourceInstanceObject
+        Output         **states.ResourceInstanceObject
 }
 
 // TODO: test
 func (n *EvalRefresh) Eval(ctx EvalContext) (interface{}, error) {
-        provider := *n.Provider
         state := *n.State
+        absAddr := n.Addr.Absolute(ctx.Path())
+
+        var diags tfdiags.Diagnostics
 
         // If we have no state, we don't do any refreshing
         if state == nil {
-                log.Printf("[DEBUG] refresh: %s: no state, not refreshing", n.Info.Id)
-                return nil, nil
+                log.Printf("[DEBUG] refresh: %s: no state, so not refreshing", n.Addr.Absolute(ctx.Path()))
+                return nil, diags.ErrWithWarnings()
+        }
+
+        schema, _ := (*n.ProviderSchema).SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Should be caught during validation, so we don't bother with a pretty error here
+                return nil, fmt.Errorf("provider does not support resource type %q", n.Addr.Resource.Type)
         }
 
         // Call pre-refresh hook
         err := ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PreRefresh(n.Info, state)
+                return h.PreRefresh(absAddr, states.CurrentGen, state.Value)
         })
         if err != nil {
-                return nil, err
+                return nil, diags.ErrWithWarnings()
         }
 
         // Refresh!
-        state, err = provider.Refresh(n.Info, state)
-        if err != nil {
-                return nil, fmt.Errorf("%s: %s", n.Info.Id, err.Error())
+        priorVal := state.Value
+        req := providers.ReadResourceRequest{
+                TypeName:   n.Addr.Resource.Type,
+                PriorState: priorVal,
         }
 
+        provider := *n.Provider
+        resp := provider.ReadResource(req)
+        diags = diags.Append(resp.Diagnostics)
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        if resp.NewState == cty.NilVal {
+                // This ought not to happen in real cases since it's not possible to
+                // send NilVal over the plugin RPC channel, but it can come up in
+                // tests due to sloppy mocking.
+                panic("new state is cty.NilVal")
+        }
+
+        for _, err := range resp.NewState.Type().TestConformance(schema.ImpliedType()) {
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Provider produced invalid object",
+                        fmt.Sprintf(
+                                "Provider %q planned an invalid value for %s during refresh: %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+                                n.ProviderAddr.ProviderConfig.Type, absAddr, tfdiags.FormatError(err),
+                        ),
+                ))
+        }
+        if diags.HasErrors() {
+                return nil, diags.Err()
+        }
+
+        newState := state.DeepCopy()
+        newState.Value = resp.NewState
+
         // Call post-refresh hook
         err = ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PostRefresh(n.Info, state)
+                return h.PostRefresh(absAddr, states.CurrentGen, priorVal, newState.Value)
         })
         if err != nil {
                 return nil, err
         }
 
         if n.Output != nil {
-                *n.Output = state
+                *n.Output = newState
         }
 
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_resource.go b/vendor/github.com/hashicorp/terraform/terraform/eval_resource.go
deleted file mode 100644
index 5eca678..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_resource.go
+++ /dev/null
@@ -1,13 +0,0 @@
-package terraform
-
-// EvalInstanceInfo is an EvalNode implementation that fills in the
-// InstanceInfo as much as it can.
-type EvalInstanceInfo struct {
-        Info *InstanceInfo
-}
-
-// TODO: test
-func (n *EvalInstanceInfo) Eval(ctx EvalContext) (interface{}, error) {
-        n.Info.ModulePath = ctx.Path()
-        return nil, nil
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_sequence.go b/vendor/github.com/hashicorp/terraform/terraform/eval_sequence.go
index 82d8178..3485e4f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_sequence.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_sequence.go
@@ -1,22 +1,37 @@
 package terraform
 
+import (
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
 // EvalSequence is an EvalNode that evaluates in sequence.
 type EvalSequence struct {
         Nodes []EvalNode
 }
 
 func (n *EvalSequence) Eval(ctx EvalContext) (interface{}, error) {
+        var diags tfdiags.Diagnostics
+
         for _, n := range n.Nodes {
                 if n == nil {
                         continue
                 }
 
                 if _, err := EvalRaw(n, ctx); err != nil {
-                        return nil, err
+                        if _, isEarlyExit := err.(EvalEarlyExitError); isEarlyExit {
+                                // In this path we abort early, losing any non-error
+                                // diagnostics we saw earlier.
+                                return nil, err
+                        }
+                        diags = diags.Append(err)
+                        if diags.HasErrors() {
+                                // Halt if we get some errors, but warnings are okay.
+                                break
+                        }
                 }
         }
 
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
 
 // EvalNodeFilterable impl.
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_state.go b/vendor/github.com/hashicorp/terraform/terraform/eval_state.go
index 1182690..d506ce3 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_state.go
@@ -2,91 +2,149 @@ package terraform
 
 import (
         "fmt"
+        "log"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // EvalReadState is an EvalNode implementation that reads the
-// primary InstanceState for a specific resource out of the state.
+// current object for a specific instance in the state.
 type EvalReadState struct {
-        Name   string
-        Output **InstanceState
+        // Addr is the address of the instance to read state for.
+        Addr addrs.ResourceInstance
+
+        // ProviderSchema is the schema for the provider given in Provider.
+        ProviderSchema **ProviderSchema
+
+        // Provider is the provider that will subsequently perform actions on
+        // the the state object. This is used to perform any schema upgrades
+        // that might be required to prepare the stored data for use.
+        Provider *providers.Interface
+
+        // Output will be written with a pointer to the retrieved object.
+        Output **states.ResourceInstanceObject
 }
 
 func (n *EvalReadState) Eval(ctx EvalContext) (interface{}, error) {
-        return readInstanceFromState(ctx, n.Name, n.Output, func(rs *ResourceState) (*InstanceState, error) {
-                return rs.Primary, nil
-        })
+        if n.Provider == nil || *n.Provider == nil {
+                panic("EvalReadState used with no Provider object")
+        }
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                panic("EvalReadState used with no ProviderSchema object")
+        }
+
+        absAddr := n.Addr.Absolute(ctx.Path())
+        log.Printf("[TRACE] EvalReadState: reading state for %s", absAddr)
+
+        src := ctx.State().ResourceInstanceObject(absAddr, states.CurrentGen)
+        if src == nil {
+                // Presumably we only have deposed objects, then.
+                log.Printf("[TRACE] EvalReadState: no state present for %s", absAddr)
+                return nil, nil
+        }
+
+        schema, currentVersion := (*n.ProviderSchema).SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Shouldn't happen since we should've failed long ago if no schema is present
+                return nil, fmt.Errorf("no schema available for %s while reading state; this is a bug in Terraform and should be reported", absAddr)
+        }
+        var diags tfdiags.Diagnostics
+        src, diags = UpgradeResourceState(absAddr, *n.Provider, src, schema, currentVersion)
+        if diags.HasErrors() {
+                // Note that we don't have any channel to return warnings here. We'll
+                // accept that for now since warnings during a schema upgrade would
+                // be pretty weird anyway, since this operation is supposed to seem
+                // invisible to the user.
+                return nil, diags.Err()
+        }
+
+        obj, err := src.Decode(schema.ImpliedType())
+        if err != nil {
+                return nil, err
+        }
+
+        if n.Output != nil {
+                *n.Output = obj
+        }
+        return obj, nil
 }
 
 // EvalReadStateDeposed is an EvalNode implementation that reads the
 // deposed InstanceState for a specific resource out of the state
 type EvalReadStateDeposed struct {
-        Name   string
-        Output **InstanceState
-        // Index indicates which instance in the Deposed list to target, or -1 for
-        // the last item.
-        Index int
+        // Addr is the address of the instance to read state for.
+        Addr addrs.ResourceInstance
+
+        // Key identifies which deposed object we will read.
+        Key states.DeposedKey
+
+        // ProviderSchema is the schema for the provider given in Provider.
+        ProviderSchema **ProviderSchema
+
+        // Provider is the provider that will subsequently perform actions on
+        // the the state object. This is used to perform any schema upgrades
+        // that might be required to prepare the stored data for use.
+        Provider *providers.Interface
+
+        // Output will be written with a pointer to the retrieved object.
+        Output **states.ResourceInstanceObject
 }
 
 func (n *EvalReadStateDeposed) Eval(ctx EvalContext) (interface{}, error) {
-        return readInstanceFromState(ctx, n.Name, n.Output, func(rs *ResourceState) (*InstanceState, error) {
-                // Get the index. If it is negative, then we get the last one
-                idx := n.Index
-                if idx < 0 {
-                        idx = len(rs.Deposed) - 1
-                }
-                if idx >= 0 && idx < len(rs.Deposed) {
-                        return rs.Deposed[idx], nil
-                } else {
-                        return nil, fmt.Errorf("bad deposed index: %d, for resource: %#v", idx, rs)
-                }
-        })
-}
+        if n.Provider == nil || *n.Provider == nil {
+                panic("EvalReadStateDeposed used with no Provider object")
+        }
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                panic("EvalReadStateDeposed used with no ProviderSchema object")
+        }
 
-// Does the bulk of the work for the various flavors of ReadState eval nodes.
-// Each node just provides a reader function to get from the ResourceState to the
-// InstanceState, and this takes care of all the plumbing.
-func readInstanceFromState(
-        ctx EvalContext,
-        resourceName string,
-        output **InstanceState,
-        readerFn func(*ResourceState) (*InstanceState, error),
-) (*InstanceState, error) {
-        state, lock := ctx.State()
-
-        // Get a read lock so we can access this instance
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Look for the module state. If we don't have one, then it doesn't matter.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                return nil, nil
+        key := n.Key
+        if key == states.NotDeposed {
+                return nil, fmt.Errorf("EvalReadStateDeposed used with no instance key; this is a bug in Terraform and should be reported")
         }
+        absAddr := n.Addr.Absolute(ctx.Path())
+        log.Printf("[TRACE] EvalReadStateDeposed: reading state for %s deposed object %s", absAddr, n.Key)
 
-        // Look for the resource state. If we don't have one, then it is okay.
-        rs := mod.Resources[resourceName]
-        if rs == nil {
+        src := ctx.State().ResourceInstanceObject(absAddr, key)
+        if src == nil {
+                // Presumably we only have deposed objects, then.
+                log.Printf("[TRACE] EvalReadStateDeposed: no state present for %s deposed object %s", absAddr, n.Key)
                 return nil, nil
         }
 
-        // Use the delegate function to get the instance state from the resource state
-        is, err := readerFn(rs)
+        schema, currentVersion := (*n.ProviderSchema).SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // Shouldn't happen since we should've failed long ago if no schema is present
+                return nil, fmt.Errorf("no schema available for %s while reading state; this is a bug in Terraform and should be reported", absAddr)
+        }
+        var diags tfdiags.Diagnostics
+        src, diags = UpgradeResourceState(absAddr, *n.Provider, src, schema, currentVersion)
+        if diags.HasErrors() {
+                // Note that we don't have any channel to return warnings here. We'll
+                // accept that for now since warnings during a schema upgrade would
+                // be pretty weird anyway, since this operation is supposed to seem
+                // invisible to the user.
+                return nil, diags.Err()
+        }
+
+        obj, err := src.Decode(schema.ImpliedType())
         if err != nil {
                 return nil, err
         }
-
-        // Write the result to the output pointer
-        if output != nil {
-                *output = is
+        if n.Output != nil {
+                *n.Output = obj
         }
-
-        return is, nil
+        return obj, nil
 }
 
-// EvalRequireState is an EvalNode implementation that early exits
-// if the state doesn't have an ID.
+// EvalRequireState is an EvalNode implementation that exits early if the given
+// object is null.
 type EvalRequireState struct {
-        State **InstanceState
+        State **states.ResourceInstanceObject
 }
 
 func (n *EvalRequireState) Eval(ctx EvalContext) (interface{}, error) {
@@ -95,7 +153,7 @@ func (n *EvalRequireState) Eval(ctx EvalContext) (interface{}, error) {
         }
 
         state := *n.State
-        if state == nil || state.ID == "" {
+        if state == nil || state.Value.IsNull() {
                 return nil, EvalEarlyExitError{}
         }
 
@@ -107,12 +165,14 @@ func (n *EvalRequireState) Eval(ctx EvalContext) (interface{}, error) {
 type EvalUpdateStateHook struct{}
 
 func (n *EvalUpdateStateHook) Eval(ctx EvalContext) (interface{}, error) {
-        state, lock := ctx.State()
-
-        // Get a full lock. Even calling something like WriteState can modify
-        // (prune) the state, so we need the full lock.
-        lock.Lock()
-        defer lock.Unlock()
+        // In principle we could grab the lock here just long enough to take a
+        // deep copy and then pass that to our hooks below, but we'll instead
+        // hold the hook for the duration to avoid the potential confusing
+        // situation of us racing to call PostStateUpdate concurrently with
+        // different state snapshots.
+        stateSync := ctx.State()
+        state := stateSync.Lock().DeepCopy()
+        defer stateSync.Unlock()
 
         // Call the hook
         err := ctx.Hook(func(h Hook) (HookAction, error) {
@@ -125,171 +185,285 @@ func (n *EvalUpdateStateHook) Eval(ctx EvalContext) (interface{}, error) {
         return nil, nil
 }
 
-// EvalWriteState is an EvalNode implementation that writes the
-// primary InstanceState for a specific resource into the state.
+// EvalWriteState is an EvalNode implementation that saves the given object
+// as the current object for the selected resource instance.
 type EvalWriteState struct {
-        Name         string
-        ResourceType string
-        Provider     string
-        Dependencies []string
-        State        **InstanceState
+        // Addr is the address of the instance to read state for.
+        Addr addrs.ResourceInstance
+
+        // State is the object state to save.
+        State **states.ResourceInstanceObject
+
+        // ProviderSchema is the schema for the provider given in ProviderAddr.
+        ProviderSchema **ProviderSchema
+
+        // ProviderAddr is the address of the provider configuration that
+        // produced the given object.
+        ProviderAddr addrs.AbsProviderConfig
 }
 
 func (n *EvalWriteState) Eval(ctx EvalContext) (interface{}, error) {
-        return writeInstanceToState(ctx, n.Name, n.ResourceType, n.Provider, n.Dependencies,
-                func(rs *ResourceState) error {
-                        rs.Primary = *n.State
-                        return nil
-                },
-        )
+        if n.State == nil {
+                // Note that a pointer _to_ nil is valid here, indicating the total
+                // absense of an object as we'd see during destroy.
+                panic("EvalWriteState used with no ResourceInstanceObject")
+        }
+
+        absAddr := n.Addr.Absolute(ctx.Path())
+        state := ctx.State()
+
+        if n.ProviderAddr.ProviderConfig.Type == "" {
+                return nil, fmt.Errorf("failed to write state for %s, missing provider type", absAddr)
+        }
+
+        obj := *n.State
+        if obj == nil || obj.Value.IsNull() {
+                // No need to encode anything: we'll just write it directly.
+                state.SetResourceInstanceCurrent(absAddr, nil, n.ProviderAddr)
+                log.Printf("[TRACE] EvalWriteState: removing state object for %s", absAddr)
+                return nil, nil
+        }
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                // Should never happen, unless our state object is nil
+                panic("EvalWriteState used with pointer to nil ProviderSchema object")
+        }
+
+        if obj != nil {
+                log.Printf("[TRACE] EvalWriteState: writing current state object for %s", absAddr)
+        } else {
+                log.Printf("[TRACE] EvalWriteState: removing current state object for %s", absAddr)
+        }
+
+        schema, currentVersion := (*n.ProviderSchema).SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // It shouldn't be possible to get this far in any real scenario
+                // without a schema, but we might end up here in contrived tests that
+                // fail to set up their world properly.
+                return nil, fmt.Errorf("failed to encode %s in state: no resource type schema available", absAddr)
+        }
+        src, err := obj.Encode(schema.ImpliedType(), currentVersion)
+        if err != nil {
+                return nil, fmt.Errorf("failed to encode %s in state: %s", absAddr, err)
+        }
+
+        state.SetResourceInstanceCurrent(absAddr, src, n.ProviderAddr)
+        return nil, nil
 }
 
 // EvalWriteStateDeposed is an EvalNode implementation that writes
 // an InstanceState out to the Deposed list of a resource in the state.
 type EvalWriteStateDeposed struct {
-        Name         string
-        ResourceType string
-        Provider     string
-        Dependencies []string
-        State        **InstanceState
-        // Index indicates which instance in the Deposed list to target, or -1 to append.
-        Index int
+        // Addr is the address of the instance to read state for.
+        Addr addrs.ResourceInstance
+
+        // Key indicates which deposed object to write to.
+        Key states.DeposedKey
+
+        // State is the object state to save.
+        State **states.ResourceInstanceObject
+
+        // ProviderSchema is the schema for the provider given in ProviderAddr.
+        ProviderSchema **ProviderSchema
+
+        // ProviderAddr is the address of the provider configuration that
+        // produced the given object.
+        ProviderAddr addrs.AbsProviderConfig
 }
 
 func (n *EvalWriteStateDeposed) Eval(ctx EvalContext) (interface{}, error) {
-        return writeInstanceToState(ctx, n.Name, n.ResourceType, n.Provider, n.Dependencies,
-                func(rs *ResourceState) error {
-                        if n.Index == -1 {
-                                rs.Deposed = append(rs.Deposed, *n.State)
-                        } else {
-                                rs.Deposed[n.Index] = *n.State
-                        }
-                        return nil
-                },
-        )
-}
+        if n.State == nil {
+                // Note that a pointer _to_ nil is valid here, indicating the total
+                // absense of an object as we'd see during destroy.
+                panic("EvalWriteStateDeposed used with no ResourceInstanceObject")
+        }
 
-// Pulls together the common tasks of the EvalWriteState nodes.  All the args
-// are passed directly down from the EvalNode along with a `writer` function
-// which is yielded the *ResourceState and is responsible for writing an
-// InstanceState to the proper field in the ResourceState.
-func writeInstanceToState(
-        ctx EvalContext,
-        resourceName string,
-        resourceType string,
-        provider string,
-        dependencies []string,
-        writerFn func(*ResourceState) error,
-) (*InstanceState, error) {
-        state, lock := ctx.State()
-        if state == nil {
-                return nil, fmt.Errorf("cannot write state to nil state")
-        }
-
-        // Get a write lock so we can access this instance
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Look for the module state. If we don't have one, create it.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                mod = state.AddModule(ctx.Path())
-        }
-
-        // Look for the resource state.
-        rs := mod.Resources[resourceName]
-        if rs == nil {
-                rs = &ResourceState{}
-                rs.init()
-                mod.Resources[resourceName] = rs
-        }
-        rs.Type = resourceType
-        rs.Dependencies = dependencies
-        rs.Provider = provider
-
-        if err := writerFn(rs); err != nil {
-                return nil, err
+        absAddr := n.Addr.Absolute(ctx.Path())
+        key := n.Key
+        state := ctx.State()
+
+        if key == states.NotDeposed {
+                // should never happen
+                return nil, fmt.Errorf("can't save deposed object for %s without a deposed key; this is a bug in Terraform that should be reported", absAddr)
+        }
+
+        obj := *n.State
+        if obj == nil {
+                // No need to encode anything: we'll just write it directly.
+                state.SetResourceInstanceDeposed(absAddr, key, nil, n.ProviderAddr)
+                log.Printf("[TRACE] EvalWriteStateDeposed: removing state object for %s deposed %s", absAddr, key)
+                return nil, nil
+        }
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                // Should never happen, unless our state object is nil
+                panic("EvalWriteStateDeposed used with no ProviderSchema object")
+        }
+
+        schema, currentVersion := (*n.ProviderSchema).SchemaForResourceAddr(n.Addr.ContainingResource())
+        if schema == nil {
+                // It shouldn't be possible to get this far in any real scenario
+                // without a schema, but we might end up here in contrived tests that
+                // fail to set up their world properly.
+                return nil, fmt.Errorf("failed to encode %s in state: no resource type schema available", absAddr)
+        }
+        src, err := obj.Encode(schema.ImpliedType(), currentVersion)
+        if err != nil {
+                return nil, fmt.Errorf("failed to encode %s in state: %s", absAddr, err)
         }
 
+        log.Printf("[TRACE] EvalWriteStateDeposed: writing state object for %s deposed %s", absAddr, key)
+        state.SetResourceInstanceDeposed(absAddr, key, src, n.ProviderAddr)
         return nil, nil
 }
 
-// EvalDeposeState is an EvalNode implementation that takes the primary
-// out of a state and makes it Deposed. This is done at the beginning of
-// create-before-destroy calls so that the create can create while preserving
-// the old state of the to-be-destroyed resource.
+// EvalDeposeState is an EvalNode implementation that moves the current object
+// for the given instance to instead be a deposed object, leaving the instance
+// with no current object.
+// This is used at the beginning of a create-before-destroy replace action so
+// that the create can create while preserving the old state of the
+// to-be-destroyed object.
 type EvalDeposeState struct {
-        Name string
+        Addr addrs.ResourceInstance
+
+        // ForceKey, if a value other than states.NotDeposed, will be used as the
+        // key for the newly-created deposed object that results from this action.
+        // If set to states.NotDeposed (the zero value), a new unique key will be
+        // allocated.
+        ForceKey states.DeposedKey
+
+        // OutputKey, if non-nil, will be written with the deposed object key that
+        // was generated for the object. This can then be passed to
+        // EvalUndeposeState.Key so it knows which deposed instance to forget.
+        OutputKey *states.DeposedKey
 }
 
 // TODO: test
 func (n *EvalDeposeState) Eval(ctx EvalContext) (interface{}, error) {
-        state, lock := ctx.State()
-
-        // Get a read lock so we can access this instance
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Look for the module state. If we don't have one, then it doesn't matter.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                return nil, nil
-        }
-
-        // Look for the resource state. If we don't have one, then it is okay.
-        rs := mod.Resources[n.Name]
-        if rs == nil {
-                return nil, nil
+        absAddr := n.Addr.Absolute(ctx.Path())
+        state := ctx.State()
+
+        var key states.DeposedKey
+        if n.ForceKey == states.NotDeposed {
+                key = state.DeposeResourceInstanceObject(absAddr)
+        } else {
+                key = n.ForceKey
+                state.DeposeResourceInstanceObjectForceKey(absAddr, key)
         }
+        log.Printf("[TRACE] EvalDeposeState: prior object for %s now deposed with key %s", absAddr, key)
 
-        // If we don't have a primary, we have nothing to depose
-        if rs.Primary == nil {
-                return nil, nil
+        if n.OutputKey != nil {
+                *n.OutputKey = key
         }
 
-        // Depose
-        rs.Deposed = append(rs.Deposed, rs.Primary)
-        rs.Primary = nil
-
         return nil, nil
 }
 
-// EvalUndeposeState is an EvalNode implementation that reads the
-// InstanceState for a specific resource out of the state.
-type EvalUndeposeState struct {
-        Name  string
-        State **InstanceState
+// EvalMaybeRestoreDeposedObject is an EvalNode implementation that will
+// restore a particular deposed object of the specified resource instance
+// to be the "current" object if and only if the instance doesn't currently
+// have a current object.
+//
+// This is intended for use when the create leg of a create before destroy
+// fails with no partial new object: if we didn't take any action, the user
+// would be left in the unfortunate situation of having no current object
+// and the previously-workign object now deposed. This EvalNode causes a
+// better outcome by restoring things to how they were before the replace
+// operation began.
+//
+// The create operation may have produced a partial result even though it
+// failed and it's important that we don't "forget" that state, so in that
+// situation the prior object remains deposed and the partial new object
+// remains the current object, allowing the situation to hopefully be
+// improved in a subsequent run.
+type EvalMaybeRestoreDeposedObject struct {
+        Addr addrs.ResourceInstance
+
+        // Key is a pointer to the deposed object key that should be forgotten
+        // from the state, which must be non-nil.
+        Key *states.DeposedKey
 }
 
 // TODO: test
-func (n *EvalUndeposeState) Eval(ctx EvalContext) (interface{}, error) {
-        state, lock := ctx.State()
+func (n *EvalMaybeRestoreDeposedObject) Eval(ctx EvalContext) (interface{}, error) {
+        absAddr := n.Addr.Absolute(ctx.Path())
+        dk := *n.Key
+        state := ctx.State()
+
+        restored := state.MaybeRestoreResourceInstanceDeposed(absAddr, dk)
+        if restored {
+                log.Printf("[TRACE] EvalMaybeRestoreDeposedObject: %s deposed object %s was restored as the current object", absAddr, dk)
+        } else {
+                log.Printf("[TRACE] EvalMaybeRestoreDeposedObject: %s deposed object %s remains deposed", absAddr, dk)
+        }
 
-        // Get a read lock so we can access this instance
-        lock.RLock()
-        defer lock.RUnlock()
+        return nil, nil
+}
 
-        // Look for the module state. If we don't have one, then it doesn't matter.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                return nil, nil
-        }
+// EvalWriteResourceState is an EvalNode implementation that ensures that
+// a suitable resource-level state record is present in the state, if that's
+// required for the "each mode" of that resource.
+//
+// This is important primarily for the situation where count = 0, since this
+// eval is the only change we get to set the resource "each mode" to list
+// in that case, allowing expression evaluation to see it as a zero-element
+// list rather than as not set at all.
+type EvalWriteResourceState struct {
+        Addr         addrs.Resource
+        Config       *configs.Resource
+        ProviderAddr addrs.AbsProviderConfig
+}
 
-        // Look for the resource state. If we don't have one, then it is okay.
-        rs := mod.Resources[n.Name]
-        if rs == nil {
-                return nil, nil
+// TODO: test
+func (n *EvalWriteResourceState) Eval(ctx EvalContext) (interface{}, error) {
+        var diags tfdiags.Diagnostics
+        absAddr := n.Addr.Absolute(ctx.Path())
+        state := ctx.State()
+
+        count, countDiags := evaluateResourceCountExpression(n.Config.Count, ctx)
+        diags = diags.Append(countDiags)
+        if countDiags.HasErrors() {
+                return nil, diags.Err()
         }
 
-        // If we don't have any desposed resource, then we don't have anything to do
-        if len(rs.Deposed) == 0 {
-                return nil, nil
+        // Currently we ony support NoEach and EachList, because for_each support
+        // is not fully wired up across Terraform. Once for_each support is added,
+        // we'll need to handle that here too, setting states.EachMap if the
+        // assigned expression is a map.
+        eachMode := states.NoEach
+        if count >= 0 { // -1 signals "count not set"
+                eachMode = states.EachList
         }
 
-        // Undepose
-        idx := len(rs.Deposed) - 1
-        rs.Primary = rs.Deposed[idx]
-        rs.Deposed[idx] = *n.State
+        // This method takes care of all of the business logic of updating this
+        // while ensuring that any existing instances are preserved, etc.
+        state.SetResourceMeta(absAddr, eachMode, n.ProviderAddr)
+
+        return nil, nil
+}
+
+// EvalForgetResourceState is an EvalNode implementation that prunes out an
+// empty resource-level state for a given resource address, or produces an
+// error if it isn't empty after all.
+//
+// This should be the last action taken for a resource that has been removed
+// from the configuration altogether, to clean up the leftover husk of the
+// resource in the state after other EvalNodes have destroyed and removed
+// all of the instances and instance objects beneath it.
+type EvalForgetResourceState struct {
+        Addr addrs.Resource
+}
+
+func (n *EvalForgetResourceState) Eval(ctx EvalContext) (interface{}, error) {
+        absAddr := n.Addr.Absolute(ctx.Path())
+        state := ctx.State()
+
+        pruned := state.RemoveResourceIfEmpty(absAddr)
+        if !pruned {
+                // If this produces an error, it indicates a bug elsewhere in Terraform
+                // -- probably missing graph nodes, graph edges, or
+                // incorrectly-implemented evaluation steps.
+                return nil, fmt.Errorf("orphan resource %s still has a non-empty state after apply; this is a bug in Terraform", absAddr)
+        }
+        log.Printf("[TRACE] EvalForgetResourceState: Pruned husk of %s from state", absAddr)
 
         return nil, nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_state_upgrade.go b/vendor/github.com/hashicorp/terraform/terraform/eval_state_upgrade.go
new file mode 100644
index 0000000..e194000
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_state_upgrade.go
@@ -0,0 +1,106 @@
+package terraform
+
+import (
+        "fmt"
+        "log"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// UpgradeResourceState will, if necessary, run the provider-defined upgrade
+// logic against the given state object to make it compliant with the
+// current schema version. This is a no-op if the given state object is
+// already at the latest version.
+//
+// If any errors occur during upgrade, error diagnostics are returned. In that
+// case it is not safe to proceed with using the original state object.
+func UpgradeResourceState(addr addrs.AbsResourceInstance, provider providers.Interface, src *states.ResourceInstanceObjectSrc, currentSchema *configschema.Block, currentVersion uint64) (*states.ResourceInstanceObjectSrc, tfdiags.Diagnostics) {
+        if addr.Resource.Resource.Mode != addrs.ManagedResourceMode {
+                // We only do state upgrading for managed resources.
+                return src, nil
+        }
+
+        stateIsFlatmap := len(src.AttrsJSON) == 0
+
+        providerType := addr.Resource.Resource.DefaultProviderConfig().Type
+        if src.SchemaVersion > currentVersion {
+                log.Printf("[TRACE] UpgradeResourceState: can't downgrade state for %s from version %d to %d", addr, src.SchemaVersion, currentVersion)
+                var diags tfdiags.Diagnostics
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Resource instance managed by newer provider version",
+                        // This is not a very good error message, but we don't retain enough
+                        // information in state to give good feedback on what provider
+                        // version might be required here. :(
+                        fmt.Sprintf("The current state of %s was created by a newer provider version than is currently selected. Upgrade the %s provider to work with this state.", addr, providerType),
+                ))
+                return nil, diags
+        }
+
+        // If we get down here then we need to upgrade the state, with the
+        // provider's help.
+        // If this state was originally created by a version of Terraform prior to
+        // v0.12, this also includes translating from legacy flatmap to new-style
+        // representation, since only the provider has enough information to
+        // understand a flatmap built against an older schema.
+        if src.SchemaVersion != currentVersion {
+                log.Printf("[TRACE] UpgradeResourceState: upgrading state for %s from version %d to %d using provider %q", addr, src.SchemaVersion, currentVersion, providerType)
+        } else {
+                log.Printf("[TRACE] UpgradeResourceState: schema version of %s is still %d; calling provider %q for any other minor fixups", addr, currentVersion, providerType)
+        }
+
+        req := providers.UpgradeResourceStateRequest{
+                TypeName: addr.Resource.Resource.Type,
+
+                // TODO: The internal schema version representations are all using
+                // uint64 instead of int64, but unsigned integers aren't friendly
+                // to all protobuf target languages so in practice we use int64
+                // on the wire. In future we will change all of our internal
+                // representations to int64 too.
+                Version: int64(src.SchemaVersion),
+        }
+
+        if stateIsFlatmap {
+                req.RawStateFlatmap = src.AttrsFlat
+        } else {
+                req.RawStateJSON = src.AttrsJSON
+        }
+
+        resp := provider.UpgradeResourceState(req)
+        diags := resp.Diagnostics
+        if diags.HasErrors() {
+                return nil, diags
+        }
+
+        // After upgrading, the new value must conform to the current schema. When
+        // going over RPC this is actually already ensured by the
+        // marshaling/unmarshaling of the new value, but we'll check it here
+        // anyway for robustness, e.g. for in-process providers.
+        newValue := resp.UpgradedState
+        if errs := newValue.Type().TestConformance(currentSchema.ImpliedType()); len(errs) > 0 {
+                for _, err := range errs {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid resource state upgrade",
+                                fmt.Sprintf("The %s provider upgraded the state for %s from a previous version, but produced an invalid result: %s.", providerType, addr, tfdiags.FormatError(err)),
+                        ))
+                }
+                return nil, diags
+        }
+
+        new, err := src.CompleteUpgrade(newValue, currentSchema.ImpliedType(), uint64(currentVersion))
+        if err != nil {
+                // We already checked for type conformance above, so getting into this
+                // codepath should be rare and is probably a bug somewhere under CompleteUpgrade.
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Failed to encode result of resource state upgrade",
+                        fmt.Sprintf("Failed to encode state for %s after resource schema upgrade: %s.", addr, tfdiags.FormatError(err)),
+                ))
+        }
+        return new, diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go b/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
index 3e5a84c..0033e01 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
@@ -2,126 +2,163 @@ package terraform
 
 import (
         "fmt"
-
-        "github.com/hashicorp/terraform/config"
-        "github.com/mitchellh/mapstructure"
+        "log"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/gocty"
 )
 
-// EvalValidateError is the error structure returned if there were
-// validation errors.
-type EvalValidateError struct {
-        Warnings []string
-        Errors   []error
-}
-
-func (e *EvalValidateError) Error() string {
-        return fmt.Sprintf("Warnings: %s. Errors: %s", e.Warnings, e.Errors)
-}
-
 // EvalValidateCount is an EvalNode implementation that validates
 // the count of a resource.
 type EvalValidateCount struct {
-        Resource *config.Resource
+        Resource *configs.Resource
 }
 
 // TODO: test
 func (n *EvalValidateCount) Eval(ctx EvalContext) (interface{}, error) {
+        var diags tfdiags.Diagnostics
         var count int
-        var errs []error
         var err error
-        if _, err := ctx.Interpolate(n.Resource.RawCount, nil); err != nil {
-                errs = append(errs, fmt.Errorf(
-                        "Failed to interpolate count: %s", err))
+
+        val, valDiags := ctx.EvaluateExpr(n.Resource.Count, cty.Number, nil)
+        diags = diags.Append(valDiags)
+        if valDiags.HasErrors() {
                 goto RETURN
         }
-
-        count, err = n.Resource.Count()
-        if err != nil {
-                // If we can't get the count during validation, then
-                // just replace it with the number 1.
-                c := n.Resource.RawCount.Config()
-                c[n.Resource.RawCount.Key] = "1"
-                count = 1
+        if val.IsNull() || !val.IsKnown() {
+                goto RETURN
         }
-        err = nil
 
-        if count < 0 {
-                errs = append(errs, fmt.Errorf(
-                        "Count is less than zero: %d", count))
+        err = gocty.FromCtyValue(val, &count)
+        if err != nil {
+                // The EvaluateExpr call above already guaranteed us a number value,
+                // so if we end up here then we have something that is out of range
+                // for an int, and the error message will include a description of
+                // the valid range.
+                rawVal := val.AsBigFloat()
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count value",
+                        Detail:   fmt.Sprintf("The number %s is not a valid count value: %s.", rawVal, err),
+                        Subject:  n.Resource.Count.Range().Ptr(),
+                })
+        } else if count < 0 {
+                rawVal := val.AsBigFloat()
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count value",
+                        Detail:   fmt.Sprintf("The number %s is not a valid count value: count must not be negative.", rawVal),
+                        Subject:  n.Resource.Count.Range().Ptr(),
+                })
         }
 
 RETURN:
-        if len(errs) != 0 {
-                err = &EvalValidateError{
-                        Errors: errs,
-                }
-        }
-        return nil, err
+        return nil, diags.NonFatalErr()
 }
 
 // EvalValidateProvider is an EvalNode implementation that validates
-// the configuration of a resource.
+// a provider configuration.
 type EvalValidateProvider struct {
-        Provider *ResourceProvider
-        Config   **ResourceConfig
+        Addr     addrs.ProviderConfig
+        Provider *providers.Interface
+        Config   *configs.Provider
 }
 
 func (n *EvalValidateProvider) Eval(ctx EvalContext) (interface{}, error) {
+        var diags tfdiags.Diagnostics
         provider := *n.Provider
-        config := *n.Config
 
-        warns, errs := provider.Validate(config)
-        if len(warns) == 0 && len(errs) == 0 {
-                return nil, nil
+        configBody := buildProviderConfig(ctx, n.Addr, n.Config)
+
+        resp := provider.GetSchema()
+        diags = diags.Append(resp.Diagnostics)
+        if diags.HasErrors() {
+                return nil, diags.NonFatalErr()
         }
 
-        return nil, &EvalValidateError{
-                Warnings: warns,
-                Errors:   errs,
+        configSchema := resp.Provider.Block
+        if configSchema == nil {
+                // Should never happen in real code, but often comes up in tests where
+                // mock schemas are being used that tend to be incomplete.
+                log.Printf("[WARN] EvalValidateProvider: no config schema is available for %s, so using empty schema", n.Addr)
+                configSchema = &configschema.Block{}
         }
+
+        configVal, configBody, evalDiags := ctx.EvaluateBlock(configBody, configSchema, nil, EvalDataForNoInstanceKey)
+        diags = diags.Append(evalDiags)
+        if evalDiags.HasErrors() {
+                return nil, diags.NonFatalErr()
+        }
+
+        req := providers.PrepareProviderConfigRequest{
+                Config: configVal,
+        }
+
+        validateResp := provider.PrepareProviderConfig(req)
+        diags = diags.Append(validateResp.Diagnostics)
+
+        return nil, diags.NonFatalErr()
 }
 
 // EvalValidateProvisioner is an EvalNode implementation that validates
-// the configuration of a resource.
+// the configuration of a provisioner belonging to a resource. The provisioner
+// config is expected to contain the merged connection configurations.
 type EvalValidateProvisioner struct {
-        Provisioner *ResourceProvisioner
-        Config      **ResourceConfig
-        ConnConfig  **ResourceConfig
+        ResourceAddr     addrs.Resource
+        Provisioner      *provisioners.Interface
+        Schema           **configschema.Block
+        Config           *configs.Provisioner
+        ResourceHasCount bool
 }
 
 func (n *EvalValidateProvisioner) Eval(ctx EvalContext) (interface{}, error) {
         provisioner := *n.Provisioner
         config := *n.Config
-        var warns []string
-        var errs []error
+        schema := *n.Schema
+
+        var diags tfdiags.Diagnostics
 
         {
                 // Validate the provisioner's own config first
-                w, e := provisioner.Validate(config)
-                warns = append(warns, w...)
-                errs = append(errs, e...)
-        }
 
-        {
-                // Now validate the connection config, which might either be from
-                // the provisioner block itself or inherited from the resource's
-                // shared connection info.
-                w, e := n.validateConnConfig(*n.ConnConfig)
-                warns = append(warns, w...)
-                errs = append(errs, e...)
-        }
+                configVal, _, configDiags := n.evaluateBlock(ctx, config.Config, schema)
+                diags = diags.Append(configDiags)
+                if configDiags.HasErrors() {
+                        return nil, diags.Err()
+                }
 
-        if len(warns) == 0 && len(errs) == 0 {
-                return nil, nil
+                if configVal == cty.NilVal {
+                        // Should never happen for a well-behaved EvaluateBlock implementation
+                        return nil, fmt.Errorf("EvaluateBlock returned nil value")
+                }
+
+                req := provisioners.ValidateProvisionerConfigRequest{
+                        Config: configVal,
+                }
+
+                resp := provisioner.ValidateProvisionerConfig(req)
+                diags = diags.Append(resp.Diagnostics)
         }
 
-        return nil, &EvalValidateError{
-                Warnings: warns,
-                Errors:   errs,
+        {
+                // Now validate the connection config, which contains the merged bodies
+                // of the resource and provisioner connection blocks.
+                connDiags := n.validateConnConfig(ctx, config.Connection, n.ResourceAddr)
+                diags = diags.Append(connDiags)
         }
+
+        return nil, diags.NonFatalErr()
 }
 
-func (n *EvalValidateProvisioner) validateConnConfig(connConfig *ResourceConfig) (warns []string, errs []error) {
+func (n *EvalValidateProvisioner) validateConnConfig(ctx EvalContext, config *configs.Connection, self addrs.Referenceable) tfdiags.Diagnostics {
         // We can't comprehensively validate the connection config since its
         // final structure is decided by the communicator and we can't instantiate
         // that until we have a complete instance state. However, we *can* catch
@@ -129,103 +166,379 @@ func (n *EvalValidateProvisioner) validateConnConfig(connConfig *ResourceConfig)
         // typos early rather than waiting until we actually try to run one of
         // the resource's provisioners.
 
-        type connConfigSuperset struct {
-                // All attribute types are interface{} here because at this point we
-                // may still have unresolved interpolation expressions, which will
-                // appear as strings regardless of the final goal type.
+        var diags tfdiags.Diagnostics
 
-                Type       interface{} `mapstructure:"type"`
-                User       interface{} `mapstructure:"user"`
-                Password   interface{} `mapstructure:"password"`
-                Host       interface{} `mapstructure:"host"`
-                Port       interface{} `mapstructure:"port"`
-                Timeout    interface{} `mapstructure:"timeout"`
-                ScriptPath interface{} `mapstructure:"script_path"`
+        if config == nil || config.Config == nil {
+                // No block to validate
+                return diags
+        }
 
-                // For type=ssh only (enforced in ssh communicator)
-                PrivateKey        interface{} `mapstructure:"private_key"`
-                HostKey           interface{} `mapstructure:"host_key"`
-                Agent             interface{} `mapstructure:"agent"`
-                BastionHost       interface{} `mapstructure:"bastion_host"`
-                BastionHostKey    interface{} `mapstructure:"bastion_host_key"`
-                BastionPort       interface{} `mapstructure:"bastion_port"`
-                BastionUser       interface{} `mapstructure:"bastion_user"`
-                BastionPassword   interface{} `mapstructure:"bastion_password"`
-                BastionPrivateKey interface{} `mapstructure:"bastion_private_key"`
-                AgentIdentity     interface{} `mapstructure:"agent_identity"`
+        // We evaluate here just by evaluating the block and returning any
+        // diagnostics we get, since evaluation alone is enough to check for
+        // extraneous arguments and incorrectly-typed arguments.
+        _, _, configDiags := n.evaluateBlock(ctx, config.Config, connectionBlockSupersetSchema)
+        diags = diags.Append(configDiags)
 
-                // For type=winrm only (enforced in winrm communicator)
-                HTTPS    interface{} `mapstructure:"https"`
-                Insecure interface{} `mapstructure:"insecure"`
-                NTLM     interface{} `mapstructure:"use_ntlm"`
-                CACert   interface{} `mapstructure:"cacert"`
-        }
+        return diags
+}
 
-        var metadata mapstructure.Metadata
-        decoder, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{
-                Metadata: &metadata,
-                Result:   &connConfigSuperset{}, // result is disregarded; we only care about unused keys
-        })
-        if err != nil {
-                // should never happen
-                errs = append(errs, err)
-                return
-        }
+func (n *EvalValidateProvisioner) evaluateBlock(ctx EvalContext, body hcl.Body, schema *configschema.Block) (cty.Value, hcl.Body, tfdiags.Diagnostics) {
+        keyData := EvalDataForNoInstanceKey
+        selfAddr := n.ResourceAddr.Instance(addrs.NoKey)
 
-        if err := decoder.Decode(connConfig.Config); err != nil {
-                errs = append(errs, err)
-                return
-        }
+        if n.ResourceHasCount {
+                // For a resource that has count, we allow count.index but don't
+                // know at this stage what it will return.
+                keyData = InstanceKeyEvalData{
+                        CountIndex: cty.UnknownVal(cty.Number),
+                }
 
-        for _, attrName := range metadata.Unused {
-                errs = append(errs, fmt.Errorf("unknown 'connection' argument %q", attrName))
+                // "self" can't point to an unknown key, but we'll force it to be
+                // key 0 here, which should return an unknown value of the
+                // expected type since none of these elements are known at this
+                // point anyway.
+                selfAddr = n.ResourceAddr.Instance(addrs.IntKey(0))
         }
-        return
+
+        return ctx.EvaluateBlock(body, schema, selfAddr, keyData)
+}
+
+// connectionBlockSupersetSchema is a schema representing the superset of all
+// possible arguments for "connection" blocks across all supported connection
+// types.
+//
+// This currently lives here because we've not yet updated our communicator
+// subsystem to be aware of schema itself. Once that is done, we can remove
+// this and use a type-specific schema from the communicator to validate
+// exactly what is expected for a given connection type.
+var connectionBlockSupersetSchema = &configschema.Block{
+        Attributes: map[string]*configschema.Attribute{
+                // NOTE: "type" is not included here because it's treated special
+                // by the config loader and stored away in a separate field.
+
+                // Common attributes for both connection types
+                "host": {
+                        Type:     cty.String,
+                        Required: true,
+                },
+                "type": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "user": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "password": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "port": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "timeout": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "script_path": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+
+                // For type=ssh only (enforced in ssh communicator)
+                "private_key": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "certificate": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "host_key": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "agent": {
+                        Type:     cty.Bool,
+                        Optional: true,
+                },
+                "agent_identity": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "bastion_host": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "bastion_host_key": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "bastion_port": {
+                        Type:     cty.Number,
+                        Optional: true,
+                },
+                "bastion_user": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "bastion_password": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "bastion_private_key": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+
+                // For type=winrm only (enforced in winrm communicator)
+                "https": {
+                        Type:     cty.Bool,
+                        Optional: true,
+                },
+                "insecure": {
+                        Type:     cty.Bool,
+                        Optional: true,
+                },
+                "cacert": {
+                        Type:     cty.String,
+                        Optional: true,
+                },
+                "use_ntlm": {
+                        Type:     cty.Bool,
+                        Optional: true,
+                },
+        },
+}
+
+// connectionBlockSupersetSchema is a schema representing the superset of all
+// possible arguments for "connection" blocks across all supported connection
+// types.
+//
+// This currently lives here because we've not yet updated our communicator
+// subsystem to be aware of schema itself. It's exported only for use in the
+// configs/configupgrade package and should not be used from anywhere else.
+// The caller may not modify any part of the returned schema data structure.
+func ConnectionBlockSupersetSchema() *configschema.Block {
+        return connectionBlockSupersetSchema
 }
 
 // EvalValidateResource is an EvalNode implementation that validates
 // the configuration of a resource.
 type EvalValidateResource struct {
-        Provider     *ResourceProvider
-        Config       **ResourceConfig
-        ResourceName string
-        ResourceType string
-        ResourceMode config.ResourceMode
+        Addr           addrs.Resource
+        Provider       *providers.Interface
+        ProviderSchema **ProviderSchema
+        Config         *configs.Resource
 
         // IgnoreWarnings means that warnings will not be passed through. This allows
         // "just-in-time" passes of validation to continue execution through warnings.
         IgnoreWarnings bool
+
+        // ConfigVal, if non-nil, will be updated with the value resulting from
+        // evaluating the given configuration body. Since validation is performed
+        // very early, this value is likely to contain lots of unknown values,
+        // but its type will conform to the schema of the resource type associated
+        // with the resource instance being validated.
+        ConfigVal *cty.Value
 }
 
 func (n *EvalValidateResource) Eval(ctx EvalContext) (interface{}, error) {
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                return nil, fmt.Errorf("EvalValidateResource has nil schema for %s", n.Addr)
+        }
+
+        var diags tfdiags.Diagnostics
         provider := *n.Provider
         cfg := *n.Config
-        var warns []string
-        var errs []error
+        schema := *n.ProviderSchema
+        mode := cfg.Mode
+
+        keyData := EvalDataForNoInstanceKey
+        if n.Config.Count != nil {
+                // If the config block has count, we'll evaluate with an unknown
+                // number as count.index so we can still type check even though
+                // we won't expand count until the plan phase.
+                keyData = InstanceKeyEvalData{
+                        CountIndex: cty.UnknownVal(cty.Number),
+                }
+
+                // Basic type-checking of the count argument. More complete validation
+                // of this will happen when we DynamicExpand during the plan walk.
+                countDiags := n.validateCount(ctx, n.Config.Count)
+                diags = diags.Append(countDiags)
+        }
+
+        for _, traversal := range n.Config.DependsOn {
+                ref, refDiags := addrs.ParseRef(traversal)
+                diags = diags.Append(refDiags)
+                if len(ref.Remaining) != 0 {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid depends_on reference",
+                                Detail:   "References in depends_on must be to a whole object (resource, etc), not to an attribute of an object.",
+                                Subject:  ref.Remaining.SourceRange().Ptr(),
+                        })
+                }
+
+                // The ref must also refer to something that exists. To test that,
+                // we'll just eval it and count on the fact that our evaluator will
+                // detect references to non-existent objects.
+                if !diags.HasErrors() {
+                        scope := ctx.EvaluationScope(nil, EvalDataForNoInstanceKey)
+                        if scope != nil { // sometimes nil in tests, due to incomplete mocks
+                                _, refDiags = scope.EvalReference(ref, cty.DynamicPseudoType)
+                                diags = diags.Append(refDiags)
+                        }
+                }
+        }
+
         // Provider entry point varies depending on resource mode, because
         // managed resources and data resources are two distinct concepts
         // in the provider abstraction.
-        switch n.ResourceMode {
-        case config.ManagedResourceMode:
-                warns, errs = provider.ValidateResource(n.ResourceType, cfg)
-        case config.DataResourceMode:
-                warns, errs = provider.ValidateDataSource(n.ResourceType, cfg)
-        }
+        switch mode {
+        case addrs.ManagedResourceMode:
+                schema, _ := schema.SchemaForResourceType(mode, cfg.Type)
+                if schema == nil {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid resource type",
+                                Detail:   fmt.Sprintf("The provider %s does not support resource type %q.", cfg.ProviderConfigAddr(), cfg.Type),
+                                Subject:  &cfg.TypeRange,
+                        })
+                        return nil, diags.Err()
+                }
+
+                configVal, _, valDiags := ctx.EvaluateBlock(cfg.Config, schema, nil, keyData)
+                diags = diags.Append(valDiags)
+                if valDiags.HasErrors() {
+                        return nil, diags.Err()
+                }
+
+                if cfg.Managed != nil { // can be nil only in tests with poorly-configured mocks
+                        for _, traversal := range cfg.Managed.IgnoreChanges {
+                                moreDiags := schema.StaticValidateTraversal(traversal)
+                                diags = diags.Append(moreDiags)
+                        }
+                }
+
+                req := providers.ValidateResourceTypeConfigRequest{
+                        TypeName: cfg.Type,
+                        Config:   configVal,
+                }
+
+                resp := provider.ValidateResourceTypeConfig(req)
+                diags = diags.Append(resp.Diagnostics.InConfigBody(cfg.Config))
+
+                if n.ConfigVal != nil {
+                        *n.ConfigVal = configVal
+                }
+
+        case addrs.DataResourceMode:
+                schema, _ := schema.SchemaForResourceType(mode, cfg.Type)
+                if schema == nil {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid data source",
+                                Detail:   fmt.Sprintf("The provider %s does not support data source %q.", cfg.ProviderConfigAddr(), cfg.Type),
+                                Subject:  &cfg.TypeRange,
+                        })
+                        return nil, diags.Err()
+                }
+
+                configVal, _, valDiags := ctx.EvaluateBlock(cfg.Config, schema, nil, keyData)
+                diags = diags.Append(valDiags)
+                if valDiags.HasErrors() {
+                        return nil, diags.Err()
+                }
 
-        // If the resource name doesn't match the name regular
-        // expression, show an error.
-        if !config.NameRegexp.Match([]byte(n.ResourceName)) {
-                errs = append(errs, fmt.Errorf(
-                        "%s: resource name can only contain letters, numbers, "+
-                                "dashes, and underscores.", n.ResourceName))
+                req := providers.ValidateDataSourceConfigRequest{
+                        TypeName: cfg.Type,
+                        Config:   configVal,
+                }
+
+                resp := provider.ValidateDataSourceConfig(req)
+                diags = diags.Append(resp.Diagnostics.InConfigBody(cfg.Config))
         }
 
-        if (len(warns) == 0 || n.IgnoreWarnings) && len(errs) == 0 {
+        if n.IgnoreWarnings {
+                // If we _only_ have warnings then we'll return nil.
+                if diags.HasErrors() {
+                        return nil, diags.NonFatalErr()
+                }
                 return nil, nil
+        } else {
+                // We'll return an error if there are any diagnostics at all, even if
+                // some of them are warnings.
+                return nil, diags.NonFatalErr()
+        }
+}
+
+func (n *EvalValidateResource) validateCount(ctx EvalContext, expr hcl.Expression) tfdiags.Diagnostics {
+        if expr == nil {
+                return nil
+        }
+
+        var diags tfdiags.Diagnostics
+
+        countVal, countDiags := ctx.EvaluateExpr(expr, cty.Number, nil)
+        diags = diags.Append(countDiags)
+        if diags.HasErrors() {
+                return diags
+        }
+
+        if countVal.IsNull() {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   `The given "count" argument value is null. An integer is required.`,
+                        Subject:  expr.Range().Ptr(),
+                })
+                return diags
         }
 
-        return nil, &EvalValidateError{
-                Warnings: warns,
-                Errors:   errs,
+        var err error
+        countVal, err = convert.Convert(countVal, cty.Number)
+        if err != nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   fmt.Sprintf(`The given "count" argument value is unsuitable: %s.`, err),
+                        Subject:  expr.Range().Ptr(),
+                })
+                return diags
         }
+
+        // If the value isn't known then that's the best we can do for now, but
+        // we'll check more thoroughly during the plan walk.
+        if !countVal.IsKnown() {
+                return diags
+        }
+
+        // If we _do_ know the value, then we can do a few more checks here.
+        var count int
+        err = gocty.FromCtyValue(countVal, &count)
+        if err != nil {
+                // Isn't a whole number, etc.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   fmt.Sprintf(`The given "count" argument value is unsuitable: %s.`, err),
+                        Subject:  expr.Range().Ptr(),
+                })
+                return diags
+        }
+
+        if count < 0 {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid count argument",
+                        Detail:   `The given "count" argument value is unsuitable: count cannot be negative.`,
+                        Subject:  expr.Range().Ptr(),
+                })
+                return diags
+        }
+
+        return diags
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_validate_selfref.go b/vendor/github.com/hashicorp/terraform/terraform/eval_validate_selfref.go
index ae4436a..edd604f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_validate_selfref.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_validate_selfref.go
@@ -3,72 +3,65 @@ package terraform
 import (
         "fmt"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/hcl2/hcl"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
-// EvalValidateResourceSelfRef is an EvalNode implementation that validates that
-// a configuration doesn't contain a reference to the resource itself.
-//
-// This must be done prior to interpolating configuration in order to avoid
-// any infinite loop scenarios.
-type EvalValidateResourceSelfRef struct {
-        Addr   **ResourceAddress
-        Config **config.RawConfig
+// EvalValidateSelfRef is an EvalNode implementation that checks to ensure that
+// expressions within a particular referencable block do not reference that
+// same block.
+type EvalValidateSelfRef struct {
+        Addr           addrs.Referenceable
+        Config         hcl.Body
+        ProviderSchema **ProviderSchema
 }
 
-func (n *EvalValidateResourceSelfRef) Eval(ctx EvalContext) (interface{}, error) {
-        addr := *n.Addr
-        conf := *n.Config
-
-        // Go through the variables and find self references
-        var errs []error
-        for k, raw := range conf.Variables {
-                rv, ok := raw.(*config.ResourceVariable)
-                if !ok {
-                        continue
-                }
-
-                // Build an address from the variable
-                varAddr := &ResourceAddress{
-                        Path:         addr.Path,
-                        Mode:         rv.Mode,
-                        Type:         rv.Type,
-                        Name:         rv.Name,
-                        Index:        rv.Index,
-                        InstanceType: TypePrimary,
-                }
+func (n *EvalValidateSelfRef) Eval(ctx EvalContext) (interface{}, error) {
+        var diags tfdiags.Diagnostics
+        addr := n.Addr
 
-                // If the variable access is a multi-access (*), then we just
-                // match the index so that we'll match our own addr if everything
-                // else matches.
-                if rv.Multi && rv.Index == -1 {
-                        varAddr.Index = addr.Index
-                }
+        addrStrs := make([]string, 0, 1)
+        addrStrs = append(addrStrs, addr.String())
+        switch tAddr := addr.(type) {
+        case addrs.ResourceInstance:
+                // A resource instance may not refer to its containing resource either.
+                addrStrs = append(addrStrs, tAddr.ContainingResource().String())
+        }
 
-                // This is a weird thing where ResourceAddres has index "-1" when
-                // index isn't set at all. This means index "0" for resource access.
-                // So, if we have this scenario, just set our varAddr to -1 so it
-                // matches.
-                if addr.Index == -1 && varAddr.Index == 0 {
-                        varAddr.Index = -1
-                }
+        if n.ProviderSchema == nil || *n.ProviderSchema == nil {
+                return nil, fmt.Errorf("provider schema unavailable while validating %s for self-references; this is a bug in Terraform and should be reported", addr)
+        }
 
-                // If the addresses match, then this is a self reference
-                if varAddr.Equals(addr) && varAddr.Index == addr.Index {
-                        errs = append(errs, fmt.Errorf(
-                                "%s: self reference not allowed: %q",
-                                addr, k))
-                }
+        providerSchema := *n.ProviderSchema
+        var schema *configschema.Block
+        switch tAddr := addr.(type) {
+        case addrs.Resource:
+                schema, _ = providerSchema.SchemaForResourceAddr(tAddr)
+        case addrs.ResourceInstance:
+                schema, _ = providerSchema.SchemaForResourceAddr(tAddr.ContainingResource())
         }
 
-        // If no errors, no errors!
-        if len(errs) == 0 {
-                return nil, nil
+        if schema == nil {
+                return nil, fmt.Errorf("no schema available for %s to validate for self-references; this is a bug in Terraform and should be reported", addr)
         }
 
-        // Wrap the errors in the proper wrapper so we can handle validation
-        // formatting properly upstream.
-        return nil, &EvalValidateError{
-                Errors: errs,
+        refs, _ := lang.ReferencesInBlock(n.Config, schema)
+        for _, ref := range refs {
+                for _, addrStr := range addrStrs {
+                        if ref.Subject.String() == addrStr {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Self-referential block",
+                                        Detail:   fmt.Sprintf("Configuration for %s may not refer to itself.", addrStr),
+                                        Subject:  ref.SourceRange.ToHCL().Ptr(),
+                                })
+                        }
+                }
         }
+
+        return nil, diags.NonFatalErr()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_variable.go b/vendor/github.com/hashicorp/terraform/terraform/eval_variable.go
index e39a33c..68adf76 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_variable.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_variable.go
@@ -4,12 +4,17 @@ import (
         "fmt"
         "log"
         "reflect"
-        "strconv"
         "strings"
 
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs"
+
+        "github.com/hashicorp/terraform/addrs"
+
         "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/config/module"
-        "github.com/hashicorp/terraform/helper/hilmapstructure"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
 )
 
 // EvalTypeCheckVariable is an EvalNode which ensures that the variable
@@ -93,166 +98,88 @@ func (n *EvalTypeCheckVariable) Eval(ctx EvalContext) (interface{}, error) {
         return nil, nil
 }
 
-// EvalSetVariables is an EvalNode implementation that sets the variables
-// explicitly for interpolation later.
-type EvalSetVariables struct {
-        Module    *string
-        Variables map[string]interface{}
+// EvalSetModuleCallArguments is an EvalNode implementation that sets values
+// for arguments of a child module call, for later retrieval during
+// expression evaluation.
+type EvalSetModuleCallArguments struct {
+        Module addrs.ModuleCallInstance
+        Values map[string]cty.Value
 }
 
 // TODO: test
-func (n *EvalSetVariables) Eval(ctx EvalContext) (interface{}, error) {
-        ctx.SetVariables(*n.Module, n.Variables)
+func (n *EvalSetModuleCallArguments) Eval(ctx EvalContext) (interface{}, error) {
+        ctx.SetModuleCallArguments(n.Module, n.Values)
         return nil, nil
 }
 
-// EvalVariableBlock is an EvalNode implementation that evaluates the
-// given configuration, and uses the final values as a way to set the
-// mapping.
-type EvalVariableBlock struct {
-        Config         **ResourceConfig
-        VariableValues map[string]interface{}
+// EvalModuleCallArgument is an EvalNode implementation that produces the value
+// for a particular variable as will be used by a child module instance.
+//
+// The result is written into the map given in Values, with its key
+// set to the local name of the variable, disregarding the module instance
+// address. Any existing values in that map are deleted first. This weird
+// interface is a result of trying to be convenient for use with
+// EvalContext.SetModuleCallArguments, which expects a map to merge in with
+// any existing arguments.
+type EvalModuleCallArgument struct {
+        Addr   addrs.InputVariable
+        Config *configs.Variable
+        Expr   hcl.Expression
+
+        // If this flag is set, any diagnostics are discarded and this operation
+        // will always succeed, though may produce an unknown value in the
+        // event of an error.
+        IgnoreDiagnostics bool
+
+        Values map[string]cty.Value
 }
 
-func (n *EvalVariableBlock) Eval(ctx EvalContext) (interface{}, error) {
+func (n *EvalModuleCallArgument) Eval(ctx EvalContext) (interface{}, error) {
         // Clear out the existing mapping
-        for k, _ := range n.VariableValues {
-                delete(n.VariableValues, k)
-        }
-
-        // Get our configuration
-        rc := *n.Config
-        for k, v := range rc.Config {
-                vKind := reflect.ValueOf(v).Type().Kind()
-
-                switch vKind {
-                case reflect.Slice:
-                        var vSlice []interface{}
-                        if err := hilmapstructure.WeakDecode(v, &vSlice); err == nil {
-                                n.VariableValues[k] = vSlice
-                                continue
-                        }
-                case reflect.Map:
-                        var vMap map[string]interface{}
-                        if err := hilmapstructure.WeakDecode(v, &vMap); err == nil {
-                                n.VariableValues[k] = vMap
-                                continue
-                        }
-                default:
-                        var vString string
-                        if err := hilmapstructure.WeakDecode(v, &vString); err == nil {
-                                n.VariableValues[k] = vString
-                                continue
-                        }
-                }
-
-                return nil, fmt.Errorf("Variable value for %s is not a string, list or map type", k)
-        }
-
-        for _, path := range rc.ComputedKeys {
-                log.Printf("[DEBUG] Setting Unknown Variable Value for computed key: %s", path)
-                err := n.setUnknownVariableValueForPath(path)
-                if err != nil {
-                        return nil, err
-                }
+        for k := range n.Values {
+                delete(n.Values, k)
         }
 
-        return nil, nil
-}
-
-func (n *EvalVariableBlock) setUnknownVariableValueForPath(path string) error {
-        pathComponents := strings.Split(path, ".")
-
-        if len(pathComponents) < 1 {
-                return fmt.Errorf("No path comoponents in %s", path)
+        wantType := n.Config.Type
+        name := n.Addr.Name
+        expr := n.Expr
+
+        if expr == nil {
+                // Should never happen, but we'll bail out early here rather than
+                // crash in case it does. We set no value at all in this case,
+                // making a subsequent call to EvalContext.SetModuleCallArguments
+                // a no-op.
+                log.Printf("[ERROR] attempt to evaluate %s with nil expression", n.Addr.String())
+                return nil, nil
         }
 
-        if len(pathComponents) == 1 {
-                // Special case the "top level" since we know the type
-                if _, ok := n.VariableValues[pathComponents[0]]; !ok {
-                        n.VariableValues[pathComponents[0]] = config.UnknownVariableValue
-                }
-                return nil
+        val, diags := ctx.EvaluateExpr(expr, cty.DynamicPseudoType, nil)
+
+        // We intentionally passed DynamicPseudoType to EvaluateExpr above because
+        // now we can do our own local type conversion and produce an error message
+        // with better context if it fails.
+        var convErr error
+        val, convErr = convert.Convert(val, wantType)
+        if convErr != nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid value for module argument",
+                        Detail: fmt.Sprintf(
+                                "The given value is not suitable for child module variable %q defined at %s: %s.",
+                                name, n.Config.DeclRange.String(), convErr,
+                        ),
+                        Subject: expr.Range().Ptr(),
+                })
+                // We'll return a placeholder unknown value to avoid producing
+                // redundant downstream errors.
+                val = cty.UnknownVal(wantType)
         }
 
-        // Otherwise find the correct point in the tree and then set to unknown
-        var current interface{} = n.VariableValues[pathComponents[0]]
-        for i := 1; i < len(pathComponents); i++ {
-                switch tCurrent := current.(type) {
-                case []interface{}:
-                        index, err := strconv.Atoi(pathComponents[i])
-                        if err != nil {
-                                return fmt.Errorf("Cannot convert %s to slice index in path %s",
-                                        pathComponents[i], path)
-                        }
-                        current = tCurrent[index]
-                case []map[string]interface{}:
-                        index, err := strconv.Atoi(pathComponents[i])
-                        if err != nil {
-                                return fmt.Errorf("Cannot convert %s to slice index in path %s",
-                                        pathComponents[i], path)
-                        }
-                        current = tCurrent[index]
-                case map[string]interface{}:
-                        if val, hasVal := tCurrent[pathComponents[i]]; hasVal {
-                                current = val
-                                continue
-                        }
-
-                        tCurrent[pathComponents[i]] = config.UnknownVariableValue
-                        break
-                }
+        n.Values[name] = val
+        if n.IgnoreDiagnostics {
+                return nil, nil
         }
-
-        return nil
-}
-
-// EvalCoerceMapVariable is an EvalNode implementation that recognizes a
-// specific ambiguous HCL parsing situation and resolves it. In HCL parsing, a
-// bare map literal is indistinguishable from a list of maps w/ one element.
-//
-// We take all the same inputs as EvalTypeCheckVariable above, since we need
-// both the target type and the proposed value in order to properly coerce.
-type EvalCoerceMapVariable struct {
-        Variables  map[string]interface{}
-        ModulePath []string
-        ModuleTree *module.Tree
-}
-
-// Eval implements the EvalNode interface. See EvalCoerceMapVariable for
-// details.
-func (n *EvalCoerceMapVariable) Eval(ctx EvalContext) (interface{}, error) {
-        currentTree := n.ModuleTree
-        for _, pathComponent := range n.ModulePath[1:] {
-                currentTree = currentTree.Children()[pathComponent]
-        }
-        targetConfig := currentTree.Config()
-
-        prototypes := make(map[string]config.VariableType)
-        for _, variable := range targetConfig.Variables {
-                prototypes[variable.Name] = variable.Type()
-        }
-
-        for name, declaredType := range prototypes {
-                if declaredType != config.VariableTypeMap {
-                        continue
-                }
-
-                proposedValue, ok := n.Variables[name]
-                if !ok {
-                        continue
-                }
-
-                if list, ok := proposedValue.([]interface{}); ok && len(list) == 1 {
-                        if m, ok := list[0].(map[string]interface{}); ok {
-                                log.Printf("[DEBUG] EvalCoerceMapVariable: "+
-                                        "Coercing single element list into map: %#v", m)
-                                n.Variables[name] = m
-                        }
-                }
-        }
-
-        return nil, nil
+        return nil, diags.ErrWithWarnings()
 }
 
 // hclTypeName returns the name of the type that would represent this value in
diff --git a/vendor/github.com/hashicorp/terraform/terraform/evaltree_provider.go b/vendor/github.com/hashicorp/terraform/terraform/evaltree_provider.go
index 0c3da48..6b4df67 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/evaltree_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/evaltree_provider.go
@@ -1,48 +1,34 @@
 package terraform
 
 import (
-        "strings"
-
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/providers"
 )
 
 // ProviderEvalTree returns the evaluation tree for initializing and
 // configuring providers.
-func ProviderEvalTree(n *NodeApplyableProvider, config *config.ProviderConfig) EvalNode {
-        var provider ResourceProvider
-        var resourceConfig *ResourceConfig
+func ProviderEvalTree(n *NodeApplyableProvider, config *configs.Provider) EvalNode {
+        var provider providers.Interface
 
-        typeName := strings.SplitN(n.NameValue, ".", 2)[0]
+        addr := n.Addr
+        relAddr := addr.ProviderConfig
 
         seq := make([]EvalNode, 0, 5)
         seq = append(seq, &EvalInitProvider{
-                TypeName: typeName,
-                Name:     n.Name(),
+                TypeName: relAddr.Type,
+                Addr:     addr.ProviderConfig,
         })
 
         // Input stuff
         seq = append(seq, &EvalOpFilter{
-                Ops: []walkOperation{walkInput, walkImport},
+                Ops: []walkOperation{walkImport},
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalGetProvider{
-                                        Name:   n.Name(),
+                                        Addr:   addr,
                                         Output: &provider,
                                 },
-                                &EvalInterpolateProvider{
-                                        Config: config,
-                                        Output: &resourceConfig,
-                                },
-                                &EvalBuildProviderConfig{
-                                        Provider: n.NameValue,
-                                        Config:   &resourceConfig,
-                                        Output:   &resourceConfig,
-                                },
-                                &EvalInputProvider{
-                                        Name:     n.NameValue,
-                                        Provider: &provider,
-                                        Config:   &resourceConfig,
-                                },
                         },
                 },
         })
@@ -52,21 +38,13 @@ func ProviderEvalTree(n *NodeApplyableProvider, config *config.ProviderConfig) E
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalGetProvider{
-                                        Name:   n.Name(),
+                                        Addr:   addr,
                                         Output: &provider,
                                 },
-                                &EvalInterpolateProvider{
-                                        Config: config,
-                                        Output: &resourceConfig,
-                                },
-                                &EvalBuildProviderConfig{
-                                        Provider: n.NameValue,
-                                        Config:   &resourceConfig,
-                                        Output:   &resourceConfig,
-                                },
                                 &EvalValidateProvider{
+                                        Addr:     relAddr,
                                         Provider: &provider,
-                                        Config:   &resourceConfig,
+                                        Config:   config,
                                 },
                         },
                 },
@@ -78,18 +56,9 @@ func ProviderEvalTree(n *NodeApplyableProvider, config *config.ProviderConfig) E
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalGetProvider{
-                                        Name:   n.Name(),
+                                        Addr:   addr,
                                         Output: &provider,
                                 },
-                                &EvalInterpolateProvider{
-                                        Config: config,
-                                        Output: &resourceConfig,
-                                },
-                                &EvalBuildProviderConfig{
-                                        Provider: n.NameValue,
-                                        Config:   &resourceConfig,
-                                        Output:   &resourceConfig,
-                                },
                         },
                 },
         })
@@ -101,8 +70,9 @@ func ProviderEvalTree(n *NodeApplyableProvider, config *config.ProviderConfig) E
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalConfigProvider{
-                                        Provider: n.Name(),
-                                        Config:   &resourceConfig,
+                                        Addr:     relAddr,
+                                        Provider: &provider,
+                                        Config:   config,
                                 },
                         },
                 },
@@ -113,6 +83,6 @@ func ProviderEvalTree(n *NodeApplyableProvider, config *config.ProviderConfig) E
 
 // CloseProviderEvalTree returns the evaluation tree for closing
 // provider connections that aren't needed anymore.
-func CloseProviderEvalTree(n string) EvalNode {
-        return &EvalCloseProvider{Name: n}
+func CloseProviderEvalTree(addr addrs.AbsProviderConfig) EvalNode {
+        return &EvalCloseProvider{Addr: addr.ProviderConfig}
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/evaluate.go b/vendor/github.com/hashicorp/terraform/terraform/evaluate.go
new file mode 100644
index 0000000..ab65d47
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/evaluate.go
@@ -0,0 +1,933 @@
+package terraform
+
+import (
+        "fmt"
+        "log"
+        "os"
+        "path/filepath"
+        "strconv"
+        "sync"
+
+        "github.com/agext/levenshtein"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// Evaluator provides the necessary contextual data for evaluating expressions
+// for a particular walk operation.
+type Evaluator struct {
+        // Operation defines what type of operation this evaluator is being used
+        // for.
+        Operation walkOperation
+
+        // Meta is contextual metadata about the current operation.
+        Meta *ContextMeta
+
+        // Config is the root node in the configuration tree.
+        Config *configs.Config
+
+        // VariableValues is a map from variable names to their associated values,
+        // within the module indicated by ModulePath. VariableValues is modified
+        // concurrently, and so it must be accessed only while holding
+        // VariableValuesLock.
+        //
+        // The first map level is string representations of addr.ModuleInstance
+        // values, while the second level is variable names.
+        VariableValues     map[string]map[string]cty.Value
+        VariableValuesLock *sync.Mutex
+
+        // Schemas is a repository of all of the schemas we should need to
+        // evaluate expressions. This must be constructed by the caller to
+        // include schemas for all of the providers, resource types, data sources
+        // and provisioners used by the given configuration and state.
+        //
+        // This must not be mutated during evaluation.
+        Schemas *Schemas
+
+        // State is the current state, embedded in a wrapper that ensures that
+        // it can be safely accessed and modified concurrently.
+        State *states.SyncState
+
+        // Changes is the set of proposed changes, embedded in a wrapper that
+        // ensures they can be safely accessed and modified concurrently.
+        Changes *plans.ChangesSync
+}
+
+// Scope creates an evaluation scope for the given module path and optional
+// resource.
+//
+// If the "self" argument is nil then the "self" object is not available
+// in evaluated expressions. Otherwise, it behaves as an alias for the given
+// address.
+func (e *Evaluator) Scope(data lang.Data, self addrs.Referenceable) *lang.Scope {
+        return &lang.Scope{
+                Data:     data,
+                SelfAddr: self,
+                PureOnly: e.Operation != walkApply && e.Operation != walkDestroy,
+                BaseDir:  ".", // Always current working directory for now.
+        }
+}
+
+// evaluationStateData is an implementation of lang.Data that resolves
+// references primarily (but not exclusively) using information from a State.
+type evaluationStateData struct {
+        Evaluator *Evaluator
+
+        // ModulePath is the path through the dynamic module tree to the module
+        // that references will be resolved relative to.
+        ModulePath addrs.ModuleInstance
+
+        // InstanceKeyData describes the values, if any, that are accessible due
+        // to repetition of a containing object using "count" or "for_each"
+        // arguments. (It is _not_ used for the for_each inside "dynamic" blocks,
+        // since the user specifies in that case which variable name to locally
+        // shadow.)
+        InstanceKeyData InstanceKeyEvalData
+
+        // Operation records the type of walk the evaluationStateData is being used
+        // for.
+        Operation walkOperation
+}
+
+// InstanceKeyEvalData is used during evaluation to specify which values,
+// if any, should be produced for count.index, each.key, and each.value.
+type InstanceKeyEvalData struct {
+        // CountIndex is the value for count.index, or cty.NilVal if evaluating
+        // in a context where the "count" argument is not active.
+        //
+        // For correct operation, this should always be of type cty.Number if not
+        // nil.
+        CountIndex cty.Value
+
+        // EachKey and EachValue are the values for each.key and each.value
+        // respectively, or cty.NilVal if evaluating in a context where the
+        // "for_each" argument is not active. These must either both be set
+        // or neither set.
+        //
+        // For correct operation, EachKey must always be either of type cty.String
+        // or cty.Number if not nil.
+        EachKey, EachValue cty.Value
+}
+
+// EvalDataForInstanceKey constructs a suitable InstanceKeyEvalData for
+// evaluating in a context that has the given instance key.
+func EvalDataForInstanceKey(key addrs.InstanceKey) InstanceKeyEvalData {
+        // At the moment we don't actually implement for_each, so we only
+        // ever populate CountIndex.
+        // (When we implement for_each later we may need to reorganize this some,
+        // so that we can resolve the ambiguity that an int key may either be
+        // a count.index or an each.key where for_each is over a list.)
+
+        var countIdx cty.Value
+        if intKey, ok := key.(addrs.IntKey); ok {
+                countIdx = cty.NumberIntVal(int64(intKey))
+        }
+
+        return InstanceKeyEvalData{
+                CountIndex: countIdx,
+        }
+}
+
+// EvalDataForNoInstanceKey is a value of InstanceKeyData that sets no instance
+// key values at all, suitable for use in contexts where no keyed instance
+// is relevant.
+var EvalDataForNoInstanceKey = InstanceKeyEvalData{}
+
+// evaluationStateData must implement lang.Data
+var _ lang.Data = (*evaluationStateData)(nil)
+
+func (d *evaluationStateData) GetCountAttr(addr addrs.CountAttr, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        switch addr.Name {
+
+        case "index":
+                idxVal := d.InstanceKeyData.CountIndex
+                if idxVal == cty.NilVal {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  `Reference to "count" in non-counted context`,
+                                Detail:   fmt.Sprintf(`The "count" object can be used only in "resource" and "data" blocks, and only when the "count" argument is set.`),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                        return cty.UnknownVal(cty.Number), diags
+                }
+                return idxVal, diags
+
+        default:
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid "count" attribute`,
+                        Detail:   fmt.Sprintf(`The "count" object does not have an attribute named %q. The only supported attribute is count.index, which is the index of each instance of a resource block that has the "count" argument set.`, addr.Name),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+}
+
+func (d *evaluationStateData) GetInputVariable(addr addrs.InputVariable, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // First we'll make sure the requested value is declared in configuration,
+        // so we can produce a nice message if not.
+        moduleConfig := d.Evaluator.Config.DescendentForInstance(d.ModulePath)
+        if moduleConfig == nil {
+                // should never happen, since we can't be evaluating in a module
+                // that wasn't mentioned in configuration.
+                panic(fmt.Sprintf("input variable read from %s, which has no configuration", d.ModulePath))
+        }
+
+        config := moduleConfig.Module.Variables[addr.Name]
+        if config == nil {
+                var suggestions []string
+                for k := range moduleConfig.Module.Variables {
+                        suggestions = append(suggestions, k)
+                }
+                suggestion := nameSuggestion(addr.Name, suggestions)
+                if suggestion != "" {
+                        suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+                } else {
+                        suggestion = fmt.Sprintf(" This variable can be declared with a variable %q {} block.", addr.Name)
+                }
+
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared input variable`,
+                        Detail:   fmt.Sprintf(`An input variable with the name %q has not been declared.%s`, addr.Name, suggestion),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        wantType := cty.DynamicPseudoType
+        if config.Type != cty.NilType {
+                wantType = config.Type
+        }
+
+        d.Evaluator.VariableValuesLock.Lock()
+        defer d.Evaluator.VariableValuesLock.Unlock()
+
+        // During the validate walk, input variables are always unknown so
+        // that we are validating the configuration for all possible input values
+        // rather than for a specific set. Checking against a specific set of
+        // input values then happens during the plan walk.
+        //
+        // This is important because otherwise the validation walk will tend to be
+        // overly strict, requiring expressions throughout the configuration to
+        // be complicated to accommodate all possible inputs, whereas returning
+        // known here allows for simpler patterns like using input values as
+        // guards to broadly enable/disable resources, avoid processing things
+        // that are disabled, etc. Terraform's static validation leans towards
+        // being liberal in what it accepts because the subsequent plan walk has
+        // more information available and so can be more conservative.
+        if d.Operation == walkValidate {
+                return cty.UnknownVal(wantType), diags
+        }
+
+        moduleAddrStr := d.ModulePath.String()
+        vals := d.Evaluator.VariableValues[moduleAddrStr]
+        if vals == nil {
+                return cty.UnknownVal(wantType), diags
+        }
+
+        val, isSet := vals[addr.Name]
+        if !isSet {
+                if config.Default != cty.NilVal {
+                        return config.Default, diags
+                }
+                return cty.UnknownVal(wantType), diags
+        }
+
+        var err error
+        val, err = convert.Convert(val, wantType)
+        if err != nil {
+                // We should never get here because this problem should've been caught
+                // during earlier validation, but we'll do something reasonable anyway.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Incorrect variable type`,
+                        Detail:   fmt.Sprintf(`The resolved value of variable %q is not appropriate: %s.`, addr.Name, err),
+                        Subject:  &config.DeclRange,
+                })
+                // Stub out our return value so that the semantic checker doesn't
+                // produce redundant downstream errors.
+                val = cty.UnknownVal(wantType)
+        }
+
+        return val, diags
+}
+
+func (d *evaluationStateData) GetLocalValue(addr addrs.LocalValue, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // First we'll make sure the requested value is declared in configuration,
+        // so we can produce a nice message if not.
+        moduleConfig := d.Evaluator.Config.DescendentForInstance(d.ModulePath)
+        if moduleConfig == nil {
+                // should never happen, since we can't be evaluating in a module
+                // that wasn't mentioned in configuration.
+                panic(fmt.Sprintf("local value read from %s, which has no configuration", d.ModulePath))
+        }
+
+        config := moduleConfig.Module.Locals[addr.Name]
+        if config == nil {
+                var suggestions []string
+                for k := range moduleConfig.Module.Locals {
+                        suggestions = append(suggestions, k)
+                }
+                suggestion := nameSuggestion(addr.Name, suggestions)
+                if suggestion != "" {
+                        suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+                }
+
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared local value`,
+                        Detail:   fmt.Sprintf(`A local value with the name %q has not been declared.%s`, addr.Name, suggestion),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        val := d.Evaluator.State.LocalValue(addr.Absolute(d.ModulePath))
+        if val == cty.NilVal {
+                // Not evaluated yet?
+                val = cty.DynamicVal
+        }
+
+        return val, diags
+}
+
+func (d *evaluationStateData) GetModuleInstance(addr addrs.ModuleCallInstance, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // Output results live in the module that declares them, which is one of
+        // the child module instances of our current module path.
+        moduleAddr := addr.ModuleInstance(d.ModulePath)
+
+        // We'll consult the configuration to see what output names we are
+        // expecting, so we can ensure the resulting object is of the expected
+        // type even if our data is incomplete for some reason.
+        moduleConfig := d.Evaluator.Config.DescendentForInstance(moduleAddr)
+        if moduleConfig == nil {
+                // should never happen, since this should've been caught during
+                // static validation.
+                panic(fmt.Sprintf("output value read from %s, which has no configuration", moduleAddr))
+        }
+        outputConfigs := moduleConfig.Module.Outputs
+
+        vals := map[string]cty.Value{}
+        for n := range outputConfigs {
+                addr := addrs.OutputValue{Name: n}.Absolute(moduleAddr)
+
+                // If a pending change is present in our current changeset then its value
+                // takes priority over what's in state. (It will usually be the same but
+                // will differ if the new value is unknown during planning.)
+                if changeSrc := d.Evaluator.Changes.GetOutputChange(addr); changeSrc != nil {
+                        change, err := changeSrc.Decode()
+                        if err != nil {
+                                // This should happen only if someone has tampered with a plan
+                                // file, so we won't bother with a pretty error for it.
+                                diags = diags.Append(fmt.Errorf("planned change for %s could not be decoded: %s", addr, err))
+                                vals[n] = cty.DynamicVal
+                                continue
+                        }
+                        // We care only about the "after" value, which is the value this output
+                        // will take on after the plan is applied.
+                        vals[n] = change.After
+                } else {
+                        os := d.Evaluator.State.OutputValue(addr)
+                        if os == nil {
+                                // Not evaluated yet?
+                                vals[n] = cty.DynamicVal
+                                continue
+                        }
+                        vals[n] = os.Value
+                }
+        }
+        return cty.ObjectVal(vals), diags
+}
+
+func (d *evaluationStateData) GetModuleInstanceOutput(addr addrs.ModuleCallOutput, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // Output results live in the module that declares them, which is one of
+        // the child module instances of our current module path.
+        absAddr := addr.AbsOutputValue(d.ModulePath)
+        moduleAddr := absAddr.Module
+
+        // First we'll consult the configuration to see if an output of this
+        // name is declared at all.
+        moduleConfig := d.Evaluator.Config.DescendentForInstance(moduleAddr)
+        if moduleConfig == nil {
+                // this doesn't happen in normal circumstances due to our validation
+                // pass, but it can turn up in some unusual situations, like in the
+                // "terraform console" repl where arbitrary expressions can be
+                // evaluated.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared module`,
+                        Detail:   fmt.Sprintf(`The configuration contains no %s.`, moduleAddr),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        config := moduleConfig.Module.Outputs[addr.Name]
+        if config == nil {
+                var suggestions []string
+                for k := range moduleConfig.Module.Outputs {
+                        suggestions = append(suggestions, k)
+                }
+                suggestion := nameSuggestion(addr.Name, suggestions)
+                if suggestion != "" {
+                        suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+                }
+
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared output value`,
+                        Detail:   fmt.Sprintf(`An output value with the name %q has not been declared in %s.%s`, addr.Name, moduleDisplayAddr(moduleAddr), suggestion),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        // If a pending change is present in our current changeset then its value
+        // takes priority over what's in state. (It will usually be the same but
+        // will differ if the new value is unknown during planning.)
+        if changeSrc := d.Evaluator.Changes.GetOutputChange(absAddr); changeSrc != nil {
+                change, err := changeSrc.Decode()
+                if err != nil {
+                        // This should happen only if someone has tampered with a plan
+                        // file, so we won't bother with a pretty error for it.
+                        diags = diags.Append(fmt.Errorf("planned change for %s could not be decoded: %s", absAddr, err))
+                        return cty.DynamicVal, diags
+                }
+                // We care only about the "after" value, which is the value this output
+                // will take on after the plan is applied.
+                return change.After, diags
+        }
+
+        os := d.Evaluator.State.OutputValue(absAddr)
+        if os == nil {
+                // Not evaluated yet?
+                return cty.DynamicVal, diags
+        }
+
+        return os.Value, diags
+}
+
+func (d *evaluationStateData) GetPathAttr(addr addrs.PathAttr, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        switch addr.Name {
+
+        case "cwd":
+                wd, err := os.Getwd()
+                if err != nil {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  `Failed to get working directory`,
+                                Detail:   fmt.Sprintf(`The value for path.cwd cannot be determined due to a system error: %s`, err),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                        return cty.DynamicVal, diags
+                }
+                return cty.StringVal(filepath.ToSlash(wd)), diags
+
+        case "module":
+                moduleConfig := d.Evaluator.Config.DescendentForInstance(d.ModulePath)
+                if moduleConfig == nil {
+                        // should never happen, since we can't be evaluating in a module
+                        // that wasn't mentioned in configuration.
+                        panic(fmt.Sprintf("module.path read from module %s, which has no configuration", d.ModulePath))
+                }
+                sourceDir := moduleConfig.Module.SourceDir
+                return cty.StringVal(filepath.ToSlash(sourceDir)), diags
+
+        case "root":
+                sourceDir := d.Evaluator.Config.Module.SourceDir
+                return cty.StringVal(filepath.ToSlash(sourceDir)), diags
+
+        default:
+                suggestion := nameSuggestion(addr.Name, []string{"cwd", "module", "root"})
+                if suggestion != "" {
+                        suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+                }
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid "path" attribute`,
+                        Detail:   fmt.Sprintf(`The "path" object does not have an attribute named %q.%s`, addr.Name, suggestion),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+}
+
+func (d *evaluationStateData) GetResourceInstance(addr addrs.ResourceInstance, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        // Although we are giving a ResourceInstance address here, if it has
+        // a key of addrs.NoKey then it might actually be a request for all of
+        // the instances of a particular resource. The reference resolver can't
+        // resolve the ambiguity itself, so we must do it in here.
+
+        // First we'll consult the configuration to see if an resource of this
+        // name is declared at all.
+        moduleAddr := d.ModulePath
+        moduleConfig := d.Evaluator.Config.DescendentForInstance(moduleAddr)
+        if moduleConfig == nil {
+                // should never happen, since we can't be evaluating in a module
+                // that wasn't mentioned in configuration.
+                panic(fmt.Sprintf("resource value read from %s, which has no configuration", moduleAddr))
+        }
+
+        config := moduleConfig.Module.ResourceByAddr(addr.ContainingResource())
+        if config == nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared resource`,
+                        Detail:   fmt.Sprintf(`A resource %q %q has not been declared in %s`, addr.Resource.Type, addr.Resource.Name, moduleDisplayAddr(moduleAddr)),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        // First we'll find the state for the resource as a whole, and decide
+        // from there whether we're going to interpret the given address as a
+        // resource or a resource instance address.
+        rs := d.Evaluator.State.Resource(addr.ContainingResource().Absolute(d.ModulePath))
+
+        if rs == nil {
+                schema := d.getResourceSchema(addr.ContainingResource(), config.ProviderConfigAddr().Absolute(d.ModulePath))
+
+                // If it doesn't exist at all then we can't reliably determine whether
+                // single-instance or whole-resource interpretation was intended, but
+                // we can decide this partially...
+                if addr.Key != addrs.NoKey {
+                        // If there's an instance key then the user must be intending
+                        // single-instance interpretation, and so we can return a
+                        // properly-typed unknown value to help with type checking.
+                        return cty.UnknownVal(schema.ImpliedType()), diags
+                }
+
+                // otherwise we must return DynamicVal so that both interpretations
+                // can proceed without generating errors, and we'll deal with this
+                // in a later step where more information is gathered.
+                // (In practice we should only end up here during the validate walk,
+                // since later walks should have at least partial states populated
+                // for all resources in the configuration.)
+                return cty.DynamicVal, diags
+        }
+
+        // Break out early during validation, because resource may not be expanded
+        // yet and indexed references may show up as invalid.
+        if d.Operation == walkValidate {
+                return cty.DynamicVal, diags
+        }
+
+        schema := d.getResourceSchema(addr.ContainingResource(), rs.ProviderConfig)
+
+        // If we are able to automatically convert to the "right" type of instance
+        // key for this each mode then we'll do so, to match with how we generally
+        // treat values elsewhere in the language. This allows code below to
+        // assume that any possible conversions have already been dealt with and
+        // just worry about validation.
+        key := d.coerceInstanceKey(addr.Key, rs.EachMode)
+
+        multi := false
+
+        switch rs.EachMode {
+        case states.NoEach:
+                if key != addrs.NoKey {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid resource index",
+                                Detail:   fmt.Sprintf("Resource %s does not have either \"count\" or \"for_each\" set, so it cannot be indexed.", addr.ContainingResource()),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                        return cty.DynamicVal, diags
+                }
+        case states.EachList:
+                multi = key == addrs.NoKey
+                if _, ok := addr.Key.(addrs.IntKey); !multi && !ok {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid resource index",
+                                Detail:   fmt.Sprintf("Resource %s must be indexed with a number value.", addr.ContainingResource()),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                        return cty.DynamicVal, diags
+                }
+        case states.EachMap:
+                multi = key == addrs.NoKey
+                if _, ok := addr.Key.(addrs.IntKey); !multi && !ok {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid resource index",
+                                Detail:   fmt.Sprintf("Resource %s must be indexed with a string value.", addr.ContainingResource()),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                        return cty.DynamicVal, diags
+                }
+        }
+
+        if !multi {
+                log.Printf("[TRACE] GetResourceInstance: %s is a single instance", addr)
+                is := rs.Instance(key)
+                if is == nil {
+                        return cty.UnknownVal(schema.ImpliedType()), diags
+                }
+                return d.getResourceInstanceSingle(addr, rng, is, config, rs.ProviderConfig)
+        }
+
+        log.Printf("[TRACE] GetResourceInstance: %s has multiple keyed instances", addr)
+        return d.getResourceInstancesAll(addr.ContainingResource(), rng, config, rs, rs.ProviderConfig)
+}
+
+func (d *evaluationStateData) getResourceInstanceSingle(addr addrs.ResourceInstance, rng tfdiags.SourceRange, is *states.ResourceInstance, config *configs.Resource, providerAddr addrs.AbsProviderConfig) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        schema := d.getResourceSchema(addr.ContainingResource(), providerAddr)
+        if schema == nil {
+                // This shouldn't happen, since validation before we get here should've
+                // taken care of it, but we'll show a reasonable error message anyway.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Missing resource type schema`,
+                        Detail:   fmt.Sprintf("No schema is available for %s in %s. This is a bug in Terraform and should be reported.", addr, providerAddr),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        ty := schema.ImpliedType()
+        if is == nil || is.Current == nil {
+                // Assume we're dealing with an instance that hasn't been created yet.
+                return cty.UnknownVal(ty), diags
+        }
+
+        if is.Current.Status == states.ObjectPlanned {
+                // If there's a pending change for this instance in our plan, we'll prefer
+                // that. This is important because the state can't represent unknown values
+                // and so its data is inaccurate when changes are pending.
+                if change := d.Evaluator.Changes.GetResourceInstanceChange(addr.Absolute(d.ModulePath), states.CurrentGen); change != nil {
+                        val, err := change.After.Decode(ty)
+                        if err != nil {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid resource instance data in plan",
+                                        Detail:   fmt.Sprintf("Instance %s data could not be decoded from the plan: %s.", addr.Absolute(d.ModulePath), err),
+                                        Subject:  &config.DeclRange,
+                                })
+                                return cty.UnknownVal(ty), diags
+                        }
+                        return val, diags
+                } else {
+                        // If the object is in planned status then we should not
+                        // get here, since we should've found a pending value
+                        // in the plan above instead.
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing pending object in plan",
+                                Detail:   fmt.Sprintf("Instance %s is marked as having a change pending but that change is not recorded in the plan. This is a bug in Terraform; please report it.", addr),
+                                Subject:  &config.DeclRange,
+                        })
+                        return cty.UnknownVal(ty), diags
+                }
+        }
+
+        ios, err := is.Current.Decode(ty)
+        if err != nil {
+                // This shouldn't happen, since by the time we get here
+                // we should've upgraded the state data already.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid resource instance data in state",
+                        Detail:   fmt.Sprintf("Instance %s data could not be decoded from the state: %s.", addr.Absolute(d.ModulePath), err),
+                        Subject:  &config.DeclRange,
+                })
+                return cty.UnknownVal(ty), diags
+        }
+
+        return ios.Value, diags
+}
+
+func (d *evaluationStateData) getResourceInstancesAll(addr addrs.Resource, rng tfdiags.SourceRange, config *configs.Resource, rs *states.Resource, providerAddr addrs.AbsProviderConfig) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+
+        schema := d.getResourceSchema(addr, providerAddr)
+        if schema == nil {
+                // This shouldn't happen, since validation before we get here should've
+                // taken care of it, but we'll show a reasonable error message anyway.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Missing resource type schema`,
+                        Detail:   fmt.Sprintf("No schema is available for %s in %s. This is a bug in Terraform and should be reported.", addr, providerAddr),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+
+        switch rs.EachMode {
+
+        case states.EachList:
+                // We need to infer the length of our resulting tuple by searching
+                // for the max IntKey in our instances map.
+                length := 0
+                for k := range rs.Instances {
+                        if ik, ok := k.(addrs.IntKey); ok {
+                                if int(ik) >= length {
+                                        length = int(ik) + 1
+                                }
+                        }
+                }
+
+                vals := make([]cty.Value, length)
+                for i := 0; i < length; i++ {
+                        ty := schema.ImpliedType()
+                        key := addrs.IntKey(i)
+                        is, exists := rs.Instances[key]
+                        if exists {
+                                instAddr := addr.Instance(key).Absolute(d.ModulePath)
+
+                                // Prefer pending value in plan if present. See getResourceInstanceSingle
+                                // comment for the rationale.
+                                if is.Current.Status == states.ObjectPlanned {
+                                        if change := d.Evaluator.Changes.GetResourceInstanceChange(instAddr, states.CurrentGen); change != nil {
+                                                val, err := change.After.Decode(ty)
+                                                if err != nil {
+                                                        diags = diags.Append(&hcl.Diagnostic{
+                                                                Severity: hcl.DiagError,
+                                                                Summary:  "Invalid resource instance data in plan",
+                                                                Detail:   fmt.Sprintf("Instance %s data could not be decoded from the plan: %s.", instAddr, err),
+                                                                Subject:  &config.DeclRange,
+                                                        })
+                                                        continue
+                                                }
+                                                vals[i] = val
+                                                continue
+                                        } else {
+                                                // If the object is in planned status then we should not
+                                                // get here, since we should've found a pending value
+                                                // in the plan above instead.
+                                                diags = diags.Append(&hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Missing pending object in plan",
+                                                        Detail:   fmt.Sprintf("Instance %s is marked as having a change pending but that change is not recorded in the plan. This is a bug in Terraform; please report it.", instAddr),
+                                                        Subject:  &config.DeclRange,
+                                                })
+                                                continue
+                                        }
+                                }
+
+                                ios, err := is.Current.Decode(ty)
+                                if err != nil {
+                                        // This shouldn't happen, since by the time we get here
+                                        // we should've upgraded the state data already.
+                                        diags = diags.Append(&hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Invalid resource instance data in state",
+                                                Detail:   fmt.Sprintf("Instance %s data could not be decoded from the state: %s.", instAddr, err),
+                                                Subject:  &config.DeclRange,
+                                        })
+                                        continue
+                                }
+                                vals[i] = ios.Value
+                        } else {
+                                // There shouldn't normally be "gaps" in our list but we'll
+                                // allow it under the assumption that we're in a weird situation
+                                // where e.g. someone has run "terraform state mv" to reorder
+                                // a list and left a hole behind.
+                                vals[i] = cty.UnknownVal(schema.ImpliedType())
+                        }
+                }
+
+                // We use a tuple rather than a list here because resource schemas may
+                // include dynamically-typed attributes, which will then cause each
+                // instance to potentially have a different runtime type even though
+                // they all conform to the static schema.
+                return cty.TupleVal(vals), diags
+
+        case states.EachMap:
+                ty := schema.ImpliedType()
+                vals := make(map[string]cty.Value, len(rs.Instances))
+                for k, is := range rs.Instances {
+                        if sk, ok := k.(addrs.StringKey); ok {
+                                instAddr := addr.Instance(k).Absolute(d.ModulePath)
+
+                                // Prefer pending value in plan if present. See getResourceInstanceSingle
+                                // comment for the rationale.
+                                // Prefer pending value in plan if present. See getResourceInstanceSingle
+                                // comment for the rationale.
+                                if is.Current.Status == states.ObjectPlanned {
+                                        if change := d.Evaluator.Changes.GetResourceInstanceChange(instAddr, states.CurrentGen); change != nil {
+                                                val, err := change.After.Decode(ty)
+                                                if err != nil {
+                                                        diags = diags.Append(&hcl.Diagnostic{
+                                                                Severity: hcl.DiagError,
+                                                                Summary:  "Invalid resource instance data in plan",
+                                                                Detail:   fmt.Sprintf("Instance %s data could not be decoded from the plan: %s.", instAddr, err),
+                                                                Subject:  &config.DeclRange,
+                                                        })
+                                                        continue
+                                                }
+                                                vals[string(sk)] = val
+                                                continue
+                                        } else {
+                                                // If the object is in planned status then we should not
+                                                // get here, since we should've found a pending value
+                                                // in the plan above instead.
+                                                diags = diags.Append(&hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Missing pending object in plan",
+                                                        Detail:   fmt.Sprintf("Instance %s is marked as having a change pending but that change is not recorded in the plan. This is a bug in Terraform; please report it.", instAddr),
+                                                        Subject:  &config.DeclRange,
+                                                })
+                                                continue
+                                        }
+                                }
+
+                                ios, err := is.Current.Decode(ty)
+                                if err != nil {
+                                        // This shouldn't happen, since by the time we get here
+                                        // we should've upgraded the state data already.
+                                        diags = diags.Append(&hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Invalid resource instance data in state",
+                                                Detail:   fmt.Sprintf("Instance %s data could not be decoded from the state: %s.", instAddr, err),
+                                                Subject:  &config.DeclRange,
+                                        })
+                                        continue
+                                }
+                                vals[string(sk)] = ios.Value
+                        }
+                }
+
+                // We use an object rather than a map here because resource schemas may
+                // include dynamically-typed attributes, which will then cause each
+                // instance to potentially have a different runtime type even though
+                // they all conform to the static schema.
+                return cty.ObjectVal(vals), diags
+
+        default:
+                // Should never happen since caller should deal with other modes
+                panic(fmt.Sprintf("unsupported EachMode %s", rs.EachMode))
+        }
+}
+
+func (d *evaluationStateData) getResourceSchema(addr addrs.Resource, providerAddr addrs.AbsProviderConfig) *configschema.Block {
+        providerType := providerAddr.ProviderConfig.Type
+        schemas := d.Evaluator.Schemas
+        schema, _ := schemas.ResourceTypeConfig(providerType, addr.Mode, addr.Type)
+        return schema
+}
+
+// coerceInstanceKey attempts to convert the given key to the type expected
+// for the given EachMode.
+//
+// If the key is already of the correct type or if it cannot be converted then
+// it is returned verbatim. If conversion is required and possible, the
+// converted value is returned. Callers should not try to determine if
+// conversion was possible, should instead just check if the result is of
+// the expected type.
+func (d *evaluationStateData) coerceInstanceKey(key addrs.InstanceKey, mode states.EachMode) addrs.InstanceKey {
+        if key == addrs.NoKey {
+                // An absent key can't be converted
+                return key
+        }
+
+        switch mode {
+        case states.NoEach:
+                // No conversions possible at all
+                return key
+        case states.EachMap:
+                if intKey, isInt := key.(addrs.IntKey); isInt {
+                        return addrs.StringKey(strconv.Itoa(int(intKey)))
+                }
+                return key
+        case states.EachList:
+                if strKey, isStr := key.(addrs.StringKey); isStr {
+                        i, err := strconv.Atoi(string(strKey))
+                        if err != nil {
+                                return key
+                        }
+                        return addrs.IntKey(i)
+                }
+                return key
+        default:
+                return key
+        }
+}
+
+func (d *evaluationStateData) GetTerraformAttr(addr addrs.TerraformAttr, rng tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
+        switch addr.Name {
+
+        case "workspace":
+                workspaceName := d.Evaluator.Meta.Env
+                return cty.StringVal(workspaceName), diags
+
+        case "env":
+                // Prior to Terraform 0.12 there was an attribute "env", which was
+                // an alias name for "workspace". This was deprecated and is now
+                // removed.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid "terraform" attribute`,
+                        Detail:   `The terraform.env attribute was deprecated in v0.10 and removed in v0.12. The "state environment" concept was rename to "workspace" in v0.12, and so the workspace name can now be accessed using the terraform.workspace attribute.`,
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+
+        default:
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid "terraform" attribute`,
+                        Detail:   fmt.Sprintf(`The "terraform" object does not have an attribute named %q. The only supported attribute is terraform.workspace, the name of the currently-selected workspace.`, addr.Name),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+}
+
+// nameSuggestion tries to find a name from the given slice of suggested names
+// that is close to the given name and returns it if found. If no suggestion
+// is close enough, returns the empty string.
+//
+// The suggestions are tried in order, so earlier suggestions take precedence
+// if the given string is similar to two or more suggestions.
+//
+// This function is intended to be used with a relatively-small number of
+// suggestions. It's not optimized for hundreds or thousands of them.
+func nameSuggestion(given string, suggestions []string) string {
+        for _, suggestion := range suggestions {
+                dist := levenshtein.Distance(given, suggestion, nil)
+                if dist < 3 { // threshold determined experimentally
+                        return suggestion
+                }
+        }
+        return ""
+}
+
+// moduleDisplayAddr returns a string describing the given module instance
+// address that is appropriate for returning to users in situations where the
+// root module is possible. Specifically, it returns "the root module" if the
+// root module instance is given, or a string representation of the module
+// address otherwise.
+func moduleDisplayAddr(addr addrs.ModuleInstance) string {
+        switch {
+        case addr.IsRoot():
+                return "the root module"
+        default:
+                return addr.String()
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/evaluate_valid.go b/vendor/github.com/hashicorp/terraform/terraform/evaluate_valid.go
new file mode 100644
index 0000000..4255102
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/evaluate_valid.go
@@ -0,0 +1,299 @@
+package terraform
+
+import (
+        "fmt"
+        "sort"
+
+        "github.com/hashicorp/hcl2/hcl"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/helper/didyoumean"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// StaticValidateReferences checks the given references against schemas and
+// other statically-checkable rules, producing error diagnostics if any
+// problems are found.
+//
+// If this method returns errors for a particular reference then evaluating
+// that reference is likely to generate a very similar error, so callers should
+// not run this method and then also evaluate the source expression(s) and
+// merge the two sets of diagnostics together, since this will result in
+// confusing redundant errors.
+//
+// This method can find more errors than can be found by evaluating an
+// expression with a partially-populated scope, since it checks the referenced
+// names directly against the schema rather than relying on evaluation errors.
+//
+// The result may include warning diagnostics if, for example, deprecated
+// features are referenced.
+func (d *evaluationStateData) StaticValidateReferences(refs []*addrs.Reference, self addrs.Referenceable) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+        for _, ref := range refs {
+                moreDiags := d.staticValidateReference(ref, self)
+                diags = diags.Append(moreDiags)
+        }
+        return diags
+}
+
+func (d *evaluationStateData) staticValidateReference(ref *addrs.Reference, self addrs.Referenceable) tfdiags.Diagnostics {
+        modCfg := d.Evaluator.Config.DescendentForInstance(d.ModulePath)
+        if modCfg == nil {
+                // This is a bug in the caller rather than a problem with the
+                // reference, but rather than crashing out here in an unhelpful way
+                // we'll just ignore it and trust a different layer to catch it.
+                return nil
+        }
+
+        if ref.Subject == addrs.Self {
+                // The "self" address is a special alias for the address given as
+                // our self parameter here, if present.
+                if self == nil {
+                        var diags tfdiags.Diagnostics
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  `Invalid "self" reference`,
+                                // This detail message mentions some current practice that
+                                // this codepath doesn't really "know about". If the "self"
+                                // object starts being supported in more contexts later then
+                                // we'll need to adjust this message.
+                                Detail:  `The "self" object is not available in this context. This object can be used only in resource provisioner and connection blocks.`,
+                                Subject: ref.SourceRange.ToHCL().Ptr(),
+                        })
+                        return diags
+                }
+
+                synthRef := *ref // shallow copy
+                synthRef.Subject = self
+                ref = &synthRef
+        }
+
+        switch addr := ref.Subject.(type) {
+
+        // For static validation we validate both resource and resource instance references the same way.
+        // We mostly disregard the index, though we do some simple validation of
+        // its _presence_ in staticValidateSingleResourceReference and
+        // staticValidateMultiResourceReference respectively.
+        case addrs.Resource:
+                var diags tfdiags.Diagnostics
+                diags = diags.Append(d.staticValidateSingleResourceReference(modCfg, addr, ref.Remaining, ref.SourceRange))
+                diags = diags.Append(d.staticValidateResourceReference(modCfg, addr, ref.Remaining, ref.SourceRange))
+                return diags
+        case addrs.ResourceInstance:
+                var diags tfdiags.Diagnostics
+                diags = diags.Append(d.staticValidateMultiResourceReference(modCfg, addr, ref.Remaining, ref.SourceRange))
+                diags = diags.Append(d.staticValidateResourceReference(modCfg, addr.ContainingResource(), ref.Remaining, ref.SourceRange))
+                return diags
+
+        // We also handle all module call references the same way, disregarding index.
+        case addrs.ModuleCall:
+                return d.staticValidateModuleCallReference(modCfg, addr, ref.Remaining, ref.SourceRange)
+        case addrs.ModuleCallInstance:
+                return d.staticValidateModuleCallReference(modCfg, addr.Call, ref.Remaining, ref.SourceRange)
+        case addrs.ModuleCallOutput:
+                // This one is a funny one because we will take the output name referenced
+                // and use it to fake up a "remaining" that would make sense for the
+                // module call itself, rather than for the specific output, and then
+                // we can just re-use our static module call validation logic.
+                remain := make(hcl.Traversal, len(ref.Remaining)+1)
+                copy(remain[1:], ref.Remaining)
+                remain[0] = hcl.TraverseAttr{
+                        Name: addr.Name,
+
+                        // Using the whole reference as the source range here doesn't exactly
+                        // match how HCL would normally generate an attribute traversal,
+                        // but is close enough for our purposes.
+                        SrcRange: ref.SourceRange.ToHCL(),
+                }
+                return d.staticValidateModuleCallReference(modCfg, addr.Call.Call, remain, ref.SourceRange)
+
+        default:
+                // Anything else we'll just permit through without any static validation
+                // and let it be caught during dynamic evaluation, in evaluate.go .
+                return nil
+        }
+}
+
+func (d *evaluationStateData) staticValidateSingleResourceReference(modCfg *configs.Config, addr addrs.Resource, remain hcl.Traversal, rng tfdiags.SourceRange) tfdiags.Diagnostics {
+        // If we have at least one step in "remain" and this resource has
+        // "count" set then we know for sure this in invalid because we have
+        // something like:
+        //     aws_instance.foo.bar
+        // ...when we really need
+        //     aws_instance.foo[count.index].bar
+
+        // It is _not_ safe to do this check when remain is empty, because that
+        // would also match aws_instance.foo[count.index].bar due to `count.index`
+        // not being statically-resolvable as part of a reference, and match
+        // direct references to the whole aws_instance.foo tuple.
+        if len(remain) == 0 {
+                return nil
+        }
+
+        var diags tfdiags.Diagnostics
+
+        cfg := modCfg.Module.ResourceByAddr(addr)
+        if cfg == nil {
+                // We'll just bail out here and catch this in our subsequent call to
+                // staticValidateResourceReference, then.
+                return diags
+        }
+
+        if cfg.Count != nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Missing resource instance key`,
+                        Detail:   fmt.Sprintf("Because %s has \"count\" set, its attributes must be accessed on specific instances.\n\nFor example, to correlate with indices of a referring resource, use:\n    %s[count.index]", addr, addr),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+        }
+        if cfg.ForEach != nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Missing resource instance key`,
+                        Detail:   fmt.Sprintf("Because %s has \"for_each\" set, its attributes must be accessed on specific instances.\n\nFor example, to correlate with indices of a referring resource, use:\n    %s[each.key]", addr, addr),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+        }
+
+        return diags
+}
+
+func (d *evaluationStateData) staticValidateMultiResourceReference(modCfg *configs.Config, addr addrs.ResourceInstance, remain hcl.Traversal, rng tfdiags.SourceRange) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        cfg := modCfg.Module.ResourceByAddr(addr.ContainingResource())
+        if cfg == nil {
+                // We'll just bail out here and catch this in our subsequent call to
+                // staticValidateResourceReference, then.
+                return diags
+        }
+
+        if addr.Key == addrs.NoKey {
+                // This is a different path into staticValidateSingleResourceReference
+                return d.staticValidateSingleResourceReference(modCfg, addr.ContainingResource(), remain, rng)
+        } else {
+                if cfg.Count == nil && cfg.ForEach == nil {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  `Unexpected resource instance key`,
+                                Detail:   fmt.Sprintf(`Because %s does not have "count" or "for_each" set, references to it must not include an index key. Remove the bracketed index to refer to the single instance of this resource.`, addr.ContainingResource()),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                }
+        }
+
+        return diags
+}
+
+func (d *evaluationStateData) staticValidateResourceReference(modCfg *configs.Config, addr addrs.Resource, remain hcl.Traversal, rng tfdiags.SourceRange) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        var modeAdjective string
+        switch addr.Mode {
+        case addrs.ManagedResourceMode:
+                modeAdjective = "managed"
+        case addrs.DataResourceMode:
+                modeAdjective = "data"
+        default:
+                // should never happen
+                modeAdjective = "<invalid-mode>"
+        }
+
+        cfg := modCfg.Module.ResourceByAddr(addr)
+        if cfg == nil {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared resource`,
+                        Detail:   fmt.Sprintf(`A %s resource %q %q has not been declared in %s.`, modeAdjective, addr.Type, addr.Name, moduleConfigDisplayAddr(modCfg.Path)),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return diags
+        }
+
+        // Normally accessing this directly is wrong because it doesn't take into
+        // account provider inheritance, etc but it's okay here because we're only
+        // paying attention to the type anyway.
+        providerType := cfg.ProviderConfigAddr().Type
+        schema, _ := d.Evaluator.Schemas.ResourceTypeConfig(providerType, addr.Mode, addr.Type)
+
+        if schema == nil {
+                // Prior validation should've taken care of a resource block with an
+                // unsupported type, so we should never get here but we'll handle it
+                // here anyway for robustness.
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Invalid resource type`,
+                        Detail:   fmt.Sprintf(`A %s resource type %q is not supported by provider %q.`, modeAdjective, addr.Type, providerType),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return diags
+        }
+
+        // As a special case we'll detect attempts to access an attribute called
+        // "count" and produce a special error for it, since versions of Terraform
+        // prior to v0.12 offered this as a weird special case that we can no
+        // longer support.
+        if len(remain) > 0 {
+                if step, ok := remain[0].(hcl.TraverseAttr); ok && step.Name == "count" {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  `Invalid resource count attribute`,
+                                Detail:   fmt.Sprintf(`The special "count" attribute is no longer supported after Terraform v0.12. Instead, use length(%s) to count resource instances.`, addr),
+                                Subject:  rng.ToHCL().Ptr(),
+                        })
+                        return diags
+                }
+        }
+
+        // If we got this far then we'll try to validate the remaining traversal
+        // steps against our schema.
+        moreDiags := schema.StaticValidateTraversal(remain)
+        diags = diags.Append(moreDiags)
+
+        return diags
+}
+
+func (d *evaluationStateData) staticValidateModuleCallReference(modCfg *configs.Config, addr addrs.ModuleCall, remain hcl.Traversal, rng tfdiags.SourceRange) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        // For now, our focus here is just in testing that the referenced module
+        // call exists. All other validation is deferred until evaluation time.
+        _, exists := modCfg.Module.ModuleCalls[addr.Name]
+        if !exists {
+                var suggestions []string
+                for name := range modCfg.Module.ModuleCalls {
+                        suggestions = append(suggestions, name)
+                }
+                sort.Strings(suggestions)
+                suggestion := didyoumean.NameSuggestion(addr.Name, suggestions)
+                if suggestion != "" {
+                        suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+                }
+
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  `Reference to undeclared module`,
+                        Detail:   fmt.Sprintf(`No module call named %q is declared in %s.%s`, addr.Name, moduleConfigDisplayAddr(modCfg.Path), suggestion),
+                        Subject:  rng.ToHCL().Ptr(),
+                })
+                return diags
+        }
+
+        return diags
+}
+
+// moduleConfigDisplayAddr returns a string describing the given module
+// address that is appropriate for returning to users in situations where the
+// root module is possible. Specifically, it returns "the root module" if the
+// root module instance is given, or a string representation of the module
+// address otherwise.
+func moduleConfigDisplayAddr(addr addrs.Module) string {
+        switch {
+        case addr.IsRoot():
+                return "the root module"
+        default:
+                return addr.String()
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph.go b/vendor/github.com/hashicorp/terraform/terraform/graph.go
index 735ec4e..58d45a7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph.go
@@ -3,17 +3,13 @@ package terraform
 import (
         "fmt"
         "log"
-        "runtime/debug"
-        "strings"
 
-        "github.com/hashicorp/terraform/dag"
-)
+        "github.com/hashicorp/terraform/tfdiags"
 
-// RootModuleName is the name given to the root module implicitly.
-const RootModuleName = "root"
+        "github.com/hashicorp/terraform/addrs"
 
-// RootModulePath is the path for the root module.
-var RootModulePath = []string{RootModuleName}
+        "github.com/hashicorp/terraform/dag"
+)
 
 // Graph represents the graph that Terraform uses to represent resources
 // and their dependencies.
@@ -23,9 +19,7 @@ type Graph struct {
         dag.AcyclicGraph
 
         // Path is the path in the module tree that this Graph represents.
-        // The root is represented by a single element list containing
-        // RootModuleName
-        Path []string
+        Path addrs.ModuleInstance
 
         // debugName is a name for reference in the debug output. This is usually
         // to indicate what topmost builder was, and if this graph is a shadow or
@@ -40,71 +34,42 @@ func (g *Graph) DirectedGraph() dag.Grapher {
 // Walk walks the graph with the given walker for callbacks. The graph
 // will be walked with full parallelism, so the walker should expect
 // to be called in concurrently.
-func (g *Graph) Walk(walker GraphWalker) error {
+func (g *Graph) Walk(walker GraphWalker) tfdiags.Diagnostics {
         return g.walk(walker)
 }
 
-func (g *Graph) walk(walker GraphWalker) error {
+func (g *Graph) walk(walker GraphWalker) tfdiags.Diagnostics {
         // The callbacks for enter/exiting a graph
         ctx := walker.EnterPath(g.Path)
         defer walker.ExitPath(g.Path)
 
         // Get the path for logs
-        path := strings.Join(ctx.Path(), ".")
-
-        // Determine if our walker is a panic wrapper
-        panicwrap, ok := walker.(GraphWalkerPanicwrapper)
-        if !ok {
-                panicwrap = nil // just to be sure
-        }
+        path := ctx.Path().String()
 
         debugName := "walk-graph.json"
         if g.debugName != "" {
                 debugName = g.debugName + "-" + debugName
         }
 
-        debugBuf := dbug.NewFileWriter(debugName)
-        g.SetDebugWriter(debugBuf)
-        defer debugBuf.Close()
-
         // Walk the graph.
         var walkFn dag.WalkFunc
-        walkFn = func(v dag.Vertex) (rerr error) {
-                log.Printf("[TRACE] vertex '%s.%s': walking", path, dag.VertexName(v))
+        walkFn = func(v dag.Vertex) (diags tfdiags.Diagnostics) {
+                log.Printf("[TRACE] vertex %q: starting visit (%T)", dag.VertexName(v), v)
                 g.DebugVisitInfo(v, g.debugName)
 
-                // If we have a panic wrap GraphWalker and a panic occurs, recover
-                // and call that. We ensure the return value is an error, however,
-                // so that future nodes are not called.
                 defer func() {
-                        // If no panicwrap, do nothing
-                        if panicwrap == nil {
-                                return
-                        }
-
-                        // If no panic, do nothing
-                        err := recover()
-                        if err == nil {
-                                return
-                        }
-
-                        // Modify the return value to show the error
-                        rerr = fmt.Errorf("vertex %q captured panic: %s\n\n%s",
-                                dag.VertexName(v), err, debug.Stack())
-
-                        // Call the panic wrapper
-                        panicwrap.Panic(v, err)
+                        log.Printf("[TRACE] vertex %q: visit complete", dag.VertexName(v))
                 }()
 
                 walker.EnterVertex(v)
-                defer walker.ExitVertex(v, rerr)
+                defer walker.ExitVertex(v, diags)
 
                 // vertexCtx is the context that we use when evaluating. This
                 // is normally the context of our graph but can be overridden
                 // with a GraphNodeSubPath impl.
                 vertexCtx := ctx
                 if pn, ok := v.(GraphNodeSubPath); ok && len(pn.Path()) > 0 {
-                        vertexCtx = walker.EnterPath(normalizeModulePath(pn.Path()))
+                        vertexCtx = walker.EnterPath(pn.Path())
                         defer walker.ExitPath(pn.Path())
                 }
 
@@ -112,60 +77,64 @@ func (g *Graph) walk(walker GraphWalker) error {
                 if ev, ok := v.(GraphNodeEvalable); ok {
                         tree := ev.EvalTree()
                         if tree == nil {
-                                panic(fmt.Sprintf(
-                                        "%s.%s (%T): nil eval tree", path, dag.VertexName(v), v))
+                                panic(fmt.Sprintf("%q (%T): nil eval tree", dag.VertexName(v), v))
                         }
 
                         // Allow the walker to change our tree if needed. Eval,
                         // then callback with the output.
-                        log.Printf("[TRACE] vertex '%s.%s': evaluating", path, dag.VertexName(v))
+                        log.Printf("[TRACE] vertex %q: evaluating", dag.VertexName(v))
 
                         g.DebugVertexInfo(v, fmt.Sprintf("evaluating %T(%s)", v, path))
 
                         tree = walker.EnterEvalTree(v, tree)
                         output, err := Eval(tree, vertexCtx)
-                        if rerr = walker.ExitEvalTree(v, output, err); rerr != nil {
+                        diags = diags.Append(walker.ExitEvalTree(v, output, err))
+                        if diags.HasErrors() {
                                 return
                         }
                 }
 
                 // If the node is dynamically expanded, then expand it
                 if ev, ok := v.(GraphNodeDynamicExpandable); ok {
-                        log.Printf(
-                                "[TRACE] vertex '%s.%s': expanding/walking dynamic subgraph",
-                                path,
-                                dag.VertexName(v))
+                        log.Printf("[TRACE] vertex %q: expanding dynamic subgraph", dag.VertexName(v))
 
                         g.DebugVertexInfo(v, fmt.Sprintf("expanding %T(%s)", v, path))
 
                         g, err := ev.DynamicExpand(vertexCtx)
                         if err != nil {
-                                rerr = err
+                                diags = diags.Append(err)
                                 return
                         }
                         if g != nil {
                                 // Walk the subgraph
-                                if rerr = g.walk(walker); rerr != nil {
+                                log.Printf("[TRACE] vertex %q: entering dynamic subgraph", dag.VertexName(v))
+                                subDiags := g.walk(walker)
+                                diags = diags.Append(subDiags)
+                                if subDiags.HasErrors() {
+                                        log.Printf("[TRACE] vertex %q: dynamic subgraph encountered errors", dag.VertexName(v))
                                         return
                                 }
+                                log.Printf("[TRACE] vertex %q: dynamic subgraph completed successfully", dag.VertexName(v))
+                        } else {
+                                log.Printf("[TRACE] vertex %q: produced no dynamic subgraph", dag.VertexName(v))
                         }
                 }
 
                 // If the node has a subgraph, then walk the subgraph
                 if sn, ok := v.(GraphNodeSubgraph); ok {
-                        log.Printf(
-                                "[TRACE] vertex '%s.%s': walking subgraph",
-                                path,
-                                dag.VertexName(v))
+                        log.Printf("[TRACE] vertex %q: entering static subgraph", dag.VertexName(v))
 
                         g.DebugVertexInfo(v, fmt.Sprintf("subgraph: %T(%s)", v, path))
 
-                        if rerr = sn.Subgraph().(*Graph).walk(walker); rerr != nil {
+                        subDiags := sn.Subgraph().(*Graph).walk(walker)
+                        if subDiags.HasErrors() {
+                                log.Printf("[TRACE] vertex %q: static subgraph encountered errors", dag.VertexName(v))
                                 return
                         }
+                        log.Printf("[TRACE] vertex %q: static subgraph completed successfully", dag.VertexName(v))
                 }
 
-                return nil
+                return
         }
 
         return g.AcyclicGraph.Walk(walkFn)
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder.go
index 6374bb9..66b21f3 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder.go
@@ -4,6 +4,10 @@ import (
         "fmt"
         "log"
         "strings"
+
+        "github.com/hashicorp/terraform/tfdiags"
+
+        "github.com/hashicorp/terraform/addrs"
 )
 
 // GraphBuilder is an interface that can be implemented and used with
@@ -12,7 +16,7 @@ type GraphBuilder interface {
         // Build builds the graph for the given module path. It is up to
         // the interface implementation whether this build should expand
         // the graph or not.
-        Build(path []string) (*Graph, error)
+        Build(addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics)
 }
 
 // BasicGraphBuilder is a GraphBuilder that builds a graph out of a
@@ -25,21 +29,16 @@ type BasicGraphBuilder struct {
         Name string
 }
 
-func (b *BasicGraphBuilder) Build(path []string) (*Graph, error) {
+func (b *BasicGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
         g := &Graph{Path: path}
 
-        debugName := "graph.json"
-        if b.Name != "" {
-                debugName = b.Name + "-" + debugName
-        }
-        debugBuf := dbug.NewFileWriter(debugName)
-        g.SetDebugWriter(debugBuf)
-        defer debugBuf.Close()
-
+        var lastStepStr string
         for _, step := range b.Steps {
                 if step == nil {
                         continue
                 }
+                log.Printf("[TRACE] Executing graph transform %T", step)
 
                 stepName := fmt.Sprintf("%T", step)
                 dot := strings.LastIndex(stepName, ".")
@@ -56,12 +55,20 @@ func (b *BasicGraphBuilder) Build(path []string) (*Graph, error) {
                 }
                 debugOp.End(errMsg)
 
-                log.Printf(
-                        "[TRACE] Graph after step %T:\n\n%s",
-                        step, g.StringWithNodeTypes())
+                if thisStepStr := g.StringWithNodeTypes(); thisStepStr != lastStepStr {
+                        log.Printf("[TRACE] Completed graph transform %T with new graph:\n%s------", step, thisStepStr)
+                        lastStepStr = thisStepStr
+                } else {
+                        log.Printf("[TRACE] Completed graph transform %T (no changes)", step)
+                }
 
                 if err != nil {
-                        return g, err
+                        if nf, isNF := err.(tfdiags.NonFatalError); isNF {
+                                diags = diags.Append(nf.Diagnostics)
+                        } else {
+                                diags = diags.Append(err)
+                                return g, diags
+                        }
                 }
         }
 
@@ -69,9 +76,10 @@ func (b *BasicGraphBuilder) Build(path []string) (*Graph, error) {
         if b.Validate {
                 if err := g.Validate(); err != nil {
                         log.Printf("[ERROR] Graph validation failed. Graph:\n\n%s", g.String())
-                        return nil, err
+                        diags = diags.Append(err)
+                        return nil, diags
                 }
         }
 
-        return g, nil
+        return g, diags
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_apply.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_apply.go
index 0c2b233..7182dd7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_apply.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_apply.go
@@ -1,8 +1,12 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ApplyGraphBuilder implements GraphBuilder and is responsible for building
@@ -13,26 +17,28 @@ import (
 // that aren't explicitly in the diff. There are other scenarios where the
 // diff can be deviated, so this is just one layer of protection.
 type ApplyGraphBuilder struct {
-        // Module is the root module for the graph to build.
-        Module *module.Tree
+        // Config is the configuration tree that the diff was built from.
+        Config *configs.Config
 
-        // Diff is the diff to apply.
-        Diff *Diff
+        // Changes describes the changes that we need apply.
+        Changes *plans.Changes
 
         // State is the current state
-        State *State
+        State *states.State
 
-        // Providers is the list of providers supported.
-        Providers []string
+        // Components is a factory for the plug-in components (providers and
+        // provisioners) available for use.
+        Components contextComponentFactory
 
-        // Provisioners is the list of provisioners supported.
-        Provisioners []string
+        // Schemas is the repository of schemas we will draw from to analyse
+        // the configuration.
+        Schemas *Schemas
 
         // Targets are resources to target. This is only required to make sure
         // unnecessary outputs aren't included in the apply graph. The plan
         // builder successfully handles targeting resources. In the future,
         // outputs should go into the diff so that this is unnecessary.
-        Targets []string
+        Targets []addrs.Targetable
 
         // DisableReduce, if true, will not reduce the graph. Great for testing.
         DisableReduce bool
@@ -45,7 +51,7 @@ type ApplyGraphBuilder struct {
 }
 
 // See GraphBuilder
-func (b *ApplyGraphBuilder) Build(path []string) (*Graph, error) {
+func (b *ApplyGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
         return (&BasicGraphBuilder{
                 Steps:    b.Steps(),
                 Validate: b.Validate,
@@ -68,53 +74,99 @@ func (b *ApplyGraphBuilder) Steps() []GraphTransformer {
                 }
         }
 
+        concreteOrphanResource := func(a *NodeAbstractResource) dag.Vertex {
+                return &NodeDestroyResource{
+                        NodeAbstractResource: a,
+                }
+        }
+
+        concreteResourceInstance := func(a *NodeAbstractResourceInstance) dag.Vertex {
+                return &NodeApplyableResourceInstance{
+                        NodeAbstractResourceInstance: a,
+                }
+        }
+
         steps := []GraphTransformer{
-                // Creates all the nodes represented in the diff.
-                &DiffTransformer{
+                // Creates all the resources represented in the config. During apply,
+                // we use this just to ensure that the whole-resource metadata is
+                // updated to reflect things such as whether the count argument is
+                // set in config, or which provider configuration manages each resource.
+                &ConfigTransformer{
                         Concrete: concreteResource,
+                        Config:   b.Config,
+                },
 
-                        Diff:   b.Diff,
-                        Module: b.Module,
-                        State:  b.State,
+                // Creates all the resource instances represented in the diff, along
+                // with dependency edges against the whole-resource nodes added by
+                // ConfigTransformer above.
+                &DiffTransformer{
+                        Concrete: concreteResourceInstance,
+                        State:    b.State,
+                        Changes:  b.Changes,
+                },
+
+                // Creates extra cleanup nodes for any entire resources that are
+                // no longer present in config, so we can make sure we clean up the
+                // leftover empty resource states after the instances have been
+                // destroyed.
+                // (We don't track this particular type of change in the plan because
+                // it's just cleanup of our own state object, and so doesn't effect
+                // any real remote objects or consumable outputs.)
+                &OrphanResourceTransformer{
+                        Concrete: concreteOrphanResource,
+                        Config:   b.Config,
+                        State:    b.State,
                 },
 
                 // Create orphan output nodes
-                &OrphanOutputTransformer{Module: b.Module, State: b.State},
+                &OrphanOutputTransformer{Config: b.Config, State: b.State},
 
                 // Attach the configuration to any resources
-                &AttachResourceConfigTransformer{Module: b.Module},
+                &AttachResourceConfigTransformer{Config: b.Config},
 
                 // Attach the state
                 &AttachStateTransformer{State: b.State},
 
-                // add providers
-                TransformProviders(b.Providers, concreteProvider, b.Module),
-
                 // Destruction ordering
-                &DestroyEdgeTransformer{Module: b.Module, State: b.State},
+                &DestroyEdgeTransformer{
+                        Config:  b.Config,
+                        State:   b.State,
+                        Schemas: b.Schemas,
+                },
                 GraphTransformIf(
                         func() bool { return !b.Destroy },
-                        &CBDEdgeTransformer{Module: b.Module, State: b.State},
+                        &CBDEdgeTransformer{
+                                Config:  b.Config,
+                                State:   b.State,
+                                Schemas: b.Schemas,
+                        },
                 ),
 
                 // Provisioner-related transformations
-                &MissingProvisionerTransformer{Provisioners: b.Provisioners},
+                &MissingProvisionerTransformer{Provisioners: b.Components.ResourceProvisioners()},
                 &ProvisionerTransformer{},
 
                 // Add root variables
-                &RootVariableTransformer{Module: b.Module},
+                &RootVariableTransformer{Config: b.Config},
 
                 // Add the local values
-                &LocalTransformer{Module: b.Module},
+                &LocalTransformer{Config: b.Config},
 
                 // Add the outputs
-                &OutputTransformer{Module: b.Module},
+                &OutputTransformer{Config: b.Config},
 
                 // Add module variables
-                &ModuleVariableTransformer{Module: b.Module},
+                &ModuleVariableTransformer{Config: b.Config},
+
+                // add providers
+                TransformProviders(b.Components.ResourceProviders(), concreteProvider, b.Config),
 
                 // Remove modules no longer present in the config
-                &RemovedModuleTransformer{Module: b.Module, State: b.State},
+                &RemovedModuleTransformer{Config: b.Config, State: b.State},
+
+                // Must attach schemas before ReferenceTransformer so that we can
+                // analyze the configuration to find references.
+                &AttachSchemaTransformer{Schemas: b.Schemas},
 
                 // Connect references so ordering is correct
                 &ReferenceTransformer{},
@@ -135,7 +187,9 @@ func (b *ApplyGraphBuilder) Steps() []GraphTransformer {
                 ),
 
                 // Add the node to fix the state count boundaries
-                &CountBoundaryTransformer{},
+                &CountBoundaryTransformer{
+                        Config: b.Config,
+                },
 
                 // Target
                 &TargetsTransformer{Targets: b.Targets},
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_destroy_plan.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_destroy_plan.go
index 014b348..a6047a9 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_destroy_plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_destroy_plan.go
@@ -1,8 +1,11 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // DestroyPlanGraphBuilder implements GraphBuilder and is responsible for
@@ -11,21 +14,29 @@ import (
 // Planning a pure destroy operation is simple because we can ignore most
 // ordering configuration and simply reverse the state.
 type DestroyPlanGraphBuilder struct {
-        // Module is the root module for the graph to build.
-        Module *module.Tree
+        // Config is the configuration tree to build the plan from.
+        Config *configs.Config
 
         // State is the current state
-        State *State
+        State *states.State
+
+        // Components is a factory for the plug-in components (providers and
+        // provisioners) available for use.
+        Components contextComponentFactory
+
+        // Schemas is the repository of schemas we will draw from to analyse
+        // the configuration.
+        Schemas *Schemas
 
         // Targets are resources to target
-        Targets []string
+        Targets []addrs.Targetable
 
         // Validate will do structural validation of the graph.
         Validate bool
 }
 
 // See GraphBuilder
-func (b *DestroyPlanGraphBuilder) Build(path []string) (*Graph, error) {
+func (b *DestroyPlanGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
         return (&BasicGraphBuilder{
                 Steps:    b.Steps(),
                 Validate: b.Validate,
@@ -35,25 +46,44 @@ func (b *DestroyPlanGraphBuilder) Build(path []string) (*Graph, error) {
 
 // See GraphBuilder
 func (b *DestroyPlanGraphBuilder) Steps() []GraphTransformer {
-        concreteResource := func(a *NodeAbstractResource) dag.Vertex {
-                return &NodePlanDestroyableResource{
-                        NodeAbstractResource: a,
+        concreteResourceInstance := func(a *NodeAbstractResourceInstance) dag.Vertex {
+                return &NodePlanDestroyableResourceInstance{
+                        NodeAbstractResourceInstance: a,
+                }
+        }
+        concreteResourceInstanceDeposed := func(a *NodeAbstractResourceInstance, key states.DeposedKey) dag.Vertex {
+                return &NodePlanDeposedResourceInstanceObject{
+                        NodeAbstractResourceInstance: a,
+                        DeposedKey:                   key,
+                }
+        }
+
+        concreteProvider := func(a *NodeAbstractProvider) dag.Vertex {
+                return &NodeApplyableProvider{
+                        NodeAbstractProvider: a,
                 }
         }
 
         steps := []GraphTransformer{
-                // Creates all the nodes represented in the state.
+                // Creates nodes for the resource instances tracked in the state.
                 &StateTransformer{
-                        Concrete: concreteResource,
-                        State:    b.State,
+                        ConcreteCurrent: concreteResourceInstance,
+                        ConcreteDeposed: concreteResourceInstanceDeposed,
+                        State:           b.State,
                 },
 
                 // Attach the configuration to any resources
-                &AttachResourceConfigTransformer{Module: b.Module},
+                &AttachResourceConfigTransformer{Config: b.Config},
+
+                TransformProviders(b.Components.ResourceProviders(), concreteProvider, b.Config),
 
                 // Destruction ordering. We require this only so that
                 // targeting below will prune the correct things.
-                &DestroyEdgeTransformer{Module: b.Module, State: b.State},
+                &DestroyEdgeTransformer{
+                        Config:  b.Config,
+                        State:   b.State,
+                        Schemas: b.Schemas,
+                },
 
                 // Target. Note we don't set "Destroy: true" here since we already
                 // created proper destroy ordering.
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_eval.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_eval.go
new file mode 100644
index 0000000..eb6c897
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_eval.go
@@ -0,0 +1,108 @@
+package terraform
+
+import (
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// EvalGraphBuilder implements GraphBuilder and constructs a graph suitable
+// for evaluating in-memory values (input variables, local values, output
+// values) in the state without any other side-effects.
+//
+// This graph is used only in weird cases, such as the "terraform console"
+// CLI command, where we need to evaluate expressions against the state
+// without taking any other actions.
+//
+// The generated graph will include nodes for providers, resources, etc
+// just to allow indirect dependencies to be resolved, but these nodes will
+// not take any actions themselves since we assume that their parts of the
+// state, if any, are already complete.
+//
+// Although the providers are never configured, they must still be available
+// in order to obtain schema information used for type checking, etc.
+type EvalGraphBuilder struct {
+        // Config is the configuration tree.
+        Config *configs.Config
+
+        // State is the current state
+        State *states.State
+
+        // Components is a factory for the plug-in components (providers and
+        // provisioners) available for use.
+        Components contextComponentFactory
+
+        // Schemas is the repository of schemas we will draw from to analyse
+        // the configuration.
+        Schemas *Schemas
+}
+
+// See GraphBuilder
+func (b *EvalGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
+        return (&BasicGraphBuilder{
+                Steps:    b.Steps(),
+                Validate: true,
+                Name:     "EvalGraphBuilder",
+        }).Build(path)
+}
+
+// See GraphBuilder
+func (b *EvalGraphBuilder) Steps() []GraphTransformer {
+        concreteProvider := func(a *NodeAbstractProvider) dag.Vertex {
+                return &NodeEvalableProvider{
+                        NodeAbstractProvider: a,
+                }
+        }
+
+        steps := []GraphTransformer{
+                // Creates all the data resources that aren't in the state. This will also
+                // add any orphans from scaling in as destroy nodes.
+                &ConfigTransformer{
+                        Concrete: nil, // just use the abstract type
+                        Config:   b.Config,
+                        Unique:   true,
+                },
+
+                // Attach the state
+                &AttachStateTransformer{State: b.State},
+
+                // Attach the configuration to any resources
+                &AttachResourceConfigTransformer{Config: b.Config},
+
+                // Add root variables
+                &RootVariableTransformer{Config: b.Config},
+
+                // Add the local values
+                &LocalTransformer{Config: b.Config},
+
+                // Add the outputs
+                &OutputTransformer{Config: b.Config},
+
+                // Add module variables
+                &ModuleVariableTransformer{Config: b.Config},
+
+                TransformProviders(b.Components.ResourceProviders(), concreteProvider, b.Config),
+
+                // Must attach schemas before ReferenceTransformer so that we can
+                // analyze the configuration to find references.
+                &AttachSchemaTransformer{Schemas: b.Schemas},
+
+                // Connect so that the references are ready for targeting. We'll
+                // have to connect again later for providers and so on.
+                &ReferenceTransformer{},
+
+                // Although we don't configure providers, we do still start them up
+                // to get their schemas, and so we must shut them down again here.
+                &CloseProviderTransformer{},
+
+                // Single root
+                &RootTransformer{},
+
+                // Remove redundant edges to simplify the graph.
+                &TransitiveReductionTransformer{},
+        }
+
+        return steps
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_import.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_import.go
index 07a1eaf..7b0e39f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_import.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_import.go
@@ -1,8 +1,10 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ImportGraphBuilder implements GraphBuilder and is responsible for building
@@ -12,15 +14,19 @@ type ImportGraphBuilder struct {
         // ImportTargets are the list of resources to import.
         ImportTargets []*ImportTarget
 
-        // Module is the module to add to the graph. See ImportOpts.Module.
-        Module *module.Tree
+        // Module is a configuration to build the graph from. See ImportOpts.Config.
+        Config *configs.Config
 
-        // Providers is the list of providers supported.
-        Providers []string
+        // Components is the factory for our available plugin components.
+        Components contextComponentFactory
+
+        // Schemas is the repository of schemas we will draw from to analyse
+        // the configuration.
+        Schemas *Schemas
 }
 
 // Build builds the graph according to the steps returned by Steps.
-func (b *ImportGraphBuilder) Build(path []string) (*Graph, error) {
+func (b *ImportGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
         return (&BasicGraphBuilder{
                 Steps:    b.Steps(),
                 Validate: true,
@@ -33,9 +39,9 @@ func (b *ImportGraphBuilder) Build(path []string) (*Graph, error) {
 func (b *ImportGraphBuilder) Steps() []GraphTransformer {
         // Get the module. If we don't have one, we just use an empty tree
         // so that the transform still works but does nothing.
-        mod := b.Module
-        if mod == nil {
-                mod = module.NewEmptyTree()
+        config := b.Config
+        if config == nil {
+                config = configs.NewEmptyConfig()
         }
 
         // Custom factory for creating providers.
@@ -47,16 +53,36 @@ func (b *ImportGraphBuilder) Steps() []GraphTransformer {
 
         steps := []GraphTransformer{
                 // Create all our resources from the configuration and state
-                &ConfigTransformer{Module: mod},
+                &ConfigTransformer{Config: config},
 
                 // Add the import steps
                 &ImportStateTransformer{Targets: b.ImportTargets},
 
-                TransformProviders(b.Providers, concreteProvider, mod),
+                // Add root variables
+                &RootVariableTransformer{Config: b.Config},
+
+                TransformProviders(b.Components.ResourceProviders(), concreteProvider, config),
 
                 // This validates that the providers only depend on variables
                 &ImportProviderValidateTransformer{},
 
+                // Add the local values
+                &LocalTransformer{Config: b.Config},
+
+                // Add the outputs
+                &OutputTransformer{Config: b.Config},
+
+                // Add module variables
+                &ModuleVariableTransformer{Config: b.Config},
+
+                // Must attach schemas before ReferenceTransformer so that we can
+                // analyze the configuration to find references.
+                &AttachSchemaTransformer{Schemas: b.Schemas},
+
+                // Connect so that the references are ready for targeting. We'll
+                // have to connect again later for providers and so on.
+                &ReferenceTransformer{},
+
                 // Close opened plugin connections
                 &CloseProviderTransformer{},
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_input.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_input.go
deleted file mode 100644
index 0df48cd..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_input.go
+++ /dev/null
@@ -1,27 +0,0 @@
-package terraform
-
-import (
-        "github.com/hashicorp/terraform/dag"
-)
-
-// InputGraphBuilder creates the graph for the input operation.
-//
-// Unlike other graph builders, this is a function since it currently modifies
-// and is based on the PlanGraphBuilder. The PlanGraphBuilder passed in will be
-// modified and should not be used for any other operations.
-func InputGraphBuilder(p *PlanGraphBuilder) GraphBuilder {
-        // We're going to customize the concrete functions
-        p.CustomConcrete = true
-
-        // Set the provider to the normal provider. This will ask for input.
-        p.ConcreteProvider = func(a *NodeAbstractProvider) dag.Vertex {
-                return &NodeApplyableProvider{
-                        NodeAbstractProvider: a,
-                }
-        }
-
-        // We purposely don't set any more concrete fields since the remainder
-        // should be no-ops.
-
-        return p
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go
index f8dd0fc..17adfd2 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go
@@ -3,8 +3,11 @@ package terraform
 import (
         "sync"
 
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // PlanGraphBuilder implements GraphBuilder and is responsible for building
@@ -19,20 +22,22 @@ import (
 //     create-before-destroy can be completely ignored.
 //
 type PlanGraphBuilder struct {
-        // Module is the root module for the graph to build.
-        Module *module.Tree
+        // Config is the configuration tree to build a plan from.
+        Config *configs.Config
 
         // State is the current state
-        State *State
+        State *states.State
 
-        // Providers is the list of providers supported.
-        Providers []string
+        // Components is a factory for the plug-in components (providers and
+        // provisioners) available for use.
+        Components contextComponentFactory
 
-        // Provisioners is the list of provisioners supported.
-        Provisioners []string
+        // Schemas is the repository of schemas we will draw from to analyse
+        // the configuration.
+        Schemas *Schemas
 
         // Targets are resources to target
-        Targets []string
+        Targets []addrs.Targetable
 
         // DisableReduce, if true, will not reduce the graph. Great for testing.
         DisableReduce bool
@@ -46,13 +51,13 @@ type PlanGraphBuilder struct {
         CustomConcrete         bool
         ConcreteProvider       ConcreteProviderNodeFunc
         ConcreteResource       ConcreteResourceNodeFunc
-        ConcreteResourceOrphan ConcreteResourceNodeFunc
+        ConcreteResourceOrphan ConcreteResourceInstanceNodeFunc
 
         once sync.Once
 }
 
 // See GraphBuilder
-func (b *PlanGraphBuilder) Build(path []string) (*Graph, error) {
+func (b *PlanGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
         return (&BasicGraphBuilder{
                 Steps:    b.Steps(),
                 Validate: b.Validate,
@@ -64,66 +69,82 @@ func (b *PlanGraphBuilder) Build(path []string) (*Graph, error) {
 func (b *PlanGraphBuilder) Steps() []GraphTransformer {
         b.once.Do(b.init)
 
+        concreteResourceInstanceDeposed := func(a *NodeAbstractResourceInstance, key states.DeposedKey) dag.Vertex {
+                return &NodePlanDeposedResourceInstanceObject{
+                        NodeAbstractResourceInstance: a,
+                        DeposedKey:                   key,
+                }
+        }
+
         steps := []GraphTransformer{
                 // Creates all the resources represented in the config
                 &ConfigTransformer{
                         Concrete: b.ConcreteResource,
-                        Module:   b.Module,
+                        Config:   b.Config,
                 },
 
                 // Add the local values
-                &LocalTransformer{Module: b.Module},
+                &LocalTransformer{Config: b.Config},
 
                 // Add the outputs
-                &OutputTransformer{Module: b.Module},
+                &OutputTransformer{Config: b.Config},
 
                 // Add orphan resources
-                &OrphanResourceTransformer{
+                &OrphanResourceInstanceTransformer{
                         Concrete: b.ConcreteResourceOrphan,
                         State:    b.State,
-                        Module:   b.Module,
+                        Config:   b.Config,
+                },
+
+                // We also need nodes for any deposed instance objects present in the
+                // state, so we can plan to destroy them. (This intentionally
+                // skips creating nodes for _current_ objects, since ConfigTransformer
+                // created nodes that will do that during DynamicExpand.)
+                &StateTransformer{
+                        ConcreteDeposed: concreteResourceInstanceDeposed,
+                        State:           b.State,
                 },
 
                 // Create orphan output nodes
                 &OrphanOutputTransformer{
-                        Module: b.Module,
+                        Config: b.Config,
                         State:  b.State,
                 },
 
                 // Attach the configuration to any resources
-                &AttachResourceConfigTransformer{Module: b.Module},
+                &AttachResourceConfigTransformer{Config: b.Config},
 
                 // Attach the state
                 &AttachStateTransformer{State: b.State},
 
                 // Add root variables
-                &RootVariableTransformer{Module: b.Module},
-
-                TransformProviders(b.Providers, b.ConcreteProvider, b.Module),
+                &RootVariableTransformer{Config: b.Config},
 
-                // Provisioner-related transformations. Only add these if requested.
-                GraphTransformIf(
-                        func() bool { return b.Provisioners != nil },
-                        GraphTransformMulti(
-                                &MissingProvisionerTransformer{Provisioners: b.Provisioners},
-                                &ProvisionerTransformer{},
-                        ),
-                ),
+                &MissingProvisionerTransformer{Provisioners: b.Components.ResourceProvisioners()},
+                &ProvisionerTransformer{},
 
                 // Add module variables
                 &ModuleVariableTransformer{
-                        Module: b.Module,
+                        Config: b.Config,
                 },
 
+                TransformProviders(b.Components.ResourceProviders(), b.ConcreteProvider, b.Config),
+
                 // Remove modules no longer present in the config
-                &RemovedModuleTransformer{Module: b.Module, State: b.State},
+                &RemovedModuleTransformer{Config: b.Config, State: b.State},
+
+                // Must attach schemas before ReferenceTransformer so that we can
+                // analyze the configuration to find references.
+                &AttachSchemaTransformer{Schemas: b.Schemas},
 
                 // Connect so that the references are ready for targeting. We'll
                 // have to connect again later for providers and so on.
                 &ReferenceTransformer{},
 
                 // Add the node to fix the state count boundaries
-                &CountBoundaryTransformer{},
+                &CountBoundaryTransformer{
+                        Config: b.Config,
+                },
 
                 // Target
                 &TargetsTransformer{
@@ -136,6 +157,10 @@ func (b *PlanGraphBuilder) Steps() []GraphTransformer {
                         IgnoreIndices: true,
                 },
 
+                // Detect when create_before_destroy must be forced on for a particular
+                // node due to dependency edges, to avoid graph cycles during apply.
+                &ForcedCBDTransformer{},
+
                 // Close opened plugin connections
                 &CloseProviderTransformer{},
                 &CloseProvisionerTransformer{},
@@ -167,15 +192,13 @@ func (b *PlanGraphBuilder) init() {
 
         b.ConcreteResource = func(a *NodeAbstractResource) dag.Vertex {
                 return &NodePlannableResource{
-                        NodeAbstractCountResource: &NodeAbstractCountResource{
-                                NodeAbstractResource: a,
-                        },
+                        NodeAbstractResource: a,
                 }
         }
 
-        b.ConcreteResourceOrphan = func(a *NodeAbstractResource) dag.Vertex {
-                return &NodePlannableResourceOrphan{
-                        NodeAbstractResource: a,
+        b.ConcreteResourceOrphan = func(a *NodeAbstractResourceInstance) dag.Vertex {
+                return &NodePlannableResourceInstanceOrphan{
+                        NodeAbstractResourceInstance: a,
                 }
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go
index 9638d4c..0342cdb 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go
@@ -3,8 +3,11 @@ package terraform
 import (
         "log"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -21,17 +24,22 @@ import (
 //     create-before-destroy can be completely ignored.
 //
 type RefreshGraphBuilder struct {
-        // Module is the root module for the graph to build.
-        Module *module.Tree
+        // Config is the configuration tree.
+        Config *configs.Config
+
+        // State is the prior state
+        State *states.State
 
-        // State is the current state
-        State *State
+        // Components is a factory for the plug-in components (providers and
+        // provisioners) available for use.
+        Components contextComponentFactory
 
-        // Providers is the list of providers supported.
-        Providers []string
+        // Schemas is the repository of schemas we will draw from to analyse
+        // the configuration.
+        Schemas *Schemas
 
         // Targets are resources to target
-        Targets []string
+        Targets []addrs.Targetable
 
         // DisableReduce, if true, will not reduce the graph. Great for testing.
         DisableReduce bool
@@ -41,7 +49,7 @@ type RefreshGraphBuilder struct {
 }
 
 // See GraphBuilder
-func (b *RefreshGraphBuilder) Build(path []string) (*Graph, error) {
+func (b *RefreshGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
         return (&BasicGraphBuilder{
                 Steps:    b.Steps(),
                 Validate: b.Validate,
@@ -60,23 +68,27 @@ func (b *RefreshGraphBuilder) Steps() []GraphTransformer {
 
         concreteManagedResource := func(a *NodeAbstractResource) dag.Vertex {
                 return &NodeRefreshableManagedResource{
-                        NodeAbstractCountResource: &NodeAbstractCountResource{
-                                NodeAbstractResource: a,
-                        },
+                        NodeAbstractResource: a,
                 }
         }
 
-        concreteManagedResourceInstance := func(a *NodeAbstractResource) dag.Vertex {
+        concreteManagedResourceInstance := func(a *NodeAbstractResourceInstance) dag.Vertex {
                 return &NodeRefreshableManagedResourceInstance{
-                        NodeAbstractResource: a,
+                        NodeAbstractResourceInstance: a,
+                }
+        }
+
+        concreteResourceInstanceDeposed := func(a *NodeAbstractResourceInstance, key states.DeposedKey) dag.Vertex {
+                // The "Plan" node type also handles refreshing behavior.
+                return &NodePlanDeposedResourceInstanceObject{
+                        NodeAbstractResourceInstance: a,
+                        DeposedKey:                   key,
                 }
         }
 
         concreteDataResource := func(a *NodeAbstractResource) dag.Vertex {
                 return &NodeRefreshableDataResource{
-                        NodeAbstractCountResource: &NodeAbstractCountResource{
-                                NodeAbstractResource: a,
-                        },
+                        NodeAbstractResource: a,
                 }
         }
 
@@ -88,13 +100,13 @@ func (b *RefreshGraphBuilder) Steps() []GraphTransformer {
                         if b.State.HasResources() {
                                 return &ConfigTransformer{
                                         Concrete:   concreteManagedResource,
-                                        Module:     b.Module,
+                                        Config:     b.Config,
                                         Unique:     true,
                                         ModeFilter: true,
-                                        Mode:       config.ManagedResourceMode,
+                                        Mode:       addrs.ManagedResourceMode,
                                 }
                         }
-                        log.Println("[TRACE] No managed resources in state during refresh, skipping managed resource transformer")
+                        log.Println("[TRACE] No managed resources in state during refresh; skipping managed resource transformer")
                         return nil
                 }(),
 
@@ -102,40 +114,53 @@ func (b *RefreshGraphBuilder) Steps() []GraphTransformer {
                 // add any orphans from scaling in as destroy nodes.
                 &ConfigTransformer{
                         Concrete:   concreteDataResource,
-                        Module:     b.Module,
+                        Config:     b.Config,
                         Unique:     true,
                         ModeFilter: true,
-                        Mode:       config.DataResourceMode,
+                        Mode:       addrs.DataResourceMode,
                 },
 
                 // Add any fully-orphaned resources from config (ones that have been
                 // removed completely, not ones that are just orphaned due to a scaled-in
                 // count.
-                &OrphanResourceTransformer{
+                &OrphanResourceInstanceTransformer{
                         Concrete: concreteManagedResourceInstance,
                         State:    b.State,
-                        Module:   b.Module,
+                        Config:   b.Config,
+                },
+
+                // We also need nodes for any deposed instance objects present in the
+                // state, so we can check if they still exist. (This intentionally
+                // skips creating nodes for _current_ objects, since ConfigTransformer
+                // created nodes that will do that during DynamicExpand.)
+                &StateTransformer{
+                        ConcreteDeposed: concreteResourceInstanceDeposed,
+                        State:           b.State,
                 },
 
                 // Attach the state
                 &AttachStateTransformer{State: b.State},
 
                 // Attach the configuration to any resources
-                &AttachResourceConfigTransformer{Module: b.Module},
+                &AttachResourceConfigTransformer{Config: b.Config},
 
                 // Add root variables
-                &RootVariableTransformer{Module: b.Module},
-
-                TransformProviders(b.Providers, concreteProvider, b.Module),
+                &RootVariableTransformer{Config: b.Config},
 
                 // Add the local values
-                &LocalTransformer{Module: b.Module},
+                &LocalTransformer{Config: b.Config},
 
                 // Add the outputs
-                &OutputTransformer{Module: b.Module},
+                &OutputTransformer{Config: b.Config},
 
                 // Add module variables
-                &ModuleVariableTransformer{Module: b.Module},
+                &ModuleVariableTransformer{Config: b.Config},
+
+                TransformProviders(b.Components.ResourceProviders(), concreteProvider, b.Config),
+
+                // Must attach schemas before ReferenceTransformer so that we can
+                // analyze the configuration to find references.
+                &AttachSchemaTransformer{Schemas: b.Schemas},
 
                 // Connect so that the references are ready for targeting. We'll
                 // have to connect again later for providers and so on.
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_validate.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_validate.go
index 645ec7b..1881f95 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_validate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_validate.go
@@ -23,9 +23,7 @@ func ValidateGraphBuilder(p *PlanGraphBuilder) GraphBuilder {
 
         p.ConcreteResource = func(a *NodeAbstractResource) dag.Vertex {
                 return &NodeValidatableResource{
-                        NodeAbstractCountResource: &NodeAbstractCountResource{
-                                NodeAbstractResource: a,
-                        },
+                        NodeAbstractResource: a,
                 }
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_interface_subgraph.go b/vendor/github.com/hashicorp/terraform/terraform/graph_interface_subgraph.go
index 2897eb5..768590f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_interface_subgraph.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_interface_subgraph.go
@@ -1,7 +1,11 @@
 package terraform
 
+import (
+        "github.com/hashicorp/terraform/addrs"
+)
+
 // GraphNodeSubPath says that a node is part of a graph with a
 // different path, and the context should be adjusted accordingly.
 type GraphNodeSubPath interface {
-        Path() []string
+        Path() addrs.ModuleInstance
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_walk.go b/vendor/github.com/hashicorp/terraform/terraform/graph_walk.go
index 34ce6f6..e980e0c 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_walk.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_walk.go
@@ -1,60 +1,32 @@
 package terraform
 
 import (
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // GraphWalker is an interface that can be implemented that when used
 // with Graph.Walk will invoke the given callbacks under certain events.
 type GraphWalker interface {
-        EnterPath([]string) EvalContext
-        ExitPath([]string)
+        EnterPath(addrs.ModuleInstance) EvalContext
+        ExitPath(addrs.ModuleInstance)
         EnterVertex(dag.Vertex)
-        ExitVertex(dag.Vertex, error)
+        ExitVertex(dag.Vertex, tfdiags.Diagnostics)
         EnterEvalTree(dag.Vertex, EvalNode) EvalNode
-        ExitEvalTree(dag.Vertex, interface{}, error) error
+        ExitEvalTree(dag.Vertex, interface{}, error) tfdiags.Diagnostics
 }
 
-// GrpahWalkerPanicwrapper can be optionally implemented to catch panics
-// that occur while walking the graph. This is not generally recommended
-// since panics should crash Terraform and result in a bug report. However,
-// this is particularly useful for situations like the shadow graph where
-// you don't ever want to cause a panic.
-type GraphWalkerPanicwrapper interface {
-        GraphWalker
-
-        // Panic is called when a panic occurs. This will halt the panic from
-        // propogating so if the walker wants it to crash still it should panic
-        // again. This is called from within a defer so runtime/debug.Stack can
-        // be used to get the stack trace of the panic.
-        Panic(dag.Vertex, interface{})
-}
-
-// GraphWalkerPanicwrap wraps an existing Graphwalker to wrap and swallow
-// the panics. This doesn't lose the panics since the panics are still
-// returned as errors as part of a graph walk.
-func GraphWalkerPanicwrap(w GraphWalker) GraphWalkerPanicwrapper {
-        return &graphWalkerPanicwrapper{
-                GraphWalker: w,
-        }
-}
-
-type graphWalkerPanicwrapper struct {
-        GraphWalker
-}
-
-func (graphWalkerPanicwrapper) Panic(dag.Vertex, interface{}) {}
-
 // NullGraphWalker is a GraphWalker implementation that does nothing.
 // This can be embedded within other GraphWalker implementations for easily
 // implementing all the required functions.
 type NullGraphWalker struct{}
 
-func (NullGraphWalker) EnterPath([]string) EvalContext                  { return new(MockEvalContext) }
-func (NullGraphWalker) ExitPath([]string)                               {}
+func (NullGraphWalker) EnterPath(addrs.ModuleInstance) EvalContext      { return new(MockEvalContext) }
+func (NullGraphWalker) ExitPath(addrs.ModuleInstance)                   {}
 func (NullGraphWalker) EnterVertex(dag.Vertex)                          {}
-func (NullGraphWalker) ExitVertex(dag.Vertex, error)                    {}
+func (NullGraphWalker) ExitVertex(dag.Vertex, tfdiags.Diagnostics)      {}
 func (NullGraphWalker) EnterEvalTree(v dag.Vertex, n EvalNode) EvalNode { return n }
-func (NullGraphWalker) ExitEvalTree(dag.Vertex, interface{}, error) error {
+func (NullGraphWalker) ExitEvalTree(dag.Vertex, interface{}, error) tfdiags.Diagnostics {
         return nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_walk_context.go b/vendor/github.com/hashicorp/terraform/terraform/graph_walk_context.go
index 89f376e..03c192a 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_walk_context.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_walk_context.go
@@ -2,12 +2,19 @@ package terraform
 
 import (
         "context"
-        "fmt"
         "log"
         "sync"
 
-        "github.com/hashicorp/errwrap"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ContextGraphWalker is the GraphWalker implementation used with the
@@ -16,54 +23,56 @@ type ContextGraphWalker struct {
         NullGraphWalker
 
         // Configurable values
-        Context     *Context
-        Operation   walkOperation
-        StopContext context.Context
-
-        // Outputs, do not set these. Do not read these while the graph
-        // is being walked.
-        ValidationWarnings []string
-        ValidationErrors   []error
-
-        errorLock           sync.Mutex
-        once                sync.Once
-        contexts            map[string]*BuiltinEvalContext
-        contextLock         sync.Mutex
-        interpolaterVars    map[string]map[string]interface{}
-        interpolaterVarLock sync.Mutex
-        providerCache       map[string]ResourceProvider
-        providerLock        sync.Mutex
-        provisionerCache    map[string]ResourceProvisioner
-        provisionerLock     sync.Mutex
+        Context            *Context
+        State              *states.SyncState  // Used for safe concurrent access to state
+        Changes            *plans.ChangesSync // Used for safe concurrent writes to changes
+        Operation          walkOperation
+        StopContext        context.Context
+        RootVariableValues InputValues
+
+        // This is an output. Do not set this, nor read it while a graph walk
+        // is in progress.
+        NonFatalDiagnostics tfdiags.Diagnostics
+
+        errorLock          sync.Mutex
+        once               sync.Once
+        contexts           map[string]*BuiltinEvalContext
+        contextLock        sync.Mutex
+        variableValues     map[string]map[string]cty.Value
+        variableValuesLock sync.Mutex
+        providerCache      map[string]providers.Interface
+        providerSchemas    map[string]*ProviderSchema
+        providerLock       sync.Mutex
+        provisionerCache   map[string]provisioners.Interface
+        provisionerSchemas map[string]*configschema.Block
+        provisionerLock    sync.Mutex
 }
 
-func (w *ContextGraphWalker) EnterPath(path []string) EvalContext {
+func (w *ContextGraphWalker) EnterPath(path addrs.ModuleInstance) EvalContext {
         w.once.Do(w.init)
 
         w.contextLock.Lock()
         defer w.contextLock.Unlock()
 
         // If we already have a context for this path cached, use that
-        key := PathCacheKey(path)
+        key := path.String()
         if ctx, ok := w.contexts[key]; ok {
                 return ctx
         }
 
-        // Setup the variables for this interpolater
-        variables := make(map[string]interface{})
-        if len(path) <= 1 {
-                for k, v := range w.Context.variables {
-                        variables[k] = v
-                }
-        }
-        w.interpolaterVarLock.Lock()
-        if m, ok := w.interpolaterVars[key]; ok {
-                for k, v := range m {
-                        variables[k] = v
-                }
+        // Our evaluator shares some locks with the main context and the walker
+        // so that we can safely run multiple evaluations at once across
+        // different modules.
+        evaluator := &Evaluator{
+                Meta:               w.Context.meta,
+                Config:             w.Context.config,
+                Operation:          w.Operation,
+                State:              w.State,
+                Changes:            w.Changes,
+                Schemas:            w.Context.schemas,
+                VariableValues:     w.variableValues,
+                VariableValuesLock: &w.variableValuesLock,
         }
-        w.interpolaterVars[key] = variables
-        w.interpolaterVarLock.Unlock()
 
         ctx := &BuiltinEvalContext{
                 StopContext:         w.StopContext,
@@ -71,26 +80,17 @@ func (w *ContextGraphWalker) EnterPath(path []string) EvalContext {
                 Hooks:               w.Context.hooks,
                 InputValue:          w.Context.uiInput,
                 Components:          w.Context.components,
+                Schemas:             w.Context.schemas,
                 ProviderCache:       w.providerCache,
                 ProviderInputConfig: w.Context.providerInputConfig,
                 ProviderLock:        &w.providerLock,
                 ProvisionerCache:    w.provisionerCache,
                 ProvisionerLock:     &w.provisionerLock,
-                DiffValue:           w.Context.diff,
-                DiffLock:            &w.Context.diffLock,
-                StateValue:          w.Context.state,
-                StateLock:           &w.Context.stateLock,
-                Interpolater: &Interpolater{
-                        Operation:          w.Operation,
-                        Meta:               w.Context.meta,
-                        Module:             w.Context.module,
-                        State:              w.Context.state,
-                        StateLock:          &w.Context.stateLock,
-                        VariableValues:     variables,
-                        VariableValuesLock: &w.interpolaterVarLock,
-                },
-                InterpolaterVars:    w.interpolaterVars,
-                InterpolaterVarLock: &w.interpolaterVarLock,
+                ChangesValue:        w.Changes,
+                StateValue:          w.State,
+                Evaluator:           evaluator,
+                VariableValues:      w.variableValues,
+                VariableValuesLock:  &w.variableValuesLock,
         }
 
         w.contexts[key] = ctx
@@ -98,8 +98,7 @@ func (w *ContextGraphWalker) EnterPath(path []string) EvalContext {
 }
 
 func (w *ContextGraphWalker) EnterEvalTree(v dag.Vertex, n EvalNode) EvalNode {
-        log.Printf("[TRACE] [%s] Entering eval tree: %s",
-                w.Operation, dag.VertexName(v))
+        log.Printf("[TRACE] [%s] Entering eval tree: %s", w.Operation, dag.VertexName(v))
 
         // Acquire a lock on the semaphore
         w.Context.parallelSem.Acquire()
@@ -109,10 +108,8 @@ func (w *ContextGraphWalker) EnterEvalTree(v dag.Vertex, n EvalNode) EvalNode {
         return EvalFilter(n, EvalNodeFilterOp(w.Operation))
 }
 
-func (w *ContextGraphWalker) ExitEvalTree(
-        v dag.Vertex, output interface{}, err error) error {
-        log.Printf("[TRACE] [%s] Exiting eval tree: %s",
-                w.Operation, dag.VertexName(v))
+func (w *ContextGraphWalker) ExitEvalTree(v dag.Vertex, output interface{}, err error) tfdiags.Diagnostics {
+        log.Printf("[TRACE] [%s] Exiting eval tree: %s", w.Operation, dag.VertexName(v))
 
         // Release the semaphore
         w.Context.parallelSem.Release()
@@ -125,30 +122,36 @@ func (w *ContextGraphWalker) ExitEvalTree(
         w.errorLock.Lock()
         defer w.errorLock.Unlock()
 
-        // Try to get a validation error out of it. If its not a validation
-        // error, then just record the normal error.
-        verr, ok := err.(*EvalValidateError)
-        if !ok {
-                return err
-        }
-
-        for _, msg := range verr.Warnings {
-                w.ValidationWarnings = append(
-                        w.ValidationWarnings,
-                        fmt.Sprintf("%s: %s", dag.VertexName(v), msg))
-        }
-        for _, e := range verr.Errors {
-                w.ValidationErrors = append(
-                        w.ValidationErrors,
-                        errwrap.Wrapf(fmt.Sprintf("%s: {{err}}", dag.VertexName(v)), e))
+        // If the error is non-fatal then we'll accumulate its diagnostics in our
+        // non-fatal list, rather than returning it directly, so that the graph
+        // walk can continue.
+        if nferr, ok := err.(tfdiags.NonFatalError); ok {
+                log.Printf("[WARN] %s: %s", dag.VertexName(v), nferr)
+                w.NonFatalDiagnostics = w.NonFatalDiagnostics.Append(nferr.Diagnostics)
+                return nil
         }
 
-        return nil
+        // Otherwise, we'll let our usual diagnostics machinery figure out how to
+        // unpack this as one or more diagnostic messages and return that. If we
+        // get down here then the returned diagnostics will contain at least one
+        // error, causing the graph walk to halt.
+        var diags tfdiags.Diagnostics
+        diags = diags.Append(err)
+        return diags
 }
 
 func (w *ContextGraphWalker) init() {
-        w.contexts = make(map[string]*BuiltinEvalContext, 5)
-        w.providerCache = make(map[string]ResourceProvider, 5)
-        w.provisionerCache = make(map[string]ResourceProvisioner, 5)
-        w.interpolaterVars = make(map[string]map[string]interface{}, 5)
+        w.contexts = make(map[string]*BuiltinEvalContext)
+        w.providerCache = make(map[string]providers.Interface)
+        w.providerSchemas = make(map[string]*ProviderSchema)
+        w.provisionerCache = make(map[string]provisioners.Interface)
+        w.provisionerSchemas = make(map[string]*configschema.Block)
+        w.variableValues = make(map[string]map[string]cty.Value)
+
+        // Populate root module variable values. Other modules will be populated
+        // during the graph walk.
+        w.variableValues[""] = make(map[string]cty.Value)
+        for k, iv := range w.RootVariableValues {
+                w.variableValues[""][k] = iv.Value
+        }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_walk_operation.go b/vendor/github.com/hashicorp/terraform/terraform/graph_walk_operation.go
index 3fb3748..a3756e7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_walk_operation.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_walk_operation.go
@@ -7,7 +7,6 @@ type walkOperation byte
 
 const (
         walkInvalid walkOperation = iota
-        walkInput
         walkApply
         walkPlan
         walkPlanDestroy
@@ -15,4 +14,5 @@ const (
         walkValidate
         walkDestroy
         walkImport
+        walkEval // used just to prepare EvalContext for expression evaluation, with no other actions
 )
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graphtype_string.go b/vendor/github.com/hashicorp/terraform/terraform/graphtype_string.go
index 95ef4e9..b51e1a2 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graphtype_string.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graphtype_string.go
@@ -4,9 +4,23 @@ package terraform
 
 import "strconv"
 
-const _GraphType_name = "GraphTypeInvalidGraphTypeLegacyGraphTypeRefreshGraphTypePlanGraphTypePlanDestroyGraphTypeApplyGraphTypeInputGraphTypeValidate"
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[GraphTypeInvalid-0]
+        _ = x[GraphTypeLegacy-1]
+        _ = x[GraphTypeRefresh-2]
+        _ = x[GraphTypePlan-3]
+        _ = x[GraphTypePlanDestroy-4]
+        _ = x[GraphTypeApply-5]
+        _ = x[GraphTypeValidate-6]
+        _ = x[GraphTypeEval-7]
+}
+
+const _GraphType_name = "GraphTypeInvalidGraphTypeLegacyGraphTypeRefreshGraphTypePlanGraphTypePlanDestroyGraphTypeApplyGraphTypeValidateGraphTypeEval"
 
-var _GraphType_index = [...]uint8{0, 16, 31, 47, 60, 80, 94, 108, 125}
+var _GraphType_index = [...]uint8{0, 16, 31, 47, 60, 80, 94, 111, 124}
 
 func (i GraphType) String() string {
         if i >= GraphType(len(_GraphType_index)-1) {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/hook.go b/vendor/github.com/hashicorp/terraform/terraform/hook.go
index ab11e8e..c0bb23a 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/hook.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/hook.go
@@ -1,5 +1,14 @@
 package terraform
 
+import (
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+)
+
 // HookAction is an enum of actions that can be taken as a result of a hook
 // callback. This allows you to modify the behavior of Terraform at runtime.
 type HookAction byte
@@ -21,42 +30,56 @@ const (
 // NilHook into your struct, which implements all of the interface but does
 // nothing. Then, override only the functions you want to implement.
 type Hook interface {
-        // PreApply and PostApply are called before and after a single
-        // resource is applied. The error argument in PostApply is the
+        // PreApply and PostApply are called before and after an action for a
+        // single instance is applied. The error argument in PostApply is the
         // error, if any, that was returned from the provider Apply call itself.
-        PreApply(*InstanceInfo, *InstanceState, *InstanceDiff) (HookAction, error)
-        PostApply(*InstanceInfo, *InstanceState, error) (HookAction, error)
-
-        // PreDiff and PostDiff are called before and after a single resource
-        // resource is diffed.
-        PreDiff(*InstanceInfo, *InstanceState) (HookAction, error)
-        PostDiff(*InstanceInfo, *InstanceDiff) (HookAction, error)
-
-        // Provisioning hooks
+        PreApply(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error)
+        PostApply(addr addrs.AbsResourceInstance, gen states.Generation, newState cty.Value, err error) (HookAction, error)
+
+        // PreDiff and PostDiff are called before and after a provider is given
+        // the opportunity to customize the proposed new state to produce the
+        // planned new state.
+        PreDiff(addr addrs.AbsResourceInstance, gen states.Generation, priorState, proposedNewState cty.Value) (HookAction, error)
+        PostDiff(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error)
+
+        // The provisioning hooks signal both the overall start end end of
+        // provisioning for a particular instance and of each of the individual
+        // configured provisioners for each instance. The sequence of these
+        // for a given instance might look something like this:
         //
-        // All should be self-explanatory. ProvisionOutput is called with
-        // output sent back by the provisioners. This will be called multiple
-        // times as output comes in, but each call should represent a line of
-        // output. The ProvisionOutput method cannot control whether the
-        // hook continues running.
-        PreProvisionResource(*InstanceInfo, *InstanceState) (HookAction, error)
-        PostProvisionResource(*InstanceInfo, *InstanceState) (HookAction, error)
-        PreProvision(*InstanceInfo, string) (HookAction, error)
-        PostProvision(*InstanceInfo, string, error) (HookAction, error)
-        ProvisionOutput(*InstanceInfo, string, string)
+        //          PreProvisionInstance(aws_instance.foo[1], ...)
+        //      PreProvisionInstanceStep(aws_instance.foo[1], "file")
+        //     PostProvisionInstanceStep(aws_instance.foo[1], "file", nil)
+        //      PreProvisionInstanceStep(aws_instance.foo[1], "remote-exec")
+        //               ProvisionOutput(aws_instance.foo[1], "remote-exec", "Installing foo...")
+        //               ProvisionOutput(aws_instance.foo[1], "remote-exec", "Configuring bar...")
+        //     PostProvisionInstanceStep(aws_instance.foo[1], "remote-exec", nil)
+        //         PostProvisionInstance(aws_instance.foo[1], ...)
+        //
+        // ProvisionOutput is called with output sent back by the provisioners.
+        // This will be called multiple times as output comes in, with each call
+        // representing one line of output. It cannot control whether the
+        // provisioner continues running.
+        PreProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error)
+        PostProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error)
+        PreProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string) (HookAction, error)
+        PostProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string, err error) (HookAction, error)
+        ProvisionOutput(addr addrs.AbsResourceInstance, typeName string, line string)
 
         // PreRefresh and PostRefresh are called before and after a single
         // resource state is refreshed, respectively.
-        PreRefresh(*InstanceInfo, *InstanceState) (HookAction, error)
-        PostRefresh(*InstanceInfo, *InstanceState) (HookAction, error)
-
-        // PostStateUpdate is called after the state is updated.
-        PostStateUpdate(*State) (HookAction, error)
+        PreRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value) (HookAction, error)
+        PostRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value, newState cty.Value) (HookAction, error)
 
         // PreImportState and PostImportState are called before and after
-        // a single resource's state is being improted.
-        PreImportState(*InstanceInfo, string) (HookAction, error)
-        PostImportState(*InstanceInfo, []*InstanceState) (HookAction, error)
+        // (respectively) each state import operation for a given resource address.
+        PreImportState(addr addrs.AbsResourceInstance, importID string) (HookAction, error)
+        PostImportState(addr addrs.AbsResourceInstance, imported []providers.ImportedResource) (HookAction, error)
+
+        // PostStateUpdate is called each time the state is updated. It receives
+        // a deep copy of the state, which it may therefore access freely without
+        // any need for locks to protect from concurrent writes from the caller.
+        PostStateUpdate(new *states.State) (HookAction, error)
 }
 
 // NilHook is a Hook implementation that does nothing. It exists only to
@@ -64,59 +87,60 @@ type Hook interface {
 // and only implement the functions you are interested in.
 type NilHook struct{}
 
-func (*NilHook) PreApply(*InstanceInfo, *InstanceState, *InstanceDiff) (HookAction, error) {
+var _ Hook = (*NilHook)(nil)
+
+func (*NilHook) PreApply(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostApply(*InstanceInfo, *InstanceState, error) (HookAction, error) {
+func (*NilHook) PostApply(addr addrs.AbsResourceInstance, gen states.Generation, newState cty.Value, err error) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PreDiff(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (*NilHook) PreDiff(addr addrs.AbsResourceInstance, gen states.Generation, priorState, proposedNewState cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostDiff(*InstanceInfo, *InstanceDiff) (HookAction, error) {
+func (*NilHook) PostDiff(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PreProvisionResource(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (*NilHook) PreProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostProvisionResource(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (*NilHook) PostProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PreProvision(*InstanceInfo, string) (HookAction, error) {
+func (*NilHook) PreProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostProvision(*InstanceInfo, string, error) (HookAction, error) {
+func (*NilHook) PostProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string, err error) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) ProvisionOutput(
-        *InstanceInfo, string, string) {
+func (*NilHook) ProvisionOutput(addr addrs.AbsResourceInstance, typeName string, line string) {
 }
 
-func (*NilHook) PreRefresh(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (*NilHook) PreRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostRefresh(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (*NilHook) PostRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value, newState cty.Value) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PreImportState(*InstanceInfo, string) (HookAction, error) {
+func (*NilHook) PreImportState(addr addrs.AbsResourceInstance, importID string) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostImportState(*InstanceInfo, []*InstanceState) (HookAction, error) {
+func (*NilHook) PostImportState(addr addrs.AbsResourceInstance, imported []providers.ImportedResource) (HookAction, error) {
         return HookActionContinue, nil
 }
 
-func (*NilHook) PostStateUpdate(*State) (HookAction, error) {
+func (*NilHook) PostStateUpdate(new *states.State) (HookAction, error) {
         return HookActionContinue, nil
 }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/hook_mock.go b/vendor/github.com/hashicorp/terraform/terraform/hook_mock.go
index 0e46400..6efa319 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/hook_mock.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/hook_mock.go
@@ -1,245 +1,274 @@
 package terraform
 
-import "sync"
+import (
+        "sync"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+)
 
 // MockHook is an implementation of Hook that can be used for tests.
 // It records all of its function calls.
 type MockHook struct {
         sync.Mutex
 
-        PreApplyCalled bool
-        PreApplyInfo   *InstanceInfo
-        PreApplyDiff   *InstanceDiff
-        PreApplyState  *InstanceState
-        PreApplyReturn HookAction
-        PreApplyError  error
+        PreApplyCalled       bool
+        PreApplyAddr         addrs.AbsResourceInstance
+        PreApplyGen          states.Generation
+        PreApplyAction       plans.Action
+        PreApplyPriorState   cty.Value
+        PreApplyPlannedState cty.Value
+        PreApplyReturn       HookAction
+        PreApplyError        error
 
         PostApplyCalled      bool
-        PostApplyInfo        *InstanceInfo
-        PostApplyState       *InstanceState
+        PostApplyAddr        addrs.AbsResourceInstance
+        PostApplyGen         states.Generation
+        PostApplyNewState    cty.Value
         PostApplyError       error
         PostApplyReturn      HookAction
         PostApplyReturnError error
-        PostApplyFn          func(*InstanceInfo, *InstanceState, error) (HookAction, error)
-
-        PreDiffCalled bool
-        PreDiffInfo   *InstanceInfo
-        PreDiffState  *InstanceState
-        PreDiffReturn HookAction
-        PreDiffError  error
-
-        PostDiffCalled bool
-        PostDiffInfo   *InstanceInfo
-        PostDiffDiff   *InstanceDiff
-        PostDiffReturn HookAction
-        PostDiffError  error
-
-        PreProvisionResourceCalled bool
-        PreProvisionResourceInfo   *InstanceInfo
-        PreProvisionInstanceState  *InstanceState
-        PreProvisionResourceReturn HookAction
-        PreProvisionResourceError  error
-
-        PostProvisionResourceCalled bool
-        PostProvisionResourceInfo   *InstanceInfo
-        PostProvisionInstanceState  *InstanceState
-        PostProvisionResourceReturn HookAction
-        PostProvisionResourceError  error
-
-        PreProvisionCalled        bool
-        PreProvisionInfo          *InstanceInfo
-        PreProvisionProvisionerId string
-        PreProvisionReturn        HookAction
-        PreProvisionError         error
-
-        PostProvisionCalled        bool
-        PostProvisionInfo          *InstanceInfo
-        PostProvisionProvisionerId string
-        PostProvisionErrorArg      error
-        PostProvisionReturn        HookAction
-        PostProvisionError         error
-
-        ProvisionOutputCalled        bool
-        ProvisionOutputInfo          *InstanceInfo
-        ProvisionOutputProvisionerId string
-        ProvisionOutputMessage       string
-
-        PostRefreshCalled bool
-        PostRefreshInfo   *InstanceInfo
-        PostRefreshState  *InstanceState
-        PostRefreshReturn HookAction
-        PostRefreshError  error
-
-        PreRefreshCalled bool
-        PreRefreshInfo   *InstanceInfo
-        PreRefreshState  *InstanceState
-        PreRefreshReturn HookAction
-        PreRefreshError  error
+        PostApplyFn          func(addrs.AbsResourceInstance, states.Generation, cty.Value, error) (HookAction, error)
+
+        PreDiffCalled        bool
+        PreDiffAddr          addrs.AbsResourceInstance
+        PreDiffGen           states.Generation
+        PreDiffPriorState    cty.Value
+        PreDiffProposedState cty.Value
+        PreDiffReturn        HookAction
+        PreDiffError         error
+
+        PostDiffCalled       bool
+        PostDiffAddr         addrs.AbsResourceInstance
+        PostDiffGen          states.Generation
+        PostDiffAction       plans.Action
+        PostDiffPriorState   cty.Value
+        PostDiffPlannedState cty.Value
+        PostDiffReturn       HookAction
+        PostDiffError        error
+
+        PreProvisionInstanceCalled bool
+        PreProvisionInstanceAddr   addrs.AbsResourceInstance
+        PreProvisionInstanceState  cty.Value
+        PreProvisionInstanceReturn HookAction
+        PreProvisionInstanceError  error
+
+        PostProvisionInstanceCalled bool
+        PostProvisionInstanceAddr   addrs.AbsResourceInstance
+        PostProvisionInstanceState  cty.Value
+        PostProvisionInstanceReturn HookAction
+        PostProvisionInstanceError  error
+
+        PreProvisionInstanceStepCalled          bool
+        PreProvisionInstanceStepAddr            addrs.AbsResourceInstance
+        PreProvisionInstanceStepProvisionerType string
+        PreProvisionInstanceStepReturn          HookAction
+        PreProvisionInstanceStepError           error
+
+        PostProvisionInstanceStepCalled          bool
+        PostProvisionInstanceStepAddr            addrs.AbsResourceInstance
+        PostProvisionInstanceStepProvisionerType string
+        PostProvisionInstanceStepErrorArg        error
+        PostProvisionInstanceStepReturn          HookAction
+        PostProvisionInstanceStepError           error
+
+        ProvisionOutputCalled          bool
+        ProvisionOutputAddr            addrs.AbsResourceInstance
+        ProvisionOutputProvisionerType string
+        ProvisionOutputMessage         string
+
+        PreRefreshCalled     bool
+        PreRefreshAddr       addrs.AbsResourceInstance
+        PreRefreshGen        states.Generation
+        PreRefreshPriorState cty.Value
+        PreRefreshReturn     HookAction
+        PreRefreshError      error
+
+        PostRefreshCalled     bool
+        PostRefreshAddr       addrs.AbsResourceInstance
+        PostRefreshGen        states.Generation
+        PostRefreshPriorState cty.Value
+        PostRefreshNewState   cty.Value
+        PostRefreshReturn     HookAction
+        PostRefreshError      error
 
         PreImportStateCalled bool
-        PreImportStateInfo   *InstanceInfo
-        PreImportStateId     string
+        PreImportStateAddr   addrs.AbsResourceInstance
+        PreImportStateID     string
         PreImportStateReturn HookAction
         PreImportStateError  error
 
-        PostImportStateCalled bool
-        PostImportStateInfo   *InstanceInfo
-        PostImportStateState  []*InstanceState
-        PostImportStateReturn HookAction
-        PostImportStateError  error
+        PostImportStateCalled    bool
+        PostImportStateAddr      addrs.AbsResourceInstance
+        PostImportStateNewStates []providers.ImportedResource
+        PostImportStateReturn    HookAction
+        PostImportStateError     error
 
         PostStateUpdateCalled bool
-        PostStateUpdateState  *State
+        PostStateUpdateState  *states.State
         PostStateUpdateReturn HookAction
         PostStateUpdateError  error
 }
 
-func (h *MockHook) PreApply(n *InstanceInfo, s *InstanceState, d *InstanceDiff) (HookAction, error) {
+var _ Hook = (*MockHook)(nil)
+
+func (h *MockHook) PreApply(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PreApplyCalled = true
-        h.PreApplyInfo = n
-        h.PreApplyDiff = d
-        h.PreApplyState = s
+        h.PreApplyAddr = addr
+        h.PreApplyGen = gen
+        h.PreApplyAction = action
+        h.PreApplyPriorState = priorState
+        h.PreApplyPlannedState = plannedNewState
         return h.PreApplyReturn, h.PreApplyError
 }
 
-func (h *MockHook) PostApply(n *InstanceInfo, s *InstanceState, e error) (HookAction, error) {
+func (h *MockHook) PostApply(addr addrs.AbsResourceInstance, gen states.Generation, newState cty.Value, err error) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PostApplyCalled = true
-        h.PostApplyInfo = n
-        h.PostApplyState = s
-        h.PostApplyError = e
+        h.PostApplyAddr = addr
+        h.PostApplyGen = gen
+        h.PostApplyNewState = newState
+        h.PostApplyError = err
 
         if h.PostApplyFn != nil {
-                return h.PostApplyFn(n, s, e)
+                return h.PostApplyFn(addr, gen, newState, err)
         }
 
         return h.PostApplyReturn, h.PostApplyReturnError
 }
 
-func (h *MockHook) PreDiff(n *InstanceInfo, s *InstanceState) (HookAction, error) {
+func (h *MockHook) PreDiff(addr addrs.AbsResourceInstance, gen states.Generation, priorState, proposedNewState cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PreDiffCalled = true
-        h.PreDiffInfo = n
-        h.PreDiffState = s
+        h.PreDiffAddr = addr
+        h.PreDiffGen = gen
+        h.PreDiffPriorState = priorState
+        h.PreDiffProposedState = proposedNewState
         return h.PreDiffReturn, h.PreDiffError
 }
 
-func (h *MockHook) PostDiff(n *InstanceInfo, d *InstanceDiff) (HookAction, error) {
+func (h *MockHook) PostDiff(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PostDiffCalled = true
-        h.PostDiffInfo = n
-        h.PostDiffDiff = d
+        h.PostDiffAddr = addr
+        h.PostDiffGen = gen
+        h.PostDiffAction = action
+        h.PostDiffPriorState = priorState
+        h.PostDiffPlannedState = plannedNewState
         return h.PostDiffReturn, h.PostDiffError
 }
 
-func (h *MockHook) PreProvisionResource(n *InstanceInfo, s *InstanceState) (HookAction, error) {
+func (h *MockHook) PreProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
-        h.PreProvisionResourceCalled = true
-        h.PreProvisionResourceInfo = n
-        h.PreProvisionInstanceState = s
-        return h.PreProvisionResourceReturn, h.PreProvisionResourceError
+        h.PreProvisionInstanceCalled = true
+        h.PreProvisionInstanceAddr = addr
+        h.PreProvisionInstanceState = state
+        return h.PreProvisionInstanceReturn, h.PreProvisionInstanceError
 }
 
-func (h *MockHook) PostProvisionResource(n *InstanceInfo, s *InstanceState) (HookAction, error) {
+func (h *MockHook) PostProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
-        h.PostProvisionResourceCalled = true
-        h.PostProvisionResourceInfo = n
-        h.PostProvisionInstanceState = s
-        return h.PostProvisionResourceReturn, h.PostProvisionResourceError
+        h.PostProvisionInstanceCalled = true
+        h.PostProvisionInstanceAddr = addr
+        h.PostProvisionInstanceState = state
+        return h.PostProvisionInstanceReturn, h.PostProvisionInstanceError
 }
 
-func (h *MockHook) PreProvision(n *InstanceInfo, provId string) (HookAction, error) {
+func (h *MockHook) PreProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
-        h.PreProvisionCalled = true
-        h.PreProvisionInfo = n
-        h.PreProvisionProvisionerId = provId
-        return h.PreProvisionReturn, h.PreProvisionError
+        h.PreProvisionInstanceStepCalled = true
+        h.PreProvisionInstanceStepAddr = addr
+        h.PreProvisionInstanceStepProvisionerType = typeName
+        return h.PreProvisionInstanceStepReturn, h.PreProvisionInstanceStepError
 }
 
-func (h *MockHook) PostProvision(n *InstanceInfo, provId string, err error) (HookAction, error) {
+func (h *MockHook) PostProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string, err error) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
-        h.PostProvisionCalled = true
-        h.PostProvisionInfo = n
-        h.PostProvisionProvisionerId = provId
-        h.PostProvisionErrorArg = err
-        return h.PostProvisionReturn, h.PostProvisionError
+        h.PostProvisionInstanceStepCalled = true
+        h.PostProvisionInstanceStepAddr = addr
+        h.PostProvisionInstanceStepProvisionerType = typeName
+        h.PostProvisionInstanceStepErrorArg = err
+        return h.PostProvisionInstanceStepReturn, h.PostProvisionInstanceStepError
 }
 
-func (h *MockHook) ProvisionOutput(
-        n *InstanceInfo,
-        provId string,
-        msg string) {
+func (h *MockHook) ProvisionOutput(addr addrs.AbsResourceInstance, typeName string, line string) {
         h.Lock()
         defer h.Unlock()
 
         h.ProvisionOutputCalled = true
-        h.ProvisionOutputInfo = n
-        h.ProvisionOutputProvisionerId = provId
-        h.ProvisionOutputMessage = msg
+        h.ProvisionOutputAddr = addr
+        h.ProvisionOutputProvisionerType = typeName
+        h.ProvisionOutputMessage = line
 }
 
-func (h *MockHook) PreRefresh(n *InstanceInfo, s *InstanceState) (HookAction, error) {
+func (h *MockHook) PreRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PreRefreshCalled = true
-        h.PreRefreshInfo = n
-        h.PreRefreshState = s
+        h.PreRefreshAddr = addr
+        h.PreRefreshGen = gen
+        h.PreRefreshPriorState = priorState
         return h.PreRefreshReturn, h.PreRefreshError
 }
 
-func (h *MockHook) PostRefresh(n *InstanceInfo, s *InstanceState) (HookAction, error) {
+func (h *MockHook) PostRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value, newState cty.Value) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PostRefreshCalled = true
-        h.PostRefreshInfo = n
-        h.PostRefreshState = s
+        h.PostRefreshAddr = addr
+        h.PostRefreshPriorState = priorState
+        h.PostRefreshNewState = newState
         return h.PostRefreshReturn, h.PostRefreshError
 }
 
-func (h *MockHook) PreImportState(info *InstanceInfo, id string) (HookAction, error) {
+func (h *MockHook) PreImportState(addr addrs.AbsResourceInstance, importID string) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PreImportStateCalled = true
-        h.PreImportStateInfo = info
-        h.PreImportStateId = id
+        h.PreImportStateAddr = addr
+        h.PreImportStateID = importID
         return h.PreImportStateReturn, h.PreImportStateError
 }
 
-func (h *MockHook) PostImportState(info *InstanceInfo, s []*InstanceState) (HookAction, error) {
+func (h *MockHook) PostImportState(addr addrs.AbsResourceInstance, imported []providers.ImportedResource) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PostImportStateCalled = true
-        h.PostImportStateInfo = info
-        h.PostImportStateState = s
+        h.PostImportStateAddr = addr
+        h.PostImportStateNewStates = imported
         return h.PostImportStateReturn, h.PostImportStateError
 }
 
-func (h *MockHook) PostStateUpdate(s *State) (HookAction, error) {
+func (h *MockHook) PostStateUpdate(new *states.State) (HookAction, error) {
         h.Lock()
         defer h.Unlock()
 
         h.PostStateUpdateCalled = true
-        h.PostStateUpdateState = s
+        h.PostStateUpdateState = new
         return h.PostStateUpdateReturn, h.PostStateUpdateError
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/hook_stop.go b/vendor/github.com/hashicorp/terraform/terraform/hook_stop.go
index 104d009..811fb33 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/hook_stop.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/hook_stop.go
@@ -2,6 +2,13 @@ package terraform
 
 import (
         "sync/atomic"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
 )
 
 // stopHook is a private Hook implementation that Terraform uses to
@@ -10,63 +17,69 @@ type stopHook struct {
         stop uint32
 }
 
-func (h *stopHook) PreApply(*InstanceInfo, *InstanceState, *InstanceDiff) (HookAction, error) {
+var _ Hook = (*stopHook)(nil)
+
+func (h *stopHook) PreApply(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostApply(*InstanceInfo, *InstanceState, error) (HookAction, error) {
+func (h *stopHook) PostApply(addr addrs.AbsResourceInstance, gen states.Generation, newState cty.Value, err error) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PreDiff(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (h *stopHook) PreDiff(addr addrs.AbsResourceInstance, gen states.Generation, priorState, proposedNewState cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostDiff(*InstanceInfo, *InstanceDiff) (HookAction, error) {
+func (h *stopHook) PostDiff(addr addrs.AbsResourceInstance, gen states.Generation, action plans.Action, priorState, plannedNewState cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PreProvisionResource(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (h *stopHook) PreProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostProvisionResource(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (h *stopHook) PostProvisionInstance(addr addrs.AbsResourceInstance, state cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PreProvision(*InstanceInfo, string) (HookAction, error) {
+func (h *stopHook) PreProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostProvision(*InstanceInfo, string, error) (HookAction, error) {
+func (h *stopHook) PostProvisionInstanceStep(addr addrs.AbsResourceInstance, typeName string, err error) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) ProvisionOutput(*InstanceInfo, string, string) {
+func (h *stopHook) ProvisionOutput(addr addrs.AbsResourceInstance, typeName string, line string) {
 }
 
-func (h *stopHook) PreRefresh(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (h *stopHook) PreRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostRefresh(*InstanceInfo, *InstanceState) (HookAction, error) {
+func (h *stopHook) PostRefresh(addr addrs.AbsResourceInstance, gen states.Generation, priorState cty.Value, newState cty.Value) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PreImportState(*InstanceInfo, string) (HookAction, error) {
+func (h *stopHook) PreImportState(addr addrs.AbsResourceInstance, importID string) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostImportState(*InstanceInfo, []*InstanceState) (HookAction, error) {
+func (h *stopHook) PostImportState(addr addrs.AbsResourceInstance, imported []providers.ImportedResource) (HookAction, error) {
         return h.hook()
 }
 
-func (h *stopHook) PostStateUpdate(*State) (HookAction, error) {
+func (h *stopHook) PostStateUpdate(new *states.State) (HookAction, error) {
         return h.hook()
 }
 
 func (h *stopHook) hook() (HookAction, error) {
         if h.Stopped() {
+                // FIXME: This should really return an error since stopping partway
+                // through is not a successful run-to-completion, but we'll need to
+                // introduce that cautiously since existing automation solutions may
+                // be depending on this behavior.
                 return HookActionHalt, nil
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/instancetype_string.go b/vendor/github.com/hashicorp/terraform/terraform/instancetype_string.go
index b8e7d1f..95b7a98 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/instancetype_string.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/instancetype_string.go
@@ -4,6 +4,16 @@ package terraform
 
 import "strconv"
 
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[TypeInvalid-0]
+        _ = x[TypePrimary-1]
+        _ = x[TypeTainted-2]
+        _ = x[TypeDeposed-3]
+}
+
 const _InstanceType_name = "TypeInvalidTypePrimaryTypeTaintedTypeDeposed"
 
 var _InstanceType_index = [...]uint8{0, 11, 22, 33, 44}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/interpolate.go b/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
index 4f4e178..26c1857 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
@@ -45,65 +45,7 @@ type InterpolationScope struct {
 func (i *Interpolater) Values(
         scope *InterpolationScope,
         vars map[string]config.InterpolatedVariable) (map[string]ast.Variable, error) {
-        if scope == nil {
-                scope = &InterpolationScope{}
-        }
-
-        result := make(map[string]ast.Variable, len(vars))
-
-        // Copy the default variables
-        if i.Module != nil && scope != nil {
-                mod := i.Module
-                if len(scope.Path) > 1 {
-                        mod = i.Module.Child(scope.Path[1:])
-                }
-                for _, v := range mod.Config().Variables {
-                        // Set default variables
-                        if v.Default == nil {
-                                continue
-                        }
-
-                        n := fmt.Sprintf("var.%s", v.Name)
-                        variable, err := hil.InterfaceToVariable(v.Default)
-                        if err != nil {
-                                return nil, fmt.Errorf("invalid default map value for %s: %v", v.Name, v.Default)
-                        }
-
-                        result[n] = variable
-                }
-        }
-
-        for n, rawV := range vars {
-                var err error
-                switch v := rawV.(type) {
-                case *config.CountVariable:
-                        err = i.valueCountVar(scope, n, v, result)
-                case *config.ModuleVariable:
-                        err = i.valueModuleVar(scope, n, v, result)
-                case *config.PathVariable:
-                        err = i.valuePathVar(scope, n, v, result)
-                case *config.ResourceVariable:
-                        err = i.valueResourceVar(scope, n, v, result)
-                case *config.SelfVariable:
-                        err = i.valueSelfVar(scope, n, v, result)
-                case *config.SimpleVariable:
-                        err = i.valueSimpleVar(scope, n, v, result)
-                case *config.TerraformVariable:
-                        err = i.valueTerraformVar(scope, n, v, result)
-                case *config.LocalVariable:
-                        err = i.valueLocalVar(scope, n, v, result)
-                case *config.UserVariable:
-                        err = i.valueUserVar(scope, n, v, result)
-                default:
-                        err = fmt.Errorf("%s: unknown variable type: %T", n, rawV)
-                }
-
-                if err != nil {
-                        return nil, err
-                }
-        }
-
-        return result, nil
+        return nil, fmt.Errorf("type Interpolator is no longer supported; use the evaluator API instead")
 }
 
 func (i *Interpolater) valueCountVar(
@@ -153,7 +95,7 @@ func (i *Interpolater) valueModuleVar(
         defer i.StateLock.RUnlock()
 
         // Get the module where we're looking for the value
-        mod := i.State.ModuleByPath(path)
+        mod := i.State.ModuleByPath(normalizeModulePath(path))
         if mod == nil {
                 // If the module doesn't exist, then we can return an empty string.
                 // This happens usually only in Refresh() when we haven't populated
@@ -257,13 +199,13 @@ func (i *Interpolater) valueResourceVar(
         }
 
         if variable == nil {
-                // During the input walk we tolerate missing variables because
+                // During the refresh walk we tolerate missing variables because
                 // we haven't yet had a chance to refresh state, so dynamic data may
                 // not yet be complete.
                 // If it truly is missing, we'll catch it on a later walk.
                 // This applies only to graph nodes that interpolate during the
-                // config walk, e.g. providers.
-                if i.Operation == walkInput || i.Operation == walkRefresh {
+                // refresh walk, e.g. providers.
+                if i.Operation == walkRefresh {
                         result[n] = unknownVariable()
                         return nil
                 }
@@ -365,7 +307,7 @@ func (i *Interpolater) valueLocalVar(
         }
 
         // Get the relevant module
-        module := i.State.ModuleByPath(scope.Path)
+        module := i.State.ModuleByPath(normalizeModulePath(scope.Path))
         if module == nil {
                 result[n] = unknownVariable()
                 return nil
@@ -584,10 +526,7 @@ MISSING:
         //
         // For a Destroy, we're also fine with computed values, since our goal is
         // only to get destroy nodes for existing resources.
-        //
-        // For an input walk, computed values are okay to return because we're only
-        // looking for missing variables to prompt the user for.
-        if i.Operation == walkRefresh || i.Operation == walkPlanDestroy || i.Operation == walkInput {
+        if i.Operation == walkRefresh || i.Operation == walkPlanDestroy {
                 return &unknownVariable, nil
         }
 
@@ -607,13 +546,6 @@ func (i *Interpolater) computeResourceMultiVariable(
 
         unknownVariable := unknownVariable()
 
-        // If we're only looking for input, we don't need to expand a
-        // multi-variable. This prevents us from encountering things that should be
-        // known but aren't because the state has yet to be refreshed.
-        if i.Operation == walkInput {
-                return &unknownVariable, nil
-        }
-
         // Get the information about this resource variable, and verify
         // that it exists and such.
         module, cr, err := i.resourceVariableInfo(scope, v)
@@ -695,7 +627,7 @@ func (i *Interpolater) computeResourceMultiVariable(
                 //
                 // For an input walk, computed values are okay to return because we're only
                 // looking for missing variables to prompt the user for.
-                if i.Operation == walkRefresh || i.Operation == walkPlanDestroy || i.Operation == walkDestroy || i.Operation == walkInput {
+                if i.Operation == walkRefresh || i.Operation == walkPlanDestroy || i.Operation == walkDestroy {
                         return &unknownVariable, nil
                 }
 
@@ -776,7 +708,7 @@ func (i *Interpolater) resourceVariableInfo(
         }
 
         // Get the relevant module
-        module := i.State.ModuleByPath(scope.Path)
+        module := i.State.ModuleByPath(normalizeModulePath(scope.Path))
         return module, cr, nil
 }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go b/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go
index 4594cb6..66a68c7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go
@@ -1,84 +1,135 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        version "github.com/hashicorp/go-version"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/moduledeps"
         "github.com/hashicorp/terraform/plugin/discovery"
+        "github.com/hashicorp/terraform/states"
 )
 
-// ModuleTreeDependencies returns the dependencies of the tree of modules
-// described by the given configuration tree and state.
+// ConfigTreeDependencies returns the dependencies of the tree of modules
+// described by the given configuration and state.
 //
 // Both configuration and state are required because there can be resources
 // implied by instances in the state that no longer exist in config.
-//
-// This function will panic if any invalid version constraint strings are
-// present in the configuration. This is guaranteed not to happen for any
-// configuration that has passed a call to Config.Validate().
-func ModuleTreeDependencies(root *module.Tree, state *State) *moduledeps.Module {
+func ConfigTreeDependencies(root *configs.Config, state *states.State) *moduledeps.Module {
         // First we walk the configuration tree to build the overall structure
         // and capture the explicit/implicit/inherited provider dependencies.
-        deps := moduleTreeConfigDependencies(root, nil)
+        deps := configTreeConfigDependencies(root, nil)
 
         // Next we walk over the resources in the state to catch any additional
         // dependencies created by existing resources that are no longer in config.
         // Most things we find in state will already be present in 'deps', but
         // we're interested in the rare thing that isn't.
-        moduleTreeMergeStateDependencies(deps, state)
+        configTreeMergeStateDependencies(deps, state)
 
         return deps
 }
 
-func moduleTreeConfigDependencies(root *module.Tree, inheritProviders map[string]*config.ProviderConfig) *moduledeps.Module {
+func configTreeConfigDependencies(root *configs.Config, inheritProviders map[string]*configs.Provider) *moduledeps.Module {
         if root == nil {
                 // If no config is provided, we'll make a synthetic root.
                 // This isn't necessarily correct if we're called with a nil that
                 // *isn't* at the root, but in practice that can never happen.
                 return &moduledeps.Module{
-                        Name: "root",
+                        Name:      "root",
+                        Providers: make(moduledeps.Providers),
                 }
         }
 
+        name := "root"
+        if len(root.Path) != 0 {
+                name = root.Path[len(root.Path)-1]
+        }
+
         ret := &moduledeps.Module{
-                Name: root.Name(),
+                Name: name,
         }
 
-        cfg := root.Config()
-        providerConfigs := cfg.ProviderConfigsByFullName()
+        module := root.Module
 
         // Provider dependencies
         {
-                providers := make(moduledeps.Providers, len(providerConfigs))
+                providers := make(moduledeps.Providers)
 
-                // Any providerConfigs elements are *explicit* provider dependencies,
-                // which is the only situation where the user might provide an actual
-                // version constraint. We'll take care of these first.
-                for fullName, pCfg := range providerConfigs {
+                // The main way to declare a provider dependency is explicitly inside
+                // the "terraform" block, which allows declaring a requirement without
+                // also creating a configuration.
+                for fullName, constraints := range module.ProviderRequirements {
                         inst := moduledeps.ProviderInstance(fullName)
-                        versionSet := discovery.AllVersions
-                        if pCfg.Version != "" {
-                                versionSet = discovery.ConstraintStr(pCfg.Version).MustParse()
+
+                        // The handling here is a bit fiddly because the moduledeps package
+                        // was designed around the legacy (pre-0.12) configuration model
+                        // and hasn't yet been revised to handle the new model. As a result,
+                        // we need to do some translation here.
+                        // FIXME: Eventually we should adjust the underlying model so we
+                        // can also retain the source location of each constraint, for
+                        // more informative output from the "terraform providers" command.
+                        var rawConstraints version.Constraints
+                        for _, constraint := range constraints {
+                                rawConstraints = append(rawConstraints, constraint.Required...)
                         }
+                        discoConstraints := discovery.NewConstraints(rawConstraints)
+
                         providers[inst] = moduledeps.ProviderDependency{
-                                Constraints: versionSet,
+                                Constraints: discoConstraints,
                                 Reason:      moduledeps.ProviderDependencyExplicit,
                         }
                 }
 
+                // Provider configurations can also include version constraints,
+                // allowing for more terse declaration in situations where both a
+                // configuration and a constraint are defined in the same module.
+                for fullName, pCfg := range module.ProviderConfigs {
+                        inst := moduledeps.ProviderInstance(fullName)
+                        discoConstraints := discovery.AllVersions
+                        if pCfg.Version.Required != nil {
+                                discoConstraints = discovery.NewConstraints(pCfg.Version.Required)
+                        }
+                        if existing, exists := providers[inst]; exists {
+                                existing.Constraints = existing.Constraints.Append(discoConstraints)
+                        } else {
+                                providers[inst] = moduledeps.ProviderDependency{
+                                        Constraints: discoConstraints,
+                                        Reason:      moduledeps.ProviderDependencyExplicit,
+                                }
+                        }
+                }
+
                 // Each resource in the configuration creates an *implicit* provider
                 // dependency, though we'll only record it if there isn't already
                 // an explicit dependency on the same provider.
-                for _, rc := range cfg.Resources {
-                        fullName := rc.ProviderFullName()
-                        inst := moduledeps.ProviderInstance(fullName)
+                for _, rc := range module.ManagedResources {
+                        addr := rc.ProviderConfigAddr()
+                        inst := moduledeps.ProviderInstance(addr.StringCompact())
+                        if _, exists := providers[inst]; exists {
+                                // Explicit dependency already present
+                                continue
+                        }
+
+                        reason := moduledeps.ProviderDependencyImplicit
+                        if _, inherited := inheritProviders[addr.StringCompact()]; inherited {
+                                reason = moduledeps.ProviderDependencyInherited
+                        }
+
+                        providers[inst] = moduledeps.ProviderDependency{
+                                Constraints: discovery.AllVersions,
+                                Reason:      reason,
+                        }
+                }
+                for _, rc := range module.DataResources {
+                        addr := rc.ProviderConfigAddr()
+                        inst := moduledeps.ProviderInstance(addr.StringCompact())
                         if _, exists := providers[inst]; exists {
                                 // Explicit dependency already present
                                 continue
                         }
 
                         reason := moduledeps.ProviderDependencyImplicit
-                        if _, inherited := inheritProviders[fullName]; inherited {
+                        if _, inherited := inheritProviders[addr.String()]; inherited {
                                 reason = moduledeps.ProviderDependencyInherited
                         }
 
@@ -91,31 +142,31 @@ func moduleTreeConfigDependencies(root *module.Tree, inheritProviders map[string
                 ret.Providers = providers
         }
 
-        childInherit := make(map[string]*config.ProviderConfig)
+        childInherit := make(map[string]*configs.Provider)
         for k, v := range inheritProviders {
                 childInherit[k] = v
         }
-        for k, v := range providerConfigs {
+        for k, v := range module.ProviderConfigs {
                 childInherit[k] = v
         }
-        for _, c := range root.Children() {
-                ret.Children = append(ret.Children, moduleTreeConfigDependencies(c, childInherit))
+        for _, c := range root.Children {
+                ret.Children = append(ret.Children, configTreeConfigDependencies(c, childInherit))
         }
 
         return ret
 }
 
-func moduleTreeMergeStateDependencies(root *moduledeps.Module, state *State) {
+func configTreeMergeStateDependencies(root *moduledeps.Module, state *states.State) {
         if state == nil {
                 return
         }
 
-        findModule := func(path []string) *moduledeps.Module {
+        findModule := func(path addrs.ModuleInstance) *moduledeps.Module {
                 module := root
-                for _, name := range path[1:] { // skip initial "root"
+                for _, step := range path {
                         var next *moduledeps.Module
                         for _, cm := range module.Children {
-                                if cm.Name == name {
+                                if cm.Name == step.Name {
                                         next = cm
                                         break
                                 }
@@ -124,7 +175,8 @@ func moduleTreeMergeStateDependencies(root *moduledeps.Module, state *State) {
                         if next == nil {
                                 // If we didn't find a next node, we'll need to make one
                                 next = &moduledeps.Module{
-                                        Name: name,
+                                        Name:      step.Name,
+                                        Providers: make(moduledeps.Providers),
                                 }
                                 module.Children = append(module.Children, next)
                         }
@@ -135,15 +187,11 @@ func moduleTreeMergeStateDependencies(root *moduledeps.Module, state *State) {
         }
 
         for _, ms := range state.Modules {
-                module := findModule(ms.Path)
+                module := findModule(ms.Addr)
 
-                for _, is := range ms.Resources {
-                        fullName := config.ResourceProviderFullName(is.Type, is.Provider)
-                        inst := moduledeps.ProviderInstance(fullName)
+                for _, rs := range ms.Resources {
+                        inst := moduledeps.ProviderInstance(rs.ProviderConfig.ProviderConfig.StringCompact())
                         if _, exists := module.Providers[inst]; !exists {
-                                if module.Providers == nil {
-                                        module.Providers = make(moduledeps.Providers)
-                                }
                                 module.Providers[inst] = moduledeps.ProviderDependency{
                                         Constraints: discovery.AllVersions,
                                         Reason:      moduledeps.ProviderDependencyFromState,
@@ -151,5 +199,4 @@ func moduleTreeMergeStateDependencies(root *moduledeps.Module, state *State) {
                         }
                 }
         }
-
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_count_boundary.go b/vendor/github.com/hashicorp/terraform/terraform/node_count_boundary.go
index bd32c79..e495203 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_count_boundary.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_count_boundary.go
@@ -1,14 +1,22 @@
 package terraform
 
-// NodeCountBoundary fixes any "count boundarie" in the state: resources
-// that are named "foo.0" when they should be named "foo"
-type NodeCountBoundary struct{}
+import (
+        "github.com/hashicorp/terraform/configs"
+)
+
+// NodeCountBoundary fixes up any transitions between "each modes" in objects
+// saved in state, such as switching from NoEach to EachInt.
+type NodeCountBoundary struct {
+        Config *configs.Config
+}
 
 func (n *NodeCountBoundary) Name() string {
-        return "meta.count-boundary (count boundary fixup)"
+        return "meta.count-boundary (EachMode fixup)"
 }
 
 // GraphNodeEvalable
 func (n *NodeCountBoundary) EvalTree() EvalNode {
-        return &EvalCountFixZeroOneBoundaryGlobal{}
+        return &EvalCountFixZeroOneBoundaryGlobal{
+                Config: n.Config,
+        }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_data_destroy.go b/vendor/github.com/hashicorp/terraform/terraform/node_data_destroy.go
index e32cea8..6ba3990 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_data_destroy.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_data_destroy.go
@@ -1,22 +1,40 @@
 package terraform
 
-// NodeDestroyableDataResource represents a resource that is "plannable":
-// it is ready to be planned in order to create a diff.
-type NodeDestroyableDataResource struct {
-        *NodeAbstractResource
+import (
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+)
+
+// NodeDestroyableDataResourceInstance represents a resource that is "destroyable":
+// it is ready to be destroyed.
+type NodeDestroyableDataResourceInstance struct {
+        *NodeAbstractResourceInstance
 }
 
 // GraphNodeEvalable
-func (n *NodeDestroyableDataResource) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
+func (n *NodeDestroyableDataResourceInstance) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
 
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
+        var providerSchema *ProviderSchema
+        // We don't need the provider, but we're calling EvalGetProvider to load the
+        // schema.
+        var provider providers.Interface
 
         // Just destroy it.
-        var state *InstanceState
-        return &EvalWriteState{
-                Name:  stateId,
-                State: &state, // state is nil here
+        var state *states.ResourceInstanceObject
+        return &EvalSequence{
+                Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
+                        &EvalWriteState{
+                                Addr:           addr.Resource,
+                                State:          &state,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                        },
+                },
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go
index d5ca641..ab82163 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go
@@ -2,46 +2,71 @@ package terraform
 
 import (
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
 )
 
-// NodeRefreshableDataResource represents a resource that is "plannable":
-// it is ready to be planned in order to create a diff.
+// NodeRefreshableDataResource represents a resource that is "refreshable".
 type NodeRefreshableDataResource struct {
-        *NodeAbstractCountResource
+        *NodeAbstractResource
 }
 
+var (
+        _ GraphNodeSubPath              = (*NodeRefreshableDataResource)(nil)
+        _ GraphNodeDynamicExpandable    = (*NodeRefreshableDataResource)(nil)
+        _ GraphNodeReferenceable        = (*NodeRefreshableDataResource)(nil)
+        _ GraphNodeReferencer           = (*NodeRefreshableDataResource)(nil)
+        _ GraphNodeResource             = (*NodeRefreshableDataResource)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodeRefreshableDataResource)(nil)
+)
+
 // GraphNodeDynamicExpandable
 func (n *NodeRefreshableDataResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
-        // Grab the state which we read
-        state, lock := ctx.State()
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Expand the resource count which must be available by now from EvalTree
-        count, err := n.Config.Count()
-        if err != nil {
-                return nil, err
+        var diags tfdiags.Diagnostics
+
+        count, countKnown, countDiags := evaluateResourceCountExpressionKnown(n.Config.Count, ctx)
+        diags = diags.Append(countDiags)
+        if countDiags.HasErrors() {
+                return nil, diags.Err()
+        }
+        if !countKnown {
+                // If the count isn't known yet, we'll skip refreshing and try expansion
+                // again during the plan walk.
+                return nil, nil
         }
 
+        // Next we need to potentially rename an instance address in the state
+        // if we're transitioning whether "count" is set at all.
+        fixResourceCountSetTransition(ctx, n.ResourceAddr(), count != -1)
+
+        // Our graph transformers require access to the full state, so we'll
+        // temporarily lock it while we work on this.
+        state := ctx.State().Lock()
+        defer ctx.State().Unlock()
+
         // The concrete resource factory we'll use
-        concreteResource := func(a *NodeAbstractResource) dag.Vertex {
+        concreteResource := func(a *NodeAbstractResourceInstance) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
                 a.ResolvedProvider = n.ResolvedProvider
 
                 return &NodeRefreshableDataResourceInstance{
-                        NodeAbstractResource: a,
+                        NodeAbstractResourceInstance: a,
                 }
         }
 
         // We also need a destroyable resource for orphans that are a result of a
         // scaled-in count.
-        concreteResourceDestroyable := func(a *NodeAbstractResource) dag.Vertex {
-                // Add the config since we don't do that via transforms
+        concreteResourceDestroyable := func(a *NodeAbstractResourceInstance) dag.Vertex {
+                // Add the config and provider since we don't do that via transforms
                 a.Config = n.Config
+                a.ResolvedProvider = n.ResolvedProvider
 
-                return &NodeDestroyableDataResource{
-                        NodeAbstractResource: a,
+                return &NodeDestroyableDataResourceInstance{
+                        NodeAbstractResourceInstance: a,
                 }
         }
 
@@ -50,6 +75,7 @@ func (n *NodeRefreshableDataResource) DynamicExpand(ctx EvalContext) (*Graph, er
                 // Expand the count.
                 &ResourceCountTransformer{
                         Concrete: concreteResource,
+                        Schema:   n.Schema,
                         Count:    count,
                         Addr:     n.ResourceAddr(),
                 },
@@ -67,7 +93,7 @@ func (n *NodeRefreshableDataResource) DynamicExpand(ctx EvalContext) (*Graph, er
                 &AttachStateTransformer{State: state},
 
                 // Targeting
-                &TargetsTransformer{ParsedTargets: n.Targets},
+                &TargetsTransformer{Targets: n.Targets},
 
                 // Connect references so ordering is correct
                 &ReferenceTransformer{},
@@ -83,139 +109,118 @@ func (n *NodeRefreshableDataResource) DynamicExpand(ctx EvalContext) (*Graph, er
                 Name:     "NodeRefreshableDataResource",
         }
 
-        return b.Build(ctx.Path())
+        graph, diags := b.Build(ctx.Path())
+        return graph, diags.ErrWithWarnings()
 }
 
-// NodeRefreshableDataResourceInstance represents a _single_ resource instance
+// NodeRefreshableDataResourceInstance represents a single resource instance
 // that is refreshable.
 type NodeRefreshableDataResourceInstance struct {
-        *NodeAbstractResource
+        *NodeAbstractResourceInstance
 }
 
 // GraphNodeEvalable
 func (n *NodeRefreshableDataResourceInstance) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
-
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
-
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:   stateId,
-                Type: addr.Type,
-        }
-
-        // Get the state if we have it, if not we build it
-        rs := n.ResourceState
-        if rs == nil {
-                rs = &ResourceState{
-                        Provider: n.ResolvedProvider,
-                }
-        }
+        addr := n.ResourceInstanceAddr()
 
-        // If the config isn't empty we update the state
-        if n.Config != nil {
-                rs = &ResourceState{
-                        Type:         n.Config.Type,
-                        Provider:     n.Config.Provider,
-                        Dependencies: n.StateReferences(),
-                }
-        }
-
-        // Build the resource for eval
-        resource := &Resource{
-                Name:       addr.Name,
-                Type:       addr.Type,
-                CountIndex: addr.Index,
-        }
-        if resource.CountIndex < 0 {
-                resource.CountIndex = 0
-        }
-
-        // Declare a bunch of variables that are used for state during
-        // evaluation. Most of this are written to by-address below.
-        var config *ResourceConfig
-        var diff *InstanceDiff
-        var provider ResourceProvider
-        var state *InstanceState
+        // These variables are the state for the eval sequence below, and are
+        // updated through pointers.
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
+        var configVal cty.Value
 
         return &EvalSequence{
                 Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
+
                         // Always destroy the existing state first, since we must
                         // make sure that values from a previous read will not
                         // get interpolated if we end up needing to defer our
                         // loading until apply time.
                         &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: rs.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: rs.Dependencies,
-                                State:        &state, // state is nil here
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                State:          &state, // a pointer to nil, here
+                                ProviderSchema: &providerSchema,
                         },
 
-                        &EvalInterpolate{
-                                Config:   n.Config.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &config,
-                        },
-
-                        // The rest of this pass can proceed only if there are no
-                        // computed values in our config.
-                        // (If there are, we'll deal with this during the plan and
-                        // apply phases.)
                         &EvalIf{
                                 If: func(ctx EvalContext) (bool, error) {
-                                        if config.ComputedKeys != nil && len(config.ComputedKeys) > 0 {
-                                                return true, EvalEarlyExitError{}
-                                        }
-
                                         // If the config explicitly has a depends_on for this
                                         // data source, assume the intention is to prevent
-                                        // refreshing ahead of that dependency.
+                                        // refreshing ahead of that dependency, and therefore
+                                        // we need to deal with this resource during the apply
+                                        // phase..
                                         if len(n.Config.DependsOn) > 0 {
                                                 return true, EvalEarlyExitError{}
                                         }
 
                                         return true, nil
                                 },
-
                                 Then: EvalNoop{},
                         },
 
-                        // The remainder of this pass is the same as running
-                        // a "plan" pass immediately followed by an "apply" pass,
-                        // populating the state early so it'll be available to
-                        // provider configurations that need this data during
-                        // refresh/plan.
-                        &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
-                                Output: &provider,
-                        },
-
-                        &EvalReadDataDiff{
-                                Info:        info,
-                                Config:      &config,
-                                Provider:    &provider,
-                                Output:      &diff,
-                                OutputState: &state,
-                        },
-
-                        &EvalReadDataApply{
-                                Info:     info,
-                                Diff:     &diff,
-                                Provider: &provider,
-                                Output:   &state,
+                        // EvalReadData will _attempt_ to read the data source, but may
+                        // generate an incomplete planned object if the configuration
+                        // includes values that won't be known until apply.
+                        &EvalReadData{
+                                Addr:              addr.Resource,
+                                Config:            n.Config,
+                                Dependencies:      n.StateReferences(),
+                                Provider:          &provider,
+                                ProviderAddr:      n.ResolvedProvider,
+                                ProviderSchema:    &providerSchema,
+                                OutputChange:      &change,
+                                OutputConfigValue: &configVal,
+                                OutputState:       &state,
                         },
 
-                        &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: rs.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: rs.Dependencies,
-                                State:        &state,
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        return (*state).Status != states.ObjectPlanned, nil
+                                },
+                                Then: &EvalSequence{
+                                        Nodes: []EvalNode{
+                                                &EvalWriteState{
+                                                        Addr:           addr.Resource,
+                                                        ProviderAddr:   n.ResolvedProvider,
+                                                        State:          &state,
+                                                        ProviderSchema: &providerSchema,
+                                                },
+                                                &EvalUpdateStateHook{},
+                                        },
+                                },
+                                Else: &EvalSequence{
+                                        // We can't deal with this yet, so we'll repeat this step
+                                        // during the plan walk to produce a planned change to read
+                                        // this during the apply walk. However, we do still need to
+                                        // save the generated change and partial state so that
+                                        // results from it can be included in other data resources
+                                        // or provider configurations during the refresh walk.
+                                        // (The planned object we save in the state here will be
+                                        // pruned out at the end of the refresh walk, returning
+                                        // it back to being unset again for subsequent walks.)
+                                        Nodes: []EvalNode{
+                                                &EvalWriteDiff{
+                                                        Addr:           addr.Resource,
+                                                        Change:         &change,
+                                                        ProviderSchema: &providerSchema,
+                                                },
+                                                &EvalWriteState{
+                                                        Addr:           addr.Resource,
+                                                        ProviderAddr:   n.ResolvedProvider,
+                                                        State:          &state,
+                                                        ProviderSchema: &providerSchema,
+                                                },
+                                        },
+                                },
                         },
-
-                        &EvalUpdateStateHook{},
                 },
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_local.go b/vendor/github.com/hashicorp/terraform/terraform/node_local.go
index d387222..591eb30 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_local.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_local.go
@@ -1,10 +1,10 @@
 package terraform
 
 import (
-        "fmt"
-        "strings"
-
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/lang"
 )
 
 // NodeLocal represents a named local value in a particular module.
@@ -12,22 +12,26 @@ import (
 // Local value nodes only have one operation, common to all walk types:
 // evaluate the result and place it in state.
 type NodeLocal struct {
-        PathValue []string
-        Config    *config.Local
+        Addr   addrs.AbsLocalValue
+        Config *configs.Local
 }
 
-func (n *NodeLocal) Name() string {
-        result := fmt.Sprintf("local.%s", n.Config.Name)
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
-        }
+var (
+        _ GraphNodeSubPath       = (*NodeLocal)(nil)
+        _ RemovableIfNotTargeted = (*NodeLocal)(nil)
+        _ GraphNodeReferenceable = (*NodeLocal)(nil)
+        _ GraphNodeReferencer    = (*NodeLocal)(nil)
+        _ GraphNodeEvalable      = (*NodeLocal)(nil)
+        _ dag.GraphNodeDotter    = (*NodeLocal)(nil)
+)
 
-        return result
+func (n *NodeLocal) Name() string {
+        return n.Addr.String()
 }
 
 // GraphNodeSubPath
-func (n *NodeLocal) Path() []string {
-        return n.PathValue
+func (n *NodeLocal) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // RemovableIfNotTargeted
@@ -36,31 +40,31 @@ func (n *NodeLocal) RemoveIfNotTargeted() bool {
 }
 
 // GraphNodeReferenceable
-func (n *NodeLocal) ReferenceableName() []string {
-        name := fmt.Sprintf("local.%s", n.Config.Name)
-        return []string{name}
+func (n *NodeLocal) ReferenceableAddrs() []addrs.Referenceable {
+        return []addrs.Referenceable{n.Addr.LocalValue}
 }
 
 // GraphNodeReferencer
-func (n *NodeLocal) References() []string {
-        var result []string
-        result = append(result, ReferencesFromConfig(n.Config.RawConfig)...)
-        for _, v := range result {
-                split := strings.Split(v, "/")
-                for i, s := range split {
-                        split[i] = s + ".destroy"
-                }
-
-                result = append(result, strings.Join(split, "/"))
-        }
-
-        return result
+func (n *NodeLocal) References() []*addrs.Reference {
+        refs, _ := lang.ReferencesInExpr(n.Config.Expr)
+        return appendResourceDestroyReferences(refs)
 }
 
 // GraphNodeEvalable
 func (n *NodeLocal) EvalTree() EvalNode {
         return &EvalLocal{
-                Name:  n.Config.Name,
-                Value: n.Config.RawConfig,
+                Addr: n.Addr.LocalValue,
+                Expr: n.Config.Expr,
+        }
+}
+
+// dag.GraphNodeDotter impl.
+func (n *NodeLocal) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
+        return &dag.DotNode{
+                Name: name,
+                Attrs: map[string]string{
+                        "label": n.Name(),
+                        "shape": "note",
+                },
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_module_removed.go b/vendor/github.com/hashicorp/terraform/terraform/node_module_removed.go
index bb3e5ee..cb55a1a 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_module_removed.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_module_removed.go
@@ -2,76 +2,80 @@ package terraform
 
 import (
         "fmt"
-        "log"
-        "reflect"
+
+        "github.com/hashicorp/terraform/addrs"
 )
 
 // NodeModuleRemoved represents a module that is no longer in the
 // config.
 type NodeModuleRemoved struct {
-        PathValue []string
+        Addr addrs.ModuleInstance
 }
 
+var (
+        _ GraphNodeSubPath          = (*NodeModuleRemoved)(nil)
+        _ GraphNodeEvalable         = (*NodeModuleRemoved)(nil)
+        _ GraphNodeReferencer       = (*NodeModuleRemoved)(nil)
+        _ GraphNodeReferenceOutside = (*NodeModuleRemoved)(nil)
+)
+
 func (n *NodeModuleRemoved) Name() string {
-        return fmt.Sprintf("%s (removed)", modulePrefixStr(n.PathValue))
+        return fmt.Sprintf("%s (removed)", n.Addr.String())
 }
 
 // GraphNodeSubPath
-func (n *NodeModuleRemoved) Path() []string {
-        return n.PathValue
+func (n *NodeModuleRemoved) Path() addrs.ModuleInstance {
+        return n.Addr
 }
 
 // GraphNodeEvalable
 func (n *NodeModuleRemoved) EvalTree() EvalNode {
         return &EvalOpFilter{
                 Ops: []walkOperation{walkRefresh, walkApply, walkDestroy},
-                Node: &EvalDeleteModule{
-                        PathValue: n.PathValue,
+                Node: &EvalCheckModuleRemoved{
+                        Addr: n.Addr,
                 },
         }
 }
 
-func (n *NodeModuleRemoved) ReferenceGlobal() bool {
-        return true
+func (n *NodeModuleRemoved) ReferenceOutside() (selfPath, referencePath addrs.ModuleInstance) {
+        // Our "References" implementation indicates that this node depends on
+        // the call to the module it represents, which implicitly depends on
+        // everything inside the module. That reference must therefore be
+        // interpreted in terms of our parent module.
+        return n.Addr, n.Addr.Parent()
 }
 
-func (n *NodeModuleRemoved) References() []string {
-        return []string{modulePrefixStr(n.PathValue)}
-}
+func (n *NodeModuleRemoved) References() []*addrs.Reference {
+        // We depend on the call to the module we represent, because that
+        // implicitly then depends on everything inside that module.
+        // Our ReferenceOutside implementation causes this to be interpreted
+        // within the parent module.
 
-// EvalDeleteModule is an EvalNode implementation that removes an empty module
-// entry from the state.
-type EvalDeleteModule struct {
-        PathValue []string
-}
+        _, call := n.Addr.CallInstance()
+        return []*addrs.Reference{
+                {
+                        Subject: call,
 
-func (n *EvalDeleteModule) Eval(ctx EvalContext) (interface{}, error) {
-        state, lock := ctx.State()
-        if state == nil {
-                return nil, nil
+                        // No source range here, because there's nothing reasonable for
+                        // us to return.
+                },
         }
+}
 
-        // Get a write lock so we can access this instance
-        lock.Lock()
-        defer lock.Unlock()
-
-        // Make sure we have a clean state
-        // Destroyed resources aren't deleted, they're written with an ID of "".
-        state.prune()
+// EvalCheckModuleRemoved is an EvalNode implementation that verifies that
+// a module has been removed from the state as expected.
+type EvalCheckModuleRemoved struct {
+        Addr addrs.ModuleInstance
+}
 
-        // find the module and delete it
-        for i, m := range state.Modules {
-                if reflect.DeepEqual(m.Path, n.PathValue) {
-                        if !m.Empty() {
-                                // a targeted apply may leave module resources even without a config,
-                                // so just log this and return.
-                                log.Printf("[DEBUG] cannot remove module %s, not empty", modulePrefixStr(n.PathValue))
-                                break
-                        }
-                        state.Modules = append(state.Modules[:i], state.Modules[i+1:]...)
-                        break
-                }
+func (n *EvalCheckModuleRemoved) Eval(ctx EvalContext) (interface{}, error) {
+        mod := ctx.State().Module(n.Addr)
+        if mod != nil {
+                // If we get here then that indicates a bug either in the states
+                // module or in an earlier step of the graph walk, since we should've
+                // pruned out the module when the last resource was removed from it.
+                return nil, fmt.Errorf("leftover module %s in state that should have been removed; this is a bug in Terraform and should be reported", n.Addr)
         }
-
         return nil, nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_module_variable.go b/vendor/github.com/hashicorp/terraform/terraform/node_module_variable.go
index 66ff7d5..aca5a6a 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_module_variable.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_module_variable.go
@@ -1,40 +1,43 @@
 package terraform
 
 import (
-        "fmt"
-
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // NodeApplyableModuleVariable represents a module variable input during
 // the apply step.
 type NodeApplyableModuleVariable struct {
-        PathValue []string
-        Config    *config.Variable  // Config is the var in the config
-        Value     *config.RawConfig // Value is the value that is set
-
-        Module *module.Tree // Antiquated, want to remove
+        Addr   addrs.AbsInputVariableInstance
+        Config *configs.Variable // Config is the var in the config
+        Expr   hcl.Expression    // Expr is the value expression given in the call
 }
 
-func (n *NodeApplyableModuleVariable) Name() string {
-        result := fmt.Sprintf("var.%s", n.Config.Name)
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
-        }
+// Ensure that we are implementing all of the interfaces we think we are
+// implementing.
+var (
+        _ GraphNodeSubPath          = (*NodeApplyableModuleVariable)(nil)
+        _ RemovableIfNotTargeted    = (*NodeApplyableModuleVariable)(nil)
+        _ GraphNodeReferenceOutside = (*NodeApplyableModuleVariable)(nil)
+        _ GraphNodeReferenceable    = (*NodeApplyableModuleVariable)(nil)
+        _ GraphNodeReferencer       = (*NodeApplyableModuleVariable)(nil)
+        _ GraphNodeEvalable         = (*NodeApplyableModuleVariable)(nil)
+        _ dag.GraphNodeDotter       = (*NodeApplyableModuleVariable)(nil)
+)
 
-        return result
+func (n *NodeApplyableModuleVariable) Name() string {
+        return n.Addr.String()
 }
 
 // GraphNodeSubPath
-func (n *NodeApplyableModuleVariable) Path() []string {
-        // We execute in the parent scope (above our own module) so that
-        // we can access the proper interpolations.
-        if len(n.PathValue) > 2 {
-                return n.PathValue[:len(n.PathValue)-1]
-        }
-
-        return rootModulePath
+func (n *NodeApplyableModuleVariable) Path() addrs.ModuleInstance {
+        // We execute in the parent scope (above our own module) because
+        // expressions in our value are resolved in that context.
+        return n.Addr.Module.Parent()
 }
 
 // RemovableIfNotTargeted
@@ -44,95 +47,96 @@ func (n *NodeApplyableModuleVariable) RemoveIfNotTargeted() bool {
         return true
 }
 
-// GraphNodeReferenceGlobal
-func (n *NodeApplyableModuleVariable) ReferenceGlobal() bool {
-        // We have to create fully qualified references because we cross
-        // boundaries here: our ReferenceableName is in one path and our
-        // References are from another path.
-        return true
+// GraphNodeReferenceOutside implementation
+func (n *NodeApplyableModuleVariable) ReferenceOutside() (selfPath, referencePath addrs.ModuleInstance) {
+
+        // Module input variables have their value expressions defined in the
+        // context of their calling (parent) module, and so references from
+        // a node of this type should be resolved in the parent module instance.
+        referencePath = n.Addr.Module.Parent()
+
+        // Input variables are _referenced_ from their own module, though.
+        selfPath = n.Addr.Module
+
+        return // uses named return values
 }
 
 // GraphNodeReferenceable
-func (n *NodeApplyableModuleVariable) ReferenceableName() []string {
-        return []string{n.Name()}
+func (n *NodeApplyableModuleVariable) ReferenceableAddrs() []addrs.Referenceable {
+        return []addrs.Referenceable{n.Addr.Variable}
 }
 
 // GraphNodeReferencer
-func (n *NodeApplyableModuleVariable) References() []string {
-        // If we have no value set, we depend on nothing
-        if n.Value == nil {
-                return nil
-        }
+func (n *NodeApplyableModuleVariable) References() []*addrs.Reference {
 
-        // Can't depend on anything if we're in the root
-        if len(n.PathValue) < 2 {
+        // If we have no value expression, we cannot depend on anything.
+        if n.Expr == nil {
                 return nil
         }
 
-        // Otherwise, we depend on anything that is in our value, but
-        // specifically in the namespace of the parent path.
-        // Create the prefix based on the path
-        var prefix string
-        if p := n.Path(); len(p) > 0 {
-                prefix = modulePrefixStr(p)
+        // Variables in the root don't depend on anything, because their values
+        // are gathered prior to the graph walk and recorded in the context.
+        if len(n.Addr.Module) == 0 {
+                return nil
         }
 
-        result := ReferencesFromConfig(n.Value)
-        return modulePrefixList(result, prefix)
+        // Otherwise, we depend on anything referenced by our value expression.
+        // We ignore diagnostics here under the assumption that we'll re-eval
+        // all these things later and catch them then; for our purposes here,
+        // we only care about valid references.
+        //
+        // Due to our GraphNodeReferenceOutside implementation, the addresses
+        // returned by this function are interpreted in the _parent_ module from
+        // where our associated variable was declared, which is correct because
+        // our value expression is assigned within a "module" block in the parent
+        // module.
+        refs, _ := lang.ReferencesInExpr(n.Expr)
+        return refs
 }
 
 // GraphNodeEvalable
 func (n *NodeApplyableModuleVariable) EvalTree() EvalNode {
         // If we have no value, do nothing
-        if n.Value == nil {
+        if n.Expr == nil {
                 return &EvalNoop{}
         }
 
         // Otherwise, interpolate the value of this variable and set it
         // within the variables mapping.
-        var config *ResourceConfig
-        variables := make(map[string]interface{})
+        vals := make(map[string]cty.Value)
+
+        _, call := n.Addr.Module.CallInstance()
 
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalOpFilter{
-                                Ops: []walkOperation{walkInput},
-                                Node: &EvalInterpolate{
-                                        Config:        n.Value,
-                                        Output:        &config,
-                                        ContinueOnErr: true,
-                                },
-                        },
-                        &EvalOpFilter{
                                 Ops: []walkOperation{walkRefresh, walkPlan, walkApply,
                                         walkDestroy, walkValidate},
-                                Node: &EvalInterpolate{
-                                        Config: n.Value,
-                                        Output: &config,
-                                },
-                        },
+                                Node: &EvalModuleCallArgument{
+                                        Addr:   n.Addr.Variable,
+                                        Config: n.Config,
+                                        Expr:   n.Expr,
+                                        Values: vals,
 
-                        &EvalVariableBlock{
-                                Config:         &config,
-                                VariableValues: variables,
-                        },
-
-                        &EvalCoerceMapVariable{
-                                Variables:  variables,
-                                ModulePath: n.PathValue,
-                                ModuleTree: n.Module,
+                                        IgnoreDiagnostics: false,
+                                },
                         },
 
-                        &EvalTypeCheckVariable{
-                                Variables:  variables,
-                                ModulePath: n.PathValue,
-                                ModuleTree: n.Module,
+                        &EvalSetModuleCallArguments{
+                                Module: call,
+                                Values: vals,
                         },
+                },
+        }
+}
 
-                        &EvalSetVariables{
-                                Module:    &n.PathValue[len(n.PathValue)-1],
-                                Variables: variables,
-                        },
+// dag.GraphNodeDotter impl.
+func (n *NodeApplyableModuleVariable) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
+        return &dag.DotNode{
+                Name: name,
+                Attrs: map[string]string{
+                        "label": n.Name(),
+                        "shape": "note",
                 },
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_output.go b/vendor/github.com/hashicorp/terraform/terraform/node_output.go
index 83e9925..bb3d065 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_output.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_output.go
@@ -2,31 +2,38 @@ package terraform
 
 import (
         "fmt"
-        "strings"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/lang"
 )
 
 // NodeApplyableOutput represents an output that is "applyable":
 // it is ready to be applied.
 type NodeApplyableOutput struct {
-        PathValue []string
-        Config    *config.Output // Config is the output in the config
+        Addr   addrs.AbsOutputValue
+        Config *configs.Output // Config is the output in the config
 }
 
-func (n *NodeApplyableOutput) Name() string {
-        result := fmt.Sprintf("output.%s", n.Config.Name)
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
-        }
+var (
+        _ GraphNodeSubPath          = (*NodeApplyableOutput)(nil)
+        _ RemovableIfNotTargeted    = (*NodeApplyableOutput)(nil)
+        _ GraphNodeTargetDownstream = (*NodeApplyableOutput)(nil)
+        _ GraphNodeReferenceable    = (*NodeApplyableOutput)(nil)
+        _ GraphNodeReferencer       = (*NodeApplyableOutput)(nil)
+        _ GraphNodeReferenceOutside = (*NodeApplyableOutput)(nil)
+        _ GraphNodeEvalable         = (*NodeApplyableOutput)(nil)
+        _ dag.GraphNodeDotter       = (*NodeApplyableOutput)(nil)
+)
 
-        return result
+func (n *NodeApplyableOutput) Name() string {
+        return n.Addr.String()
 }
 
 // GraphNodeSubPath
-func (n *NodeApplyableOutput) Path() []string {
-        return n.PathValue
+func (n *NodeApplyableOutput) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // RemovableIfNotTargeted
@@ -44,27 +51,64 @@ func (n *NodeApplyableOutput) TargetDownstream(targetedDeps, untargetedDeps *dag
         return true
 }
 
+func referenceOutsideForOutput(addr addrs.AbsOutputValue) (selfPath, referencePath addrs.ModuleInstance) {
+
+        // Output values have their expressions resolved in the context of the
+        // module where they are defined.
+        referencePath = addr.Module
+
+        // ...but they are referenced in the context of their calling module.
+        selfPath = addr.Module.Parent()
+
+        return // uses named return values
+
+}
+
+// GraphNodeReferenceOutside implementation
+func (n *NodeApplyableOutput) ReferenceOutside() (selfPath, referencePath addrs.ModuleInstance) {
+        return referenceOutsideForOutput(n.Addr)
+}
+
+func referenceableAddrsForOutput(addr addrs.AbsOutputValue) []addrs.Referenceable {
+        // An output in the root module can't be referenced at all.
+        if addr.Module.IsRoot() {
+                return nil
+        }
+
+        // Otherwise, we can be referenced via a reference to our output name
+        // on the parent module's call, or via a reference to the entire call.
+        // e.g. module.foo.bar or just module.foo .
+        // Note that our ReferenceOutside method causes these addresses to be
+        // relative to the calling module, not the module where the output
+        // was declared.
+        _, outp := addr.ModuleCallOutput()
+        _, call := addr.Module.CallInstance()
+        return []addrs.Referenceable{outp, call}
+
+}
+
 // GraphNodeReferenceable
-func (n *NodeApplyableOutput) ReferenceableName() []string {
-        name := fmt.Sprintf("output.%s", n.Config.Name)
-        return []string{name}
+func (n *NodeApplyableOutput) ReferenceableAddrs() []addrs.Referenceable {
+        return referenceableAddrsForOutput(n.Addr)
 }
 
-// GraphNodeReferencer
-func (n *NodeApplyableOutput) References() []string {
-        var result []string
-        result = append(result, n.Config.DependsOn...)
-        result = append(result, ReferencesFromConfig(n.Config.RawConfig)...)
-        for _, v := range result {
-                split := strings.Split(v, "/")
-                for i, s := range split {
-                        split[i] = s + ".destroy"
-                }
-
-                result = append(result, strings.Join(split, "/"))
+func referencesForOutput(c *configs.Output) []*addrs.Reference {
+        impRefs, _ := lang.ReferencesInExpr(c.Expr)
+        expRefs, _ := lang.References(c.DependsOn)
+        l := len(impRefs) + len(expRefs)
+        if l == 0 {
+                return nil
         }
+        refs := make([]*addrs.Reference, 0, l)
+        refs = append(refs, impRefs...)
+        refs = append(refs, expRefs...)
+        return refs
 
-        return result
+}
+
+// GraphNodeReferencer
+func (n *NodeApplyableOutput) References() []*addrs.Reference {
+        return appendResourceDestroyReferences(referencesForOutput(n.Config))
 }
 
 // GraphNodeEvalable
@@ -72,47 +116,51 @@ func (n *NodeApplyableOutput) EvalTree() EvalNode {
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalOpFilter{
-                                // Don't let interpolation errors stop Input, since it happens
-                                // before Refresh.
-                                Ops: []walkOperation{walkInput},
-                                Node: &EvalWriteOutput{
-                                        Name:          n.Config.Name,
-                                        Sensitive:     n.Config.Sensitive,
-                                        Value:         n.Config.RawConfig,
-                                        ContinueOnErr: true,
-                                },
-                        },
-                        &EvalOpFilter{
                                 Ops: []walkOperation{walkRefresh, walkPlan, walkApply, walkValidate, walkDestroy, walkPlanDestroy},
                                 Node: &EvalWriteOutput{
-                                        Name:      n.Config.Name,
+                                        Addr:      n.Addr.OutputValue,
                                         Sensitive: n.Config.Sensitive,
-                                        Value:     n.Config.RawConfig,
+                                        Expr:      n.Config.Expr,
                                 },
                         },
                 },
         }
 }
 
+// dag.GraphNodeDotter impl.
+func (n *NodeApplyableOutput) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
+        return &dag.DotNode{
+                Name: name,
+                Attrs: map[string]string{
+                        "label": n.Name(),
+                        "shape": "note",
+                },
+        }
+}
+
 // NodeDestroyableOutput represents an output that is "destroybale":
 // its application will remove the output from the state.
 type NodeDestroyableOutput struct {
-        PathValue []string
-        Config    *config.Output // Config is the output in the config
+        Addr   addrs.AbsOutputValue
+        Config *configs.Output // Config is the output in the config
 }
 
-func (n *NodeDestroyableOutput) Name() string {
-        result := fmt.Sprintf("output.%s (destroy)", n.Config.Name)
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
-        }
+var (
+        _ GraphNodeSubPath          = (*NodeDestroyableOutput)(nil)
+        _ RemovableIfNotTargeted    = (*NodeDestroyableOutput)(nil)
+        _ GraphNodeTargetDownstream = (*NodeDestroyableOutput)(nil)
+        _ GraphNodeReferencer       = (*NodeDestroyableOutput)(nil)
+        _ GraphNodeEvalable         = (*NodeDestroyableOutput)(nil)
+        _ dag.GraphNodeDotter       = (*NodeDestroyableOutput)(nil)
+)
 
-        return result
+func (n *NodeDestroyableOutput) Name() string {
+        return fmt.Sprintf("%s (destroy)", n.Addr.String())
 }
 
 // GraphNodeSubPath
-func (n *NodeDestroyableOutput) Path() []string {
-        return n.PathValue
+func (n *NodeDestroyableOutput) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // RemovableIfNotTargeted
@@ -129,25 +177,24 @@ func (n *NodeDestroyableOutput) TargetDownstream(targetedDeps, untargetedDeps *d
 }
 
 // GraphNodeReferencer
-func (n *NodeDestroyableOutput) References() []string {
-        var result []string
-        result = append(result, n.Config.DependsOn...)
-        result = append(result, ReferencesFromConfig(n.Config.RawConfig)...)
-        for _, v := range result {
-                split := strings.Split(v, "/")
-                for i, s := range split {
-                        split[i] = s + ".destroy"
-                }
-
-                result = append(result, strings.Join(split, "/"))
-        }
-
-        return result
+func (n *NodeDestroyableOutput) References() []*addrs.Reference {
+        return referencesForOutput(n.Config)
 }
 
 // GraphNodeEvalable
 func (n *NodeDestroyableOutput) EvalTree() EvalNode {
         return &EvalDeleteOutput{
-                Name: n.Config.Name,
+                Addr: n.Addr.OutputValue,
+        }
+}
+
+// dag.GraphNodeDotter impl.
+func (n *NodeDestroyableOutput) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
+        return &dag.DotNode{
+                Name: name,
+                Attrs: map[string]string{
+                        "label": n.Name(),
+                        "shape": "note",
+                },
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_output_orphan.go b/vendor/github.com/hashicorp/terraform/terraform/node_output_orphan.go
index 0fd1554..518b8aa 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_output_orphan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_output_orphan.go
@@ -2,31 +2,39 @@ package terraform
 
 import (
         "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
 )
 
 // NodeOutputOrphan represents an output that is an orphan.
 type NodeOutputOrphan struct {
-        OutputName string
-        PathValue  []string
+        Addr addrs.AbsOutputValue
 }
 
+var (
+        _ GraphNodeSubPath          = (*NodeOutputOrphan)(nil)
+        _ GraphNodeReferenceable    = (*NodeOutputOrphan)(nil)
+        _ GraphNodeReferenceOutside = (*NodeOutputOrphan)(nil)
+        _ GraphNodeEvalable         = (*NodeOutputOrphan)(nil)
+)
+
 func (n *NodeOutputOrphan) Name() string {
-        result := fmt.Sprintf("output.%s (orphan)", n.OutputName)
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
-        }
+        return fmt.Sprintf("%s (orphan)", n.Addr.String())
+}
 
-        return result
+// GraphNodeReferenceOutside implementation
+func (n *NodeOutputOrphan) ReferenceOutside() (selfPath, referencePath addrs.ModuleInstance) {
+        return referenceOutsideForOutput(n.Addr)
 }
 
 // GraphNodeReferenceable
-func (n *NodeOutputOrphan) ReferenceableName() []string {
-        return []string{"output." + n.OutputName}
+func (n *NodeOutputOrphan) ReferenceableAddrs() []addrs.Referenceable {
+        return referenceableAddrsForOutput(n.Addr)
 }
 
 // GraphNodeSubPath
-func (n *NodeOutputOrphan) Path() []string {
-        return n.PathValue
+func (n *NodeOutputOrphan) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // GraphNodeEvalable
@@ -34,7 +42,7 @@ func (n *NodeOutputOrphan) EvalTree() EvalNode {
         return &EvalOpFilter{
                 Ops: []walkOperation{walkRefresh, walkApply, walkDestroy},
                 Node: &EvalDeleteOutput{
-                        Name: n.OutputName,
+                        Addr: n.Addr.OutputValue,
                 },
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_provider_abstract.go b/vendor/github.com/hashicorp/terraform/terraform/node_provider_abstract.go
index 9e490f7..a0cdcfe 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_provider_abstract.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_provider_abstract.go
@@ -1,10 +1,10 @@
 package terraform
 
 import (
-        "fmt"
-        "strings"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
 
-        "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -15,37 +15,33 @@ type ConcreteProviderNodeFunc func(*NodeAbstractProvider) dag.Vertex
 // NodeAbstractProvider represents a provider that has no associated operations.
 // It registers all the common interfaces across operations for providers.
 type NodeAbstractProvider struct {
-        NameValue string
-        PathValue []string
+        Addr addrs.AbsProviderConfig
 
         // The fields below will be automatically set using the Attach
         // interfaces if you're running those transforms, but also be explicitly
         // set if you already have that information.
 
-        Config *config.ProviderConfig
+        Config *configs.Provider
+        Schema *configschema.Block
 }
 
-func ResolveProviderName(name string, path []string) string {
-        if strings.Contains(name, "provider.") {
-                // already resolved
-                return name
-        }
-
-        name = fmt.Sprintf("provider.%s", name)
-        if len(path) >= 1 {
-                name = fmt.Sprintf("%s.%s", modulePrefixStr(path), name)
-        }
-
-        return name
-}
+var (
+        _ GraphNodeSubPath                    = (*NodeAbstractProvider)(nil)
+        _ RemovableIfNotTargeted              = (*NodeAbstractProvider)(nil)
+        _ GraphNodeReferencer                 = (*NodeAbstractProvider)(nil)
+        _ GraphNodeProvider                   = (*NodeAbstractProvider)(nil)
+        _ GraphNodeAttachProvider             = (*NodeAbstractProvider)(nil)
+        _ GraphNodeAttachProviderConfigSchema = (*NodeAbstractProvider)(nil)
+        _ dag.GraphNodeDotter                 = (*NodeAbstractProvider)(nil)
+)
 
 func (n *NodeAbstractProvider) Name() string {
-        return ResolveProviderName(n.NameValue, n.PathValue)
+        return n.Addr.String()
 }
 
 // GraphNodeSubPath
-func (n *NodeAbstractProvider) Path() []string {
-        return n.PathValue
+func (n *NodeAbstractProvider) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // RemovableIfNotTargeted
@@ -56,21 +52,21 @@ func (n *NodeAbstractProvider) RemoveIfNotTargeted() bool {
 }
 
 // GraphNodeReferencer
-func (n *NodeAbstractProvider) References() []string {
-        if n.Config == nil {
+func (n *NodeAbstractProvider) References() []*addrs.Reference {
+        if n.Config == nil || n.Schema == nil {
                 return nil
         }
 
-        return ReferencesFromConfig(n.Config.RawConfig)
+        return ReferencesFromConfig(n.Config.Config, n.Schema)
 }
 
 // GraphNodeProvider
-func (n *NodeAbstractProvider) ProviderName() string {
-        return n.NameValue
+func (n *NodeAbstractProvider) ProviderAddr() addrs.AbsProviderConfig {
+        return n.Addr
 }
 
 // GraphNodeProvider
-func (n *NodeAbstractProvider) ProviderConfig() *config.ProviderConfig {
+func (n *NodeAbstractProvider) ProviderConfig() *configs.Provider {
         if n.Config == nil {
                 return nil
         }
@@ -79,10 +75,15 @@ func (n *NodeAbstractProvider) ProviderConfig() *config.ProviderConfig {
 }
 
 // GraphNodeAttachProvider
-func (n *NodeAbstractProvider) AttachProvider(c *config.ProviderConfig) {
+func (n *NodeAbstractProvider) AttachProvider(c *configs.Provider) {
         n.Config = c
 }
 
+// GraphNodeAttachProviderConfigSchema impl.
+func (n *NodeAbstractProvider) AttachProviderConfigSchema(schema *configschema.Block) {
+        n.Schema = schema
+}
+
 // GraphNodeDotter impl.
 func (n *NodeAbstractProvider) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
         return &dag.DotNode{
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_provider_disabled.go b/vendor/github.com/hashicorp/terraform/terraform/node_provider_disabled.go
index a00bc46..30d8813 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_provider_disabled.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_provider_disabled.go
@@ -2,6 +2,8 @@ package terraform
 
 import (
         "fmt"
+
+        "github.com/hashicorp/terraform/dag"
 )
 
 // NodeDisabledProvider represents a provider that is disabled. A disabled
@@ -11,24 +13,15 @@ type NodeDisabledProvider struct {
         *NodeAbstractProvider
 }
 
+var (
+        _ GraphNodeSubPath        = (*NodeDisabledProvider)(nil)
+        _ RemovableIfNotTargeted  = (*NodeDisabledProvider)(nil)
+        _ GraphNodeReferencer     = (*NodeDisabledProvider)(nil)
+        _ GraphNodeProvider       = (*NodeDisabledProvider)(nil)
+        _ GraphNodeAttachProvider = (*NodeDisabledProvider)(nil)
+        _ dag.GraphNodeDotter     = (*NodeDisabledProvider)(nil)
+)
+
 func (n *NodeDisabledProvider) Name() string {
         return fmt.Sprintf("%s (disabled)", n.NodeAbstractProvider.Name())
 }
-
-// GraphNodeEvalable
-func (n *NodeDisabledProvider) EvalTree() EvalNode {
-        var resourceConfig *ResourceConfig
-        return &EvalSequence{
-                Nodes: []EvalNode{
-                        &EvalInterpolateProvider{
-                                Config: n.ProviderConfig(),
-                                Output: &resourceConfig,
-                        },
-                        &EvalBuildProviderConfig{
-                                Provider: n.ProviderName(),
-                                Config:   &resourceConfig,
-                                Output:   &resourceConfig,
-                        },
-                },
-        }
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_provider_eval.go b/vendor/github.com/hashicorp/terraform/terraform/node_provider_eval.go
new file mode 100644
index 0000000..580e60c
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_provider_eval.go
@@ -0,0 +1,20 @@
+package terraform
+
+// NodeEvalableProvider represents a provider during an "eval" walk.
+// This special provider node type just initializes a provider and
+// fetches its schema, without configuring it or otherwise interacting
+// with it.
+type NodeEvalableProvider struct {
+        *NodeAbstractProvider
+}
+
+// GraphNodeEvalable
+func (n *NodeEvalableProvider) EvalTree() EvalNode {
+        addr := n.Addr
+        relAddr := addr.ProviderConfig
+
+        return &EvalInitProvider{
+                TypeName: relAddr.Type,
+                Addr:     addr.ProviderConfig,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_provisioner.go b/vendor/github.com/hashicorp/terraform/terraform/node_provisioner.go
index bb117c1..31ed1a8 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_provisioner.go
@@ -3,6 +3,7 @@ package terraform
 import (
         "fmt"
 
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/config"
 )
 
@@ -10,7 +11,7 @@ import (
 // It registers all the common interfaces across operations for providers.
 type NodeProvisioner struct {
         NameValue string
-        PathValue []string
+        PathValue addrs.ModuleInstance
 
         // The fields below will be automatically set using the Attach
         // interfaces if you're running those transforms, but also be explicitly
@@ -19,17 +20,23 @@ type NodeProvisioner struct {
         Config *config.ProviderConfig
 }
 
+var (
+        _ GraphNodeSubPath     = (*NodeProvisioner)(nil)
+        _ GraphNodeProvisioner = (*NodeProvisioner)(nil)
+        _ GraphNodeEvalable    = (*NodeProvisioner)(nil)
+)
+
 func (n *NodeProvisioner) Name() string {
         result := fmt.Sprintf("provisioner.%s", n.NameValue)
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
+        if len(n.PathValue) > 0 {
+                result = fmt.Sprintf("%s.%s", n.PathValue.String(), result)
         }
 
         return result
 }
 
 // GraphNodeSubPath
-func (n *NodeProvisioner) Path() []string {
+func (n *NodeProvisioner) Path() addrs.ModuleInstance {
         return n.PathValue
 }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go
index 73509c8..3a0570c 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go
@@ -2,10 +2,16 @@ package terraform
 
 import (
         "fmt"
-        "strings"
+        "log"
+        "sort"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/lang"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ConcreteResourceNodeFunc is a callback type used to convert an
@@ -16,225 +22,420 @@ type ConcreteResourceNodeFunc func(*NodeAbstractResource) dag.Vertex
 // The type of operation cannot be assumed, only that this node represents
 // the given resource.
 type GraphNodeResource interface {
-        ResourceAddr() *ResourceAddress
+        ResourceAddr() addrs.AbsResource
+}
+
+// ConcreteResourceInstanceNodeFunc is a callback type used to convert an
+// abstract resource instance to a concrete one of some type.
+type ConcreteResourceInstanceNodeFunc func(*NodeAbstractResourceInstance) dag.Vertex
+
+// GraphNodeResourceInstance is implemented by any nodes that represent
+// a resource instance. A single resource may have multiple instances if,
+// for example, the "count" or "for_each" argument is used for it in
+// configuration.
+type GraphNodeResourceInstance interface {
+        ResourceInstanceAddr() addrs.AbsResourceInstance
 }
 
 // NodeAbstractResource represents a resource that has no associated
 // operations. It registers all the interfaces for a resource that common
 // across multiple operation types.
 type NodeAbstractResource struct {
-        Addr *ResourceAddress // Addr is the address for this resource
+        Addr addrs.AbsResource // Addr is the address for this resource
 
         // The fields below will be automatically set using the Attach
         // interfaces if you're running those transforms, but also be explicitly
         // set if you already have that information.
 
-        Config        *config.Resource // Config is the resource in the config
-        ResourceState *ResourceState   // ResourceState is the ResourceState for this
+        Schema        *configschema.Block // Schema for processing the configuration body
+        SchemaVersion uint64              // Schema version of "Schema", as decided by the provider
+        Config        *configs.Resource   // Config is the resource in the config
 
-        Targets []ResourceAddress // Set from GraphNodeTargetable
+        ProvisionerSchemas map[string]*configschema.Block
+
+        Targets []addrs.Targetable // Set from GraphNodeTargetable
 
         // The address of the provider this resource will use
-        ResolvedProvider string
+        ResolvedProvider addrs.AbsProviderConfig
+}
+
+var (
+        _ GraphNodeSubPath                 = (*NodeAbstractResource)(nil)
+        _ GraphNodeReferenceable           = (*NodeAbstractResource)(nil)
+        _ GraphNodeReferencer              = (*NodeAbstractResource)(nil)
+        _ GraphNodeProviderConsumer        = (*NodeAbstractResource)(nil)
+        _ GraphNodeProvisionerConsumer     = (*NodeAbstractResource)(nil)
+        _ GraphNodeResource                = (*NodeAbstractResource)(nil)
+        _ GraphNodeAttachResourceConfig    = (*NodeAbstractResource)(nil)
+        _ GraphNodeAttachResourceSchema    = (*NodeAbstractResource)(nil)
+        _ GraphNodeAttachProvisionerSchema = (*NodeAbstractResource)(nil)
+        _ GraphNodeTargetable              = (*NodeAbstractResource)(nil)
+        _ dag.GraphNodeDotter              = (*NodeAbstractResource)(nil)
+)
+
+// NewNodeAbstractResource creates an abstract resource graph node for
+// the given absolute resource address.
+func NewNodeAbstractResource(addr addrs.AbsResource) *NodeAbstractResource {
+        return &NodeAbstractResource{
+                Addr: addr,
+        }
+}
+
+// NodeAbstractResourceInstance represents a resource instance with no
+// associated operations. It embeds NodeAbstractResource but additionally
+// contains an instance key, used to identify one of potentially many
+// instances that were created from a resource in configuration, e.g. using
+// the "count" or "for_each" arguments.
+type NodeAbstractResourceInstance struct {
+        NodeAbstractResource
+        InstanceKey addrs.InstanceKey
+
+        // The fields below will be automatically set using the Attach
+        // interfaces if you're running those transforms, but also be explicitly
+        // set if you already have that information.
+
+        ResourceState *states.Resource
+}
+
+var (
+        _ GraphNodeSubPath                 = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeReferenceable           = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeReferencer              = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeProviderConsumer        = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeProvisionerConsumer     = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeResource                = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeResourceInstance        = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeAttachResourceState     = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeAttachResourceConfig    = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeAttachResourceSchema    = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeAttachProvisionerSchema = (*NodeAbstractResourceInstance)(nil)
+        _ GraphNodeTargetable              = (*NodeAbstractResourceInstance)(nil)
+        _ dag.GraphNodeDotter              = (*NodeAbstractResourceInstance)(nil)
+)
+
+// NewNodeAbstractResourceInstance creates an abstract resource instance graph
+// node for the given absolute resource instance address.
+func NewNodeAbstractResourceInstance(addr addrs.AbsResourceInstance) *NodeAbstractResourceInstance {
+        // Due to the fact that we embed NodeAbstractResource, the given address
+        // actually ends up split between the resource address in the embedded
+        // object and the InstanceKey field in our own struct. The
+        // ResourceInstanceAddr method will stick these back together again on
+        // request.
+        return &NodeAbstractResourceInstance{
+                NodeAbstractResource: NodeAbstractResource{
+                        Addr: addr.ContainingResource(),
+                },
+                InstanceKey: addr.Resource.Key,
+        }
 }
 
 func (n *NodeAbstractResource) Name() string {
-        return n.Addr.String()
+        return n.ResourceAddr().String()
+}
+
+func (n *NodeAbstractResourceInstance) Name() string {
+        return n.ResourceInstanceAddr().String()
 }
 
 // GraphNodeSubPath
-func (n *NodeAbstractResource) Path() []string {
-        return n.Addr.Path
+func (n *NodeAbstractResource) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // GraphNodeReferenceable
-func (n *NodeAbstractResource) ReferenceableName() []string {
-        // We always are referenceable as "type.name" as long as
-        // we have a config or address. Determine what that value is.
-        var id string
-        if n.Config != nil {
-                id = n.Config.Id()
-        } else if n.Addr != nil {
-                addrCopy := n.Addr.Copy()
-                addrCopy.Path = nil // ReferenceTransformer handles paths
-                addrCopy.Index = -1 // We handle indexes below
-                id = addrCopy.String()
-        } else {
-                // No way to determine our type.name, just return
-                return nil
-        }
+func (n *NodeAbstractResource) ReferenceableAddrs() []addrs.Referenceable {
+        return []addrs.Referenceable{n.Addr.Resource}
+}
 
-        var result []string
+// GraphNodeReferenceable
+func (n *NodeAbstractResourceInstance) ReferenceableAddrs() []addrs.Referenceable {
+        addr := n.ResourceInstanceAddr()
+        return []addrs.Referenceable{
+                addr.Resource,
+
+                // A resource instance can also be referenced by the address of its
+                // containing resource, so that e.g. a reference to aws_instance.foo
+                // would match both aws_instance.foo[0] and aws_instance.foo[1].
+                addr.ContainingResource().Resource,
+        }
+}
 
-        // Always include our own ID. This is primarily for backwards
-        // compatibility with states that didn't yet support the more
-        // specific dep string.
-        result = append(result, id)
+// GraphNodeReferencer
+func (n *NodeAbstractResource) References() []*addrs.Reference {
+        // If we have a config then we prefer to use that.
+        if c := n.Config; c != nil {
+                var result []*addrs.Reference
+
+                for _, traversal := range c.DependsOn {
+                        ref, err := addrs.ParseRef(traversal)
+                        if err != nil {
+                                // We ignore this here, because this isn't a suitable place to return
+                                // errors. This situation should be caught and rejected during
+                                // validation.
+                                log.Printf("[ERROR] Can't parse %#v from depends_on as reference: %s", traversal, err)
+                                continue
+                        }
 
-        // We represent all multi-access
-        result = append(result, fmt.Sprintf("%s.*", id))
+                        result = append(result, ref)
+                }
 
-        // We represent either a specific number, or all numbers
-        suffix := "N"
-        if n.Addr != nil {
-                idx := n.Addr.Index
-                if idx == -1 {
-                        idx = 0
+                if n.Schema == nil {
+                        // Should never happens, but we'll log if it does so that we can
+                        // see this easily when debugging.
+                        log.Printf("[WARN] no schema is attached to %s, so config references cannot be detected", n.Name())
                 }
 
-                suffix = fmt.Sprintf("%d", idx)
+                refs, _ := lang.ReferencesInExpr(c.Count)
+                result = append(result, refs...)
+                refs, _ = lang.ReferencesInBlock(c.Config, n.Schema)
+                result = append(result, refs...)
+                if c.Managed != nil {
+                        for _, p := range c.Managed.Provisioners {
+                                if p.When != configs.ProvisionerWhenCreate {
+                                        continue
+                                }
+                                if p.Connection != nil {
+                                        refs, _ = lang.ReferencesInBlock(p.Connection.Config, connectionBlockSupersetSchema)
+                                        result = append(result, refs...)
+                                }
+
+                                schema := n.ProvisionerSchemas[p.Type]
+                                if schema == nil {
+                                        log.Printf("[WARN] no schema for provisioner %q is attached to %s, so provisioner block references cannot be detected", p.Type, n.Name())
+                                }
+                                refs, _ = lang.ReferencesInBlock(p.Config, schema)
+                                result = append(result, refs...)
+                        }
+                }
+                return result
         }
-        result = append(result, fmt.Sprintf("%s.%s", id, suffix))
 
-        return result
+        // Otherwise, we have no references.
+        return nil
 }
 
 // GraphNodeReferencer
-func (n *NodeAbstractResource) References() []string {
-        // If we have a config, that is our source of truth
-        if c := n.Config; c != nil {
-                // Grab all the references
-                var result []string
-                result = append(result, c.DependsOn...)
-                result = append(result, ReferencesFromConfig(c.RawCount)...)
-                result = append(result, ReferencesFromConfig(c.RawConfig)...)
-                for _, p := range c.Provisioners {
-                        if p.When == config.ProvisionerWhenCreate {
-                                result = append(result, ReferencesFromConfig(p.ConnInfo)...)
-                                result = append(result, ReferencesFromConfig(p.RawConfig)...)
-                        }
+func (n *NodeAbstractResourceInstance) References() []*addrs.Reference {
+        // If we have a configuration attached then we'll delegate to our
+        // embedded abstract resource, which knows how to extract dependencies
+        // from configuration.
+        if n.Config != nil {
+                if n.Schema == nil {
+                        // We'll produce a log message about this out here so that
+                        // we can include the full instance address, since the equivalent
+                        // message in NodeAbstractResource.References cannot see it.
+                        log.Printf("[WARN] no schema is attached to %s, so config references cannot be detected", n.Name())
+                        return nil
                 }
-
-                return uniqueStrings(result)
+                return n.NodeAbstractResource.References()
         }
 
-        // If we have state, that is our next source
-        if s := n.ResourceState; s != nil {
-                return s.Dependencies
+        // Otherwise, if we have state then we'll use the values stored in state
+        // as a fallback.
+        if rs := n.ResourceState; rs != nil {
+                if s := rs.Instance(n.InstanceKey); s != nil {
+                        // State is still storing dependencies as old-style strings, so we'll
+                        // need to do a little work here to massage this to the form we now
+                        // want.
+                        var result []*addrs.Reference
+                        for _, addr := range s.Current.Dependencies {
+                                if addr == nil {
+                                        // Should never happen; indicates a bug in the state loader
+                                        panic(fmt.Sprintf("dependencies for current object on %s contains nil address", n.ResourceInstanceAddr()))
+                                }
+
+                                // This is a little weird: we need to manufacture an addrs.Reference
+                                // with a fake range here because the state isn't something we can
+                                // make source references into.
+                                result = append(result, &addrs.Reference{
+                                        Subject: addr,
+                                        SourceRange: tfdiags.SourceRange{
+                                                Filename: "(state file)",
+                                        },
+                                })
+                        }
+                        return result
+                }
         }
 
+        // If we have neither config nor state then we have no references.
         return nil
 }
 
+// converts an instance address to the legacy dotted notation
+func dottedInstanceAddr(tr addrs.ResourceInstance) string {
+        // The legacy state format uses dot-separated instance keys,
+        // rather than bracketed as in our modern syntax.
+        var suffix string
+        switch tk := tr.Key.(type) {
+        case addrs.IntKey:
+                suffix = fmt.Sprintf(".%d", int(tk))
+        case addrs.StringKey:
+                suffix = fmt.Sprintf(".%s", string(tk))
+        }
+        return tr.Resource.String() + suffix
+}
+
 // StateReferences returns the dependencies to put into the state for
 // this resource.
-func (n *NodeAbstractResource) StateReferences() []string {
-        self := n.ReferenceableName()
-
-        // Determine what our "prefix" is for checking for references to
-        // ourself.
-        addrCopy := n.Addr.Copy()
-        addrCopy.Index = -1
-        selfPrefix := addrCopy.String() + "."
+func (n *NodeAbstractResourceInstance) StateReferences() []addrs.Referenceable {
+        selfAddrs := n.ReferenceableAddrs()
+
+        // Since we don't include the source location references in our
+        // results from this method, we'll also filter out duplicates:
+        // there's no point in listing the same object twice without
+        // that additional context.
+        seen := map[string]struct{}{}
+
+        // Pretend that we've already "seen" all of our own addresses so that we
+        // won't record self-references in the state. This can arise if, for
+        // example, a provisioner for a resource refers to the resource itself,
+        // which is valid (since provisioners always run after apply) but should
+        // not create an explicit dependency edge.
+        for _, selfAddr := range selfAddrs {
+                seen[selfAddr.String()] = struct{}{}
+                if riAddr, ok := selfAddr.(addrs.ResourceInstance); ok {
+                        seen[riAddr.ContainingResource().String()] = struct{}{}
+                }
+        }
 
         depsRaw := n.References()
-        deps := make([]string, 0, len(depsRaw))
+        deps := make([]addrs.Referenceable, 0, len(depsRaw))
         for _, d := range depsRaw {
-                // Ignore any variable dependencies
-                if strings.HasPrefix(d, "var.") {
-                        continue
+                subj := d.Subject
+                if mco, isOutput := subj.(addrs.ModuleCallOutput); isOutput {
+                        // For state dependencies, we simplify outputs to just refer
+                        // to the module as a whole. It's not really clear why we do this,
+                        // but this logic is preserved from before the 0.12 rewrite of
+                        // this function.
+                        subj = mco.Call
                 }
 
-                // If this has a backup ref, ignore those for now. The old state
-                // file never contained those and I'd rather store the rich types we
-                // add in the future.
-                if idx := strings.IndexRune(d, '/'); idx != -1 {
-                        d = d[:idx]
-                }
-
-                // If we're referencing ourself, then ignore it
-                found := false
-                for _, s := range self {
-                        if d == s {
-                                found = true
-                        }
-                }
-                if found {
+                k := subj.String()
+                if _, exists := seen[k]; exists {
                         continue
                 }
-
-                // If this is a reference to ourself and a specific index, we keep
-                // it. For example, if this resource is "foo.bar" and the reference
-                // is "foo.bar.0" then we keep it exact. Otherwise, we strip it.
-                if strings.HasSuffix(d, ".0") && !strings.HasPrefix(d, selfPrefix) {
-                        d = d[:len(d)-2]
-                }
-
-                // This is sad. The dependencies are currently in the format of
-                // "module.foo.bar" (the full field). This strips the field off.
-                if strings.HasPrefix(d, "module.") {
-                        parts := strings.SplitN(d, ".", 3)
-                        d = strings.Join(parts[0:2], ".")
+                seen[k] = struct{}{}
+                switch tr := subj.(type) {
+                case addrs.ResourceInstance:
+                        deps = append(deps, tr)
+                case addrs.Resource:
+                        deps = append(deps, tr)
+                case addrs.ModuleCallInstance:
+                        deps = append(deps, tr)
+                default:
+                        // No other reference types are recorded in the state.
                 }
-
-                deps = append(deps, d)
         }
 
+        // We'll also sort them, since that'll avoid creating changes in the
+        // serialized state that make no semantic difference.
+        sort.Slice(deps, func(i, j int) bool {
+                // Simple string-based sort because we just care about consistency,
+                // not user-friendliness.
+                return deps[i].String() < deps[j].String()
+        })
+
         return deps
 }
 
-func (n *NodeAbstractResource) SetProvider(p string) {
+func (n *NodeAbstractResource) SetProvider(p addrs.AbsProviderConfig) {
         n.ResolvedProvider = p
 }
 
 // GraphNodeProviderConsumer
-func (n *NodeAbstractResource) ProvidedBy() string {
+func (n *NodeAbstractResource) ProvidedBy() (addrs.AbsProviderConfig, bool) {
         // If we have a config we prefer that above all else
         if n.Config != nil {
-                return resourceProvider(n.Config.Type, n.Config.Provider)
+                relAddr := n.Config.ProviderConfigAddr()
+                return relAddr.Absolute(n.Path()), false
+        }
+
+        // Use our type and containing module path to guess a provider configuration address
+        return n.Addr.Resource.DefaultProviderConfig().Absolute(n.Addr.Module), false
+}
+
+// GraphNodeProviderConsumer
+func (n *NodeAbstractResourceInstance) ProvidedBy() (addrs.AbsProviderConfig, bool) {
+        // If we have a config we prefer that above all else
+        if n.Config != nil {
+                relAddr := n.Config.ProviderConfigAddr()
+                return relAddr.Absolute(n.Path()), false
         }
 
         // If we have state, then we will use the provider from there
-        if n.ResourceState != nil && n.ResourceState.Provider != "" {
-                return n.ResourceState.Provider
+        if n.ResourceState != nil {
+                // An address from the state must match exactly, since we must ensure
+                // we refresh/destroy a resource with the same provider configuration
+                // that created it.
+                return n.ResourceState.ProviderConfig, true
         }
 
-        // Use our type
-        return resourceProvider(n.Addr.Type, "")
+        // Use our type and containing module path to guess a provider configuration address
+        return n.Addr.Resource.DefaultProviderConfig().Absolute(n.Path()), false
 }
 
 // GraphNodeProvisionerConsumer
 func (n *NodeAbstractResource) ProvisionedBy() []string {
         // If we have no configuration, then we have no provisioners
-        if n.Config == nil {
+        if n.Config == nil || n.Config.Managed == nil {
                 return nil
         }
 
         // Build the list of provisioners we need based on the configuration.
         // It is okay to have duplicates here.
-        result := make([]string, len(n.Config.Provisioners))
-        for i, p := range n.Config.Provisioners {
+        result := make([]string, len(n.Config.Managed.Provisioners))
+        for i, p := range n.Config.Managed.Provisioners {
                 result[i] = p.Type
         }
 
         return result
 }
 
-// GraphNodeResource, GraphNodeAttachResourceState
-func (n *NodeAbstractResource) ResourceAddr() *ResourceAddress {
+// GraphNodeProvisionerConsumer
+func (n *NodeAbstractResource) AttachProvisionerSchema(name string, schema *configschema.Block) {
+        if n.ProvisionerSchemas == nil {
+                n.ProvisionerSchemas = make(map[string]*configschema.Block)
+        }
+        n.ProvisionerSchemas[name] = schema
+}
+
+// GraphNodeResource
+func (n *NodeAbstractResource) ResourceAddr() addrs.AbsResource {
         return n.Addr
 }
 
+// GraphNodeResourceInstance
+func (n *NodeAbstractResourceInstance) ResourceInstanceAddr() addrs.AbsResourceInstance {
+        return n.NodeAbstractResource.Addr.Instance(n.InstanceKey)
+}
+
 // GraphNodeAddressable, TODO: remove, used by target, should unify
 func (n *NodeAbstractResource) ResourceAddress() *ResourceAddress {
-        return n.ResourceAddr()
+        return NewLegacyResourceAddress(n.Addr)
 }
 
 // GraphNodeTargetable
-func (n *NodeAbstractResource) SetTargets(targets []ResourceAddress) {
+func (n *NodeAbstractResource) SetTargets(targets []addrs.Targetable) {
         n.Targets = targets
 }
 
 // GraphNodeAttachResourceState
-func (n *NodeAbstractResource) AttachResourceState(s *ResourceState) {
+func (n *NodeAbstractResourceInstance) AttachResourceState(s *states.Resource) {
         n.ResourceState = s
 }
 
 // GraphNodeAttachResourceConfig
-func (n *NodeAbstractResource) AttachResourceConfig(c *config.Resource) {
+func (n *NodeAbstractResource) AttachResourceConfig(c *configs.Resource) {
         n.Config = c
 }
 
+// GraphNodeAttachResourceSchema impl
+func (n *NodeAbstractResource) AttachResourceSchema(schema *configschema.Block, version uint64) {
+        n.Schema = schema
+        n.SchemaVersion = version
+}
+
 // GraphNodeDotter impl.
 func (n *NodeAbstractResource) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
         return &dag.DotNode{
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract_count.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract_count.go
deleted file mode 100644
index 573570d..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract_count.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package terraform
-
-// NodeAbstractCountResource should be embedded instead of NodeAbstractResource
-// if the resource has a `count` value that needs to be expanded.
-//
-// The embedder should implement `DynamicExpand` to process the count.
-type NodeAbstractCountResource struct {
-        *NodeAbstractResource
-
-        // Validate, if true, will perform the validation for the count.
-        // This should only be turned on for the "validate" operation.
-        Validate bool
-}
-
-// GraphNodeEvalable
-func (n *NodeAbstractCountResource) EvalTree() EvalNode {
-        // We only check if the count is computed if we're not validating.
-        // If we're validating we allow computed counts since they just turn
-        // into more computed values.
-        var evalCountCheckComputed EvalNode
-        if !n.Validate {
-                evalCountCheckComputed = &EvalCountCheckComputed{Resource: n.Config}
-        }
-
-        return &EvalSequence{
-                Nodes: []EvalNode{
-                        // The EvalTree for a plannable resource primarily involves
-                        // interpolating the count since it can contain variables
-                        // we only just received access to.
-                        //
-                        // With the interpolated count, we can then DynamicExpand
-                        // into the proper number of instances.
-                        &EvalInterpolate{Config: n.Config.RawCount},
-
-                        // Check if the count is computed
-                        evalCountCheckComputed,
-
-                        // If validation is enabled, perform the validation
-                        &EvalIf{
-                                If: func(ctx EvalContext) (bool, error) {
-                                        return n.Validate, nil
-                                },
-
-                                Then: &EvalValidateCount{Resource: n.Config},
-                        },
-
-                        &EvalCountFixZeroOneBoundary{Resource: n.Config},
-                },
-        }
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply.go
index 40ee1cf..3e2fff3 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply.go
@@ -1,400 +1,71 @@
 package terraform
 
 import (
-        "fmt"
+        "log"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/lang"
 )
 
 // NodeApplyableResource represents a resource that is "applyable":
-// it is ready to be applied and is represented by a diff.
+// it may need to have its record in the state adjusted to match configuration.
+//
+// Unlike in the plan walk, this resource node does not DynamicExpand. Instead,
+// it should be inserted into the same graph as any instances of the nodes
+// with dependency edges ensuring that the resource is evaluated before any
+// of its instances, which will turn ensure that the whole-resource record
+// in the state is suitably prepared to receive any updates to instances.
 type NodeApplyableResource struct {
         *NodeAbstractResource
 }
 
-// GraphNodeCreator
-func (n *NodeApplyableResource) CreateAddr() *ResourceAddress {
-        return n.NodeAbstractResource.Addr
-}
-
-// GraphNodeReferencer, overriding NodeAbstractResource
-func (n *NodeApplyableResource) References() []string {
-        result := n.NodeAbstractResource.References()
-
-        // The "apply" side of a resource generally also depends on the
-        // destruction of its dependencies as well. For example, if a LB
-        // references a set of VMs with ${vm.foo.*.id}, then we must wait for
-        // the destruction so we get the newly updated list of VMs.
-        //
-        // The exception here is CBD. When CBD is set, we don't do this since
-        // it would create a cycle. By not creating a cycle, we require two
-        // applies since the first apply the creation step will use the OLD
-        // values (pre-destroy) and the second step will update.
-        //
-        // This is how Terraform behaved with "legacy" graphs (TF <= 0.7.x).
-        // We mimic that behavior here now and can improve upon it in the future.
-        //
-        // This behavior is tested in graph_build_apply_test.go to test ordering.
-        cbd := n.Config != nil && n.Config.Lifecycle.CreateBeforeDestroy
-        if !cbd {
-                // The "apply" side of a resource always depends on the destruction
-                // of all its dependencies in addition to the creation.
-                for _, v := range result {
-                        result = append(result, v+".destroy")
-                }
-        }
+var (
+        _ GraphNodeResource             = (*NodeApplyableResource)(nil)
+        _ GraphNodeEvalable             = (*NodeApplyableResource)(nil)
+        _ GraphNodeProviderConsumer     = (*NodeApplyableResource)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodeApplyableResource)(nil)
+        _ GraphNodeReferencer           = (*NodeApplyableResource)(nil)
+)
 
-        return result
+func (n *NodeApplyableResource) Name() string {
+        return n.NodeAbstractResource.Name() + " (prepare state)"
 }
 
-// GraphNodeEvalable
-func (n *NodeApplyableResource) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
-
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
-
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:   stateId,
-                Type: addr.Type,
+func (n *NodeApplyableResource) References() []*addrs.Reference {
+        if n.Config == nil {
+                log.Printf("[WARN] NodeApplyableResource %q: no configuration, so can't determine References", dag.VertexName(n))
+                return nil
         }
 
-        // Build the resource for eval
-        resource := &Resource{
-                Name:       addr.Name,
-                Type:       addr.Type,
-                CountIndex: addr.Index,
-        }
-        if resource.CountIndex < 0 {
-                resource.CountIndex = 0
-        }
+        var result []*addrs.Reference
 
-        // Determine the dependencies for the state.
-        stateDeps := n.StateReferences()
+        // Since this node type only updates resource-level metadata, we only
+        // need to worry about the parts of the configuration that affect
+        // our "each mode": the count and for_each meta-arguments.
+        refs, _ := lang.ReferencesInExpr(n.Config.Count)
+        result = append(result, refs...)
+        refs, _ = lang.ReferencesInExpr(n.Config.ForEach)
+        result = append(result, refs...)
 
-        // Eval info is different depending on what kind of resource this is
-        switch n.Config.Mode {
-        case config.ManagedResourceMode:
-                return n.evalTreeManagedResource(
-                        stateId, info, resource, stateDeps,
-                )
-        case config.DataResourceMode:
-                return n.evalTreeDataResource(
-                        stateId, info, resource, stateDeps)
-        default:
-                panic(fmt.Errorf("unsupported resource mode %s", n.Config.Mode))
-        }
+        return result
 }
 
-func (n *NodeApplyableResource) evalTreeDataResource(
-        stateId string, info *InstanceInfo,
-        resource *Resource, stateDeps []string) EvalNode {
-        var provider ResourceProvider
-        var config *ResourceConfig
-        var diff *InstanceDiff
-        var state *InstanceState
-
-        return &EvalSequence{
-                Nodes: []EvalNode{
-                        // Build the instance info
-                        &EvalInstanceInfo{
-                                Info: info,
-                        },
-
-                        // Get the saved diff for apply
-                        &EvalReadDiff{
-                                Name: stateId,
-                                Diff: &diff,
-                        },
-
-                        // Stop here if we don't actually have a diff
-                        &EvalIf{
-                                If: func(ctx EvalContext) (bool, error) {
-                                        if diff == nil {
-                                                return true, EvalEarlyExitError{}
-                                        }
-
-                                        if diff.GetAttributesLen() == 0 {
-                                                return true, EvalEarlyExitError{}
-                                        }
-
-                                        return true, nil
-                                },
-                                Then: EvalNoop{},
-                        },
-
-                        // Normally we interpolate count as a preparation step before
-                        // a DynamicExpand, but an apply graph has pre-expanded nodes
-                        // and so the count would otherwise never be interpolated.
-                        //
-                        // This is redundant when there are multiple instances created
-                        // from the same config (count > 1) but harmless since the
-                        // underlying structures have mutexes to make this concurrency-safe.
-                        //
-                        // In most cases this isn't actually needed because we dealt with
-                        // all of the counts during the plan walk, but we do it here
-                        // for completeness because other code assumes that the
-                        // final count is always available during interpolation.
-                        //
-                        // Here we are just populating the interpolated value in-place
-                        // inside this RawConfig object, like we would in
-                        // NodeAbstractCountResource.
-                        &EvalInterpolate{
-                                Config:        n.Config.RawCount,
-                                ContinueOnErr: true,
-                        },
-
-                        // We need to re-interpolate the config here, rather than
-                        // just using the diff's values directly, because we've
-                        // potentially learned more variable values during the
-                        // apply pass that weren't known when the diff was produced.
-                        &EvalInterpolate{
-                                Config:   n.Config.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &config,
-                        },
-
-                        &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
-                                Output: &provider,
-                        },
-
-                        // Make a new diff with our newly-interpolated config.
-                        &EvalReadDataDiff{
-                                Info:     info,
-                                Config:   &config,
-                                Previous: &diff,
-                                Provider: &provider,
-                                Output:   &diff,
-                        },
-
-                        &EvalReadDataApply{
-                                Info:     info,
-                                Diff:     &diff,
-                                Provider: &provider,
-                                Output:   &state,
-                        },
-
-                        &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: n.Config.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: stateDeps,
-                                State:        &state,
-                        },
-
-                        // Clear the diff now that we've applied it, so
-                        // later nodes won't see a diff that's now a no-op.
-                        &EvalWriteDiff{
-                                Name: stateId,
-                                Diff: nil,
-                        },
-
-                        &EvalUpdateStateHook{},
-                },
+// GraphNodeEvalable
+func (n *NodeApplyableResource) EvalTree() EvalNode {
+        addr := n.ResourceAddr()
+        config := n.Config
+        providerAddr := n.ResolvedProvider
+
+        if config == nil {
+                // Nothing to do, then.
+                log.Printf("[TRACE] NodeApplyableResource: no configuration present for %s", addr)
+                return &EvalNoop{}
         }
-}
-
-func (n *NodeApplyableResource) evalTreeManagedResource(
-        stateId string, info *InstanceInfo,
-        resource *Resource, stateDeps []string) EvalNode {
-        // Declare a bunch of variables that are used for state during
-        // evaluation. Most of this are written to by-address below.
-        var provider ResourceProvider
-        var diff, diffApply *InstanceDiff
-        var state *InstanceState
-        var resourceConfig *ResourceConfig
-        var err error
-        var createNew bool
-        var createBeforeDestroyEnabled bool
-
-        return &EvalSequence{
-                Nodes: []EvalNode{
-                        // Build the instance info
-                        &EvalInstanceInfo{
-                                Info: info,
-                        },
-
-                        // Get the saved diff for apply
-                        &EvalReadDiff{
-                                Name: stateId,
-                                Diff: &diffApply,
-                        },
-
-                        // We don't want to do any destroys
-                        &EvalIf{
-                                If: func(ctx EvalContext) (bool, error) {
-                                        if diffApply == nil {
-                                                return true, EvalEarlyExitError{}
-                                        }
-
-                                        if diffApply.GetDestroy() && diffApply.GetAttributesLen() == 0 {
-                                                return true, EvalEarlyExitError{}
-                                        }
-
-                                        diffApply.SetDestroy(false)
-                                        return true, nil
-                                },
-                                Then: EvalNoop{},
-                        },
-
-                        &EvalIf{
-                                If: func(ctx EvalContext) (bool, error) {
-                                        destroy := false
-                                        if diffApply != nil {
-                                                destroy = diffApply.GetDestroy() || diffApply.RequiresNew()
-                                        }
-
-                                        createBeforeDestroyEnabled =
-                                                n.Config.Lifecycle.CreateBeforeDestroy &&
-                                                        destroy
-
-                                        return createBeforeDestroyEnabled, nil
-                                },
-                                Then: &EvalDeposeState{
-                                        Name: stateId,
-                                },
-                        },
-
-                        // Normally we interpolate count as a preparation step before
-                        // a DynamicExpand, but an apply graph has pre-expanded nodes
-                        // and so the count would otherwise never be interpolated.
-                        //
-                        // This is redundant when there are multiple instances created
-                        // from the same config (count > 1) but harmless since the
-                        // underlying structures have mutexes to make this concurrency-safe.
-                        //
-                        // In most cases this isn't actually needed because we dealt with
-                        // all of the counts during the plan walk, but we need to do this
-                        // in order to support interpolation of resource counts from
-                        // apply-time-interpolated expressions, such as those in
-                        // "provisioner" blocks.
-                        //
-                        // Here we are just populating the interpolated value in-place
-                        // inside this RawConfig object, like we would in
-                        // NodeAbstractCountResource.
-                        &EvalInterpolate{
-                                Config:        n.Config.RawCount,
-                                ContinueOnErr: true,
-                        },
-
-                        &EvalInterpolate{
-                                Config:   n.Config.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &resourceConfig,
-                        },
-                        &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
-                                Output: &provider,
-                        },
-                        &EvalReadState{
-                                Name:   stateId,
-                                Output: &state,
-                        },
-                        // Re-run validation to catch any errors we missed, e.g. type
-                        // mismatches on computed values.
-                        &EvalValidateResource{
-                                Provider:       &provider,
-                                Config:         &resourceConfig,
-                                ResourceName:   n.Config.Name,
-                                ResourceType:   n.Config.Type,
-                                ResourceMode:   n.Config.Mode,
-                                IgnoreWarnings: true,
-                        },
-                        &EvalDiff{
-                                Info:       info,
-                                Config:     &resourceConfig,
-                                Resource:   n.Config,
-                                Provider:   &provider,
-                                Diff:       &diffApply,
-                                State:      &state,
-                                OutputDiff: &diffApply,
-                        },
-
-                        // Get the saved diff
-                        &EvalReadDiff{
-                                Name: stateId,
-                                Diff: &diff,
-                        },
-
-                        // Compare the diffs
-                        &EvalCompareDiff{
-                                Info: info,
-                                One:  &diff,
-                                Two:  &diffApply,
-                        },
-
-                        &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
-                                Output: &provider,
-                        },
-                        &EvalReadState{
-                                Name:   stateId,
-                                Output: &state,
-                        },
-                        // Call pre-apply hook
-                        &EvalApplyPre{
-                                Info:  info,
-                                State: &state,
-                                Diff:  &diffApply,
-                        },
-                        &EvalApply{
-                                Info:      info,
-                                State:     &state,
-                                Diff:      &diffApply,
-                                Provider:  &provider,
-                                Output:    &state,
-                                Error:     &err,
-                                CreateNew: &createNew,
-                        },
-                        &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: n.Config.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: stateDeps,
-                                State:        &state,
-                        },
-                        &EvalApplyProvisioners{
-                                Info:           info,
-                                State:          &state,
-                                Resource:       n.Config,
-                                InterpResource: resource,
-                                CreateNew:      &createNew,
-                                Error:          &err,
-                                When:           config.ProvisionerWhenCreate,
-                        },
-                        &EvalIf{
-                                If: func(ctx EvalContext) (bool, error) {
-                                        return createBeforeDestroyEnabled && err != nil, nil
-                                },
-                                Then: &EvalUndeposeState{
-                                        Name:  stateId,
-                                        State: &state,
-                                },
-                                Else: &EvalWriteState{
-                                        Name:         stateId,
-                                        ResourceType: n.Config.Type,
-                                        Provider:     n.ResolvedProvider,
-                                        Dependencies: stateDeps,
-                                        State:        &state,
-                                },
-                        },
-
-                        // We clear the diff out here so that future nodes
-                        // don't see a diff that is already complete. There
-                        // is no longer a diff!
-                        &EvalWriteDiff{
-                                Name: stateId,
-                                Diff: nil,
-                        },
 
-                        &EvalApplyPost{
-                                Info:  info,
-                                State: &state,
-                                Error: &err,
-                        },
-                        &EvalUpdateStateHook{},
-                },
+        return &EvalWriteResourceState{
+                Addr:         addr.Resource,
+                Config:       config,
+                ProviderAddr: providerAddr,
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply_instance.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply_instance.go
new file mode 100644
index 0000000..dad7bfc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply_instance.go
@@ -0,0 +1,433 @@
+package terraform
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// NodeApplyableResourceInstance represents a resource instance that is
+// "applyable": it is ready to be applied and is represented by a diff.
+//
+// This node is for a specific instance of a resource. It will usually be
+// accompanied in the graph by a NodeApplyableResource representing its
+// containing resource, and should depend on that node to ensure that the
+// state is properly prepared to receive changes to instances.
+type NodeApplyableResourceInstance struct {
+        *NodeAbstractResourceInstance
+
+        destroyNode      GraphNodeDestroyerCBD
+        graphNodeDeposer // implementation of GraphNodeDeposer
+}
+
+var (
+        _ GraphNodeResource         = (*NodeApplyableResourceInstance)(nil)
+        _ GraphNodeResourceInstance = (*NodeApplyableResourceInstance)(nil)
+        _ GraphNodeCreator          = (*NodeApplyableResourceInstance)(nil)
+        _ GraphNodeReferencer       = (*NodeApplyableResourceInstance)(nil)
+        _ GraphNodeDeposer          = (*NodeApplyableResourceInstance)(nil)
+        _ GraphNodeEvalable         = (*NodeApplyableResourceInstance)(nil)
+)
+
+// GraphNodeAttachDestroyer
+func (n *NodeApplyableResourceInstance) AttachDestroyNode(d GraphNodeDestroyerCBD) {
+        n.destroyNode = d
+}
+
+// createBeforeDestroy checks this nodes config status and the status af any
+// companion destroy node for CreateBeforeDestroy.
+func (n *NodeApplyableResourceInstance) createBeforeDestroy() bool {
+        cbd := false
+
+        if n.Config != nil && n.Config.Managed != nil {
+                cbd = n.Config.Managed.CreateBeforeDestroy
+        }
+
+        if n.destroyNode != nil {
+                cbd = cbd || n.destroyNode.CreateBeforeDestroy()
+        }
+
+        return cbd
+}
+
+// GraphNodeCreator
+func (n *NodeApplyableResourceInstance) CreateAddr() *addrs.AbsResourceInstance {
+        addr := n.ResourceInstanceAddr()
+        return &addr
+}
+
+// GraphNodeReferencer, overriding NodeAbstractResourceInstance
+func (n *NodeApplyableResourceInstance) References() []*addrs.Reference {
+        // Start with the usual resource instance implementation
+        ret := n.NodeAbstractResourceInstance.References()
+
+        // Applying a resource must also depend on the destruction of any of its
+        // dependencies, since this may for example affect the outcome of
+        // evaluating an entire list of resources with "count" set (by reducing
+        // the count).
+        //
+        // However, we can't do this in create_before_destroy mode because that
+        // would create a dependency cycle. We make a compromise here of requiring
+        // changes to be updated across two applies in this case, since the first
+        // plan will use the old values.
+        if !n.createBeforeDestroy() {
+                for _, ref := range ret {
+                        switch tr := ref.Subject.(type) {
+                        case addrs.ResourceInstance:
+                                newRef := *ref // shallow copy so we can mutate
+                                newRef.Subject = tr.Phase(addrs.ResourceInstancePhaseDestroy)
+                                newRef.Remaining = nil // can't access attributes of something being destroyed
+                                ret = append(ret, &newRef)
+                        case addrs.Resource:
+                                newRef := *ref // shallow copy so we can mutate
+                                newRef.Subject = tr.Phase(addrs.ResourceInstancePhaseDestroy)
+                                newRef.Remaining = nil // can't access attributes of something being destroyed
+                                ret = append(ret, &newRef)
+                        }
+                }
+        }
+
+        return ret
+}
+
+// GraphNodeEvalable
+func (n *NodeApplyableResourceInstance) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
+
+        // State still uses legacy-style internal ids, so we need to shim to get
+        // a suitable key to use.
+        stateId := NewLegacyResourceInstanceAddress(addr).stateId()
+
+        // Determine the dependencies for the state.
+        stateDeps := n.StateReferences()
+
+        if n.Config == nil {
+                // This should not be possible, but we've got here in at least one
+                // case as discussed in the following issue:
+                //    https://github.com/hashicorp/terraform/issues/21258
+                // To avoid an outright crash here, we'll instead return an explicit
+                // error.
+                var diags tfdiags.Diagnostics
+                diags = diags.Append(tfdiags.Sourceless(
+                        tfdiags.Error,
+                        "Resource node has no configuration attached",
+                        fmt.Sprintf(
+                                "The graph node for %s has no configuration attached to it. This suggests a bug in Terraform's apply graph builder; please report it!",
+                                addr,
+                        ),
+                ))
+                err := diags.Err()
+                return &EvalReturnError{
+                        Error: &err,
+                }
+        }
+
+        // Eval info is different depending on what kind of resource this is
+        switch n.Config.Mode {
+        case addrs.ManagedResourceMode:
+                return n.evalTreeManagedResource(addr, stateId, stateDeps)
+        case addrs.DataResourceMode:
+                return n.evalTreeDataResource(addr, stateId, stateDeps)
+        default:
+                panic(fmt.Errorf("unsupported resource mode %s", n.Config.Mode))
+        }
+}
+
+func (n *NodeApplyableResourceInstance) evalTreeDataResource(addr addrs.AbsResourceInstance, stateId string, stateDeps []addrs.Referenceable) EvalNode {
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
+
+        return &EvalSequence{
+                Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
+
+                        // Get the saved diff for apply
+                        &EvalReadDiff{
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &change,
+                        },
+
+                        // Stop early if we don't actually have a diff
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        if change == nil {
+                                                return true, EvalEarlyExitError{}
+                                        }
+                                        return true, nil
+                                },
+                                Then: EvalNoop{},
+                        },
+
+                        // In this particular call to EvalReadData we include our planned
+                        // change, which signals that we expect this read to complete fully
+                        // with no unknown values; it'll produce an error if not.
+                        &EvalReadData{
+                                Addr:           addr.Resource,
+                                Config:         n.Config,
+                                Dependencies:   n.StateReferences(),
+                                Planned:        &change, // setting this indicates that the result must be complete
+                                Provider:       &provider,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                OutputState:    &state,
+                        },
+
+                        &EvalWriteState{
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                        },
+
+                        // Clear the diff now that we've applied it, so
+                        // later nodes won't see a diff that's now a no-op.
+                        &EvalWriteDiff{
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         nil,
+                        },
+
+                        &EvalUpdateStateHook{},
+                },
+        }
+}
+
+func (n *NodeApplyableResourceInstance) evalTreeManagedResource(addr addrs.AbsResourceInstance, stateId string, stateDeps []addrs.Referenceable) EvalNode {
+        // Declare a bunch of variables that are used for state during
+        // evaluation. Most of this are written to by-address below.
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var diff, diffApply *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
+        var err error
+        var createNew bool
+        var createBeforeDestroyEnabled bool
+        var configVal cty.Value
+        var deposedKey states.DeposedKey
+
+        return &EvalSequence{
+                Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
+
+                        // Get the saved diff for apply
+                        &EvalReadDiff{
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &diffApply,
+                        },
+
+                        // We don't want to do any destroys
+                        // (these are handled by NodeDestroyResourceInstance instead)
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        if diffApply == nil {
+                                                return true, EvalEarlyExitError{}
+                                        }
+                                        if diffApply.Action == plans.Delete {
+                                                return true, EvalEarlyExitError{}
+                                        }
+                                        return true, nil
+                                },
+                                Then: EvalNoop{},
+                        },
+
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        destroy := false
+                                        if diffApply != nil {
+                                                destroy = (diffApply.Action == plans.Delete || diffApply.Action.IsReplace())
+                                        }
+                                        if destroy && n.createBeforeDestroy() {
+                                                createBeforeDestroyEnabled = true
+                                        }
+                                        return createBeforeDestroyEnabled, nil
+                                },
+                                Then: &EvalDeposeState{
+                                        Addr:      addr.Resource,
+                                        ForceKey:  n.PreallocatedDeposedKey,
+                                        OutputKey: &deposedKey,
+                                },
+                        },
+
+                        &EvalReadState{
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
+                                Output: &state,
+                        },
+
+                        // Get the saved diff
+                        &EvalReadDiff{
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &diff,
+                        },
+
+                        // Make a new diff, in case we've learned new values in the state
+                        // during apply which we can now incorporate.
+                        &EvalDiff{
+                                Addr:           addr.Resource,
+                                Config:         n.Config,
+                                Provider:       &provider,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                                PreviousDiff:   &diff,
+                                OutputChange:   &diffApply,
+                                OutputValue:    &configVal,
+                                OutputState:    &state,
+                        },
+
+                        // Compare the diffs
+                        &EvalCheckPlannedChange{
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                Planned:        &diff,
+                                Actual:         &diffApply,
+                        },
+
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
+                        &EvalReadState{
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
+                                Output: &state,
+                        },
+
+                        &EvalReduceDiff{
+                                Addr:      addr.Resource,
+                                InChange:  &diffApply,
+                                Destroy:   false,
+                                OutChange: &diffApply,
+                        },
+
+                        // EvalReduceDiff may have simplified our planned change
+                        // into a NoOp if it only requires destroying, since destroying
+                        // is handled by NodeDestroyResourceInstance.
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        if diffApply == nil || diffApply.Action == plans.NoOp {
+                                                return true, EvalEarlyExitError{}
+                                        }
+                                        return true, nil
+                                },
+                                Then: EvalNoop{},
+                        },
+
+                        // Call pre-apply hook
+                        &EvalApplyPre{
+                                Addr:   addr.Resource,
+                                State:  &state,
+                                Change: &diffApply,
+                        },
+                        &EvalApply{
+                                Addr:           addr.Resource,
+                                Config:         n.Config,
+                                Dependencies:   n.StateReferences(),
+                                State:          &state,
+                                Change:         &diffApply,
+                                Provider:       &provider,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                Output:         &state,
+                                Error:          &err,
+                                CreateNew:      &createNew,
+                        },
+                        &EvalMaybeTainted{
+                                Addr:        addr.Resource,
+                                State:       &state,
+                                Change:      &diffApply,
+                                Error:       &err,
+                                StateOutput: &state,
+                        },
+                        &EvalWriteState{
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                        },
+                        &EvalApplyProvisioners{
+                                Addr:           addr.Resource,
+                                State:          &state, // EvalApplyProvisioners will skip if already tainted
+                                ResourceConfig: n.Config,
+                                CreateNew:      &createNew,
+                                Error:          &err,
+                                When:           configs.ProvisionerWhenCreate,
+                        },
+                        &EvalMaybeTainted{
+                                Addr:        addr.Resource,
+                                State:       &state,
+                                Change:      &diffApply,
+                                Error:       &err,
+                                StateOutput: &state,
+                        },
+                        &EvalWriteState{
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                        },
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        return createBeforeDestroyEnabled && err != nil, nil
+                                },
+                                Then: &EvalMaybeRestoreDeposedObject{
+                                        Addr: addr.Resource,
+                                        Key:  &deposedKey,
+                                },
+                        },
+
+                        // We clear the diff out here so that future nodes
+                        // don't see a diff that is already complete. There
+                        // is no longer a diff!
+                        &EvalIf{
+                                If: func(ctx EvalContext) (bool, error) {
+                                        if !diff.Action.IsReplace() {
+                                                return true, nil
+                                        }
+                                        if !n.createBeforeDestroy() {
+                                                return true, nil
+                                        }
+                                        return false, nil
+                                },
+                                Then: &EvalWriteDiff{
+                                        Addr:           addr.Resource,
+                                        ProviderSchema: &providerSchema,
+                                        Change:         nil,
+                                },
+                        },
+
+                        &EvalApplyPost{
+                                Addr:  addr.Resource,
+                                State: &state,
+                                Error: &err,
+                        },
+                        &EvalUpdateStateHook{},
+                },
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy.go
index 657bbee..ca2267e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy.go
@@ -2,81 +2,114 @@ package terraform
 
 import (
         "fmt"
+        "log"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/states"
 )
 
-// NodeDestroyResource represents a resource that is to be destroyed.
-type NodeDestroyResource struct {
-        *NodeAbstractResource
+// NodeDestroyResourceInstance represents a resource instance that is to be
+// destroyed.
+type NodeDestroyResourceInstance struct {
+        *NodeAbstractResourceInstance
+
+        // If DeposedKey is set to anything other than states.NotDeposed then
+        // this node destroys a deposed object of the associated instance
+        // rather than its current object.
+        DeposedKey states.DeposedKey
+
+        CreateBeforeDestroyOverride *bool
 }
 
-func (n *NodeDestroyResource) Name() string {
-        return n.NodeAbstractResource.Name() + " (destroy)"
+var (
+        _ GraphNodeResource            = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeResourceInstance    = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeDestroyer           = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeDestroyerCBD        = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeReferenceable       = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeReferencer          = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeEvalable            = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeProviderConsumer    = (*NodeDestroyResourceInstance)(nil)
+        _ GraphNodeProvisionerConsumer = (*NodeDestroyResourceInstance)(nil)
+)
+
+func (n *NodeDestroyResourceInstance) Name() string {
+        if n.DeposedKey != states.NotDeposed {
+                return fmt.Sprintf("%s (destroy deposed %s)", n.ResourceInstanceAddr(), n.DeposedKey)
+        }
+        return n.ResourceInstanceAddr().String() + " (destroy)"
 }
 
 // GraphNodeDestroyer
-func (n *NodeDestroyResource) DestroyAddr() *ResourceAddress {
-        return n.Addr
+func (n *NodeDestroyResourceInstance) DestroyAddr() *addrs.AbsResourceInstance {
+        addr := n.ResourceInstanceAddr()
+        return &addr
 }
 
 // GraphNodeDestroyerCBD
-func (n *NodeDestroyResource) CreateBeforeDestroy() bool {
+func (n *NodeDestroyResourceInstance) CreateBeforeDestroy() bool {
+        if n.CreateBeforeDestroyOverride != nil {
+                return *n.CreateBeforeDestroyOverride
+        }
+
         // If we have no config, we just assume no
-        if n.Config == nil {
+        if n.Config == nil || n.Config.Managed == nil {
                 return false
         }
 
-        return n.Config.Lifecycle.CreateBeforeDestroy
+        return n.Config.Managed.CreateBeforeDestroy
 }
 
 // GraphNodeDestroyerCBD
-func (n *NodeDestroyResource) ModifyCreateBeforeDestroy(v bool) error {
-        // If we have no config, do nothing since it won't affect the
-        // create step anyways.
-        if n.Config == nil {
-                return nil
-        }
-
-        // Set CBD to true
-        n.Config.Lifecycle.CreateBeforeDestroy = true
-
+func (n *NodeDestroyResourceInstance) ModifyCreateBeforeDestroy(v bool) error {
+        n.CreateBeforeDestroyOverride = &v
         return nil
 }
 
 // GraphNodeReferenceable, overriding NodeAbstractResource
-func (n *NodeDestroyResource) ReferenceableName() []string {
-        // We modify our referenceable name to have the suffix of ".destroy"
-        // since depending on the creation side doesn't necessarilly mean
-        // depending on destruction.
-        suffix := ".destroy"
-
-        // If we're CBD, we also append "-cbd". This is because CBD will setup
-        // its own edges (in CBDEdgeTransformer). Depending on the "destroy"
-        // side generally doesn't mean depending on CBD as well. See GH-11349
+func (n *NodeDestroyResourceInstance) ReferenceableAddrs() []addrs.Referenceable {
+        normalAddrs := n.NodeAbstractResourceInstance.ReferenceableAddrs()
+        destroyAddrs := make([]addrs.Referenceable, len(normalAddrs))
+
+        phaseType := addrs.ResourceInstancePhaseDestroy
         if n.CreateBeforeDestroy() {
-                suffix += "-cbd"
+                phaseType = addrs.ResourceInstancePhaseDestroyCBD
         }
 
-        result := n.NodeAbstractResource.ReferenceableName()
-        for i, v := range result {
-                result[i] = v + suffix
+        for i, normalAddr := range normalAddrs {
+                switch ta := normalAddr.(type) {
+                case addrs.Resource:
+                        destroyAddrs[i] = ta.Phase(phaseType)
+                case addrs.ResourceInstance:
+                        destroyAddrs[i] = ta.Phase(phaseType)
+                default:
+                        destroyAddrs[i] = normalAddr
+                }
         }
 
-        return result
+        return destroyAddrs
 }
 
 // GraphNodeReferencer, overriding NodeAbstractResource
-func (n *NodeDestroyResource) References() []string {
+func (n *NodeDestroyResourceInstance) References() []*addrs.Reference {
         // If we have a config, then we need to include destroy-time dependencies
-        if c := n.Config; c != nil {
-                var result []string
-                for _, p := range c.Provisioners {
-                        // We include conn info and config for destroy time provisioners
-                        // as dependencies that we have.
-                        if p.When == config.ProvisionerWhenDestroy {
-                                result = append(result, ReferencesFromConfig(p.ConnInfo)...)
-                                result = append(result, ReferencesFromConfig(p.RawConfig)...)
+        if c := n.Config; c != nil && c.Managed != nil {
+                var result []*addrs.Reference
+
+                // We include conn info and config for destroy time provisioners
+                // as dependencies that we have.
+                for _, p := range c.Managed.Provisioners {
+                        schema := n.ProvisionerSchemas[p.Type]
+
+                        if p.When == configs.ProvisionerWhenDestroy {
+                                if p.Connection != nil {
+                                        result = append(result, ReferencesFromConfig(p.Connection.Config, connectionBlockSupersetSchema)...)
+                                }
+                                result = append(result, ReferencesFromConfig(p.Config, schema)...)
                         }
                 }
 
@@ -86,117 +119,66 @@ func (n *NodeDestroyResource) References() []string {
         return nil
 }
 
-// GraphNodeDynamicExpandable
-func (n *NodeDestroyResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
-        // If we have no config we do nothing
-        if n.Addr == nil {
-                return nil, nil
-        }
-
-        state, lock := ctx.State()
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Start creating the steps
-        steps := make([]GraphTransformer, 0, 5)
-
-        // We want deposed resources in the state to be destroyed
-        steps = append(steps, &DeposedTransformer{
-                State:            state,
-                View:             n.Addr.stateId(),
-                ResolvedProvider: n.ResolvedProvider,
-        })
-
-        // Target
-        steps = append(steps, &TargetsTransformer{
-                ParsedTargets: n.Targets,
-        })
-
-        // Always end with the root being added
-        steps = append(steps, &RootTransformer{})
-
-        // Build the graph
-        b := &BasicGraphBuilder{
-                Steps: steps,
-                Name:  "NodeResourceDestroy",
-        }
-        return b.Build(ctx.Path())
-}
-
 // GraphNodeEvalable
-func (n *NodeDestroyResource) EvalTree() EvalNode {
-        // stateId is the ID to put into the state
-        stateId := n.Addr.stateId()
-
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:          stateId,
-                Type:        n.Addr.Type,
-                uniqueExtra: "destroy",
-        }
-
-        // Build the resource for eval
-        addr := n.Addr
-        resource := &Resource{
-                Name:       addr.Name,
-                Type:       addr.Type,
-                CountIndex: addr.Index,
-        }
-        if resource.CountIndex < 0 {
-                resource.CountIndex = 0
-        }
+func (n *NodeDestroyResourceInstance) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
 
         // Get our state
         rs := n.ResourceState
-        if rs == nil {
-                rs = &ResourceState{
-                        Provider: n.ResolvedProvider,
-                }
+        var is *states.ResourceInstance
+        if rs != nil {
+                is = rs.Instance(n.InstanceKey)
+        }
+        if is == nil {
+                log.Printf("[WARN] NodeDestroyResourceInstance for %s with no state", addr)
         }
 
-        var diffApply *InstanceDiff
-        var provider ResourceProvider
-        var state *InstanceState
+        var changeApply *plans.ResourceInstanceChange
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var state *states.ResourceInstanceObject
         var err error
         return &EvalOpFilter{
                 Ops: []walkOperation{walkApply, walkDestroy},
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
+                                &EvalGetProvider{
+                                        Addr:   n.ResolvedProvider,
+                                        Output: &provider,
+                                        Schema: &providerSchema,
+                                },
+
                                 // Get the saved diff for apply
                                 &EvalReadDiff{
-                                        Name: stateId,
-                                        Diff: &diffApply,
+                                        Addr:           addr.Resource,
+                                        ProviderSchema: &providerSchema,
+                                        Change:         &changeApply,
                                 },
 
-                                // Filter the diff so we only get the destroy
-                                &EvalFilterDiff{
-                                        Diff:    &diffApply,
-                                        Output:  &diffApply,
-                                        Destroy: true,
+                                &EvalReduceDiff{
+                                        Addr:      addr.Resource,
+                                        InChange:  &changeApply,
+                                        Destroy:   true,
+                                        OutChange: &changeApply,
                                 },
 
-                                // If we're not destroying, then compare diffs
+                                // EvalReduceDiff may have simplified our planned change
+                                // into a NoOp if it does not require destroying.
                                 &EvalIf{
                                         If: func(ctx EvalContext) (bool, error) {
-                                                if diffApply != nil && diffApply.GetDestroy() {
-                                                        return true, nil
+                                                if changeApply == nil || changeApply.Action == plans.NoOp {
+                                                        return true, EvalEarlyExitError{}
                                                 }
-
-                                                return true, EvalEarlyExitError{}
+                                                return true, nil
                                         },
                                         Then: EvalNoop{},
                                 },
 
-                                // Load the instance info so we have the module path set
-                                &EvalInstanceInfo{Info: info},
-
-                                &EvalGetProvider{
-                                        Name:   n.ResolvedProvider,
-                                        Output: &provider,
-                                },
                                 &EvalReadState{
-                                        Name:   stateId,
-                                        Output: &state,
+                                        Addr:           addr.Resource,
+                                        Output:         &state,
+                                        Provider:       &provider,
+                                        ProviderSchema: &providerSchema,
                                 },
                                 &EvalRequireState{
                                         State: &state,
@@ -204,15 +186,15 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
 
                                 // Call pre-apply hook
                                 &EvalApplyPre{
-                                        Info:  info,
-                                        State: &state,
-                                        Diff:  &diffApply,
+                                        Addr:   addr.Resource,
+                                        State:  &state,
+                                        Change: &changeApply,
                                 },
 
                                 // Run destroy provisioners if not tainted
                                 &EvalIf{
                                         If: func(ctx EvalContext) (bool, error) {
-                                                if state != nil && state.Tainted {
+                                                if state != nil && state.Status == states.ObjectTainted {
                                                         return false, nil
                                                 }
 
@@ -220,12 +202,11 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
                                         },
 
                                         Then: &EvalApplyProvisioners{
-                                                Info:           info,
+                                                Addr:           addr.Resource,
                                                 State:          &state,
-                                                Resource:       n.Config,
-                                                InterpResource: resource,
+                                                ResourceConfig: n.Config,
                                                 Error:          &err,
-                                                When:           config.ProvisionerWhenDestroy,
+                                                When:           configs.ProvisionerWhenDestroy,
                                         },
                                 },
 
@@ -237,7 +218,7 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
                                         },
 
                                         Then: &EvalApplyPost{
-                                                Info:  info,
+                                                Addr:  addr.Resource,
                                                 State: &state,
                                                 Error: &err,
                                         },
@@ -246,41 +227,38 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
                                 // Make sure we handle data sources properly.
                                 &EvalIf{
                                         If: func(ctx EvalContext) (bool, error) {
-                                                if n.Addr == nil {
-                                                        return false, fmt.Errorf("nil address")
-                                                }
-
-                                                if n.Addr.Mode == config.DataResourceMode {
-                                                        return true, nil
-                                                }
-
-                                                return false, nil
+                                                return addr.Resource.Resource.Mode == addrs.DataResourceMode, nil
                                         },
 
                                         Then: &EvalReadDataApply{
-                                                Info:     info,
-                                                Diff:     &diffApply,
-                                                Provider: &provider,
-                                                Output:   &state,
+                                                Addr:           addr.Resource,
+                                                Config:         n.Config,
+                                                Change:         &changeApply,
+                                                Provider:       &provider,
+                                                ProviderAddr:   n.ResolvedProvider,
+                                                ProviderSchema: &providerSchema,
+                                                Output:         &state,
                                         },
                                         Else: &EvalApply{
-                                                Info:     info,
-                                                State:    &state,
-                                                Diff:     &diffApply,
-                                                Provider: &provider,
-                                                Output:   &state,
-                                                Error:    &err,
+                                                Addr:           addr.Resource,
+                                                Config:         nil, // No configuration because we are destroying
+                                                State:          &state,
+                                                Change:         &changeApply,
+                                                Provider:       &provider,
+                                                ProviderAddr:   n.ResolvedProvider,
+                                                ProviderSchema: &providerSchema,
+                                                Output:         &state,
+                                                Error:          &err,
                                         },
                                 },
                                 &EvalWriteState{
-                                        Name:         stateId,
-                                        ResourceType: n.Addr.Type,
-                                        Provider:     n.ResolvedProvider,
-                                        Dependencies: rs.Dependencies,
-                                        State:        &state,
+                                        Addr:           addr.Resource,
+                                        ProviderAddr:   n.ResolvedProvider,
+                                        ProviderSchema: &providerSchema,
+                                        State:          &state,
                                 },
                                 &EvalApplyPost{
-                                        Info:  info,
+                                        Addr:  addr.Resource,
                                         State: &state,
                                         Error: &err,
                                 },
@@ -289,3 +267,55 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
                 },
         }
 }
+
+// NodeDestroyResourceInstance represents a resource that is to be destroyed.
+//
+// Destroying a resource is a state-only operation: it is the individual
+// instances being destroyed that affects remote objects. During graph
+// construction, NodeDestroyResource should always depend on any other node
+// related to the given resource, since it's just a final cleanup to avoid
+// leaving skeleton resource objects in state after their instances have
+// all been destroyed.
+type NodeDestroyResource struct {
+        *NodeAbstractResource
+}
+
+var (
+        _ GraphNodeResource      = (*NodeDestroyResource)(nil)
+        _ GraphNodeReferenceable = (*NodeDestroyResource)(nil)
+        _ GraphNodeReferencer    = (*NodeDestroyResource)(nil)
+        _ GraphNodeEvalable      = (*NodeDestroyResource)(nil)
+)
+
+func (n *NodeDestroyResource) Name() string {
+        return n.ResourceAddr().String() + " (clean up state)"
+}
+
+// GraphNodeReferenceable, overriding NodeAbstractResource
+func (n *NodeDestroyResource) ReferenceableAddrs() []addrs.Referenceable {
+        // NodeDestroyResource doesn't participate in references: the graph
+        // builder that created it should ensure directly that it already depends
+        // on every other node related to its resource, without relying on
+        // references.
+        return nil
+}
+
+// GraphNodeReferencer, overriding NodeAbstractResource
+func (n *NodeDestroyResource) References() []*addrs.Reference {
+        // NodeDestroyResource doesn't participate in references: the graph
+        // builder that created it should ensure directly that it already depends
+        // on every other node related to its resource, without relying on
+        // references.
+        return nil
+}
+
+// GraphNodeEvalable
+func (n *NodeDestroyResource) EvalTree() EvalNode {
+        // This EvalNode will produce an error if the resource isn't already
+        // empty by the time it is called, since it should just be pruning the
+        // leftover husk of a resource in state after all of the child instances
+        // and their objects were destroyed.
+        return &EvalForgetResourceState{
+                Addr: n.ResourceAddr().Resource,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy_deposed.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy_deposed.go
new file mode 100644
index 0000000..67c4691
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy_deposed.go
@@ -0,0 +1,313 @@
+package terraform
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+)
+
+// ConcreteResourceInstanceDeposedNodeFunc is a callback type used to convert
+// an abstract resource instance to a concrete one of some type that has
+// an associated deposed object key.
+type ConcreteResourceInstanceDeposedNodeFunc func(*NodeAbstractResourceInstance, states.DeposedKey) dag.Vertex
+
+type GraphNodeDeposedResourceInstanceObject interface {
+        DeposedInstanceObjectKey() states.DeposedKey
+}
+
+// NodePlanDeposedResourceInstanceObject represents deposed resource
+// instance objects during plan. These are distinct from the primary object
+// for each resource instance since the only valid operation to do with them
+// is to destroy them.
+//
+// This node type is also used during the refresh walk to ensure that the
+// record of a deposed object is up-to-date before we plan to destroy it.
+type NodePlanDeposedResourceInstanceObject struct {
+        *NodeAbstractResourceInstance
+        DeposedKey states.DeposedKey
+}
+
+var (
+        _ GraphNodeDeposedResourceInstanceObject = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeResource                      = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeResourceInstance              = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeReferenceable                 = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeReferencer                    = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeEvalable                      = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeProviderConsumer              = (*NodePlanDeposedResourceInstanceObject)(nil)
+        _ GraphNodeProvisionerConsumer           = (*NodePlanDeposedResourceInstanceObject)(nil)
+)
+
+func (n *NodePlanDeposedResourceInstanceObject) Name() string {
+        return fmt.Sprintf("%s (deposed %s)", n.ResourceInstanceAddr().String(), n.DeposedKey)
+}
+
+func (n *NodePlanDeposedResourceInstanceObject) DeposedInstanceObjectKey() states.DeposedKey {
+        return n.DeposedKey
+}
+
+// GraphNodeReferenceable implementation, overriding the one from NodeAbstractResourceInstance
+func (n *NodePlanDeposedResourceInstanceObject) ReferenceableAddrs() []addrs.Referenceable {
+        // Deposed objects don't participate in references.
+        return nil
+}
+
+// GraphNodeReferencer implementation, overriding the one from NodeAbstractResourceInstance
+func (n *NodePlanDeposedResourceInstanceObject) References() []*addrs.Reference {
+        // We don't evaluate configuration for deposed objects, so they effectively
+        // make no references.
+        return nil
+}
+
+// GraphNodeEvalable impl.
+func (n *NodePlanDeposedResourceInstanceObject) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
+
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var state *states.ResourceInstanceObject
+
+        seq := &EvalSequence{Nodes: make([]EvalNode, 0, 5)}
+
+        // During the refresh walk we will ensure that our record of the deposed
+        // object is up-to-date. If it was already deleted outside of Terraform
+        // then this will remove it from state and thus avoid us planning a
+        // destroy for it during the subsequent plan walk.
+        seq.Nodes = append(seq.Nodes, &EvalOpFilter{
+                Ops: []walkOperation{walkRefresh},
+                Node: &EvalSequence{
+                        Nodes: []EvalNode{
+                                &EvalGetProvider{
+                                        Addr:   n.ResolvedProvider,
+                                        Output: &provider,
+                                        Schema: &providerSchema,
+                                },
+                                &EvalReadStateDeposed{
+                                        Addr:           addr.Resource,
+                                        Provider:       &provider,
+                                        ProviderSchema: &providerSchema,
+                                        Key:            n.DeposedKey,
+                                        Output:         &state,
+                                },
+                                &EvalRefresh{
+                                        Addr:           addr.Resource,
+                                        ProviderAddr:   n.ResolvedProvider,
+                                        Provider:       &provider,
+                                        ProviderSchema: &providerSchema,
+                                        State:          &state,
+                                        Output:         &state,
+                                },
+                                &EvalWriteStateDeposed{
+                                        Addr:           addr.Resource,
+                                        Key:            n.DeposedKey,
+                                        ProviderAddr:   n.ResolvedProvider,
+                                        ProviderSchema: &providerSchema,
+                                        State:          &state,
+                                },
+                        },
+                },
+        })
+
+        // During the plan walk we always produce a planned destroy change, because
+        // destroying is the only supported action for deposed objects.
+        var change *plans.ResourceInstanceChange
+        seq.Nodes = append(seq.Nodes, &EvalOpFilter{
+                Ops: []walkOperation{walkPlan, walkPlanDestroy},
+                Node: &EvalSequence{
+                        Nodes: []EvalNode{
+                                &EvalGetProvider{
+                                        Addr:   n.ResolvedProvider,
+                                        Output: &provider,
+                                        Schema: &providerSchema,
+                                },
+                                &EvalReadStateDeposed{
+                                        Addr:           addr.Resource,
+                                        Output:         &state,
+                                        Key:            n.DeposedKey,
+                                        Provider:       &provider,
+                                        ProviderSchema: &providerSchema,
+                                },
+                                &EvalDiffDestroy{
+                                        Addr:         addr.Resource,
+                                        ProviderAddr: n.ResolvedProvider,
+                                        DeposedKey:   n.DeposedKey,
+                                        State:        &state,
+                                        Output:       &change,
+                                },
+                                &EvalWriteDiff{
+                                        Addr:           addr.Resource,
+                                        DeposedKey:     n.DeposedKey,
+                                        ProviderSchema: &providerSchema,
+                                        Change:         &change,
+                                },
+                                // Since deposed objects cannot be referenced by expressions
+                                // elsewhere, we don't need to also record the planned new
+                                // state in this case.
+                        },
+                },
+        })
+
+        return seq
+}
+
+// NodeDestroyDeposedResourceInstanceObject represents deposed resource
+// instance objects during apply. Nodes of this type are inserted by
+// DiffTransformer when the planned changeset contains "delete" changes for
+// deposed instance objects, and its only supported operation is to destroy
+// and then forget the associated object.
+type NodeDestroyDeposedResourceInstanceObject struct {
+        *NodeAbstractResourceInstance
+        DeposedKey states.DeposedKey
+}
+
+var (
+        _ GraphNodeDeposedResourceInstanceObject = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeResource                      = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeResourceInstance              = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeDestroyer                     = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeDestroyerCBD                  = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeReferenceable                 = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeReferencer                    = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeEvalable                      = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeProviderConsumer              = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+        _ GraphNodeProvisionerConsumer           = (*NodeDestroyDeposedResourceInstanceObject)(nil)
+)
+
+func (n *NodeDestroyDeposedResourceInstanceObject) Name() string {
+        return fmt.Sprintf("%s (destroy deposed %s)", n.Addr.String(), n.DeposedKey)
+}
+
+func (n *NodeDestroyDeposedResourceInstanceObject) DeposedInstanceObjectKey() states.DeposedKey {
+        return n.DeposedKey
+}
+
+// GraphNodeReferenceable implementation, overriding the one from NodeAbstractResourceInstance
+func (n *NodeDestroyDeposedResourceInstanceObject) ReferenceableAddrs() []addrs.Referenceable {
+        // Deposed objects don't participate in references.
+        return nil
+}
+
+// GraphNodeReferencer implementation, overriding the one from NodeAbstractResourceInstance
+func (n *NodeDestroyDeposedResourceInstanceObject) References() []*addrs.Reference {
+        // We don't evaluate configuration for deposed objects, so they effectively
+        // make no references.
+        return nil
+}
+
+// GraphNodeDestroyer
+func (n *NodeDestroyDeposedResourceInstanceObject) DestroyAddr() *addrs.AbsResourceInstance {
+        addr := n.ResourceInstanceAddr()
+        return &addr
+}
+
+// GraphNodeDestroyerCBD
+func (n *NodeDestroyDeposedResourceInstanceObject) CreateBeforeDestroy() bool {
+        // A deposed instance is always CreateBeforeDestroy by definition, since
+        // we use deposed only to handle create-before-destroy.
+        return true
+}
+
+// GraphNodeDestroyerCBD
+func (n *NodeDestroyDeposedResourceInstanceObject) ModifyCreateBeforeDestroy(v bool) error {
+        if !v {
+                // Should never happen: deposed instances are _always_ create_before_destroy.
+                return fmt.Errorf("can't deactivate create_before_destroy for a deposed instance")
+        }
+        return nil
+}
+
+// GraphNodeEvalable impl.
+func (n *NodeDestroyDeposedResourceInstanceObject) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
+
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var state *states.ResourceInstanceObject
+        var change *plans.ResourceInstanceChange
+        var err error
+
+        return &EvalSequence{
+                Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
+                        &EvalReadStateDeposed{
+                                Addr:           addr.Resource,
+                                Output:         &state,
+                                Key:            n.DeposedKey,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+                        },
+                        &EvalDiffDestroy{
+                                Addr:         addr.Resource,
+                                ProviderAddr: n.ResolvedProvider,
+                                State:        &state,
+                                Output:       &change,
+                        },
+                        // Call pre-apply hook
+                        &EvalApplyPre{
+                                Addr:   addr.Resource,
+                                State:  &state,
+                                Change: &change,
+                        },
+                        &EvalApply{
+                                Addr:           addr.Resource,
+                                Config:         nil, // No configuration because we are destroying
+                                State:          &state,
+                                Change:         &change,
+                                Provider:       &provider,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                Output:         &state,
+                                Error:          &err,
+                        },
+                        // Always write the resource back to the state deposed... if it
+                        // was successfully destroyed it will be pruned. If it was not, it will
+                        // be caught on the next run.
+                        &EvalWriteStateDeposed{
+                                Addr:           addr.Resource,
+                                Key:            n.DeposedKey,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                        },
+                        &EvalApplyPost{
+                                Addr:  addr.Resource,
+                                State: &state,
+                                Error: &err,
+                        },
+                        &EvalReturnError{
+                                Error: &err,
+                        },
+                        &EvalUpdateStateHook{},
+                },
+        }
+}
+
+// GraphNodeDeposer is an optional interface implemented by graph nodes that
+// might create a single new deposed object for a specific associated resource
+// instance, allowing a caller to optionally pre-allocate a DeposedKey for
+// it.
+type GraphNodeDeposer interface {
+        // SetPreallocatedDeposedKey will be called during graph construction
+        // if a particular node must use a pre-allocated deposed key if/when it
+        // "deposes" the current object of its associated resource instance.
+        SetPreallocatedDeposedKey(key states.DeposedKey)
+}
+
+// graphNodeDeposer is an embeddable implementation of GraphNodeDeposer.
+// Embed it in a node type to get automatic support for it, and then access
+// the field PreallocatedDeposedKey to access any pre-allocated key.
+type graphNodeDeposer struct {
+        PreallocatedDeposedKey states.DeposedKey
+}
+
+func (n *graphNodeDeposer) SetPreallocatedDeposedKey(key states.DeposedKey) {
+        n.PreallocatedDeposedKey = key
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go
index 1afae7a..633c1c4 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go
@@ -1,47 +1,119 @@
 package terraform
 
 import (
+        "log"
+
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // NodePlannableResource represents a resource that is "plannable":
 // it is ready to be planned in order to create a diff.
 type NodePlannableResource struct {
-        *NodeAbstractCountResource
+        *NodeAbstractResource
+
+        // ForceCreateBeforeDestroy might be set via our GraphNodeDestroyerCBD
+        // during graph construction, if dependencies require us to force this
+        // on regardless of what the configuration says.
+        ForceCreateBeforeDestroy *bool
+}
+
+var (
+        _ GraphNodeSubPath              = (*NodePlannableResource)(nil)
+        _ GraphNodeDestroyerCBD         = (*NodePlannableResource)(nil)
+        _ GraphNodeDynamicExpandable    = (*NodePlannableResource)(nil)
+        _ GraphNodeReferenceable        = (*NodePlannableResource)(nil)
+        _ GraphNodeReferencer           = (*NodePlannableResource)(nil)
+        _ GraphNodeResource             = (*NodePlannableResource)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodePlannableResource)(nil)
+)
+
+// GraphNodeEvalable
+func (n *NodePlannableResource) EvalTree() EvalNode {
+        addr := n.ResourceAddr()
+        config := n.Config
+
+        if config == nil {
+                // Nothing to do, then.
+                log.Printf("[TRACE] NodeApplyableResource: no configuration present for %s", addr)
+                return &EvalNoop{}
+        }
+
+        // this ensures we can reference the resource even if the count is 0
+        return &EvalWriteResourceState{
+                Addr:         addr.Resource,
+                Config:       config,
+                ProviderAddr: n.ResolvedProvider,
+        }
+}
+
+// GraphNodeDestroyerCBD
+func (n *NodePlannableResource) CreateBeforeDestroy() bool {
+        if n.ForceCreateBeforeDestroy != nil {
+                return *n.ForceCreateBeforeDestroy
+        }
+
+        // If we have no config, we just assume no
+        if n.Config == nil || n.Config.Managed == nil {
+                return false
+        }
+
+        return n.Config.Managed.CreateBeforeDestroy
+}
+
+// GraphNodeDestroyerCBD
+func (n *NodePlannableResource) ModifyCreateBeforeDestroy(v bool) error {
+        n.ForceCreateBeforeDestroy = &v
+        return nil
 }
 
 // GraphNodeDynamicExpandable
 func (n *NodePlannableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
-        // Grab the state which we read
-        state, lock := ctx.State()
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Expand the resource count which must be available by now from EvalTree
-        count, err := n.Config.Count()
-        if err != nil {
-                return nil, err
+        var diags tfdiags.Diagnostics
+
+        count, countDiags := evaluateResourceCountExpression(n.Config.Count, ctx)
+        diags = diags.Append(countDiags)
+        if countDiags.HasErrors() {
+                return nil, diags.Err()
         }
 
+        // Next we need to potentially rename an instance address in the state
+        // if we're transitioning whether "count" is set at all.
+        fixResourceCountSetTransition(ctx, n.ResourceAddr(), count != -1)
+
+        // Our graph transformers require access to the full state, so we'll
+        // temporarily lock it while we work on this.
+        state := ctx.State().Lock()
+        defer ctx.State().Unlock()
+
         // The concrete resource factory we'll use
-        concreteResource := func(a *NodeAbstractResource) dag.Vertex {
+        concreteResource := func(a *NodeAbstractResourceInstance) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
                 a.ResolvedProvider = n.ResolvedProvider
+                a.Schema = n.Schema
+                a.ProvisionerSchemas = n.ProvisionerSchemas
 
                 return &NodePlannableResourceInstance{
-                        NodeAbstractResource: a,
+                        NodeAbstractResourceInstance: a,
+
+                        // By the time we're walking, we've figured out whether we need
+                        // to force on CreateBeforeDestroy due to dependencies on other
+                        // nodes that have it.
+                        ForceCreateBeforeDestroy: n.CreateBeforeDestroy(),
                 }
         }
 
-        // The concrete resource factory we'll use for oprhans
-        concreteResourceOrphan := func(a *NodeAbstractResource) dag.Vertex {
+        // The concrete resource factory we'll use for orphans
+        concreteResourceOrphan := func(a *NodeAbstractResourceInstance) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
                 a.ResolvedProvider = n.ResolvedProvider
+                a.Schema = n.Schema
+                a.ProvisionerSchemas = n.ProvisionerSchemas
 
-                return &NodePlannableResourceOrphan{
-                        NodeAbstractResource: a,
+                return &NodePlannableResourceInstanceOrphan{
+                        NodeAbstractResourceInstance: a,
                 }
         }
 
@@ -50,6 +122,7 @@ func (n *NodePlannableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
                 // Expand the count.
                 &ResourceCountTransformer{
                         Concrete: concreteResource,
+                        Schema:   n.Schema,
                         Count:    count,
                         Addr:     n.ResourceAddr(),
                 },
@@ -66,7 +139,7 @@ func (n *NodePlannableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
                 &AttachStateTransformer{State: state},
 
                 // Targeting
-                &TargetsTransformer{ParsedTargets: n.Targets},
+                &TargetsTransformer{Targets: n.Targets},
 
                 // Connect references so ordering is correct
                 &ReferenceTransformer{},
@@ -81,5 +154,6 @@ func (n *NodePlannableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
                 Validate: true,
                 Name:     "NodePlannableResource",
         }
-        return b.Build(ctx.Path())
+        graph, diags := b.Build(ctx.Path())
+        return graph, diags.ErrWithWarnings()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_destroy.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_destroy.go
index 9b02362..38746f0 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_destroy.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_destroy.go
@@ -1,52 +1,87 @@
 package terraform
 
-// NodePlanDestroyableResource represents a resource that is "applyable":
-// it is ready to be applied and is represented by a diff.
-type NodePlanDestroyableResource struct {
-        *NodeAbstractResource
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+)
+
+// NodePlanDestroyableResourceInstance represents a resource that is ready
+// to be planned for destruction.
+type NodePlanDestroyableResourceInstance struct {
+        *NodeAbstractResourceInstance
 }
 
+var (
+        _ GraphNodeSubPath              = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeReferenceable        = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeReferencer           = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeDestroyer            = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeResource             = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeResourceInstance     = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeAttachResourceState  = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeEvalable             = (*NodePlanDestroyableResourceInstance)(nil)
+        _ GraphNodeProviderConsumer     = (*NodePlanDestroyableResourceInstance)(nil)
+)
+
 // GraphNodeDestroyer
-func (n *NodePlanDestroyableResource) DestroyAddr() *ResourceAddress {
-        return n.Addr
+func (n *NodePlanDestroyableResourceInstance) DestroyAddr() *addrs.AbsResourceInstance {
+        addr := n.ResourceInstanceAddr()
+        return &addr
 }
 
 // GraphNodeEvalable
-func (n *NodePlanDestroyableResource) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
+func (n *NodePlanDestroyableResourceInstance) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
 
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
+        // Declare a bunch of variables that are used for state during
+        // evaluation. These are written to by address in the EvalNodes we
+        // declare below.
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
 
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:   stateId,
-                Type: addr.Type,
+        if n.ResolvedProvider.ProviderConfig.Type == "" {
+                // Should never happen; indicates that the graph was not constructed
+                // correctly since we didn't get our provider attached.
+                panic(fmt.Sprintf("%T %q was not assigned a resolved provider", n, dag.VertexName(n)))
         }
 
-        // Declare a bunch of variables that are used for state during
-        // evaluation. Most of this are written to by-address below.
-        var diff *InstanceDiff
-        var state *InstanceState
-
         return &EvalSequence{
                 Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
                         &EvalReadState{
-                                Name:   stateId,
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
                                 Output: &state,
                         },
                         &EvalDiffDestroy{
-                                Info:   info,
-                                State:  &state,
-                                Output: &diff,
+                                Addr:         addr.Resource,
+                                ProviderAddr: n.ResolvedProvider,
+                                State:        &state,
+                                Output:       &change,
                         },
                         &EvalCheckPreventDestroy{
-                                Resource: n.Config,
-                                Diff:     &diff,
+                                Addr:   addr.Resource,
+                                Config: n.Config,
+                                Change: &change,
                         },
                         &EvalWriteDiff{
-                                Name: stateId,
-                                Diff: &diff,
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &change,
                         },
                 },
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go
index 7d9fcdd..75e0bcd 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go
@@ -3,187 +3,205 @@ package terraform
 import (
         "fmt"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // NodePlannableResourceInstance represents a _single_ resource
 // instance that is plannable. This means this represents a single
 // count index, for example.
 type NodePlannableResourceInstance struct {
-        *NodeAbstractResource
+        *NodeAbstractResourceInstance
+        ForceCreateBeforeDestroy bool
 }
 
+var (
+        _ GraphNodeSubPath              = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeReferenceable        = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeReferencer           = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeResource             = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeResourceInstance     = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeAttachResourceState  = (*NodePlannableResourceInstance)(nil)
+        _ GraphNodeEvalable             = (*NodePlannableResourceInstance)(nil)
+)
+
 // GraphNodeEvalable
 func (n *NodePlannableResourceInstance) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
-
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
+        addr := n.ResourceInstanceAddr()
 
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:         stateId,
-                Type:       addr.Type,
-                ModulePath: normalizeModulePath(addr.Path),
-        }
-
-        // Build the resource for eval
-        resource := &Resource{
-                Name:       addr.Name,
-                Type:       addr.Type,
-                CountIndex: addr.Index,
-        }
-        if resource.CountIndex < 0 {
-                resource.CountIndex = 0
-        }
+        // State still uses legacy-style internal ids, so we need to shim to get
+        // a suitable key to use.
+        stateId := NewLegacyResourceInstanceAddress(addr).stateId()
 
         // Determine the dependencies for the state.
         stateDeps := n.StateReferences()
 
         // Eval info is different depending on what kind of resource this is
-        switch n.Config.Mode {
-        case config.ManagedResourceMode:
-                return n.evalTreeManagedResource(
-                        stateId, info, resource, stateDeps,
-                )
-        case config.DataResourceMode:
-                return n.evalTreeDataResource(
-                        stateId, info, resource, stateDeps)
+        switch addr.Resource.Resource.Mode {
+        case addrs.ManagedResourceMode:
+                return n.evalTreeManagedResource(addr, stateId, stateDeps)
+        case addrs.DataResourceMode:
+                return n.evalTreeDataResource(addr, stateId, stateDeps)
         default:
                 panic(fmt.Errorf("unsupported resource mode %s", n.Config.Mode))
         }
 }
 
-func (n *NodePlannableResourceInstance) evalTreeDataResource(
-        stateId string, info *InstanceInfo,
-        resource *Resource, stateDeps []string) EvalNode {
-        var provider ResourceProvider
-        var config *ResourceConfig
-        var diff *InstanceDiff
-        var state *InstanceState
+func (n *NodePlannableResourceInstance) evalTreeDataResource(addr addrs.AbsResourceInstance, stateId string, stateDeps []addrs.Referenceable) EvalNode {
+        config := n.Config
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
+        var configVal cty.Value
 
         return &EvalSequence{
                 Nodes: []EvalNode{
-                        &EvalReadState{
-                                Name:   stateId,
-                                Output: &state,
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
                         },
 
-                        // We need to re-interpolate the config here because some
-                        // of the attributes may have become computed during
-                        // earlier planning, due to other resources having
-                        // "requires new resource" diffs.
-                        &EvalInterpolate{
-                                Config:   n.Config.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &config,
+                        &EvalReadState{
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
+                                Output: &state,
                         },
 
+                        // If we already have a non-planned state then we already dealt
+                        // with this during the refresh walk and so we have nothing to do
+                        // here.
                         &EvalIf{
                                 If: func(ctx EvalContext) (bool, error) {
-                                        computed := config.ComputedKeys != nil && len(config.ComputedKeys) > 0
-
-                                        // If the configuration is complete and we
-                                        // already have a state then we don't need to
-                                        // do any further work during apply, because we
-                                        // already populated the state during refresh.
-                                        if !computed && state != nil {
-                                                return true, EvalEarlyExitError{}
+                                        depChanges := false
+
+                                        // Check and see if any of our dependencies have changes.
+                                        changes := ctx.Changes()
+                                        for _, d := range n.StateReferences() {
+                                                ri, ok := d.(addrs.ResourceInstance)
+                                                if !ok {
+                                                        continue
+                                                }
+                                                change := changes.GetResourceInstanceChange(ri.Absolute(ctx.Path()), states.CurrentGen)
+                                                if change != nil && change.Action != plans.NoOp {
+                                                        depChanges = true
+                                                        break
+                                                }
                                         }
 
+                                        refreshed := state != nil && state.Status != states.ObjectPlanned
+
+                                        // If there are no dependency changes, and it's not a forced
+                                        // read because we there was no Refresh, then we don't need
+                                        // to re-read. If any dependencies have changes, it means
+                                        // our config may also have changes and we need to Read the
+                                        // data source again.
+                                        if !depChanges && refreshed {
+                                                return false, EvalEarlyExitError{}
+                                        }
                                         return true, nil
                                 },
                                 Then: EvalNoop{},
                         },
 
-                        &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
-                                Output: &provider,
+                        &EvalValidateSelfRef{
+                                Addr:           addr.Resource,
+                                Config:         config.Config,
+                                ProviderSchema: &providerSchema,
                         },
 
-                        &EvalReadDataDiff{
-                                Info:        info,
-                                Config:      &config,
-                                Provider:    &provider,
-                                Output:      &diff,
-                                OutputState: &state,
+                        &EvalReadData{
+                                Addr:           addr.Resource,
+                                Config:         n.Config,
+                                Dependencies:   n.StateReferences(),
+                                Provider:       &provider,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                ForcePlanRead:  true, // _always_ produce a Read change, even if the config seems ready
+                                OutputChange:   &change,
+                                OutputValue:    &configVal,
+                                OutputState:    &state,
                         },
 
                         &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: n.Config.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: stateDeps,
-                                State:        &state,
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
                         },
 
                         &EvalWriteDiff{
-                                Name: stateId,
-                                Diff: &diff,
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &change,
                         },
                 },
         }
 }
 
-func (n *NodePlannableResourceInstance) evalTreeManagedResource(
-        stateId string, info *InstanceInfo,
-        resource *Resource, stateDeps []string) EvalNode {
-        // Declare a bunch of variables that are used for state during
-        // evaluation. Most of this are written to by-address below.
-        var provider ResourceProvider
-        var diff *InstanceDiff
-        var state *InstanceState
-        var resourceConfig *ResourceConfig
+func (n *NodePlannableResourceInstance) evalTreeManagedResource(addr addrs.AbsResourceInstance, stateId string, stateDeps []addrs.Referenceable) EvalNode {
+        config := n.Config
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
 
         return &EvalSequence{
                 Nodes: []EvalNode{
-                        &EvalInterpolate{
-                                Config:   n.Config.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &resourceConfig,
-                        },
                         &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
+                                Addr:   n.ResolvedProvider,
                                 Output: &provider,
+                                Schema: &providerSchema,
                         },
-                        // Re-run validation to catch any errors we missed, e.g. type
-                        // mismatches on computed values.
-                        &EvalValidateResource{
-                                Provider:       &provider,
-                                Config:         &resourceConfig,
-                                ResourceName:   n.Config.Name,
-                                ResourceType:   n.Config.Type,
-                                ResourceMode:   n.Config.Mode,
-                                IgnoreWarnings: true,
-                        },
+
                         &EvalReadState{
-                                Name:   stateId,
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
                                 Output: &state,
                         },
+
+                        &EvalValidateSelfRef{
+                                Addr:           addr.Resource,
+                                Config:         config.Config,
+                                ProviderSchema: &providerSchema,
+                        },
+
                         &EvalDiff{
-                                Name:        stateId,
-                                Info:        info,
-                                Config:      &resourceConfig,
-                                Resource:    n.Config,
-                                Provider:    &provider,
-                                State:       &state,
-                                OutputDiff:  &diff,
-                                OutputState: &state,
+                                Addr:                addr.Resource,
+                                Config:              n.Config,
+                                CreateBeforeDestroy: n.ForceCreateBeforeDestroy,
+                                Provider:            &provider,
+                                ProviderAddr:        n.ResolvedProvider,
+                                ProviderSchema:      &providerSchema,
+                                State:               &state,
+                                OutputChange:        &change,
+                                OutputState:         &state,
                         },
                         &EvalCheckPreventDestroy{
-                                Resource: n.Config,
-                                Diff:     &diff,
+                                Addr:   addr.Resource,
+                                Config: n.Config,
+                                Change: &change,
                         },
                         &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: n.Config.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: stateDeps,
-                                State:        &state,
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                State:          &state,
+                                ProviderSchema: &providerSchema,
                         },
                         &EvalWriteDiff{
-                                Name: stateId,
-                                Diff: &diff,
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &change,
                         },
                 },
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_orphan.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_orphan.go
index 73d6e41..8416694 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_orphan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_orphan.go
@@ -1,53 +1,83 @@
 package terraform
 
-// NodePlannableResourceOrphan represents a resource that is "applyable":
+import (
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+)
+
+// NodePlannableResourceInstanceOrphan represents a resource that is "applyable":
 // it is ready to be applied and is represented by a diff.
-type NodePlannableResourceOrphan struct {
-        *NodeAbstractResource
+type NodePlannableResourceInstanceOrphan struct {
+        *NodeAbstractResourceInstance
 }
 
-func (n *NodePlannableResourceOrphan) Name() string {
-        return n.NodeAbstractResource.Name() + " (orphan)"
-}
+var (
+        _ GraphNodeSubPath              = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeReferenceable        = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeReferencer           = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeResource             = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeResourceInstance     = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeAttachResourceState  = (*NodePlannableResourceInstanceOrphan)(nil)
+        _ GraphNodeEvalable             = (*NodePlannableResourceInstanceOrphan)(nil)
+)
 
-// GraphNodeEvalable
-func (n *NodePlannableResourceOrphan) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
+var (
+        _ GraphNodeEvalable = (*NodePlannableResourceInstanceOrphan)(nil)
+)
 
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
+func (n *NodePlannableResourceInstanceOrphan) Name() string {
+        return n.ResourceInstanceAddr().String() + " (orphan)"
+}
 
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:         stateId,
-                Type:       addr.Type,
-                ModulePath: normalizeModulePath(addr.Path),
-        }
+// GraphNodeEvalable
+func (n *NodePlannableResourceInstanceOrphan) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
 
         // Declare a bunch of variables that are used for state during
         // evaluation. Most of this are written to by-address below.
-        var diff *InstanceDiff
-        var state *InstanceState
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
 
         return &EvalSequence{
                 Nodes: []EvalNode{
+                        &EvalGetProvider{
+                                Addr:   n.ResolvedProvider,
+                                Output: &provider,
+                                Schema: &providerSchema,
+                        },
                         &EvalReadState{
-                                Name:   stateId,
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
                                 Output: &state,
                         },
                         &EvalDiffDestroy{
-                                Info:   info,
-                                State:  &state,
-                                Output: &diff,
+                                Addr:         addr.Resource,
+                                State:        &state,
+                                ProviderAddr: n.ResolvedProvider,
+                                Output:       &change,
+                                OutputState:  &state, // Will point to a nil state after this complete, signalling destroyed
                         },
                         &EvalCheckPreventDestroy{
-                                Resource:   n.Config,
-                                ResourceId: stateId,
-                                Diff:       &diff,
+                                Addr:   addr.Resource,
+                                Config: n.Config,
+                                Change: &change,
                         },
                         &EvalWriteDiff{
-                                Name: stateId,
-                                Diff: &diff,
+                                Addr:           addr.Resource,
+                                ProviderSchema: &providerSchema,
+                                Change:         &change,
+                        },
+                        &EvalWriteState{
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
                         },
                 },
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
index 697bd49..9506023 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
@@ -2,38 +2,60 @@ package terraform
 
 import (
         "fmt"
+        "log"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/providers"
+
+        "github.com/hashicorp/terraform/states"
+
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // NodeRefreshableManagedResource represents a resource that is expanabled into
 // NodeRefreshableManagedResourceInstance. Resource count orphans are also added.
 type NodeRefreshableManagedResource struct {
-        *NodeAbstractCountResource
+        *NodeAbstractResource
 }
 
+var (
+        _ GraphNodeSubPath              = (*NodeRefreshableManagedResource)(nil)
+        _ GraphNodeDynamicExpandable    = (*NodeRefreshableManagedResource)(nil)
+        _ GraphNodeReferenceable        = (*NodeRefreshableManagedResource)(nil)
+        _ GraphNodeReferencer           = (*NodeRefreshableManagedResource)(nil)
+        _ GraphNodeResource             = (*NodeRefreshableManagedResource)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodeRefreshableManagedResource)(nil)
+)
+
 // GraphNodeDynamicExpandable
 func (n *NodeRefreshableManagedResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
-        // Grab the state which we read
-        state, lock := ctx.State()
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Expand the resource count which must be available by now from EvalTree
-        count, err := n.Config.Count()
-        if err != nil {
-                return nil, err
+        var diags tfdiags.Diagnostics
+
+        count, countDiags := evaluateResourceCountExpression(n.Config.Count, ctx)
+        diags = diags.Append(countDiags)
+        if countDiags.HasErrors() {
+                return nil, diags.Err()
         }
 
+        // Next we need to potentially rename an instance address in the state
+        // if we're transitioning whether "count" is set at all.
+        fixResourceCountSetTransition(ctx, n.ResourceAddr(), count != -1)
+
+        // Our graph transformers require access to the full state, so we'll
+        // temporarily lock it while we work on this.
+        state := ctx.State().Lock()
+        defer ctx.State().Unlock()
+
         // The concrete resource factory we'll use
-        concreteResource := func(a *NodeAbstractResource) dag.Vertex {
+        concreteResource := func(a *NodeAbstractResourceInstance) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
                 a.ResolvedProvider = n.ResolvedProvider
 
                 return &NodeRefreshableManagedResourceInstance{
-                        NodeAbstractResource: a,
+                        NodeAbstractResourceInstance: a,
                 }
         }
 
@@ -42,6 +64,7 @@ func (n *NodeRefreshableManagedResource) DynamicExpand(ctx EvalContext) (*Graph,
                 // Expand the count.
                 &ResourceCountTransformer{
                         Concrete: concreteResource,
+                        Schema:   n.Schema,
                         Count:    count,
                         Addr:     n.ResourceAddr(),
                 },
@@ -59,7 +82,7 @@ func (n *NodeRefreshableManagedResource) DynamicExpand(ctx EvalContext) (*Graph,
                 &AttachStateTransformer{State: state},
 
                 // Targeting
-                &TargetsTransformer{ParsedTargets: n.Targets},
+                &TargetsTransformer{Targets: n.Targets},
 
                 // Connect references so ordering is correct
                 &ReferenceTransformer{},
@@ -75,66 +98,76 @@ func (n *NodeRefreshableManagedResource) DynamicExpand(ctx EvalContext) (*Graph,
                 Name:     "NodeRefreshableManagedResource",
         }
 
-        return b.Build(ctx.Path())
+        graph, diags := b.Build(ctx.Path())
+        return graph, diags.ErrWithWarnings()
 }
 
 // NodeRefreshableManagedResourceInstance represents a resource that is "applyable":
 // it is ready to be applied and is represented by a diff.
 type NodeRefreshableManagedResourceInstance struct {
-        *NodeAbstractResource
+        *NodeAbstractResourceInstance
 }
 
+var (
+        _ GraphNodeSubPath              = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeReferenceable        = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeReferencer           = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeDestroyer            = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeResource             = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeResourceInstance     = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeAttachResourceState  = (*NodeRefreshableManagedResourceInstance)(nil)
+        _ GraphNodeEvalable             = (*NodeRefreshableManagedResourceInstance)(nil)
+)
+
 // GraphNodeDestroyer
-func (n *NodeRefreshableManagedResourceInstance) DestroyAddr() *ResourceAddress {
-        return n.Addr
+func (n *NodeRefreshableManagedResourceInstance) DestroyAddr() *addrs.AbsResourceInstance {
+        addr := n.ResourceInstanceAddr()
+        return &addr
 }
 
 // GraphNodeEvalable
 func (n *NodeRefreshableManagedResourceInstance) EvalTree() EvalNode {
+        addr := n.ResourceInstanceAddr()
+
         // Eval info is different depending on what kind of resource this is
-        switch mode := n.Addr.Mode; mode {
-        case config.ManagedResourceMode:
+        switch addr.Resource.Resource.Mode {
+        case addrs.ManagedResourceMode:
                 if n.ResourceState == nil {
+                        log.Printf("[TRACE] NodeRefreshableManagedResourceInstance: %s has no existing state to refresh", addr)
                         return n.evalTreeManagedResourceNoState()
                 }
+                log.Printf("[TRACE] NodeRefreshableManagedResourceInstance: %s will be refreshed", addr)
                 return n.evalTreeManagedResource()
 
-        case config.DataResourceMode:
+        case addrs.DataResourceMode:
                 // Get the data source node. If we don't have a configuration
                 // then it is an orphan so we destroy it (remove it from the state).
                 var dn GraphNodeEvalable
                 if n.Config != nil {
                         dn = &NodeRefreshableDataResourceInstance{
-                                NodeAbstractResource: n.NodeAbstractResource,
+                                NodeAbstractResourceInstance: n.NodeAbstractResourceInstance,
                         }
                 } else {
-                        dn = &NodeDestroyableDataResource{
-                                NodeAbstractResource: n.NodeAbstractResource,
+                        dn = &NodeDestroyableDataResourceInstance{
+                                NodeAbstractResourceInstance: n.NodeAbstractResourceInstance,
                         }
                 }
 
                 return dn.EvalTree()
         default:
-                panic(fmt.Errorf("unsupported resource mode %s", mode))
+                panic(fmt.Errorf("unsupported resource mode %s", addr.Resource.Resource.Mode))
         }
 }
 
 func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResource() EvalNode {
-        addr := n.NodeAbstractResource.Addr
-
-        // stateId is the ID to put into the state
-        stateId := addr.stateId()
-
-        // Build the instance info. More of this will be populated during eval
-        info := &InstanceInfo{
-                Id:   stateId,
-                Type: addr.Type,
-        }
+        addr := n.ResourceInstanceAddr()
 
         // Declare a bunch of variables that are used for state during
         // evaluation. Most of this are written to by-address below.
-        var provider ResourceProvider
-        var state *InstanceState
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var state *states.ResourceInstanceObject
 
         // This happened during initial development. All known cases were
         // fixed and tested but as a sanity check let's assert here.
@@ -150,25 +183,33 @@ func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResource() EvalN
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
+                                Addr:   n.ResolvedProvider,
                                 Output: &provider,
+                                Schema: &providerSchema,
                         },
+
                         &EvalReadState{
-                                Name:   stateId,
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
                                 Output: &state,
                         },
+
                         &EvalRefresh{
-                                Info:     info,
-                                Provider: &provider,
-                                State:    &state,
-                                Output:   &state,
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                                Output:         &state,
                         },
+
                         &EvalWriteState{
-                                Name:         stateId,
-                                ResourceType: n.ResourceState.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: n.ResourceState.Dependencies,
-                                State:        &state,
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
                         },
                 },
         }
@@ -186,80 +227,62 @@ func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResource() EvalN
 // plan, but nothing is done with the diff after it is created - it is dropped,
 // and its changes are not counted in the UI.
 func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResourceNoState() EvalNode {
+        addr := n.ResourceInstanceAddr()
+
         // Declare a bunch of variables that are used for state during
         // evaluation. Most of this are written to by-address below.
-        var provider ResourceProvider
-        var state *InstanceState
-        var resourceConfig *ResourceConfig
-
-        addr := n.NodeAbstractResource.Addr
-        stateID := addr.stateId()
-        info := &InstanceInfo{
-                Id:         stateID,
-                Type:       addr.Type,
-                ModulePath: normalizeModulePath(addr.Path),
-        }
-
-        // Build the resource for eval
-        resource := &Resource{
-                Name:       addr.Name,
-                Type:       addr.Type,
-                CountIndex: addr.Index,
-        }
-        if resource.CountIndex < 0 {
-                resource.CountIndex = 0
-        }
-
-        // Determine the dependencies for the state.
-        stateDeps := n.StateReferences()
-
-        // n.Config can be nil if the config and state don't match
-        var raw *config.RawConfig
-        if n.Config != nil {
-                raw = n.Config.RawConfig.Copy()
-        }
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var change *plans.ResourceInstanceChange
+        var state *states.ResourceInstanceObject
 
         return &EvalSequence{
                 Nodes: []EvalNode{
-                        &EvalInterpolate{
-                                Config:   raw,
-                                Resource: resource,
-                                Output:   &resourceConfig,
-                        },
                         &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
+                                Addr:   n.ResolvedProvider,
                                 Output: &provider,
+                                Schema: &providerSchema,
                         },
-                        // Re-run validation to catch any errors we missed, e.g. type
-                        // mismatches on computed values.
-                        &EvalValidateResource{
-                                Provider:       &provider,
-                                Config:         &resourceConfig,
-                                ResourceName:   n.Config.Name,
-                                ResourceType:   n.Config.Type,
-                                ResourceMode:   n.Config.Mode,
-                                IgnoreWarnings: true,
-                        },
+
                         &EvalReadState{
-                                Name:   stateID,
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+
                                 Output: &state,
                         },
+
                         &EvalDiff{
-                                Name:        stateID,
-                                Info:        info,
-                                Config:      &resourceConfig,
-                                Resource:    n.Config,
-                                Provider:    &provider,
-                                State:       &state,
-                                OutputState: &state,
-                                Stub:        true,
+                                Addr:           addr.Resource,
+                                Config:         n.Config,
+                                Provider:       &provider,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                                OutputChange:   &change,
+                                OutputState:    &state,
+                                Stub:           true,
                         },
+
                         &EvalWriteState{
-                                Name:         stateID,
-                                ResourceType: n.Config.Type,
-                                Provider:     n.ResolvedProvider,
-                                Dependencies: stateDeps,
-                                State:        &state,
+                                Addr:           addr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                        },
+
+                        // We must also save the planned change, so that expressions in
+                        // other nodes, such as provider configurations and data resources,
+                        // can work with the planned new value.
+                        //
+                        // This depends on the fact that Context.Refresh creates a
+                        // temporary new empty changeset for the duration of its graph
+                        // walk, and so this recorded change will be discarded immediately
+                        // after the refresh walk completes.
+                        &EvalWriteDiff{
+                                Addr:           addr.Resource,
+                                Change:         &change,
+                                ProviderSchema: &providerSchema,
                         },
                 },
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go
index 0df223d..734ec9e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go
@@ -1,158 +1,87 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/provisioners"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // NodeValidatableResource represents a resource that is used for validation
 // only.
 type NodeValidatableResource struct {
-        *NodeAbstractCountResource
-}
-
-// GraphNodeEvalable
-func (n *NodeValidatableResource) EvalTree() EvalNode {
-        // Ensure we're validating
-        c := n.NodeAbstractCountResource
-        c.Validate = true
-        return c.EvalTree()
-}
-
-// GraphNodeDynamicExpandable
-func (n *NodeValidatableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
-        // Grab the state which we read
-        state, lock := ctx.State()
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Expand the resource count which must be available by now from EvalTree
-        count := 1
-        if n.Config.RawCount.Value() != unknownValue() {
-                var err error
-                count, err = n.Config.Count()
-                if err != nil {
-                        return nil, err
-                }
-        }
-
-        // The concrete resource factory we'll use
-        concreteResource := func(a *NodeAbstractResource) dag.Vertex {
-                // Add the config and state since we don't do that via transforms
-                a.Config = n.Config
-                a.ResolvedProvider = n.ResolvedProvider
-
-                return &NodeValidatableResourceInstance{
-                        NodeAbstractResource: a,
-                }
-        }
-
-        // Start creating the steps
-        steps := []GraphTransformer{
-                // Expand the count.
-                &ResourceCountTransformer{
-                        Concrete: concreteResource,
-                        Count:    count,
-                        Addr:     n.ResourceAddr(),
-                },
-
-                // Attach the state
-                &AttachStateTransformer{State: state},
-
-                // Targeting
-                &TargetsTransformer{ParsedTargets: n.Targets},
-
-                // Connect references so ordering is correct
-                &ReferenceTransformer{},
-
-                // Make sure there is a single root
-                &RootTransformer{},
-        }
-
-        // Build the graph
-        b := &BasicGraphBuilder{
-                Steps:    steps,
-                Validate: true,
-                Name:     "NodeValidatableResource",
-        }
-
-        return b.Build(ctx.Path())
-}
-
-// This represents a _single_ resource instance to validate.
-type NodeValidatableResourceInstance struct {
         *NodeAbstractResource
 }
 
-// GraphNodeEvalable
-func (n *NodeValidatableResourceInstance) EvalTree() EvalNode {
-        addr := n.NodeAbstractResource.Addr
+var (
+        _ GraphNodeSubPath              = (*NodeValidatableResource)(nil)
+        _ GraphNodeEvalable             = (*NodeValidatableResource)(nil)
+        _ GraphNodeReferenceable        = (*NodeValidatableResource)(nil)
+        _ GraphNodeReferencer           = (*NodeValidatableResource)(nil)
+        _ GraphNodeResource             = (*NodeValidatableResource)(nil)
+        _ GraphNodeAttachResourceConfig = (*NodeValidatableResource)(nil)
+)
 
-        // Build the resource for eval
-        resource := &Resource{
-                Name:       addr.Name,
-                Type:       addr.Type,
-                CountIndex: addr.Index,
-        }
-        if resource.CountIndex < 0 {
-                resource.CountIndex = 0
-        }
+// GraphNodeEvalable
+func (n *NodeValidatableResource) EvalTree() EvalNode {
+        addr := n.ResourceAddr()
+        config := n.Config
 
-        // Declare a bunch of variables that are used for state during
-        // evaluation. Most of this are written to by-address below.
-        var config *ResourceConfig
-        var provider ResourceProvider
+        // Declare the variables will be used are used to pass values along
+        // the evaluation sequence below. These are written to via pointers
+        // passed to the EvalNodes.
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
+        var configVal cty.Value
 
         seq := &EvalSequence{
                 Nodes: []EvalNode{
-                        &EvalValidateResourceSelfRef{
-                                Addr:   &addr,
-                                Config: &n.Config.RawConfig,
-                        },
                         &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
+                                Addr:   n.ResolvedProvider,
                                 Output: &provider,
-                        },
-                        &EvalInterpolate{
-                                Config:   n.Config.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &config,
+                                Schema: &providerSchema,
                         },
                         &EvalValidateResource{
-                                Provider:     &provider,
-                                Config:       &config,
-                                ResourceName: n.Config.Name,
-                                ResourceType: n.Config.Type,
-                                ResourceMode: n.Config.Mode,
+                                Addr:           addr.Resource,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+                                Config:         config,
+                                ConfigVal:      &configVal,
                         },
                 },
         }
 
-        // Validate all the provisioners
-        for _, p := range n.Config.Provisioners {
-                var provisioner ResourceProvisioner
-                var connConfig *ResourceConfig
-                seq.Nodes = append(
-                        seq.Nodes,
-                        &EvalGetProvisioner{
-                                Name:   p.Type,
-                                Output: &provisioner,
-                        },
-                        &EvalInterpolate{
-                                Config:   p.RawConfig.Copy(),
-                                Resource: resource,
-                                Output:   &config,
-                        },
-                        &EvalInterpolate{
-                                Config:   p.ConnInfo.Copy(),
-                                Resource: resource,
-                                Output:   &connConfig,
-                        },
-                        &EvalValidateProvisioner{
-                                Provisioner: &provisioner,
-                                Config:      &config,
-                                ConnConfig:  &connConfig,
-                        },
-                )
+        if managed := n.Config.Managed; managed != nil {
+                hasCount := n.Config.Count != nil
+
+                // Validate all the provisioners
+                for _, p := range managed.Provisioners {
+                        var provisioner provisioners.Interface
+                        var provisionerSchema *configschema.Block
+
+                        if p.Connection == nil {
+                                p.Connection = config.Managed.Connection
+                        } else if config.Managed.Connection != nil {
+                                p.Connection.Config = configs.MergeBodies(config.Managed.Connection.Config, p.Connection.Config)
+                        }
+
+                        seq.Nodes = append(
+                                seq.Nodes,
+                                &EvalGetProvisioner{
+                                        Name:   p.Type,
+                                        Output: &provisioner,
+                                        Schema: &provisionerSchema,
+                                },
+                                &EvalValidateProvisioner{
+                                        ResourceAddr:     addr.Resource,
+                                        Provisioner:      &provisioner,
+                                        Schema:           &provisionerSchema,
+                                        Config:           p,
+                                        ResourceHasCount: hasCount,
+                                },
+                        )
+                }
         }
 
         return seq
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_root_variable.go b/vendor/github.com/hashicorp/terraform/terraform/node_root_variable.go
index cb61a4e..1c30290 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_root_variable.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_root_variable.go
@@ -1,22 +1,44 @@
 package terraform
 
 import (
-        "fmt"
-
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/dag"
 )
 
 // NodeRootVariable represents a root variable input.
 type NodeRootVariable struct {
-        Config *config.Variable
+        Addr   addrs.InputVariable
+        Config *configs.Variable
 }
 
+var (
+        _ GraphNodeSubPath       = (*NodeRootVariable)(nil)
+        _ GraphNodeReferenceable = (*NodeRootVariable)(nil)
+        _ dag.GraphNodeDotter    = (*NodeApplyableModuleVariable)(nil)
+)
+
 func (n *NodeRootVariable) Name() string {
-        result := fmt.Sprintf("var.%s", n.Config.Name)
-        return result
+        return n.Addr.String()
+}
+
+// GraphNodeSubPath
+func (n *NodeRootVariable) Path() addrs.ModuleInstance {
+        return addrs.RootModuleInstance
 }
 
 // GraphNodeReferenceable
-func (n *NodeRootVariable) ReferenceableName() []string {
-        return []string{n.Name()}
+func (n *NodeRootVariable) ReferenceableAddrs() []addrs.Referenceable {
+        return []addrs.Referenceable{n.Addr}
+}
+
+// dag.GraphNodeDotter impl.
+func (n *NodeRootVariable) DotNode(name string, opts *dag.DotOpts) *dag.DotNode {
+        return &dag.DotNode{
+                Name: name,
+                Attrs: map[string]string{
+                        "label": n.Name(),
+                        "shape": "note",
+                },
+        }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/path.go b/vendor/github.com/hashicorp/terraform/terraform/path.go
index 51dd412..9757446 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/path.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/path.go
@@ -1,10 +1,17 @@
 package terraform
 
 import (
-        "strings"
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
 )
 
-// PathCacheKey returns a cache key for a module path.
-func PathCacheKey(path []string) string {
-        return strings.Join(path, "|")
+// PathObjectCacheKey is like PathCacheKey but includes an additional name
+// to be included in the key, for module-namespaced objects.
+//
+// The result of this function is guaranteed unique for any distinct pair
+// of path and name, but is not guaranteed to be in any particular format
+// and in particular should never be shown to end-users.
+func PathObjectCacheKey(path addrs.ModuleInstance, objectName string) string {
+        return fmt.Sprintf("%s|%s", path.String(), objectName)
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/plan.go b/vendor/github.com/hashicorp/terraform/terraform/plan.go
index 30db195..af04c6c 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/plan.go
@@ -3,14 +3,13 @@ package terraform
 import (
         "bytes"
         "encoding/gob"
-        "errors"
         "fmt"
         "io"
-        "log"
         "sync"
 
-        "github.com/hashicorp/terraform/config/module"
-        "github.com/hashicorp/terraform/version"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/configs"
 )
 
 func init() {
@@ -31,9 +30,9 @@ type Plan struct {
         // plan is applied.
         Diff *Diff
 
-        // Module represents the entire configuration that was present when this
+        // Config represents the entire configuration that was present when this
         // plan was created.
-        Module *module.Tree
+        Config *configs.Config
 
         // State is the Terraform state that was current when this plan was
         // created.
@@ -44,7 +43,7 @@ type Plan struct {
 
         // Vars retains the variables that were set when creating the plan, so
         // that the same variables can be applied during apply.
-        Vars map[string]interface{}
+        Vars map[string]cty.Value
 
         // Targets, if non-empty, contains a set of resource address strings that
         // identify graph nodes that were selected as targets for plan.
@@ -78,64 +77,6 @@ type Plan struct {
         once sync.Once
 }
 
-// Context returns a Context with the data encapsulated in this plan.
-//
-// The following fields in opts are overridden by the plan: Config,
-// Diff, Variables.
-//
-// If State is not provided, it is set from the plan. If it _is_ provided,
-// it must be Equal to the state stored in plan, but may have a newer
-// serial.
-func (p *Plan) Context(opts *ContextOpts) (*Context, error) {
-        var err error
-        opts, err = p.contextOpts(opts)
-        if err != nil {
-                return nil, err
-        }
-        return NewContext(opts)
-}
-
-// contextOpts mutates the given base ContextOpts in place to use input
-// objects obtained from the receiving plan.
-func (p *Plan) contextOpts(base *ContextOpts) (*ContextOpts, error) {
-        opts := base
-
-        opts.Diff = p.Diff
-        opts.Module = p.Module
-        opts.Targets = p.Targets
-        opts.ProviderSHA256s = p.ProviderSHA256s
-        opts.Destroy = p.Destroy
-
-        if opts.State == nil {
-                opts.State = p.State
-        } else if !opts.State.Equal(p.State) {
-                // Even if we're overriding the state, it should be logically equal
-                // to what's in plan. The only valid change to have made by the time
-                // we get here is to have incremented the serial.
-                //
-                // Due to the fact that serialization may change the representation of
-                // the state, there is little chance that these aren't actually equal.
-                // Log the error condition for reference, but continue with the state
-                // we have.
-                log.Println("[WARN] Plan state and ContextOpts state are not equal")
-        }
-
-        thisVersion := version.String()
-        if p.TerraformVersion != "" && p.TerraformVersion != thisVersion {
-                return nil, fmt.Errorf(
-                        "plan was created with a different version of Terraform (created with %s, but running %s)",
-                        p.TerraformVersion, thisVersion,
-                )
-        }
-
-        opts.Variables = make(map[string]interface{})
-        for k, v := range p.Vars {
-                opts.Variables[k] = v
-        }
-
-        return opts, nil
-}
-
 func (p *Plan) String() string {
         buf := new(bytes.Buffer)
         buf.WriteString("DIFF:\n\n")
@@ -158,7 +99,7 @@ func (p *Plan) init() {
                 }
 
                 if p.Vars == nil {
-                        p.Vars = make(map[string]interface{})
+                        p.Vars = make(map[string]cty.Value)
                 }
         })
 }
@@ -172,63 +113,10 @@ const planFormatVersion byte = 2
 // ReadPlan reads a plan structure out of a reader in the format that
 // was written by WritePlan.
 func ReadPlan(src io.Reader) (*Plan, error) {
-        var result *Plan
-        var err error
-        n := 0
-
-        // Verify the magic bytes
-        magic := make([]byte, len(planFormatMagic))
-        for n < len(magic) {
-                n, err = src.Read(magic[n:])
-                if err != nil {
-                        return nil, fmt.Errorf("error while reading magic bytes: %s", err)
-                }
-        }
-        if string(magic) != planFormatMagic {
-                return nil, fmt.Errorf("not a valid plan file")
-        }
-
-        // Verify the version is something we can read
-        var formatByte [1]byte
-        n, err = src.Read(formatByte[:])
-        if err != nil {
-                return nil, err
-        }
-        if n != len(formatByte) {
-                return nil, errors.New("failed to read plan version byte")
-        }
-
-        if formatByte[0] != planFormatVersion {
-                return nil, fmt.Errorf("unknown plan file version: %d", formatByte[0])
-        }
-
-        dec := gob.NewDecoder(src)
-        if err := dec.Decode(&result); err != nil {
-                return nil, err
-        }
-
-        return result, nil
+        return nil, fmt.Errorf("terraform.ReadPlan is no longer in use; use planfile.Open instead")
 }
 
 // WritePlan writes a plan somewhere in a binary format.
 func WritePlan(d *Plan, dst io.Writer) error {
-        // Write the magic bytes so we can determine the file format later
-        n, err := dst.Write([]byte(planFormatMagic))
-        if err != nil {
-                return err
-        }
-        if n != len(planFormatMagic) {
-                return errors.New("failed to write plan format magic bytes")
-        }
-
-        // Write a version byte so we can iterate on version at some point
-        n, err = dst.Write([]byte{planFormatVersion})
-        if err != nil {
-                return err
-        }
-        if n != 1 {
-                return errors.New("failed to write plan version byte")
-        }
-
-        return gob.NewEncoder(dst).Encode(d)
+        return fmt.Errorf("terraform.WritePlan is no longer in use; use planfile.Create instead")
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/provider_mock.go b/vendor/github.com/hashicorp/terraform/terraform/provider_mock.go
new file mode 100644
index 0000000..4ae346d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/provider_mock.go
@@ -0,0 +1,522 @@
+package terraform
+
+import (
+        "encoding/json"
+        "fmt"
+        "sync"
+
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+var _ providers.Interface = (*MockProvider)(nil)
+
+// MockProvider implements providers.Interface but mocks out all the
+// calls for testing purposes.
+type MockProvider struct {
+        sync.Mutex
+
+        // Anything you want, in case you need to store extra data with the mock.
+        Meta interface{}
+
+        GetSchemaCalled bool
+        GetSchemaReturn *ProviderSchema // This is using ProviderSchema directly rather than providers.GetSchemaResponse for compatibility with old tests
+
+        PrepareProviderConfigCalled   bool
+        PrepareProviderConfigResponse providers.PrepareProviderConfigResponse
+        PrepareProviderConfigRequest  providers.PrepareProviderConfigRequest
+        PrepareProviderConfigFn       func(providers.PrepareProviderConfigRequest) providers.PrepareProviderConfigResponse
+
+        ValidateResourceTypeConfigCalled   bool
+        ValidateResourceTypeConfigTypeName string
+        ValidateResourceTypeConfigResponse providers.ValidateResourceTypeConfigResponse
+        ValidateResourceTypeConfigRequest  providers.ValidateResourceTypeConfigRequest
+        ValidateResourceTypeConfigFn       func(providers.ValidateResourceTypeConfigRequest) providers.ValidateResourceTypeConfigResponse
+
+        ValidateDataSourceConfigCalled   bool
+        ValidateDataSourceConfigTypeName string
+        ValidateDataSourceConfigResponse providers.ValidateDataSourceConfigResponse
+        ValidateDataSourceConfigRequest  providers.ValidateDataSourceConfigRequest
+        ValidateDataSourceConfigFn       func(providers.ValidateDataSourceConfigRequest) providers.ValidateDataSourceConfigResponse
+
+        UpgradeResourceStateCalled   bool
+        UpgradeResourceStateTypeName string
+        UpgradeResourceStateResponse providers.UpgradeResourceStateResponse
+        UpgradeResourceStateRequest  providers.UpgradeResourceStateRequest
+        UpgradeResourceStateFn       func(providers.UpgradeResourceStateRequest) providers.UpgradeResourceStateResponse
+
+        ConfigureCalled   bool
+        ConfigureResponse providers.ConfigureResponse
+        ConfigureRequest  providers.ConfigureRequest
+        ConfigureNewFn    func(providers.ConfigureRequest) providers.ConfigureResponse // Named ConfigureNewFn so we can still have the legacy ConfigureFn declared below
+
+        StopCalled   bool
+        StopFn       func() error
+        StopResponse error
+
+        ReadResourceCalled   bool
+        ReadResourceResponse providers.ReadResourceResponse
+        ReadResourceRequest  providers.ReadResourceRequest
+        ReadResourceFn       func(providers.ReadResourceRequest) providers.ReadResourceResponse
+
+        PlanResourceChangeCalled   bool
+        PlanResourceChangeResponse providers.PlanResourceChangeResponse
+        PlanResourceChangeRequest  providers.PlanResourceChangeRequest
+        PlanResourceChangeFn       func(providers.PlanResourceChangeRequest) providers.PlanResourceChangeResponse
+
+        ApplyResourceChangeCalled   bool
+        ApplyResourceChangeResponse providers.ApplyResourceChangeResponse
+        ApplyResourceChangeRequest  providers.ApplyResourceChangeRequest
+        ApplyResourceChangeFn       func(providers.ApplyResourceChangeRequest) providers.ApplyResourceChangeResponse
+
+        ImportResourceStateCalled   bool
+        ImportResourceStateResponse providers.ImportResourceStateResponse
+        ImportResourceStateRequest  providers.ImportResourceStateRequest
+        ImportResourceStateFn       func(providers.ImportResourceStateRequest) providers.ImportResourceStateResponse
+        // Legacy return type for existing tests, which will be shimmed into an
+        // ImportResourceStateResponse if set
+        ImportStateReturn []*InstanceState
+
+        ReadDataSourceCalled   bool
+        ReadDataSourceResponse providers.ReadDataSourceResponse
+        ReadDataSourceRequest  providers.ReadDataSourceRequest
+        ReadDataSourceFn       func(providers.ReadDataSourceRequest) providers.ReadDataSourceResponse
+
+        CloseCalled bool
+        CloseError  error
+
+        // Legacy callbacks: if these are set, we will shim incoming calls for
+        // new-style methods to these old-fashioned terraform.ResourceProvider
+        // mock callbacks, for the benefit of older tests that were written against
+        // the old mock API.
+        ValidateFn  func(c *ResourceConfig) (ws []string, es []error)
+        ConfigureFn func(c *ResourceConfig) error
+        DiffFn      func(info *InstanceInfo, s *InstanceState, c *ResourceConfig) (*InstanceDiff, error)
+        ApplyFn     func(info *InstanceInfo, s *InstanceState, d *InstanceDiff) (*InstanceState, error)
+}
+
+func (p *MockProvider) GetSchema() providers.GetSchemaResponse {
+        p.Lock()
+        defer p.Unlock()
+        p.GetSchemaCalled = true
+        return p.getSchema()
+}
+
+func (p *MockProvider) getSchema() providers.GetSchemaResponse {
+        // This version of getSchema doesn't do any locking, so it's suitable to
+        // call from other methods of this mock as long as they are already
+        // holding the lock.
+
+        ret := providers.GetSchemaResponse{
+                Provider:      providers.Schema{},
+                DataSources:   map[string]providers.Schema{},
+                ResourceTypes: map[string]providers.Schema{},
+        }
+        if p.GetSchemaReturn != nil {
+                ret.Provider.Block = p.GetSchemaReturn.Provider
+                for n, s := range p.GetSchemaReturn.DataSources {
+                        ret.DataSources[n] = providers.Schema{
+                                Block: s,
+                        }
+                }
+                for n, s := range p.GetSchemaReturn.ResourceTypes {
+                        ret.ResourceTypes[n] = providers.Schema{
+                                Version: int64(p.GetSchemaReturn.ResourceTypeSchemaVersions[n]),
+                                Block:   s,
+                        }
+                }
+        }
+
+        return ret
+}
+
+func (p *MockProvider) PrepareProviderConfig(r providers.PrepareProviderConfigRequest) providers.PrepareProviderConfigResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.PrepareProviderConfigCalled = true
+        p.PrepareProviderConfigRequest = r
+        if p.PrepareProviderConfigFn != nil {
+                return p.PrepareProviderConfigFn(r)
+        }
+        return p.PrepareProviderConfigResponse
+}
+
+func (p *MockProvider) ValidateResourceTypeConfig(r providers.ValidateResourceTypeConfigRequest) providers.ValidateResourceTypeConfigResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ValidateResourceTypeConfigCalled = true
+        p.ValidateResourceTypeConfigRequest = r
+
+        if p.ValidateFn != nil {
+                resp := p.getSchema()
+                schema := resp.Provider.Block
+                rc := NewResourceConfigShimmed(r.Config, schema)
+                warns, errs := p.ValidateFn(rc)
+                ret := providers.ValidateResourceTypeConfigResponse{}
+                for _, warn := range warns {
+                        ret.Diagnostics = ret.Diagnostics.Append(tfdiags.SimpleWarning(warn))
+                }
+                for _, err := range errs {
+                        ret.Diagnostics = ret.Diagnostics.Append(err)
+                }
+        }
+        if p.ValidateResourceTypeConfigFn != nil {
+                return p.ValidateResourceTypeConfigFn(r)
+        }
+
+        return p.ValidateResourceTypeConfigResponse
+}
+
+func (p *MockProvider) ValidateDataSourceConfig(r providers.ValidateDataSourceConfigRequest) providers.ValidateDataSourceConfigResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ValidateDataSourceConfigCalled = true
+        p.ValidateDataSourceConfigRequest = r
+
+        if p.ValidateDataSourceConfigFn != nil {
+                return p.ValidateDataSourceConfigFn(r)
+        }
+
+        return p.ValidateDataSourceConfigResponse
+}
+
+func (p *MockProvider) UpgradeResourceState(r providers.UpgradeResourceStateRequest) providers.UpgradeResourceStateResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        schemas := p.getSchema()
+        schema := schemas.ResourceTypes[r.TypeName]
+        schemaType := schema.Block.ImpliedType()
+
+        p.UpgradeResourceStateCalled = true
+        p.UpgradeResourceStateRequest = r
+
+        if p.UpgradeResourceStateFn != nil {
+                return p.UpgradeResourceStateFn(r)
+        }
+
+        resp := p.UpgradeResourceStateResponse
+
+        if resp.UpgradedState == cty.NilVal {
+                switch {
+                case r.RawStateFlatmap != nil:
+                        v, err := hcl2shim.HCL2ValueFromFlatmap(r.RawStateFlatmap, schemaType)
+                        if err != nil {
+                                resp.Diagnostics = resp.Diagnostics.Append(err)
+                                return resp
+                        }
+                        resp.UpgradedState = v
+                case len(r.RawStateJSON) > 0:
+                        v, err := ctyjson.Unmarshal(r.RawStateJSON, schemaType)
+
+                        if err != nil {
+                                resp.Diagnostics = resp.Diagnostics.Append(err)
+                                return resp
+                        }
+                        resp.UpgradedState = v
+                }
+        }
+        return resp
+}
+
+func (p *MockProvider) Configure(r providers.ConfigureRequest) providers.ConfigureResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ConfigureCalled = true
+        p.ConfigureRequest = r
+
+        if p.ConfigureFn != nil {
+                resp := p.getSchema()
+                schema := resp.Provider.Block
+                rc := NewResourceConfigShimmed(r.Config, schema)
+                ret := providers.ConfigureResponse{}
+
+                err := p.ConfigureFn(rc)
+                if err != nil {
+                        ret.Diagnostics = ret.Diagnostics.Append(err)
+                }
+                return ret
+        }
+        if p.ConfigureNewFn != nil {
+                return p.ConfigureNewFn(r)
+        }
+
+        return p.ConfigureResponse
+}
+
+func (p *MockProvider) Stop() error {
+        // We intentionally don't lock in this one because the whole point of this
+        // method is to be called concurrently with another operation that can
+        // be cancelled.  The provider itself is responsible for handling
+        // any concurrency concerns in this case.
+
+        p.StopCalled = true
+        if p.StopFn != nil {
+                return p.StopFn()
+        }
+
+        return p.StopResponse
+}
+
+func (p *MockProvider) ReadResource(r providers.ReadResourceRequest) providers.ReadResourceResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ReadResourceCalled = true
+        p.ReadResourceRequest = r
+
+        if p.ReadResourceFn != nil {
+                return p.ReadResourceFn(r)
+        }
+
+        // make sure the NewState fits the schema
+        newState, err := p.GetSchemaReturn.ResourceTypes[r.TypeName].CoerceValue(p.ReadResourceResponse.NewState)
+        if err != nil {
+                panic(err)
+        }
+        resp := p.ReadResourceResponse
+        resp.NewState = newState
+
+        return resp
+}
+
+func (p *MockProvider) PlanResourceChange(r providers.PlanResourceChangeRequest) providers.PlanResourceChangeResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.PlanResourceChangeCalled = true
+        p.PlanResourceChangeRequest = r
+
+        if p.DiffFn != nil {
+                ps := p.getSchema()
+                if ps.ResourceTypes == nil || ps.ResourceTypes[r.TypeName].Block == nil {
+                        return providers.PlanResourceChangeResponse{
+                                Diagnostics: tfdiags.Diagnostics(nil).Append(fmt.Printf("mock provider has no schema for resource type %s", r.TypeName)),
+                        }
+                }
+                schema := ps.ResourceTypes[r.TypeName].Block
+                info := &InstanceInfo{
+                        Type: r.TypeName,
+                }
+                priorState := NewInstanceStateShimmedFromValue(r.PriorState, 0)
+                cfg := NewResourceConfigShimmed(r.Config, schema)
+
+                legacyDiff, err := p.DiffFn(info, priorState, cfg)
+
+                var res providers.PlanResourceChangeResponse
+                res.PlannedState = r.ProposedNewState
+                if err != nil {
+                        res.Diagnostics = res.Diagnostics.Append(err)
+                }
+                if legacyDiff != nil {
+                        newVal, err := legacyDiff.ApplyToValue(r.PriorState, schema)
+                        if err != nil {
+                                res.Diagnostics = res.Diagnostics.Append(err)
+                        }
+
+                        res.PlannedState = newVal
+
+                        var requiresNew []string
+                        for attr, d := range legacyDiff.Attributes {
+                                if d.RequiresNew {
+                                        requiresNew = append(requiresNew, attr)
+                                }
+                        }
+                        requiresReplace, err := hcl2shim.RequiresReplace(requiresNew, schema.ImpliedType())
+                        if err != nil {
+                                res.Diagnostics = res.Diagnostics.Append(err)
+                        }
+                        res.RequiresReplace = requiresReplace
+                }
+                return res
+        }
+        if p.PlanResourceChangeFn != nil {
+                return p.PlanResourceChangeFn(r)
+        }
+
+        return p.PlanResourceChangeResponse
+}
+
+func (p *MockProvider) ApplyResourceChange(r providers.ApplyResourceChangeRequest) providers.ApplyResourceChangeResponse {
+        p.Lock()
+        p.ApplyResourceChangeCalled = true
+        p.ApplyResourceChangeRequest = r
+        p.Unlock()
+
+        if p.ApplyFn != nil {
+                // ApplyFn is a special callback fashioned after our old provider
+                // interface, which expected to be given an actual diff rather than
+                // separate old/new values to apply. Therefore we need to approximate
+                // a diff here well enough that _most_ of our legacy ApplyFns in old
+                // tests still see the behavior they are expecting. New tests should
+                // not use this, and should instead use ApplyResourceChangeFn directly.
+                providerSchema := p.getSchema()
+                schema, ok := providerSchema.ResourceTypes[r.TypeName]
+                if !ok {
+                        return providers.ApplyResourceChangeResponse{
+                                Diagnostics: tfdiags.Diagnostics(nil).Append(fmt.Errorf("no mocked schema available for resource type %s", r.TypeName)),
+                        }
+                }
+
+                info := &InstanceInfo{
+                        Type: r.TypeName,
+                }
+
+                priorVal := r.PriorState
+                plannedVal := r.PlannedState
+                priorMap := hcl2shim.FlatmapValueFromHCL2(priorVal)
+                plannedMap := hcl2shim.FlatmapValueFromHCL2(plannedVal)
+                s := NewInstanceStateShimmedFromValue(priorVal, 0)
+                d := &InstanceDiff{
+                        Attributes: make(map[string]*ResourceAttrDiff),
+                }
+                if plannedMap == nil { // destroying, then
+                        d.Destroy = true
+                        // Destroy diffs don't have any attribute diffs
+                } else {
+                        if priorMap == nil { // creating, then
+                                // We'll just make an empty prior map to make things easier below.
+                                priorMap = make(map[string]string)
+                        }
+
+                        for k, new := range plannedMap {
+                                old := priorMap[k]
+                                newComputed := false
+                                if new == config.UnknownVariableValue {
+                                        new = ""
+                                        newComputed = true
+                                }
+                                d.Attributes[k] = &ResourceAttrDiff{
+                                        Old:         old,
+                                        New:         new,
+                                        NewComputed: newComputed,
+                                        Type:        DiffAttrInput, // not generally used in tests, so just hard-coded
+                                }
+                        }
+                        // Also need any attributes that were removed in "planned"
+                        for k, old := range priorMap {
+                                if _, ok := plannedMap[k]; ok {
+                                        continue
+                                }
+                                d.Attributes[k] = &ResourceAttrDiff{
+                                        Old:        old,
+                                        NewRemoved: true,
+                                        Type:       DiffAttrInput,
+                                }
+                        }
+                }
+                newState, err := p.ApplyFn(info, s, d)
+                resp := providers.ApplyResourceChangeResponse{}
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                }
+                if newState != nil {
+                        var newVal cty.Value
+                        if newState != nil {
+                                var err error
+                                newVal, err = newState.AttrsAsObjectValue(schema.Block.ImpliedType())
+                                if err != nil {
+                                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                                }
+                        } else {
+                                // If apply returned a nil new state then that's the old way to
+                                // indicate that the object was destroyed. Our new interface calls
+                                // for that to be signalled as a null value.
+                                newVal = cty.NullVal(schema.Block.ImpliedType())
+                        }
+                        resp.NewState = newVal
+                }
+
+                return resp
+        }
+        if p.ApplyResourceChangeFn != nil {
+                return p.ApplyResourceChangeFn(r)
+        }
+
+        return p.ApplyResourceChangeResponse
+}
+
+func (p *MockProvider) ImportResourceState(r providers.ImportResourceStateRequest) providers.ImportResourceStateResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        if p.ImportStateReturn != nil {
+                for _, is := range p.ImportStateReturn {
+                        if is.Attributes == nil {
+                                is.Attributes = make(map[string]string)
+                        }
+                        is.Attributes["id"] = is.ID
+
+                        typeName := is.Ephemeral.Type
+                        // Use the requested type if the resource has no type of it's own.
+                        // We still return the empty type, which will error, but this prevents a panic.
+                        if typeName == "" {
+                                typeName = r.TypeName
+                        }
+
+                        schema := p.GetSchemaReturn.ResourceTypes[typeName]
+                        if schema == nil {
+                                panic("no schema found for " + typeName)
+                        }
+
+                        private, err := json.Marshal(is.Meta)
+                        if err != nil {
+                                panic(err)
+                        }
+
+                        state, err := hcl2shim.HCL2ValueFromFlatmap(is.Attributes, schema.ImpliedType())
+                        if err != nil {
+                                panic(err)
+                        }
+
+                        state, err = schema.CoerceValue(state)
+                        if err != nil {
+                                panic(err)
+                        }
+
+                        p.ImportResourceStateResponse.ImportedResources = append(
+                                p.ImportResourceStateResponse.ImportedResources,
+                                providers.ImportedResource{
+                                        TypeName: is.Ephemeral.Type,
+                                        State:    state,
+                                        Private:  private,
+                                })
+                }
+        }
+
+        p.ImportResourceStateCalled = true
+        p.ImportResourceStateRequest = r
+        if p.ImportResourceStateFn != nil {
+                return p.ImportResourceStateFn(r)
+        }
+
+        return p.ImportResourceStateResponse
+}
+
+func (p *MockProvider) ReadDataSource(r providers.ReadDataSourceRequest) providers.ReadDataSourceResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ReadDataSourceCalled = true
+        p.ReadDataSourceRequest = r
+
+        if p.ReadDataSourceFn != nil {
+                return p.ReadDataSourceFn(r)
+        }
+
+        return p.ReadDataSourceResponse
+}
+
+func (p *MockProvider) Close() error {
+        p.CloseCalled = true
+        return p.CloseError
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/provisioner_mock.go b/vendor/github.com/hashicorp/terraform/terraform/provisioner_mock.go
new file mode 100644
index 0000000..f595891
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/provisioner_mock.go
@@ -0,0 +1,154 @@
+package terraform
+
+import (
+        "fmt"
+        "sync"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+
+        "github.com/hashicorp/terraform/provisioners"
+)
+
+var _ provisioners.Interface = (*MockProvisioner)(nil)
+
+// MockProvisioner implements provisioners.Interface but mocks out all the
+// calls for testing purposes.
+type MockProvisioner struct {
+        sync.Mutex
+        // Anything you want, in case you need to store extra data with the mock.
+        Meta interface{}
+
+        GetSchemaCalled   bool
+        GetSchemaResponse provisioners.GetSchemaResponse
+
+        ValidateProvisionerConfigCalled   bool
+        ValidateProvisionerConfigRequest  provisioners.ValidateProvisionerConfigRequest
+        ValidateProvisionerConfigResponse provisioners.ValidateProvisionerConfigResponse
+        ValidateProvisionerConfigFn       func(provisioners.ValidateProvisionerConfigRequest) provisioners.ValidateProvisionerConfigResponse
+
+        ProvisionResourceCalled   bool
+        ProvisionResourceRequest  provisioners.ProvisionResourceRequest
+        ProvisionResourceResponse provisioners.ProvisionResourceResponse
+        ProvisionResourceFn       func(provisioners.ProvisionResourceRequest) provisioners.ProvisionResourceResponse
+
+        StopCalled   bool
+        StopResponse error
+        StopFn       func() error
+
+        CloseCalled   bool
+        CloseResponse error
+        CloseFn       func() error
+
+        // Legacy callbacks: if these are set, we will shim incoming calls for
+        // new-style methods to these old-fashioned terraform.ResourceProvider
+        // mock callbacks, for the benefit of older tests that were written against
+        // the old mock API.
+        ApplyFn func(rs *InstanceState, c *ResourceConfig) error
+}
+
+func (p *MockProvisioner) GetSchema() provisioners.GetSchemaResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.GetSchemaCalled = true
+        return p.getSchema()
+}
+
+// getSchema is the implementation of GetSchema, which can be called from other
+// methods on MockProvisioner that may already be holding the lock.
+func (p *MockProvisioner) getSchema() provisioners.GetSchemaResponse {
+        return p.GetSchemaResponse
+}
+
+func (p *MockProvisioner) ValidateProvisionerConfig(r provisioners.ValidateProvisionerConfigRequest) provisioners.ValidateProvisionerConfigResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ValidateProvisionerConfigCalled = true
+        p.ValidateProvisionerConfigRequest = r
+        if p.ValidateProvisionerConfigFn != nil {
+                return p.ValidateProvisionerConfigFn(r)
+        }
+        return p.ValidateProvisionerConfigResponse
+}
+
+func (p *MockProvisioner) ProvisionResource(r provisioners.ProvisionResourceRequest) provisioners.ProvisionResourceResponse {
+        p.Lock()
+        defer p.Unlock()
+
+        p.ProvisionResourceCalled = true
+        p.ProvisionResourceRequest = r
+        if p.ApplyFn != nil {
+                if !r.Config.IsKnown() {
+                        panic(fmt.Sprintf("cannot provision with unknown value: %#v", r.Config))
+                }
+
+                schema := p.getSchema()
+                rc := NewResourceConfigShimmed(r.Config, schema.Provisioner)
+                connVal := r.Connection
+                connMap := map[string]string{}
+
+                if !connVal.IsNull() && connVal.IsKnown() {
+                        for it := connVal.ElementIterator(); it.Next(); {
+                                ak, av := it.Element()
+                                name := ak.AsString()
+
+                                if !av.IsKnown() || av.IsNull() {
+                                        continue
+                                }
+
+                                av, _ = convert.Convert(av, cty.String)
+                                connMap[name] = av.AsString()
+                        }
+                }
+
+                // We no longer pass the full instance state to a provisioner, so we'll
+                // construct a partial one that should be good enough for what existing
+                // test mocks need.
+                is := &InstanceState{
+                        Ephemeral: EphemeralState{
+                                ConnInfo: connMap,
+                        },
+                }
+                var resp provisioners.ProvisionResourceResponse
+                err := p.ApplyFn(is, rc)
+                if err != nil {
+                        resp.Diagnostics = resp.Diagnostics.Append(err)
+                }
+                return resp
+        }
+        if p.ProvisionResourceFn != nil {
+                fn := p.ProvisionResourceFn
+                p.Unlock()
+                return fn(r)
+        }
+
+        return p.ProvisionResourceResponse
+}
+
+func (p *MockProvisioner) Stop() error {
+        // We intentionally don't lock in this one because the whole point of this
+        // method is to be called concurrently with another operation that can
+        // be cancelled. The provisioner itself is responsible for handling
+        // any concurrency concerns in this case.
+
+        p.StopCalled = true
+        if p.StopFn != nil {
+                return p.StopFn()
+        }
+
+        return p.StopResponse
+}
+
+func (p *MockProvisioner) Close() error {
+        p.Lock()
+        defer p.Unlock()
+
+        p.CloseCalled = true
+        if p.CloseFn != nil {
+                return p.CloseFn()
+        }
+
+        return p.CloseResponse
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource.go b/vendor/github.com/hashicorp/terraform/terraform/resource.go
index 2f5ebb5..2cd6c5b 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource.go
@@ -7,9 +7,14 @@ import (
         "strconv"
         "strings"
 
-        "github.com/hashicorp/terraform/config"
         "github.com/mitchellh/copystructure"
         "github.com/mitchellh/reflectwalk"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/configs/configschema"
 )
 
 // ResourceProvisionerConfig is used to pair a provisioner
@@ -25,9 +30,10 @@ type ResourceProvisionerConfig struct {
         ConnInfo    *config.RawConfig
 }
 
-// Resource encapsulates a resource, its configuration, its provider,
-// its current state, and potentially a desired diff from the state it
-// wants to reach.
+// Resource is a legacy way to identify a particular resource instance.
+//
+// New code should use addrs.ResourceInstance instead. This is still here
+// only for codepaths that haven't been updated yet.
 type Resource struct {
         // These are all used by the new EvalNode stuff.
         Name       string
@@ -47,6 +53,31 @@ type Resource struct {
         Flags        ResourceFlag
 }
 
+// NewResource constructs a legacy Resource object from an
+// addrs.ResourceInstance value.
+//
+// This is provided to shim to old codepaths that haven't been updated away
+// from this type yet. Since this old type is not able to represent instances
+// that have string keys, this function will panic if given a resource address
+// that has a string key.
+func NewResource(addr addrs.ResourceInstance) *Resource {
+        ret := &Resource{
+                Name: addr.Resource.Name,
+                Type: addr.Resource.Type,
+        }
+
+        if addr.Key != addrs.NoKey {
+                switch tk := addr.Key.(type) {
+                case addrs.IntKey:
+                        ret.CountIndex = int(tk)
+                default:
+                        panic(fmt.Errorf("resource instance with key %#v is not supported", addr.Key))
+                }
+        }
+
+        return ret
+}
+
 // ResourceKind specifies what kind of instance we're working with, whether
 // its a primary instance, a tainted instance, or an orphan.
 type ResourceFlag byte
@@ -72,20 +103,53 @@ type InstanceInfo struct {
         uniqueExtra string
 }
 
-// HumanId is a unique Id that is human-friendly and useful for UI elements.
-func (i *InstanceInfo) HumanId() string {
-        if i == nil {
-                return "<nil>"
+// NewInstanceInfo constructs an InstanceInfo from an addrs.AbsResourceInstance.
+//
+// InstanceInfo is a legacy type, and uses of it should be gradually replaced
+// by direct use of addrs.AbsResource or addrs.AbsResourceInstance as
+// appropriate.
+//
+// The legacy InstanceInfo type cannot represent module instances with instance
+// keys, so this function will panic if given such a path. Uses of this type
+// should all be removed or replaced before implementing "count" and "for_each"
+// arguments on modules in order to avoid such panics.
+//
+// This legacy type also cannot represent resource instances with string
+// instance keys. It will panic if the given key is not either NoKey or an
+// IntKey.
+func NewInstanceInfo(addr addrs.AbsResourceInstance) *InstanceInfo {
+        // We need an old-style []string module path for InstanceInfo.
+        path := make([]string, len(addr.Module))
+        for i, step := range addr.Module {
+                if step.InstanceKey != addrs.NoKey {
+                        panic("NewInstanceInfo cannot convert module instance with key")
+                }
+                path[i] = step.Name
         }
 
-        if len(i.ModulePath) <= 1 {
-                return i.Id
+        // This is a funny old meaning of "id" that is no longer current. It should
+        // not be used for anything users might see. Note that it does not include
+        // a representation of the resource mode, and so it's impossible to
+        // determine from an InstanceInfo alone whether it is a managed or data
+        // resource that is being referred to.
+        id := fmt.Sprintf("%s.%s", addr.Resource.Resource.Type, addr.Resource.Resource.Name)
+        if addr.Resource.Resource.Mode == addrs.DataResourceMode {
+                id = "data." + id
+        }
+        if addr.Resource.Key != addrs.NoKey {
+                switch k := addr.Resource.Key.(type) {
+                case addrs.IntKey:
+                        id = id + fmt.Sprintf(".%d", int(k))
+                default:
+                        panic(fmt.Sprintf("NewInstanceInfo cannot convert resource instance with %T instance key", addr.Resource.Key))
+                }
         }
 
-        return fmt.Sprintf(
-                "module.%s.%s",
-                strings.Join(i.ModulePath[1:], "."),
-                i.Id)
+        return &InstanceInfo{
+                Id:         id,
+                ModulePath: path,
+                Type:       addr.Resource.Resource.Type,
+        }
 }
 
 // ResourceAddress returns the address of the resource that the receiver is describing.
@@ -128,18 +192,9 @@ func (i *InstanceInfo) ResourceAddress() *ResourceAddress {
         return addr
 }
 
-func (i *InstanceInfo) uniqueId() string {
-        prefix := i.HumanId()
-        if v := i.uniqueExtra; v != "" {
-                prefix += " " + v
-        }
-
-        return prefix
-}
-
-// ResourceConfig holds the configuration given for a resource. This is
-// done instead of a raw `map[string]interface{}` type so that rich
-// methods can be added to it to make dealing with it easier.
+// ResourceConfig is a legacy type that was formerly used to represent
+// interpolatable configuration blocks. It is now only used to shim to old
+// APIs that still use this type, via NewResourceConfigShimmed.
 type ResourceConfig struct {
         ComputedKeys []string
         Raw          map[string]interface{}
@@ -155,6 +210,85 @@ func NewResourceConfig(c *config.RawConfig) *ResourceConfig {
         return result
 }
 
+// NewResourceConfigShimmed wraps a cty.Value of object type in a legacy
+// ResourceConfig object, so that it can be passed to older APIs that expect
+// this wrapping.
+//
+// The returned ResourceConfig is already interpolated and cannot be
+// re-interpolated. It is, therefore, useful only to functions that expect
+// an already-populated ResourceConfig which they then treat as read-only.
+//
+// If the given value is not of an object type that conforms to the given
+// schema then this function will panic.
+func NewResourceConfigShimmed(val cty.Value, schema *configschema.Block) *ResourceConfig {
+        if !val.Type().IsObjectType() {
+                panic(fmt.Errorf("NewResourceConfigShimmed given %#v; an object type is required", val.Type()))
+        }
+        ret := &ResourceConfig{}
+
+        legacyVal := hcl2shim.ConfigValueFromHCL2Block(val, schema)
+        if legacyVal != nil {
+                ret.Config = legacyVal
+
+                // Now we need to walk through our structure and find any unknown values,
+                // producing the separate list ComputedKeys to represent these. We use the
+                // schema here so that we can preserve the expected invariant
+                // that an attribute is always either wholly known or wholly unknown, while
+                // a child block can be partially unknown.
+                ret.ComputedKeys = newResourceConfigShimmedComputedKeys(val, "")
+        } else {
+                ret.Config = make(map[string]interface{})
+        }
+        ret.Raw = ret.Config
+
+        return ret
+}
+
+// Record the any config values in ComputedKeys. This field had been unused in
+// helper/schema, but in the new protocol we're using this so that the SDK can
+// now handle having an unknown collection. The legacy diff code doesn't
+// properly handle the unknown, because it can't be expressed in the same way
+// between the config and diff.
+func newResourceConfigShimmedComputedKeys(val cty.Value, path string) []string {
+        var ret []string
+        ty := val.Type()
+
+        if val.IsNull() {
+                return ret
+        }
+
+        if !val.IsKnown() {
+                // we shouldn't have an entirely unknown resource, but prevent empty
+                // strings just in case
+                if len(path) > 0 {
+                        ret = append(ret, path)
+                }
+                return ret
+        }
+
+        if path != "" {
+                path += "."
+        }
+        switch {
+        case ty.IsListType(), ty.IsTupleType(), ty.IsSetType():
+                i := 0
+                for it := val.ElementIterator(); it.Next(); i++ {
+                        _, subVal := it.Element()
+                        keys := newResourceConfigShimmedComputedKeys(subVal, fmt.Sprintf("%s%d", path, i))
+                        ret = append(ret, keys...)
+                }
+
+        case ty.IsMapType(), ty.IsObjectType():
+                for it := val.ElementIterator(); it.Next(); {
+                        subK, subVal := it.Element()
+                        keys := newResourceConfigShimmedComputedKeys(subVal, fmt.Sprintf("%s%s", path, subK.AsString()))
+                        ret = append(ret, keys...)
+                }
+        }
+
+        return ret
+}
+
 // DeepCopy performs a deep copy of the configuration. This makes it safe
 // to modify any of the structures that are part of the resource config without
 // affecting the original configuration.
@@ -374,6 +508,14 @@ func (c *ResourceConfig) get(
 // refactor is complete.
 func (c *ResourceConfig) interpolateForce() {
         if c.raw == nil {
+                // If we don't have a lowercase "raw" but we _do_ have the uppercase
+                // Raw populated then this indicates that we're recieving a shim
+                // ResourceConfig created by NewResourceConfigShimmed, which is already
+                // fully evaluated and thus this function doesn't need to do anything.
+                if c.Raw != nil {
+                        return
+                }
+
                 var err error
                 c.raw, err = config.NewRawConfig(make(map[string]interface{}))
                 if err != nil {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_address.go b/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
index a64f5d8..156ecf5 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
@@ -7,8 +7,10 @@ import (
         "strconv"
         "strings"
 
+        "github.com/hashicorp/terraform/addrs"
+
         "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
 )
 
 // ResourceAddress is a way of identifying an individual resource (or,
@@ -109,30 +111,47 @@ func (r *ResourceAddress) WholeModuleAddress() *ResourceAddress {
         }
 }
 
-// MatchesConfig returns true if the receiver matches the given
-// configuration resource within the given configuration module.
+// MatchesResourceConfig returns true if the receiver matches the given
+// configuration resource within the given _static_ module path. Note that
+// the module path in a resource address is a _dynamic_ module path, and
+// multiple dynamic resource paths may map to a single static path if
+// count and for_each are in use on module calls.
 //
 // Since resource configuration blocks represent all of the instances of
 // a multi-instance resource, the index of the address (if any) is not
 // considered.
-func (r *ResourceAddress) MatchesConfig(mod *module.Tree, rc *config.Resource) bool {
+func (r *ResourceAddress) MatchesResourceConfig(path addrs.Module, rc *configs.Resource) bool {
         if r.HasResourceSpec() {
-                if r.Mode != rc.Mode || r.Type != rc.Type || r.Name != rc.Name {
+                // FIXME: Some ugliness while we are between worlds. Functionality
+                // in "addrs" should eventually replace this ResourceAddress idea
+                // completely, but for now we'll need to translate to the old
+                // way of representing resource modes.
+                switch r.Mode {
+                case config.ManagedResourceMode:
+                        if rc.Mode != addrs.ManagedResourceMode {
+                                return false
+                        }
+                case config.DataResourceMode:
+                        if rc.Mode != addrs.DataResourceMode {
+                                return false
+                        }
+                }
+                if r.Type != rc.Type || r.Name != rc.Name {
                         return false
                 }
         }
 
         addrPath := r.Path
-        cfgPath := mod.Path()
 
         // normalize
         if len(addrPath) == 0 {
                 addrPath = nil
         }
-        if len(cfgPath) == 0 {
-                cfgPath = nil
+        if len(path) == 0 {
+                path = nil
         }
-        return reflect.DeepEqual(addrPath, cfgPath)
+        rawPath := []string(path)
+        return reflect.DeepEqual(addrPath, rawPath)
 }
 
 // stateId returns the ID that this resource should be entered with
@@ -270,6 +289,144 @@ func ParseResourceAddressForInstanceDiff(path []string, key string) (*ResourceAd
         return addr, nil
 }
 
+// NewLegacyResourceAddress creates a ResourceAddress from a new-style
+// addrs.AbsResource value.
+//
+// This is provided for shimming purposes so that we can still easily call into
+// older functions that expect the ResourceAddress type.
+func NewLegacyResourceAddress(addr addrs.AbsResource) *ResourceAddress {
+        ret := &ResourceAddress{
+                Type: addr.Resource.Type,
+                Name: addr.Resource.Name,
+        }
+
+        switch addr.Resource.Mode {
+        case addrs.ManagedResourceMode:
+                ret.Mode = config.ManagedResourceMode
+        case addrs.DataResourceMode:
+                ret.Mode = config.DataResourceMode
+        default:
+                panic(fmt.Errorf("cannot shim %s to legacy config.ResourceMode value", addr.Resource.Mode))
+        }
+
+        path := make([]string, len(addr.Module))
+        for i, step := range addr.Module {
+                if step.InstanceKey != addrs.NoKey {
+                        // At the time of writing this can't happen because we don't
+                        // ket generate keyed module instances. This legacy codepath must
+                        // be removed before we can support "count" and "for_each" for
+                        // modules.
+                        panic(fmt.Errorf("cannot shim module instance step with key %#v to legacy ResourceAddress.Path", step.InstanceKey))
+                }
+
+                path[i] = step.Name
+        }
+        ret.Path = path
+        ret.Index = -1
+
+        return ret
+}
+
+// NewLegacyResourceInstanceAddress creates a ResourceAddress from a new-style
+// addrs.AbsResource value.
+//
+// This is provided for shimming purposes so that we can still easily call into
+// older functions that expect the ResourceAddress type.
+func NewLegacyResourceInstanceAddress(addr addrs.AbsResourceInstance) *ResourceAddress {
+        ret := &ResourceAddress{
+                Type: addr.Resource.Resource.Type,
+                Name: addr.Resource.Resource.Name,
+        }
+
+        switch addr.Resource.Resource.Mode {
+        case addrs.ManagedResourceMode:
+                ret.Mode = config.ManagedResourceMode
+        case addrs.DataResourceMode:
+                ret.Mode = config.DataResourceMode
+        default:
+                panic(fmt.Errorf("cannot shim %s to legacy config.ResourceMode value", addr.Resource.Resource.Mode))
+        }
+
+        path := make([]string, len(addr.Module))
+        for i, step := range addr.Module {
+                if step.InstanceKey != addrs.NoKey {
+                        // At the time of writing this can't happen because we don't
+                        // ket generate keyed module instances. This legacy codepath must
+                        // be removed before we can support "count" and "for_each" for
+                        // modules.
+                        panic(fmt.Errorf("cannot shim module instance step with key %#v to legacy ResourceAddress.Path", step.InstanceKey))
+                }
+
+                path[i] = step.Name
+        }
+        ret.Path = path
+
+        if addr.Resource.Key == addrs.NoKey {
+                ret.Index = -1
+        } else if ik, ok := addr.Resource.Key.(addrs.IntKey); ok {
+                ret.Index = int(ik)
+        } else {
+                panic(fmt.Errorf("cannot shim resource instance with key %#v to legacy ResourceAddress.Index", addr.Resource.Key))
+        }
+
+        return ret
+}
+
+// AbsResourceInstanceAddr converts the receiver, a legacy resource address, to
+// the new resource address type addrs.AbsResourceInstance.
+//
+// This method can be used only on an address that has a resource specification.
+// It will panic if called on a module-path-only ResourceAddress. Use
+// method HasResourceSpec to check before calling, in contexts where it is
+// unclear.
+//
+// addrs.AbsResourceInstance does not represent the "tainted" and "deposed"
+// states, and so if these are present on the receiver then they are discarded.
+//
+// This is provided for shimming purposes so that we can easily adapt functions
+// that are returning the legacy ResourceAddress type, for situations where
+// the new type is required.
+func (addr *ResourceAddress) AbsResourceInstanceAddr() addrs.AbsResourceInstance {
+        if !addr.HasResourceSpec() {
+                panic("AbsResourceInstanceAddr called on ResourceAddress with no resource spec")
+        }
+
+        ret := addrs.AbsResourceInstance{
+                Module: addr.ModuleInstanceAddr(),
+                Resource: addrs.ResourceInstance{
+                        Resource: addrs.Resource{
+                                Type: addr.Type,
+                                Name: addr.Name,
+                        },
+                },
+        }
+
+        switch addr.Mode {
+        case config.ManagedResourceMode:
+                ret.Resource.Resource.Mode = addrs.ManagedResourceMode
+        case config.DataResourceMode:
+                ret.Resource.Resource.Mode = addrs.DataResourceMode
+        default:
+                panic(fmt.Errorf("cannot shim %s to addrs.ResourceMode value", addr.Mode))
+        }
+
+        if addr.Index != -1 {
+                ret.Resource.Key = addrs.IntKey(addr.Index)
+        }
+
+        return ret
+}
+
+// ModuleInstanceAddr returns the module path portion of the receiver as a
+// addrs.ModuleInstance value.
+func (addr *ResourceAddress) ModuleInstanceAddr() addrs.ModuleInstance {
+        path := make(addrs.ModuleInstance, len(addr.Path))
+        for i, name := range addr.Path {
+                path[i] = addrs.ModuleInstanceStep{Name: name}
+        }
+        return path
+}
+
 // Contains returns true if and only if the given node is contained within
 // the receiver.
 //
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go b/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go
index 93fd14f..3455ad8 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go
@@ -3,8 +3,10 @@ package terraform
 import (
         "fmt"
 
-        multierror "github.com/hashicorp/go-multierror"
+        "github.com/hashicorp/terraform/tfdiags"
+
         "github.com/hashicorp/terraform/plugin/discovery"
+        "github.com/hashicorp/terraform/providers"
 )
 
 // ResourceProvider is an interface that must be implemented by any
@@ -30,13 +32,12 @@ type ResourceProvider interface {
         // resource or data source has the SchemaAvailable flag set.
         GetSchema(*ProviderSchemaRequest) (*ProviderSchema, error)
 
-        // Input is called to ask the provider to ask the user for input
-        // for completing the configuration if necesarry.
+        // Input was used prior to v0.12 to ask the provider to prompt the user
+        // for input to complete the configuration.
         //
-        // This may or may not be called, so resource provider writers shouldn't
-        // rely on this being available to set some default values for validate
-        // later. Example of a situation where this wouldn't be called is if
-        // the user is not using a TTY.
+        // From v0.12 onwards this method is never called because Terraform Core
+        // is able to handle the necessary input logic itself based on the
+        // schema returned from GetSchema.
         Input(UIInput, *ResourceConfig) (*ResourceConfig, error)
 
         // Validate is called once at the beginning with the raw configuration
@@ -170,18 +171,6 @@ type ResourceProvider interface {
         ReadDataApply(*InstanceInfo, *InstanceDiff) (*InstanceState, error)
 }
 
-// ResourceProviderError may be returned when creating a Context if the
-// required providers cannot be satisfied. This error can then be used to
-// format a more useful message for the user.
-type ResourceProviderError struct {
-        Errors []error
-}
-
-func (e *ResourceProviderError) Error() string {
-        // use multierror to format the default output
-        return multierror.Append(nil, e.Errors...).Error()
-}
-
 // ResourceProviderCloser is an interface that providers that can close
 // connections that aren't needed anymore must implement.
 type ResourceProviderCloser interface {
@@ -296,13 +285,35 @@ func ProviderHasDataSource(p ResourceProvider, n string) bool {
 // This should be called only with configurations that have passed calls
 // to config.Validate(), which ensures that all of the given version
 // constraints are valid. It will panic if any invalid constraints are present.
-func resourceProviderFactories(resolver ResourceProviderResolver, reqd discovery.PluginRequirements) (map[string]ResourceProviderFactory, error) {
+func resourceProviderFactories(resolver providers.Resolver, reqd discovery.PluginRequirements) (map[string]providers.Factory, tfdiags.Diagnostics) {
+        var diags tfdiags.Diagnostics
         ret, errs := resolver.ResolveProviders(reqd)
         if errs != nil {
-                return nil, &ResourceProviderError{
-                        Errors: errs,
+                diags = diags.Append(
+                        tfdiags.Sourceless(tfdiags.Error,
+                                "Could not satisfy plugin requirements",
+                                errPluginInit,
+                        ),
+                )
+
+                for _, err := range errs {
+                        diags = diags.Append(err)
                 }
+
+                return nil, diags
         }
 
         return ret, nil
 }
+
+const errPluginInit = `
+Plugin reinitialization required. Please run "terraform init".
+
+Plugins are external binaries that Terraform uses to access and manipulate
+resources. The configuration provided requires plugins which can't be located,
+don't satisfy the version constraints, or are otherwise incompatible.
+
+Terraform automatically discovers provider requirements from your
+configuration, including providers used in child modules. To see the
+requirements and constraints from each module, run "terraform providers".
+`
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner.go b/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner.go
index 361ec1e..2743dd7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner.go
@@ -1,9 +1,21 @@
 package terraform
 
+import (
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/provisioners"
+)
+
 // ResourceProvisioner is an interface that must be implemented by any
 // resource provisioner: the thing that initializes resources in
 // a Terraform configuration.
 type ResourceProvisioner interface {
+        // GetConfigSchema returns the schema for the provisioner type's main
+        // configuration block. This is called prior to Validate to enable some
+        // basic structural validation to be performed automatically and to allow
+        // the configuration to be properly extracted from potentially-ambiguous
+        // configuration file formats.
+        GetConfigSchema() (*configschema.Block, error)
+
         // Validate is called once at the beginning with the raw
         // configuration (no interpolation done) and can return a list of warnings
         // and/or errors.
@@ -52,3 +64,7 @@ type ResourceProvisionerCloser interface {
 // ResourceProvisionerFactory is a function type that creates a new instance
 // of a resource provisioner.
 type ResourceProvisionerFactory func() (ResourceProvisioner, error)
+
+// ProvisionerFactory is a function type that creates a new instance
+// of a provisioners.Interface.
+type ProvisionerFactory = provisioners.Factory
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner_mock.go b/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner_mock.go
index f471a51..7b88cf7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner_mock.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_provisioner_mock.go
@@ -1,6 +1,10 @@
 package terraform
 
-import "sync"
+import (
+        "sync"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+)
 
 // MockResourceProvisioner implements ResourceProvisioner but mocks out all the
 // calls for testing purposes.
@@ -9,6 +13,10 @@ type MockResourceProvisioner struct {
         // Anything you want, in case you need to store extra data with the mock.
         Meta interface{}
 
+        GetConfigSchemaCalled       bool
+        GetConfigSchemaReturnSchema *configschema.Block
+        GetConfigSchemaReturnError  error
+
         ApplyCalled      bool
         ApplyOutput      UIOutput
         ApplyState       *InstanceState
@@ -27,6 +35,13 @@ type MockResourceProvisioner struct {
         StopReturnError error
 }
 
+var _ ResourceProvisioner = (*MockResourceProvisioner)(nil)
+
+func (p *MockResourceProvisioner) GetConfigSchema() (*configschema.Block, error) {
+        p.GetConfigSchemaCalled = true
+        return p.GetConfigSchemaReturnSchema, p.GetConfigSchemaReturnError
+}
+
 func (p *MockResourceProvisioner) Validate(c *ResourceConfig) ([]string, []error) {
         p.Lock()
         defer p.Unlock()
diff --git a/vendor/github.com/hashicorp/terraform/terraform/schemas.go b/vendor/github.com/hashicorp/terraform/terraform/schemas.go
index ec46efc..62991c8 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/schemas.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/schemas.go
@@ -1,18 +1,239 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/configschema"
+        "fmt"
+        "log"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
+// Schemas is a container for various kinds of schema that Terraform needs
+// during processing.
 type Schemas struct {
-        Providers ProviderSchemas
+        Providers    map[string]*ProviderSchema
+        Provisioners map[string]*configschema.Block
+}
+
+// ProviderSchema returns the entire ProviderSchema object that was produced
+// by the plugin for the given provider, or nil if no such schema is available.
+//
+// It's usually better to go use the more precise methods offered by type
+// Schemas to handle this detail automatically.
+func (ss *Schemas) ProviderSchema(typeName string) *ProviderSchema {
+        if ss.Providers == nil {
+                return nil
+        }
+        return ss.Providers[typeName]
+}
+
+// ProviderConfig returns the schema for the provider configuration of the
+// given provider type, or nil if no such schema is available.
+func (ss *Schemas) ProviderConfig(typeName string) *configschema.Block {
+        ps := ss.ProviderSchema(typeName)
+        if ps == nil {
+                return nil
+        }
+        return ps.Provider
+}
+
+// ResourceTypeConfig returns the schema for the configuration of a given
+// resource type belonging to a given provider type, or nil of no such
+// schema is available.
+//
+// In many cases the provider type is inferrable from the resource type name,
+// but this is not always true because users can override the provider for
+// a resource using the "provider" meta-argument. Therefore it's important to
+// always pass the correct provider name, even though it many cases it feels
+// redundant.
+func (ss *Schemas) ResourceTypeConfig(providerType string, resourceMode addrs.ResourceMode, resourceType string) (block *configschema.Block, schemaVersion uint64) {
+        ps := ss.ProviderSchema(providerType)
+        if ps == nil || ps.ResourceTypes == nil {
+                return nil, 0
+        }
+        return ps.SchemaForResourceType(resourceMode, resourceType)
+}
+
+// ProvisionerConfig returns the schema for the configuration of a given
+// provisioner, or nil of no such schema is available.
+func (ss *Schemas) ProvisionerConfig(name string) *configschema.Block {
+        return ss.Provisioners[name]
 }
 
-// ProviderSchemas is a map from provider names to provider schemas.
+// LoadSchemas searches the given configuration, state  and plan (any of which
+// may be nil) for constructs that have an associated schema, requests the
+// necessary schemas from the given component factory (which must _not_ be nil),
+// and returns a single object representing all of the necessary schemas.
 //
-// The names in this map are the direct plugin name (e.g. "aws") rather than
-// any alias name (e.g. "aws.foo"), since.
-type ProviderSchemas map[string]*ProviderSchema
+// If an error is returned, it may be a wrapped tfdiags.Diagnostics describing
+// errors across multiple separate objects. Errors here will usually indicate
+// either misbehavior on the part of one of the providers or of the provider
+// protocol itself. When returned with errors, the returned schemas object is
+// still valid but may be incomplete.
+func LoadSchemas(config *configs.Config, state *states.State, components contextComponentFactory) (*Schemas, error) {
+        schemas := &Schemas{
+                Providers:    map[string]*ProviderSchema{},
+                Provisioners: map[string]*configschema.Block{},
+        }
+        var diags tfdiags.Diagnostics
+
+        newDiags := loadProviderSchemas(schemas.Providers, config, state, components)
+        diags = diags.Append(newDiags)
+        newDiags = loadProvisionerSchemas(schemas.Provisioners, config, components)
+        diags = diags.Append(newDiags)
+
+        return schemas, diags.Err()
+}
+
+func loadProviderSchemas(schemas map[string]*ProviderSchema, config *configs.Config, state *states.State, components contextComponentFactory) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        ensure := func(typeName string) {
+                if _, exists := schemas[typeName]; exists {
+                        return
+                }
+
+                log.Printf("[TRACE] LoadSchemas: retrieving schema for provider type %q", typeName)
+                provider, err := components.ResourceProvider(typeName, "early/"+typeName)
+                if err != nil {
+                        // We'll put a stub in the map so we won't re-attempt this on
+                        // future calls.
+                        schemas[typeName] = &ProviderSchema{}
+                        diags = diags.Append(
+                                fmt.Errorf("Failed to instantiate provider %q to obtain schema: %s", typeName, err),
+                        )
+                        return
+                }
+                defer func() {
+                        provider.Close()
+                }()
+
+                resp := provider.GetSchema()
+                if resp.Diagnostics.HasErrors() {
+                        // We'll put a stub in the map so we won't re-attempt this on
+                        // future calls.
+                        schemas[typeName] = &ProviderSchema{}
+                        diags = diags.Append(
+                                fmt.Errorf("Failed to retrieve schema from provider %q: %s", typeName, resp.Diagnostics.Err()),
+                        )
+                        return
+                }
+
+                s := &ProviderSchema{
+                        Provider:      resp.Provider.Block,
+                        ResourceTypes: make(map[string]*configschema.Block),
+                        DataSources:   make(map[string]*configschema.Block),
+
+                        ResourceTypeSchemaVersions: make(map[string]uint64),
+                }
+
+                if resp.Provider.Version < 0 {
+                        // We're not using the version numbers here yet, but we'll check
+                        // for validity anyway in case we start using them in future.
+                        diags = diags.Append(
+                                fmt.Errorf("invalid negative schema version provider configuration for provider %q", typeName),
+                        )
+                }
+
+                for t, r := range resp.ResourceTypes {
+                        s.ResourceTypes[t] = r.Block
+                        s.ResourceTypeSchemaVersions[t] = uint64(r.Version)
+                        if r.Version < 0 {
+                                diags = diags.Append(
+                                        fmt.Errorf("invalid negative schema version for resource type %s in provider %q", t, typeName),
+                                )
+                        }
+                }
+
+                for t, d := range resp.DataSources {
+                        s.DataSources[t] = d.Block
+                        if d.Version < 0 {
+                                // We're not using the version numbers here yet, but we'll check
+                                // for validity anyway in case we start using them in future.
+                                diags = diags.Append(
+                                        fmt.Errorf("invalid negative schema version for data source %s in provider %q", t, typeName),
+                                )
+                        }
+                }
+
+                schemas[typeName] = s
+        }
+
+        if config != nil {
+                for _, typeName := range config.ProviderTypes() {
+                        ensure(typeName)
+                }
+        }
+
+        if state != nil {
+                needed := providers.AddressedTypesAbs(state.ProviderAddrs())
+                for _, typeName := range needed {
+                        ensure(typeName)
+                }
+        }
+
+        return diags
+}
+
+func loadProvisionerSchemas(schemas map[string]*configschema.Block, config *configs.Config, components contextComponentFactory) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        ensure := func(name string) {
+                if _, exists := schemas[name]; exists {
+                        return
+                }
+
+                log.Printf("[TRACE] LoadSchemas: retrieving schema for provisioner %q", name)
+                provisioner, err := components.ResourceProvisioner(name, "early/"+name)
+                if err != nil {
+                        // We'll put a stub in the map so we won't re-attempt this on
+                        // future calls.
+                        schemas[name] = &configschema.Block{}
+                        diags = diags.Append(
+                                fmt.Errorf("Failed to instantiate provisioner %q to obtain schema: %s", name, err),
+                        )
+                        return
+                }
+                defer func() {
+                        if closer, ok := provisioner.(ResourceProvisionerCloser); ok {
+                                closer.Close()
+                        }
+                }()
+
+                resp := provisioner.GetSchema()
+                if resp.Diagnostics.HasErrors() {
+                        // We'll put a stub in the map so we won't re-attempt this on
+                        // future calls.
+                        schemas[name] = &configschema.Block{}
+                        diags = diags.Append(
+                                fmt.Errorf("Failed to retrieve schema from provisioner %q: %s", name, resp.Diagnostics.Err()),
+                        )
+                        return
+                }
+
+                schemas[name] = resp.Provisioner
+        }
+
+        if config != nil {
+                for _, rc := range config.Module.ManagedResources {
+                        for _, pc := range rc.Managed.Provisioners {
+                                ensure(pc.Type)
+                        }
+                }
+
+                // Must also visit our child modules, recursively.
+                for _, cc := range config.Children {
+                        childDiags := loadProvisionerSchemas(schemas, cc, components)
+                        diags = diags.Append(childDiags)
+                }
+        }
+
+        return diags
+}
 
 // ProviderSchema represents the schema for a provider's own configuration
 // and the configuration for some or all of its resources and data sources.
@@ -24,6 +245,29 @@ type ProviderSchema struct {
         Provider      *configschema.Block
         ResourceTypes map[string]*configschema.Block
         DataSources   map[string]*configschema.Block
+
+        ResourceTypeSchemaVersions map[string]uint64
+}
+
+// SchemaForResourceType attempts to find a schema for the given mode and type.
+// Returns nil if no such schema is available.
+func (ps *ProviderSchema) SchemaForResourceType(mode addrs.ResourceMode, typeName string) (schema *configschema.Block, version uint64) {
+        switch mode {
+        case addrs.ManagedResourceMode:
+                return ps.ResourceTypes[typeName], ps.ResourceTypeSchemaVersions[typeName]
+        case addrs.DataResourceMode:
+                // Data resources don't have schema versions right now, since state is discarded for each refresh
+                return ps.DataSources[typeName], 0
+        default:
+                // Shouldn't happen, because the above cases are comprehensive.
+                return nil, 0
+        }
+}
+
+// SchemaForResourceAddr attempts to find a schema for the mode and type from
+// the given resource address. Returns nil if no such schema is available.
+func (ps *ProviderSchema) SchemaForResourceAddr(addr addrs.Resource) (schema *configschema.Block, version uint64) {
+        return ps.SchemaForResourceType(addr.Mode, addr.Type)
 }
 
 // ProviderSchemaRequest is used to describe to a ResourceProvider which
diff --git a/vendor/github.com/hashicorp/terraform/terraform/semantics.go b/vendor/github.com/hashicorp/terraform/terraform/semantics.go
deleted file mode 100644
index 20f1d8a..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/semantics.go
+++ /dev/null
@@ -1,132 +0,0 @@
-package terraform
-
-import (
-        "fmt"
-        "strings"
-
-        "github.com/hashicorp/go-multierror"
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/dag"
-)
-
-// GraphSemanticChecker is the interface that semantic checks across
-// the entire Terraform graph implement.
-//
-// The graph should NOT be modified by the semantic checker.
-type GraphSemanticChecker interface {
-        Check(*dag.Graph) error
-}
-
-// UnorderedSemanticCheckRunner is an implementation of GraphSemanticChecker
-// that runs a list of SemanticCheckers against the vertices of the graph
-// in no specified order.
-type UnorderedSemanticCheckRunner struct {
-        Checks []SemanticChecker
-}
-
-func (sc *UnorderedSemanticCheckRunner) Check(g *dag.Graph) error {
-        var err error
-        for _, v := range g.Vertices() {
-                for _, check := range sc.Checks {
-                        if e := check.Check(g, v); e != nil {
-                                err = multierror.Append(err, e)
-                        }
-                }
-        }
-
-        return err
-}
-
-// SemanticChecker is the interface that semantic checks across the
-// Terraform graph implement. Errors are accumulated. Even after an error
-// is returned, child vertices in the graph will still be visited.
-//
-// The graph should NOT be modified by the semantic checker.
-//
-// The order in which vertices are visited is left unspecified, so the
-// semantic checks should not rely on that.
-type SemanticChecker interface {
-        Check(*dag.Graph, dag.Vertex) error
-}
-
-// smcUserVariables does all the semantic checks to verify that the
-// variables given satisfy the configuration itself.
-func smcUserVariables(c *config.Config, vs map[string]interface{}) []error {
-        var errs []error
-
-        cvs := make(map[string]*config.Variable)
-        for _, v := range c.Variables {
-                cvs[v.Name] = v
-        }
-
-        // Check that all required variables are present
-        required := make(map[string]struct{})
-        for _, v := range c.Variables {
-                if v.Required() {
-                        required[v.Name] = struct{}{}
-                }
-        }
-        for k, _ := range vs {
-                delete(required, k)
-        }
-        if len(required) > 0 {
-                for k, _ := range required {
-                        errs = append(errs, fmt.Errorf(
-                                "Required variable not set: %s", k))
-                }
-        }
-
-        // Check that types match up
-        for name, proposedValue := range vs {
-                // Check for "map.key" fields. These stopped working with Terraform
-                // 0.7 but we do this to surface a better error message informing
-                // the user what happened.
-                if idx := strings.Index(name, "."); idx > 0 {
-                        key := name[:idx]
-                        if _, ok := cvs[key]; ok {
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: Overriding map keys with the format `name.key` is no "+
-                                                "longer allowed. You may still override keys by setting "+
-                                                "`name = { key = value }`. The maps will be merged. This "+
-                                                "behavior appeared in 0.7.0.", name))
-                                continue
-                        }
-                }
-
-                schema, ok := cvs[name]
-                if !ok {
-                        continue
-                }
-
-                declaredType := schema.Type()
-
-                switch declaredType {
-                case config.VariableTypeString:
-                        switch proposedValue.(type) {
-                        case string:
-                                continue
-                        }
-                case config.VariableTypeMap:
-                        switch v := proposedValue.(type) {
-                        case map[string]interface{}:
-                                continue
-                        case []map[string]interface{}:
-                                // if we have a list of 1 map, it will get coerced later as needed
-                                if len(v) == 1 {
-                                        continue
-                                }
-                        }
-                case config.VariableTypeList:
-                        switch proposedValue.(type) {
-                        case []interface{}:
-                                continue
-                        }
-                }
-                errs = append(errs, fmt.Errorf("variable %s should be type %s, got %s",
-                        name, declaredType.Printable(), hclTypeName(proposedValue)))
-        }
-
-        // TODO(mitchellh): variables that are unknown
-
-        return errs
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/state.go b/vendor/github.com/hashicorp/terraform/terraform/state.go
index 04b14a6..092b690 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/state.go
@@ -16,12 +16,23 @@ import (
         "strings"
         "sync"
 
-        "github.com/hashicorp/go-multierror"
-        "github.com/hashicorp/go-uuid"
-        "github.com/hashicorp/go-version"
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/errwrap"
+        multierror "github.com/hashicorp/go-multierror"
+        uuid "github.com/hashicorp/go-uuid"
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
         "github.com/mitchellh/copystructure"
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
 
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/tfdiags"
         tfversion "github.com/hashicorp/terraform/version"
 )
 
@@ -33,26 +44,38 @@ const (
 // rootModulePath is the path of the root module
 var rootModulePath = []string{"root"}
 
+// normalizeModulePath transforms a legacy module path (which may or may not
+// have a redundant "root" label at the start of it) into an
+// addrs.ModuleInstance representing the same module.
+//
+// For legacy reasons, different parts of Terraform disagree about whether the
+// root module has the path []string{} or []string{"root"}, and so this
+// function accepts both and trims off the "root". An implication of this is
+// that it's not possible to actually have a module call in the root module
+// that is itself named "root", since that would be ambiguous.
+//
 // normalizeModulePath takes a raw module path and returns a path that
 // has the rootModulePath prepended to it. If I could go back in time I
 // would've never had a rootModulePath (empty path would be root). We can
 // still fix this but thats a big refactor that my branch doesn't make sense
 // for. Instead, this function normalizes paths.
-func normalizeModulePath(p []string) []string {
-        k := len(rootModulePath)
+func normalizeModulePath(p []string) addrs.ModuleInstance {
+        // FIXME: Remove this once everyone is using addrs.ModuleInstance.
 
-        // If we already have a root module prefix, we're done
-        if len(p) >= len(rootModulePath) {
-                if reflect.DeepEqual(p[:k], rootModulePath) {
-                        return p
-                }
+        if len(p) > 0 && p[0] == "root" {
+                p = p[1:]
         }
 
-        // None? Prefix it
-        result := make([]string, len(rootModulePath)+len(p))
-        copy(result, rootModulePath)
-        copy(result[k:], p)
-        return result
+        ret := make(addrs.ModuleInstance, len(p))
+        for i, name := range p {
+                // For now we don't actually support modules with multiple instances
+                // identified by keys, so we just treat every path element as a
+                // step with no key.
+                ret[i] = addrs.ModuleInstanceStep{
+                        Name: name,
+                }
+        }
+        return ret
 }
 
 // State keeps track of a snapshot state-of-the-world that Terraform
@@ -138,21 +161,43 @@ func (s *State) children(path []string) []*ModuleState {
 //
 // This should be the preferred method to add module states since it
 // allows us to optimize lookups later as well as control sorting.
-func (s *State) AddModule(path []string) *ModuleState {
+func (s *State) AddModule(path addrs.ModuleInstance) *ModuleState {
         s.Lock()
         defer s.Unlock()
 
         return s.addModule(path)
 }
 
-func (s *State) addModule(path []string) *ModuleState {
+func (s *State) addModule(path addrs.ModuleInstance) *ModuleState {
         // check if the module exists first
         m := s.moduleByPath(path)
         if m != nil {
                 return m
         }
 
-        m = &ModuleState{Path: path}
+        // Lower the new-style address into a legacy-style address.
+        // This requires that none of the steps have instance keys, which is
+        // true for all addresses at the time of implementing this because
+        // "count" and "for_each" are not yet implemented for modules.
+        // For the purposes of state, the legacy address format also includes
+        // a redundant extra prefix element "root". It is important to include
+        // this because the "prune" method will remove any module that has a
+        // path length less than one, and other parts of the state code will
+        // trim off the first element indiscriminately.
+        legacyPath := make([]string, len(path)+1)
+        legacyPath[0] = "root"
+        for i, step := range path {
+                if step.InstanceKey != addrs.NoKey {
+                        // FIXME: Once the rest of Terraform is ready to use count and
+                        // for_each, remove all of this and just write the addrs.ModuleInstance
+                        // value itself into the ModuleState.
+                        panic("state cannot represent modules with count or for_each keys")
+                }
+
+                legacyPath[i+1] = step.Name
+        }
+
+        m = &ModuleState{Path: legacyPath}
         m.init()
         s.Modules = append(s.Modules, m)
         s.sort()
@@ -162,7 +207,7 @@ func (s *State) addModule(path []string) *ModuleState {
 // ModuleByPath is used to lookup the module state for the given path.
 // This should be the preferred lookup mechanism as it allows for future
 // lookup optimizations.
-func (s *State) ModuleByPath(path []string) *ModuleState {
+func (s *State) ModuleByPath(path addrs.ModuleInstance) *ModuleState {
         if s == nil {
                 return nil
         }
@@ -172,7 +217,7 @@ func (s *State) ModuleByPath(path []string) *ModuleState {
         return s.moduleByPath(path)
 }
 
-func (s *State) moduleByPath(path []string) *ModuleState {
+func (s *State) moduleByPath(path addrs.ModuleInstance) *ModuleState {
         for _, mod := range s.Modules {
                 if mod == nil {
                         continue
@@ -180,97 +225,14 @@ func (s *State) moduleByPath(path []string) *ModuleState {
                 if mod.Path == nil {
                         panic("missing module path")
                 }
-                if reflect.DeepEqual(mod.Path, path) {
+                modPath := normalizeModulePath(mod.Path)
+                if modPath.String() == path.String() {
                         return mod
                 }
         }
         return nil
 }
 
-// ModuleOrphans returns all the module orphans in this state by
-// returning their full paths. These paths can be used with ModuleByPath
-// to return the actual state.
-func (s *State) ModuleOrphans(path []string, c *config.Config) [][]string {
-        s.Lock()
-        defer s.Unlock()
-
-        return s.moduleOrphans(path, c)
-
-}
-
-func (s *State) moduleOrphans(path []string, c *config.Config) [][]string {
-        // direct keeps track of what direct children we have both in our config
-        // and in our state. childrenKeys keeps track of what isn't an orphan.
-        direct := make(map[string]struct{})
-        childrenKeys := make(map[string]struct{})
-        if c != nil {
-                for _, m := range c.Modules {
-                        childrenKeys[m.Name] = struct{}{}
-                        direct[m.Name] = struct{}{}
-                }
-        }
-
-        // Go over the direct children and find any that aren't in our keys.
-        var orphans [][]string
-        for _, m := range s.children(path) {
-                key := m.Path[len(m.Path)-1]
-
-                // Record that we found this key as a direct child. We use this
-                // later to find orphan nested modules.
-                direct[key] = struct{}{}
-
-                // If we have a direct child still in our config, it is not an orphan
-                if _, ok := childrenKeys[key]; ok {
-                        continue
-                }
-
-                orphans = append(orphans, m.Path)
-        }
-
-        // Find the orphans that are nested...
-        for _, m := range s.Modules {
-                if m == nil {
-                        continue
-                }
-
-                // We only want modules that are at least grandchildren
-                if len(m.Path) < len(path)+2 {
-                        continue
-                }
-
-                // If it isn't part of our tree, continue
-                if !reflect.DeepEqual(path, m.Path[:len(path)]) {
-                        continue
-                }
-
-                // If we have the direct child, then just skip it.
-                key := m.Path[len(path)]
-                if _, ok := direct[key]; ok {
-                        continue
-                }
-
-                orphanPath := m.Path[:len(path)+1]
-
-                // Don't double-add if we've already added this orphan (which can happen if
-                // there are multiple nested sub-modules that get orphaned together).
-                alreadyAdded := false
-                for _, o := range orphans {
-                        if reflect.DeepEqual(o, orphanPath) {
-                                alreadyAdded = true
-                                break
-                        }
-                }
-                if alreadyAdded {
-                        continue
-                }
-
-                // Add this orphan
-                orphans = append(orphans, orphanPath)
-        }
-
-        return orphans
-}
-
 // Empty returns true if the state is empty.
 func (s *State) Empty() bool {
         if s == nil {
@@ -443,7 +405,7 @@ func (s *State) removeModule(path []string, v *ModuleState) {
 
 func (s *State) removeResource(path []string, v *ResourceState) {
         // Get the module this resource lives in. If it doesn't exist, we're done.
-        mod := s.moduleByPath(path)
+        mod := s.moduleByPath(normalizeModulePath(path))
         if mod == nil {
                 return
         }
@@ -487,7 +449,7 @@ func (s *State) removeInstance(path []string, r *ResourceState, v *InstanceState
 
 // RootModule returns the ModuleState for the root module
 func (s *State) RootModule() *ModuleState {
-        root := s.ModuleByPath(rootModulePath)
+        root := s.ModuleByPath(addrs.RootModuleInstance)
         if root == nil {
                 panic("missing root module")
         }
@@ -522,7 +484,7 @@ func (s *State) equal(other *State) bool {
         }
         for _, m := range s.Modules {
                 // This isn't very optimal currently but works.
-                otherM := other.moduleByPath(m.Path)
+                otherM := other.moduleByPath(normalizeModulePath(m.Path))
                 if otherM == nil {
                         return false
                 }
@@ -681,8 +643,8 @@ func (s *State) init() {
                 s.Version = StateVersion
         }
 
-        if s.moduleByPath(rootModulePath) == nil {
-                s.addModule(rootModulePath)
+        if s.moduleByPath(addrs.RootModuleInstance) == nil {
+                s.addModule(addrs.RootModuleInstance)
         }
         s.ensureHasLineage()
 
@@ -811,13 +773,9 @@ func (s *State) String() string {
 
 // BackendState stores the configuration to connect to a remote backend.
 type BackendState struct {
-        Type   string                 `json:"type"`   // Backend type
-        Config map[string]interface{} `json:"config"` // Backend raw config
-
-        // Hash is the hash code to uniquely identify the original source
-        // configuration. We use this to detect when there is a change in
-        // configuration even when "type" isn't changed.
-        Hash uint64 `json:"hash"`
+        Type      string          `json:"type"`   // Backend type
+        ConfigRaw json.RawMessage `json:"config"` // Backend raw config
+        Hash      uint64          `json:"hash"`   // Hash of portion of configuration from config files
 }
 
 // Empty returns true if BackendState has no state.
@@ -825,25 +783,50 @@ func (s *BackendState) Empty() bool {
         return s == nil || s.Type == ""
 }
 
-// Rehash returns a unique content hash for this backend's configuration
-// as a uint64 value.
-// The Hash stored in the backend state needs to match the config itself, but
-// we need to compare the backend config after it has been combined with all
-// options.
-// This function must match the implementation used by config.Backend.
-func (s *BackendState) Rehash() uint64 {
+// Config decodes the type-specific configuration object using the provided
+// schema and returns the result as a cty.Value.
+//
+// An error is returned if the stored configuration does not conform to the
+// given schema.
+func (s *BackendState) Config(schema *configschema.Block) (cty.Value, error) {
+        ty := schema.ImpliedType()
         if s == nil {
-                return 0
+                return cty.NullVal(ty), nil
         }
+        return ctyjson.Unmarshal(s.ConfigRaw, ty)
+}
 
-        cfg := config.Backend{
-                Type: s.Type,
-                RawConfig: &config.RawConfig{
-                        Raw: s.Config,
-                },
+// SetConfig replaces (in-place) the type-specific configuration object using
+// the provided value and associated schema.
+//
+// An error is returned if the given value does not conform to the implied
+// type of the schema.
+func (s *BackendState) SetConfig(val cty.Value, schema *configschema.Block) error {
+        ty := schema.ImpliedType()
+        buf, err := ctyjson.Marshal(val, ty)
+        if err != nil {
+                return err
         }
+        s.ConfigRaw = buf
+        return nil
+}
 
-        return cfg.Rehash()
+// ForPlan produces an alternative representation of the reciever that is
+// suitable for storing in a plan. The current workspace must additionally
+// be provided, to be stored alongside the backend configuration.
+//
+// The backend configuration schema is required in order to properly
+// encode the backend-specific configuration settings.
+func (s *BackendState) ForPlan(schema *configschema.Block, workspaceName string) (*plans.Backend, error) {
+        if s == nil {
+                return nil, nil
+        }
+
+        configVal, err := s.Config(schema)
+        if err != nil {
+                return nil, errwrap.Wrapf("failed to decode backend config: {{err}}", err)
+        }
+        return plans.NewBackend(s.Type, configVal, schema, workspaceName)
 }
 
 // RemoteState is used to track the information about a remote
@@ -1089,58 +1072,64 @@ func (m *ModuleState) IsDescendent(other *ModuleState) bool {
 // Orphans returns a list of keys of resources that are in the State
 // but aren't present in the configuration itself. Hence, these keys
 // represent the state of resources that are orphans.
-func (m *ModuleState) Orphans(c *config.Config) []string {
+func (m *ModuleState) Orphans(c *configs.Module) []addrs.ResourceInstance {
         m.Lock()
         defer m.Unlock()
 
-        keys := make(map[string]struct{})
-        for k := range m.Resources {
-                keys[k] = struct{}{}
-        }
-
+        inConfig := make(map[string]struct{})
         if c != nil {
-                for _, r := range c.Resources {
-                        delete(keys, r.Id())
-
-                        for k := range keys {
-                                if strings.HasPrefix(k, r.Id()+".") {
-                                        delete(keys, k)
-                                }
-                        }
+                for _, r := range c.ManagedResources {
+                        inConfig[r.Addr().String()] = struct{}{}
+                }
+                for _, r := range c.DataResources {
+                        inConfig[r.Addr().String()] = struct{}{}
                 }
         }
 
-        result := make([]string, 0, len(keys))
-        for k := range keys {
-                result = append(result, k)
-        }
+        var result []addrs.ResourceInstance
+        for k := range m.Resources {
+                // Since we've not yet updated state to use our new address format,
+                // we need to do some shimming here.
+                legacyAddr, err := parseResourceAddressInternal(k)
+                if err != nil {
+                        // Suggests that the user tampered with the state, since we always
+                        // generate valid internal addresses.
+                        log.Printf("ModuleState has invalid resource key %q. Ignoring.", k)
+                        continue
+                }
 
+                addr := legacyAddr.AbsResourceInstanceAddr().Resource
+                compareKey := addr.Resource.String() // compare by resource address, ignoring instance key
+                if _, exists := inConfig[compareKey]; !exists {
+                        result = append(result, addr)
+                }
+        }
         return result
 }
 
 // RemovedOutputs returns a list of outputs that are in the State but aren't
 // present in the configuration itself.
-func (m *ModuleState) RemovedOutputs(c *config.Config) []string {
-        m.Lock()
-        defer m.Unlock()
-
-        keys := make(map[string]struct{})
-        for k := range m.Outputs {
-                keys[k] = struct{}{}
+func (s *ModuleState) RemovedOutputs(outputs map[string]*configs.Output) []addrs.OutputValue {
+        if outputs == nil {
+                // If we got no output map at all then we'll just treat our set of
+                // configured outputs as empty, since that suggests that they've all
+                // been removed by removing their containing module.
+                outputs = make(map[string]*configs.Output)
         }
 
-        if c != nil {
-                for _, o := range c.Outputs {
-                        delete(keys, o.Name)
-                }
-        }
+        s.Lock()
+        defer s.Unlock()
 
-        result := make([]string, 0, len(keys))
-        for k := range keys {
-                result = append(result, k)
+        var ret []addrs.OutputValue
+        for n := range s.Outputs {
+                if _, declared := outputs[n]; !declared {
+                        ret = append(ret, addrs.OutputValue{
+                                Name: n,
+                        })
+                }
         }
 
-        return result
+        return ret
 }
 
 // View returns a view with the given resource prefix.
@@ -1543,6 +1532,24 @@ func (s *ResourceState) Untaint() {
         }
 }
 
+// ProviderAddr returns the provider address for the receiver, by parsing the
+// string representation saved in state. An error can be returned if the
+// value in state is corrupt.
+func (s *ResourceState) ProviderAddr() (addrs.AbsProviderConfig, error) {
+        var diags tfdiags.Diagnostics
+
+        str := s.Provider
+        traversal, travDiags := hclsyntax.ParseTraversalAbs([]byte(str), "", hcl.Pos{Line: 1, Column: 1})
+        diags = diags.Append(travDiags)
+        if travDiags.HasErrors() {
+                return addrs.AbsProviderConfig{}, diags.Err()
+        }
+
+        addr, addrDiags := addrs.ParseAbsProviderConfig(traversal)
+        diags = diags.Append(addrDiags)
+        return addr, diags.Err()
+}
+
 func (s *ResourceState) init() {
         s.Lock()
         defer s.Unlock()
@@ -1651,6 +1658,51 @@ func (s *InstanceState) init() {
         s.Ephemeral.init()
 }
 
+// NewInstanceStateShimmedFromValue is a shim method to lower a new-style
+// object value representing the attributes of an instance object into the
+// legacy InstanceState representation.
+//
+// This is for shimming to old components only and should not be used in new code.
+func NewInstanceStateShimmedFromValue(state cty.Value, schemaVersion int) *InstanceState {
+        attrs := hcl2shim.FlatmapValueFromHCL2(state)
+        return &InstanceState{
+                ID:         attrs["id"],
+                Attributes: attrs,
+                Meta: map[string]interface{}{
+                        "schema_version": schemaVersion,
+                },
+        }
+}
+
+// AttrsAsObjectValue shims from the legacy InstanceState representation to
+// a new-style cty object value representation of the state attributes, using
+// the given type for guidance.
+//
+// The given type must be the implied type of the schema of the resource type
+// of the object whose state is being converted, or the result is undefined.
+//
+// This is for shimming from old components only and should not be used in
+// new code.
+func (s *InstanceState) AttrsAsObjectValue(ty cty.Type) (cty.Value, error) {
+        if s == nil {
+                // if the state is nil, we need to construct a complete cty.Value with
+                // null attributes, rather than a single cty.NullVal(ty)
+                s = &InstanceState{}
+        }
+
+        if s.Attributes == nil {
+                s.Attributes = map[string]string{}
+        }
+
+        // make sure ID is included in the attributes. The InstanceState.ID value
+        // takes precedence.
+        if s.ID != "" {
+                s.Attributes["id"] = s.ID
+        }
+
+        return hcl2shim.HCL2ValueFromFlatmap(s.Attributes, ty)
+}
+
 // Copy all the Fields from another InstanceState
 func (s *InstanceState) Set(from *InstanceState) {
         s.Lock()
@@ -1787,13 +1839,19 @@ func (s *InstanceState) MergeDiff(d *InstanceDiff) *InstanceState {
 }
 
 func (s *InstanceState) String() string {
+        notCreated := "<not created>"
+
+        if s == nil {
+                return notCreated
+        }
+
         s.Lock()
         defer s.Unlock()
 
         var buf bytes.Buffer
 
-        if s == nil || s.ID == "" {
-                return "<not created>"
+        if s.ID == "" {
+                return notCreated
         }
 
         buf.WriteString(fmt.Sprintf("ID = %s\n", s.ID))
@@ -2187,19 +2245,6 @@ func (s moduleStateSort) Swap(i, j int) {
         s[i], s[j] = s[j], s[i]
 }
 
-// StateCompatible returns an error if the state is not compatible with the
-// current version of terraform.
-func CheckStateVersion(state *State) error {
-        if state == nil {
-                return nil
-        }
-
-        if state.FromFutureTerraform() {
-                return fmt.Errorf(stateInvalidTerraformVersionErr, state.TFVersion)
-        }
-        return nil
-}
-
 const stateValidateErrMultiModule = `
 Multiple modules with the same path: %s
 
@@ -2208,11 +2253,3 @@ in your state file that point to the same module. This will cause Terraform
 to behave in unexpected and error prone ways and is invalid. Please back up
 and modify your state file manually to resolve this.
 `
-
-const stateInvalidTerraformVersionErr = `
-Terraform doesn't allow running any operations against a state
-that was written by a future Terraform version. The state is
-reporting it is written by Terraform '%s'
-
-Please run at least that version of Terraform to continue.
-`
diff --git a/vendor/github.com/hashicorp/terraform/terraform/state_add.go b/vendor/github.com/hashicorp/terraform/terraform/state_add.go
deleted file mode 100644
index 1163730..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/state_add.go
+++ /dev/null
@@ -1,374 +0,0 @@
-package terraform
-
-import "fmt"
-
-// Add adds the item in the state at the given address.
-//
-// The item can be a ModuleState, ResourceState, or InstanceState. Depending
-// on the item type, the address may or may not be valid. For example, a
-// module cannot be moved to a resource address, however a resource can be
-// moved to a module address (it retains the same name, under that resource).
-//
-// The item can also be a []*ModuleState, which is the case for nested
-// modules. In this case, Add will expect the zero-index to be the top-most
-// module to add and will only nest children from there. For semantics, this
-// is equivalent to module => module.
-//
-// The full semantics of Add:
-//
-//                      ┌───────────────────┬───────────────────┬───────────────────┐
-//                      │  Module Address   │ Resource Address  │ Instance Address  │
-//    ┌─────────────────┼───────────────────┼───────────────────┼───────────────────┤
-//    │   ModuleState   │         ✓         │         x         │         x         │
-//    ├─────────────────┼───────────────────┼───────────────────┼───────────────────┤
-//    │  ResourceState  │         ✓         │         ✓         │      maybe*       │
-//    ├─────────────────┼───────────────────┼───────────────────┼───────────────────┤
-//    │ Instance State  │         ✓         │         ✓         │         ✓         │
-//    └─────────────────┴───────────────────┴───────────────────┴───────────────────┘
-//
-// *maybe - Resources can be added at an instance address only if the resource
-//          represents a single instance (primary). Example:
-//          "aws_instance.foo" can be moved to "aws_instance.bar.tainted"
-//
-func (s *State) Add(fromAddrRaw string, toAddrRaw string, raw interface{}) error {
-        // Parse the address
-
-        toAddr, err := ParseResourceAddress(toAddrRaw)
-        if err != nil {
-                return err
-        }
-
-        // Parse the from address
-        fromAddr, err := ParseResourceAddress(fromAddrRaw)
-        if err != nil {
-                return err
-        }
-
-        // Determine the types
-        from := detectValueAddLoc(raw)
-        to := detectAddrAddLoc(toAddr)
-
-        // Find the function to do this
-        fromMap, ok := stateAddFuncs[from]
-        if !ok {
-                return fmt.Errorf("invalid source to add to state: %T", raw)
-        }
-        f, ok := fromMap[to]
-        if !ok {
-                return fmt.Errorf("invalid destination: %s (%d)", toAddr, to)
-        }
-
-        // Call the migrator
-        if err := f(s, fromAddr, toAddr, raw); err != nil {
-                return err
-        }
-
-        // Prune the state
-        s.prune()
-        return nil
-}
-
-func stateAddFunc_Module_Module(s *State, fromAddr, addr *ResourceAddress, raw interface{}) error {
-        // raw can be either *ModuleState or []*ModuleState. The former means
-        // we're moving just one module. The latter means we're moving a module
-        // and children.
-        root := raw
-        var rest []*ModuleState
-        if list, ok := raw.([]*ModuleState); ok {
-                // We need at least one item
-                if len(list) == 0 {
-                        return fmt.Errorf("module move with no value to: %s", addr)
-                }
-
-                // The first item is always the root
-                root = list[0]
-                if len(list) > 1 {
-                        rest = list[1:]
-                }
-        }
-
-        // Get the actual module state
-        src := root.(*ModuleState).deepcopy()
-
-        // If the target module exists, it is an error
-        path := append([]string{"root"}, addr.Path...)
-        if s.ModuleByPath(path) != nil {
-                return fmt.Errorf("module target is not empty: %s", addr)
-        }
-
-        // Create it and copy our outputs and dependencies
-        mod := s.AddModule(path)
-        mod.Outputs = src.Outputs
-        mod.Dependencies = src.Dependencies
-
-        // Go through the resources perform an add for each of those
-        for k, v := range src.Resources {
-                resourceKey, err := ParseResourceStateKey(k)
-                if err != nil {
-                        return err
-                }
-
-                // Update the resource address for this
-                addrCopy := *addr
-                addrCopy.Type = resourceKey.Type
-                addrCopy.Name = resourceKey.Name
-                addrCopy.Index = resourceKey.Index
-                addrCopy.Mode = resourceKey.Mode
-
-                // Perform an add
-                if err := s.Add(fromAddr.String(), addrCopy.String(), v); err != nil {
-                        return err
-                }
-        }
-
-        // Add all the children if we have them
-        for _, item := range rest {
-                // If item isn't a descendent of our root, then ignore it
-                if !src.IsDescendent(item) {
-                        continue
-                }
-
-                // It is! Strip the leading prefix and attach that to our address
-                extra := item.Path[len(src.Path):]
-                addrCopy := addr.Copy()
-                addrCopy.Path = append(addrCopy.Path, extra...)
-
-                // Add it
-                s.Add(fromAddr.String(), addrCopy.String(), item)
-        }
-
-        return nil
-}
-
-func stateAddFunc_Resource_Module(
-        s *State, from, to *ResourceAddress, raw interface{}) error {
-        // Build the more specific to addr
-        addr := *to
-        addr.Type = from.Type
-        addr.Name = from.Name
-
-        return s.Add(from.String(), addr.String(), raw)
-}
-
-func stateAddFunc_Resource_Resource(s *State, fromAddr, addr *ResourceAddress, raw interface{}) error {
-        // raw can be either *ResourceState or []*ResourceState. The former means
-        // we're moving just one resource. The latter means we're moving a count
-        // of resources.
-        if list, ok := raw.([]*ResourceState); ok {
-                // We need at least one item
-                if len(list) == 0 {
-                        return fmt.Errorf("resource move with no value to: %s", addr)
-                }
-
-                // If there is an index, this is an error since we can't assign
-                // a set of resources to a single index
-                if addr.Index >= 0 && len(list) > 1 {
-                        return fmt.Errorf(
-                                "multiple resources can't be moved to a single index: "+
-                                        "%s => %s", fromAddr, addr)
-                }
-
-                // Add each with a specific index
-                for i, rs := range list {
-                        addrCopy := addr.Copy()
-                        addrCopy.Index = i
-
-                        if err := s.Add(fromAddr.String(), addrCopy.String(), rs); err != nil {
-                                return err
-                        }
-                }
-
-                return nil
-        }
-
-        src := raw.(*ResourceState).deepcopy()
-
-        // Initialize the resource
-        resourceRaw, exists := stateAddInitAddr(s, addr)
-        if exists {
-                return fmt.Errorf("resource exists and not empty: %s", addr)
-        }
-        resource := resourceRaw.(*ResourceState)
-        resource.Type = src.Type
-        resource.Dependencies = src.Dependencies
-        resource.Provider = src.Provider
-
-        // Move the primary
-        if src.Primary != nil {
-                addrCopy := *addr
-                addrCopy.InstanceType = TypePrimary
-                addrCopy.InstanceTypeSet = true
-                if err := s.Add(fromAddr.String(), addrCopy.String(), src.Primary); err != nil {
-                        return err
-                }
-        }
-
-        // Move all deposed
-        if len(src.Deposed) > 0 {
-                resource.Deposed = src.Deposed
-        }
-
-        return nil
-}
-
-func stateAddFunc_Instance_Instance(s *State, fromAddr, addr *ResourceAddress, raw interface{}) error {
-        src := raw.(*InstanceState).DeepCopy()
-
-        // Create the instance
-        instanceRaw, _ := stateAddInitAddr(s, addr)
-        instance := instanceRaw.(*InstanceState)
-
-        // Set it
-        instance.Set(src)
-
-        return nil
-}
-
-func stateAddFunc_Instance_Module(
-        s *State, from, to *ResourceAddress, raw interface{}) error {
-        addr := *to
-        addr.Type = from.Type
-        addr.Name = from.Name
-
-        return s.Add(from.String(), addr.String(), raw)
-}
-
-func stateAddFunc_Instance_Resource(
-        s *State, from, to *ResourceAddress, raw interface{}) error {
-        addr := *to
-        addr.InstanceType = TypePrimary
-        addr.InstanceTypeSet = true
-
-        return s.Add(from.String(), addr.String(), raw)
-}
-
-// stateAddFunc is the type of function for adding an item to a state
-type stateAddFunc func(s *State, from, to *ResourceAddress, item interface{}) error
-
-// stateAddFuncs has the full matrix mapping of the state adders.
-var stateAddFuncs map[stateAddLoc]map[stateAddLoc]stateAddFunc
-
-func init() {
-        stateAddFuncs = map[stateAddLoc]map[stateAddLoc]stateAddFunc{
-                stateAddModule: {
-                        stateAddModule: stateAddFunc_Module_Module,
-                },
-                stateAddResource: {
-                        stateAddModule:   stateAddFunc_Resource_Module,
-                        stateAddResource: stateAddFunc_Resource_Resource,
-                },
-                stateAddInstance: {
-                        stateAddInstance: stateAddFunc_Instance_Instance,
-                        stateAddModule:   stateAddFunc_Instance_Module,
-                        stateAddResource: stateAddFunc_Instance_Resource,
-                },
-        }
-}
-
-// stateAddLoc is an enum to represent the location where state is being
-// moved from/to. We use this for quick lookups in a function map.
-type stateAddLoc uint
-
-const (
-        stateAddInvalid stateAddLoc = iota
-        stateAddModule
-        stateAddResource
-        stateAddInstance
-)
-
-// detectAddrAddLoc detects the state type for the given address. This
-// function is specifically not unit tested since we consider the State.Add
-// functionality to be comprehensive enough to cover this.
-func detectAddrAddLoc(addr *ResourceAddress) stateAddLoc {
-        if addr.Name == "" {
-                return stateAddModule
-        }
-
-        if !addr.InstanceTypeSet {
-                return stateAddResource
-        }
-
-        return stateAddInstance
-}
-
-// detectValueAddLoc determines the stateAddLoc value from the raw value
-// that is some State structure.
-func detectValueAddLoc(raw interface{}) stateAddLoc {
-        switch raw.(type) {
-        case *ModuleState:
-                return stateAddModule
-        case []*ModuleState:
-                return stateAddModule
-        case *ResourceState:
-                return stateAddResource
-        case []*ResourceState:
-                return stateAddResource
-        case *InstanceState:
-                return stateAddInstance
-        default:
-                return stateAddInvalid
-        }
-}
-
-// stateAddInitAddr takes a ResourceAddress and creates the non-existing
-// resources up to that point, returning the empty (or existing) interface
-// at that address.
-func stateAddInitAddr(s *State, addr *ResourceAddress) (interface{}, bool) {
-        addType := detectAddrAddLoc(addr)
-
-        // Get the module
-        path := append([]string{"root"}, addr.Path...)
-        exists := true
-        mod := s.ModuleByPath(path)
-        if mod == nil {
-                mod = s.AddModule(path)
-                exists = false
-        }
-        if addType == stateAddModule {
-                return mod, exists
-        }
-
-        // Add the resource
-        resourceKey := (&ResourceStateKey{
-                Name:  addr.Name,
-                Type:  addr.Type,
-                Index: addr.Index,
-                Mode:  addr.Mode,
-        }).String()
-        exists = true
-        resource, ok := mod.Resources[resourceKey]
-        if !ok {
-                resource = &ResourceState{Type: addr.Type}
-                resource.init()
-                mod.Resources[resourceKey] = resource
-                exists = false
-        }
-        if addType == stateAddResource {
-                return resource, exists
-        }
-
-        // Get the instance
-        exists = true
-        instance := &InstanceState{}
-        switch addr.InstanceType {
-        case TypePrimary, TypeTainted:
-                if v := resource.Primary; v != nil {
-                        instance = resource.Primary
-                } else {
-                        exists = false
-                }
-        case TypeDeposed:
-                idx := addr.Index
-                if addr.Index < 0 {
-                        idx = 0
-                }
-                if len(resource.Deposed) > idx {
-                        instance = resource.Deposed[idx]
-                } else {
-                        resource.Deposed = append(resource.Deposed, instance)
-                        exists = false
-                }
-        }
-
-        return instance, exists
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform.go b/vendor/github.com/hashicorp/terraform/terraform/transform.go
index 0e47f20..fd3f5c7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform.go
@@ -38,13 +38,18 @@ type graphTransformerMulti struct {
 }
 
 func (t *graphTransformerMulti) Transform(g *Graph) error {
+        var lastStepStr string
         for _, t := range t.Transforms {
+                log.Printf("[TRACE] (graphTransformerMulti) Executing graph transform %T", t)
                 if err := t.Transform(g); err != nil {
                         return err
                 }
-                log.Printf(
-                        "[TRACE] Graph after step %T:\n\n%s",
-                        t, g.StringWithNodeTypes())
+                if thisStepStr := g.StringWithNodeTypes(); thisStepStr != lastStepStr {
+                        log.Printf("[TRACE] (graphTransformerMulti) Completed graph transform %T with new graph:\n%s------", t, thisStepStr)
+                        lastStepStr = thisStepStr
+                } else {
+                        log.Printf("[TRACE] (graphTransformerMulti) Completed graph transform %T (no changes)", t)
+                }
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_provider.go b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_provider.go
index 39cf097..897a7e7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_provider.go
@@ -1,7 +1,8 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
 )
 
 // GraphNodeAttachProvider is an interface that must be implemented by nodes
@@ -11,8 +12,8 @@ type GraphNodeAttachProvider interface {
         GraphNodeSubPath
 
         // ProviderName with no module prefix. Example: "aws".
-        ProviderName() string
+        ProviderAddr() addrs.AbsProviderConfig
 
         // Sets the configuration
-        AttachProvider(*config.ProviderConfig)
+        AttachProvider(*configs.Provider)
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_resource.go b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_resource.go
index f2ee37e..03f8564 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_resource.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_resource.go
@@ -1,35 +1,32 @@
 package terraform
 
 import (
-        "fmt"
         "log"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/dag"
 )
 
 // GraphNodeAttachResourceConfig is an interface that must be implemented by nodes
 // that want resource configurations attached.
 type GraphNodeAttachResourceConfig interface {
-        // ResourceAddr is the address to the resource
-        ResourceAddr() *ResourceAddress
+        GraphNodeResource
 
         // Sets the configuration
-        AttachResourceConfig(*config.Resource)
+        AttachResourceConfig(*configs.Resource)
 }
 
 // AttachResourceConfigTransformer goes through the graph and attaches
-// resource configuration structures to nodes that implement the interfaces
-// above.
+// resource configuration structures to nodes that implement
+// GraphNodeAttachManagedResourceConfig or GraphNodeAttachDataResourceConfig.
 //
 // The attached configuration structures are directly from the configuration.
 // If they're going to be modified, a copy should be made.
 type AttachResourceConfigTransformer struct {
-        Module *module.Tree // Module is the root module for the config
+        Config *configs.Config // Config is the root node in the config tree
 }
 
 func (t *AttachResourceConfigTransformer) Transform(g *Graph) error {
-        log.Printf("[TRACE] AttachResourceConfigTransformer: Beginning...")
 
         // Go through and find GraphNodeAttachResource
         for _, v := range g.Vertices() {
@@ -41,36 +38,35 @@ func (t *AttachResourceConfigTransformer) Transform(g *Graph) error {
 
                 // Determine what we're looking for
                 addr := arn.ResourceAddr()
-                log.Printf(
-                        "[TRACE] AttachResourceConfigTransformer: Attach resource "+
-                                "config request: %s", addr)
 
                 // Get the configuration.
-                path := normalizeModulePath(addr.Path)
-                path = path[1:]
-                tree := t.Module.Child(path)
-                if tree == nil {
+                config := t.Config.DescendentForInstance(addr.Module)
+                if config == nil {
+                        log.Printf("[TRACE] AttachResourceConfigTransformer: %q (%T) has no configuration available", dag.VertexName(v), v)
                         continue
                 }
 
-                // Go through the resource configs to find the matching config
-                for _, r := range tree.Config().Resources {
-                        // Get a resource address so we can compare
-                        a, err := parseResourceAddressConfig(r)
-                        if err != nil {
-                                panic(fmt.Sprintf(
-                                        "Error parsing config address, this is a bug: %#v", r))
+                for _, r := range config.Module.ManagedResources {
+                        rAddr := r.Addr()
+
+                        if rAddr != addr.Resource {
+                                // Not the same resource
+                                continue
                         }
-                        a.Path = addr.Path
 
-                        // If this is not the same resource, then continue
-                        if !a.Equals(addr) {
+                        log.Printf("[TRACE] AttachResourceConfigTransformer: attaching to %q (%T) config from %s", dag.VertexName(v), v, r.DeclRange)
+                        arn.AttachResourceConfig(r)
+                }
+                for _, r := range config.Module.DataResources {
+                        rAddr := r.Addr()
+
+                        if rAddr != addr.Resource {
+                                // Not the same resource
                                 continue
                         }
 
-                        log.Printf("[TRACE] Attaching resource config: %#v", r)
+                        log.Printf("[TRACE] AttachResourceConfigTransformer: attaching to %q (%T) config from %#v", dag.VertexName(v), v, r.DeclRange)
                         arn.AttachResourceConfig(r)
-                        break
                 }
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_schema.go b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_schema.go
new file mode 100644
index 0000000..c7695dd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_schema.go
@@ -0,0 +1,99 @@
+package terraform
+
+import (
+        "fmt"
+        "log"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/dag"
+)
+
+// GraphNodeAttachResourceSchema is an interface implemented by node types
+// that need a resource schema attached.
+type GraphNodeAttachResourceSchema interface {
+        GraphNodeResource
+        GraphNodeProviderConsumer
+
+        AttachResourceSchema(schema *configschema.Block, version uint64)
+}
+
+// GraphNodeAttachProviderConfigSchema is an interface implemented by node types
+// that need a provider configuration schema attached.
+type GraphNodeAttachProviderConfigSchema interface {
+        GraphNodeProvider
+
+        AttachProviderConfigSchema(*configschema.Block)
+}
+
+// GraphNodeAttachProvisionerSchema is an interface implemented by node types
+// that need one or more provisioner schemas attached.
+type GraphNodeAttachProvisionerSchema interface {
+        ProvisionedBy() []string
+
+        // SetProvisionerSchema is called during transform for each provisioner
+        // type returned from ProvisionedBy, providing the configuration schema
+        // for each provisioner in turn. The implementer should save these for
+        // later use in evaluating provisioner configuration blocks.
+        AttachProvisionerSchema(name string, schema *configschema.Block)
+}
+
+// AttachSchemaTransformer finds nodes that implement
+// GraphNodeAttachResourceSchema, GraphNodeAttachProviderConfigSchema, or
+// GraphNodeAttachProvisionerSchema, looks up the needed schemas for each
+// and then passes them to a method implemented by the node.
+type AttachSchemaTransformer struct {
+        Schemas *Schemas
+}
+
+func (t *AttachSchemaTransformer) Transform(g *Graph) error {
+        if t.Schemas == nil {
+                // Should never happen with a reasonable caller, but we'll return a
+                // proper error here anyway so that we'll fail gracefully.
+                return fmt.Errorf("AttachSchemaTransformer used with nil Schemas")
+        }
+
+        for _, v := range g.Vertices() {
+
+                if tv, ok := v.(GraphNodeAttachResourceSchema); ok {
+                        addr := tv.ResourceAddr()
+                        mode := addr.Resource.Mode
+                        typeName := addr.Resource.Type
+                        providerAddr, _ := tv.ProvidedBy()
+                        providerType := providerAddr.ProviderConfig.Type
+
+                        schema, version := t.Schemas.ResourceTypeConfig(providerType, mode, typeName)
+                        if schema == nil {
+                                log.Printf("[ERROR] AttachSchemaTransformer: No resource schema available for %s", addr)
+                                continue
+                        }
+                        log.Printf("[TRACE] AttachSchemaTransformer: attaching resource schema to %s", dag.VertexName(v))
+                        tv.AttachResourceSchema(schema, version)
+                }
+
+                if tv, ok := v.(GraphNodeAttachProviderConfigSchema); ok {
+                        providerAddr := tv.ProviderAddr()
+                        schema := t.Schemas.ProviderConfig(providerAddr.ProviderConfig.Type)
+                        if schema == nil {
+                                log.Printf("[ERROR] AttachSchemaTransformer: No provider config schema available for %s", providerAddr)
+                                continue
+                        }
+                        log.Printf("[TRACE] AttachSchemaTransformer: attaching provider config schema to %s", dag.VertexName(v))
+                        tv.AttachProviderConfigSchema(schema)
+                }
+
+                if tv, ok := v.(GraphNodeAttachProvisionerSchema); ok {
+                        names := tv.ProvisionedBy()
+                        for _, name := range names {
+                                schema := t.Schemas.ProvisionerConfig(name)
+                                if schema == nil {
+                                        log.Printf("[ERROR] AttachSchemaTransformer: No schema available for provisioner %q on %q", name, dag.VertexName(v))
+                                        continue
+                                }
+                                log.Printf("[TRACE] AttachSchemaTransformer: attaching provisioner %q config schema to %s", name, dag.VertexName(v))
+                                tv.AttachProvisionerSchema(name, schema)
+                        }
+                }
+        }
+
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_state.go b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_state.go
index 564ff08..3af7b98 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_state.go
@@ -4,64 +4,64 @@ import (
         "log"
 
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
 )
 
 // GraphNodeAttachResourceState is an interface that can be implemented
 // to request that a ResourceState is attached to the node.
+//
+// Due to a historical naming inconsistency, the type ResourceState actually
+// represents the state for a particular _instance_, while InstanceState
+// represents the values for that instance during a particular phase
+// (e.g. primary vs. deposed). Consequently, GraphNodeAttachResourceState
+// is supported only for nodes that represent resource instances, even though
+// the name might suggest it is for containing resources.
 type GraphNodeAttachResourceState interface {
-        // The address to the resource for the state
-        ResourceAddr() *ResourceAddress
+        GraphNodeResourceInstance
 
         // Sets the state
-        AttachResourceState(*ResourceState)
+        AttachResourceState(*states.Resource)
 }
 
 // AttachStateTransformer goes through the graph and attaches
 // state to nodes that implement the interfaces above.
 type AttachStateTransformer struct {
-        State *State // State is the root state
+        State *states.State // State is the root state
 }
 
 func (t *AttachStateTransformer) Transform(g *Graph) error {
         // If no state, then nothing to do
         if t.State == nil {
-                log.Printf("[DEBUG] Not attaching any state: state is nil")
+                log.Printf("[DEBUG] Not attaching any node states: overall state is nil")
                 return nil
         }
 
-        filter := &StateFilter{State: t.State}
         for _, v := range g.Vertices() {
-                // Only care about nodes requesting we're adding state
+                // Nodes implement this interface to request state attachment.
                 an, ok := v.(GraphNodeAttachResourceState)
                 if !ok {
                         continue
                 }
-                addr := an.ResourceAddr()
+                addr := an.ResourceInstanceAddr()
 
-                // Get the module state
-                results, err := filter.Filter(addr.String())
-                if err != nil {
-                        return err
+                rs := t.State.Resource(addr.ContainingResource())
+                if rs == nil {
+                        log.Printf("[DEBUG] Resource state not found for node %q, instance %s", dag.VertexName(v), addr)
+                        continue
                 }
 
-                // Attach the first resource state we get
-                found := false
-                for _, result := range results {
-                        if rs, ok := result.Value.(*ResourceState); ok {
-                                log.Printf(
-                                        "[DEBUG] Attaching resource state to %q: %#v",
-                                        dag.VertexName(v), rs)
-                                an.AttachResourceState(rs)
-                                found = true
-                                break
-                        }
+                is := rs.Instance(addr.Resource.Key)
+                if is == nil {
+                        // We don't actually need this here, since we'll attach the whole
+                        // resource state, but we still check because it'd be weird
+                        // for the specific instance we're attaching to not to exist.
+                        log.Printf("[DEBUG] Resource instance state not found for node %q, instance %s", dag.VertexName(v), addr)
+                        continue
                 }
 
-                if !found {
-                        log.Printf(
-                                "[DEBUG] Resource state not found for %q: %s",
-                                dag.VertexName(v), addr)
-                }
+                // make sure to attach a copy of the state, so instances can modify the
+                // same ResourceState.
+                an.AttachResourceState(rs.DeepCopy())
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_config.go b/vendor/github.com/hashicorp/terraform/terraform/transform_config.go
index 61bce85..9d3b6f4 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_config.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_config.go
@@ -1,13 +1,11 @@
 package terraform
 
 import (
-        "errors"
-        "fmt"
         "log"
         "sync"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -26,14 +24,14 @@ type ConfigTransformer struct {
         Concrete ConcreteResourceNodeFunc
 
         // Module is the module to add resources from.
-        Module *module.Tree
+        Config *configs.Config
 
         // Unique will only add resources that aren't already present in the graph.
         Unique bool
 
         // Mode will only add resources that match the given mode
         ModeFilter bool
-        Mode       config.ResourceMode
+        Mode       addrs.ResourceMode
 
         l         sync.Mutex
         uniqueMap map[string]struct{}
@@ -44,16 +42,11 @@ func (t *ConfigTransformer) Transform(g *Graph) error {
         t.l.Lock()
         defer t.l.Unlock()
 
-        // If no module is given, we don't do anything
-        if t.Module == nil {
+        // If no configuration is available, we don't do anything
+        if t.Config == nil {
                 return nil
         }
 
-        // If the module isn't loaded, that is simply an error
-        if !t.Module.Loaded() {
-                return errors.New("module must be loaded for ConfigTransformer")
-        }
-
         // Reset the uniqueness map. If we're tracking uniques, then populate
         // it with addresses.
         t.uniqueMap = make(map[string]struct{})
@@ -67,22 +60,22 @@ func (t *ConfigTransformer) Transform(g *Graph) error {
         }
 
         // Start the transformation process
-        return t.transform(g, t.Module)
+        return t.transform(g, t.Config)
 }
 
-func (t *ConfigTransformer) transform(g *Graph, m *module.Tree) error {
+func (t *ConfigTransformer) transform(g *Graph, config *configs.Config) error {
         // If no config, do nothing
-        if m == nil {
+        if config == nil {
                 return nil
         }
 
         // Add our resources
-        if err := t.transformSingle(g, m); err != nil {
+        if err := t.transformSingle(g, config); err != nil {
                 return err
         }
 
         // Transform all the children.
-        for _, c := range m.Children() {
+        for _, c := range config.Children {
                 if err := t.transform(g, c); err != nil {
                         return err
                 }
@@ -91,43 +84,48 @@ func (t *ConfigTransformer) transform(g *Graph, m *module.Tree) error {
         return nil
 }
 
-func (t *ConfigTransformer) transformSingle(g *Graph, m *module.Tree) error {
-        log.Printf("[TRACE] ConfigTransformer: Starting for path: %v", m.Path())
-
-        // Get the configuration for this module
-        conf := m.Config()
-
-        // Build the path we're at
-        path := m.Path()
+func (t *ConfigTransformer) transformSingle(g *Graph, config *configs.Config) error {
+        path := config.Path
+        module := config.Module
+        log.Printf("[TRACE] ConfigTransformer: Starting for path: %v", path)
+
+        // For now we assume that each module call produces only one module
+        // instance with no key, since we don't yet support "count" and "for_each"
+        // on modules.
+        // FIXME: As part of supporting "count" and "for_each" on modules, rework
+        // this so that we'll "expand" the module call first and then create graph
+        // nodes for each module instance separately.
+        instPath := path.UnkeyedInstanceShim()
+
+        allResources := make([]*configs.Resource, 0, len(module.ManagedResources)+len(module.DataResources))
+        for _, r := range module.ManagedResources {
+                allResources = append(allResources, r)
+        }
+        for _, r := range module.DataResources {
+                allResources = append(allResources, r)
+        }
 
-        // Write all the resources out
-        for _, r := range conf.Resources {
-                // Build the resource address
-                addr, err := parseResourceAddressConfig(r)
-                if err != nil {
-                        panic(fmt.Sprintf(
-                                "Error parsing config address, this is a bug: %#v", r))
-                }
-                addr.Path = path
+        for _, r := range allResources {
+                relAddr := r.Addr()
 
-                // If this is already in our uniqueness map, don't add it again
-                if _, ok := t.uniqueMap[addr.String()]; ok {
+                if t.ModeFilter && relAddr.Mode != t.Mode {
+                        // Skip non-matching modes
                         continue
                 }
 
-                // Remove non-matching modes
-                if t.ModeFilter && addr.Mode != t.Mode {
+                addr := relAddr.Absolute(instPath)
+                if _, ok := t.uniqueMap[addr.String()]; ok {
+                        // We've already seen a resource with this address. This should
+                        // never happen, because we enforce uniqueness in the config loader.
                         continue
                 }
 
-                // Build the abstract node and the concrete one
                 abstract := &NodeAbstractResource{Addr: addr}
                 var node dag.Vertex = abstract
                 if f := t.Concrete; f != nil {
                         node = f(abstract)
                 }
 
-                // Add it to the graph
                 g.Add(node)
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_config_flat.go b/vendor/github.com/hashicorp/terraform/terraform/transform_config_flat.go
index 92f9888..866c917 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_config_flat.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_config_flat.go
@@ -1,9 +1,7 @@
 package terraform
 
 import (
-        "errors"
-
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -20,54 +18,47 @@ import (
 type FlatConfigTransformer struct {
         Concrete ConcreteResourceNodeFunc // What to turn resources into
 
-        Module *module.Tree
+        Config *configs.Config
 }
 
 func (t *FlatConfigTransformer) Transform(g *Graph) error {
-        // If no module, we do nothing
-        if t.Module == nil {
+        // We have nothing to do if there is no configuration.
+        if t.Config == nil {
                 return nil
         }
 
-        // If the module is not loaded, that is an error
-        if !t.Module.Loaded() {
-                return errors.New("module must be loaded")
-        }
-
-        return t.transform(g, t.Module)
+        return t.transform(g, t.Config)
 }
 
-func (t *FlatConfigTransformer) transform(g *Graph, m *module.Tree) error {
-        // If no module, no problem
-        if m == nil {
+func (t *FlatConfigTransformer) transform(g *Graph, config *configs.Config) error {
+        // If we have no configuration then there's nothing to do.
+        if config == nil {
                 return nil
         }
 
         // Transform all the children.
-        for _, c := range m.Children() {
+        for _, c := range config.Children {
                 if err := t.transform(g, c); err != nil {
                         return err
                 }
         }
 
-        // Get the configuration for this module
-        config := m.Config()
-
-        // Write all the resources out
-        for _, r := range config.Resources {
-                // Grab the address for this resource
-                addr, err := parseResourceAddressConfig(r)
-                if err != nil {
-                        return err
-                }
-                addr.Path = m.Path()
+        module := config.Module
+        // For now we assume that each module call produces only one module
+        // instance with no key, since we don't yet support "count" and "for_each"
+        // on modules.
+        // FIXME: As part of supporting "count" and "for_each" on modules, rework
+        // this so that we'll "expand" the module call first and then create graph
+        // nodes for each module instance separately.
+        instPath := config.Path.UnkeyedInstanceShim()
 
-                // Build the abstract resource. We have the config already so
-                // we'll just pre-populate that.
+        for _, r := range module.ManagedResources {
+                addr := r.Addr().Absolute(instPath)
                 abstract := &NodeAbstractResource{
                         Addr:   addr,
                         Config: r,
                 }
+                // Grab the address for this resource
                 var node dag.Vertex = abstract
                 if f := t.Concrete; f != nil {
                         node = f(abstract)
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_count_boundary.go b/vendor/github.com/hashicorp/terraform/terraform/transform_count_boundary.go
index 83415f3..01601bd 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_count_boundary.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_count_boundary.go
@@ -1,16 +1,21 @@
 package terraform
 
 import (
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
 )
 
 // CountBoundaryTransformer adds a node that depends on everything else
 // so that it runs last in order to clean up the state for nodes that
 // are on the "count boundary": "foo.0" when only one exists becomes "foo"
-type CountBoundaryTransformer struct{}
+type CountBoundaryTransformer struct {
+        Config *configs.Config
+}
 
 func (t *CountBoundaryTransformer) Transform(g *Graph) error {
-        node := &NodeCountBoundary{}
+        node := &NodeCountBoundary{
+                Config: t.Config,
+        }
         g.Add(node)
 
         // Depends on everything
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_deposed.go b/vendor/github.com/hashicorp/terraform/terraform/transform_deposed.go
deleted file mode 100644
index 87a1f9c..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_deposed.go
+++ /dev/null
@@ -1,178 +0,0 @@
-package terraform
-
-import "fmt"
-
-// DeposedTransformer is a GraphTransformer that adds deposed resources
-// to the graph.
-type DeposedTransformer struct {
-        // State is the global state. We'll automatically find the correct
-        // ModuleState based on the Graph.Path that is being transformed.
-        State *State
-
-        // View, if non-empty, is the ModuleState.View used around the state
-        // to find deposed resources.
-        View string
-
-        // The provider used by the resourced which were deposed
-        ResolvedProvider string
-}
-
-func (t *DeposedTransformer) Transform(g *Graph) error {
-        state := t.State.ModuleByPath(g.Path)
-        if state == nil {
-                // If there is no state for our module there can't be any deposed
-                // resources, since they live in the state.
-                return nil
-        }
-
-        // If we have a view, apply it now
-        if t.View != "" {
-                state = state.View(t.View)
-        }
-
-        // Go through all the resources in our state to look for deposed resources
-        for k, rs := range state.Resources {
-                // If we have no deposed resources, then move on
-                if len(rs.Deposed) == 0 {
-                        continue
-                }
-
-                deposed := rs.Deposed
-
-                for i, _ := range deposed {
-                        g.Add(&graphNodeDeposedResource{
-                                Index:            i,
-                                ResourceName:     k,
-                                ResourceType:     rs.Type,
-                                ProviderName:     rs.Provider,
-                                ResolvedProvider: t.ResolvedProvider,
-                        })
-                }
-        }
-
-        return nil
-}
-
-// graphNodeDeposedResource is the graph vertex representing a deposed resource.
-type graphNodeDeposedResource struct {
-        Index            int
-        ResourceName     string
-        ResourceType     string
-        ProviderName     string
-        ResolvedProvider string
-}
-
-func (n *graphNodeDeposedResource) Name() string {
-        return fmt.Sprintf("%s (deposed #%d)", n.ResourceName, n.Index)
-}
-
-func (n *graphNodeDeposedResource) ProvidedBy() string {
-        return resourceProvider(n.ResourceName, n.ProviderName)
-}
-
-func (n *graphNodeDeposedResource) SetProvider(p string) {
-        n.ResolvedProvider = p
-}
-
-// GraphNodeEvalable impl.
-func (n *graphNodeDeposedResource) EvalTree() EvalNode {
-        var provider ResourceProvider
-        var state *InstanceState
-
-        seq := &EvalSequence{Nodes: make([]EvalNode, 0, 5)}
-
-        // Build instance info
-        info := &InstanceInfo{Id: n.Name(), Type: n.ResourceType}
-        seq.Nodes = append(seq.Nodes, &EvalInstanceInfo{Info: info})
-
-        // Refresh the resource
-        seq.Nodes = append(seq.Nodes, &EvalOpFilter{
-                Ops: []walkOperation{walkRefresh},
-                Node: &EvalSequence{
-                        Nodes: []EvalNode{
-                                &EvalGetProvider{
-                                        Name:   n.ResolvedProvider,
-                                        Output: &provider,
-                                },
-                                &EvalReadStateDeposed{
-                                        Name:   n.ResourceName,
-                                        Output: &state,
-                                        Index:  n.Index,
-                                },
-                                &EvalRefresh{
-                                        Info:     info,
-                                        Provider: &provider,
-                                        State:    &state,
-                                        Output:   &state,
-                                },
-                                &EvalWriteStateDeposed{
-                                        Name:         n.ResourceName,
-                                        ResourceType: n.ResourceType,
-                                        Provider:     n.ResolvedProvider,
-                                        State:        &state,
-                                        Index:        n.Index,
-                                },
-                        },
-                },
-        })
-
-        // Apply
-        var diff *InstanceDiff
-        var err error
-        seq.Nodes = append(seq.Nodes, &EvalOpFilter{
-                Ops: []walkOperation{walkApply, walkDestroy},
-                Node: &EvalSequence{
-                        Nodes: []EvalNode{
-                                &EvalGetProvider{
-                                        Name:   n.ResolvedProvider,
-                                        Output: &provider,
-                                },
-                                &EvalReadStateDeposed{
-                                        Name:   n.ResourceName,
-                                        Output: &state,
-                                        Index:  n.Index,
-                                },
-                                &EvalDiffDestroy{
-                                        Info:   info,
-                                        State:  &state,
-                                        Output: &diff,
-                                },
-                                // Call pre-apply hook
-                                &EvalApplyPre{
-                                        Info:  info,
-                                        State: &state,
-                                        Diff:  &diff,
-                                },
-                                &EvalApply{
-                                        Info:     info,
-                                        State:    &state,
-                                        Diff:     &diff,
-                                        Provider: &provider,
-                                        Output:   &state,
-                                        Error:    &err,
-                                },
-                                // Always write the resource back to the state deposed... if it
-                                // was successfully destroyed it will be pruned. If it was not, it will
-                                // be caught on the next run.
-                                &EvalWriteStateDeposed{
-                                        Name:         n.ResourceName,
-                                        ResourceType: n.ResourceType,
-                                        Provider:     n.ResolvedProvider,
-                                        State:        &state,
-                                        Index:        n.Index,
-                                },
-                                &EvalApplyPost{
-                                        Info:  info,
-                                        State: &state,
-                                        Error: &err,
-                                },
-                                &EvalReturnError{
-                                        Error: &err,
-                                },
-                                &EvalUpdateStateHook{},
-                        },
-                },
-        })
-
-        return seq
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_cbd.go b/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_cbd.go
index edfb460..2f4d5ed 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_cbd.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_cbd.go
@@ -4,15 +4,15 @@ import (
         "fmt"
         "log"
 
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
 )
 
 // GraphNodeDestroyerCBD must be implemented by nodes that might be
-// create-before-destroy destroyers.
+// create-before-destroy destroyers, or might plan a create-before-destroy
+// action.
 type GraphNodeDestroyerCBD interface {
-        GraphNodeDestroyer
-
         // CreateBeforeDestroy returns true if this node represents a node
         // that is doing a CBD.
         CreateBeforeDestroy() bool
@@ -23,6 +23,89 @@ type GraphNodeDestroyerCBD interface {
         ModifyCreateBeforeDestroy(bool) error
 }
 
+// GraphNodeAttachDestroyer is implemented by applyable nodes that have a
+// companion destroy node. This allows the creation node to look up the status
+// of the destroy node and determine if it needs to depose the existing state,
+// or replace it.
+// If a node is not marked as create-before-destroy in the configuration, but a
+// dependency forces that status, only the destroy node will be aware of that
+// status.
+type GraphNodeAttachDestroyer interface {
+        // AttachDestroyNode takes a destroy node and saves a reference to that
+        // node in the receiver, so it can later check the status of
+        // CreateBeforeDestroy().
+        AttachDestroyNode(n GraphNodeDestroyerCBD)
+}
+
+// ForcedCBDTransformer detects when a particular CBD-able graph node has
+// dependencies with another that has create_before_destroy set that require
+// it to be forced on, and forces it on.
+//
+// This must be used in the plan graph builder to ensure that
+// create_before_destroy settings are properly propagated before constructing
+// the planned changes. This requires that the plannable resource nodes
+// implement GraphNodeDestroyerCBD.
+type ForcedCBDTransformer struct {
+}
+
+func (t *ForcedCBDTransformer) Transform(g *Graph) error {
+        for _, v := range g.Vertices() {
+                dn, ok := v.(GraphNodeDestroyerCBD)
+                if !ok {
+                        continue
+                }
+
+                if !dn.CreateBeforeDestroy() {
+                        // If there are no CBD decendent (dependent nodes), then we
+                        // do nothing here.
+                        if !t.hasCBDDescendent(g, v) {
+                                log.Printf("[TRACE] ForcedCBDTransformer: %q (%T) has no CBD descendent, so skipping", dag.VertexName(v), v)
+                                continue
+                        }
+
+                        // If this isn't naturally a CBD node, this means that an descendent is
+                        // and we need to auto-upgrade this node to CBD. We do this because
+                        // a CBD node depending on non-CBD will result in cycles. To avoid this,
+                        // we always attempt to upgrade it.
+                        log.Printf("[TRACE] ForcedCBDTransformer: forcing create_before_destroy on for %q (%T)", dag.VertexName(v), v)
+                        if err := dn.ModifyCreateBeforeDestroy(true); err != nil {
+                                return fmt.Errorf(
+                                        "%s: must have create before destroy enabled because "+
+                                                "a dependent resource has CBD enabled. However, when "+
+                                                "attempting to automatically do this, an error occurred: %s",
+                                        dag.VertexName(v), err)
+                        }
+                } else {
+                        log.Printf("[TRACE] ForcedCBDTransformer: %q (%T) already has create_before_destroy set", dag.VertexName(v), v)
+                }
+        }
+        return nil
+}
+
+// hasCBDDescendent returns true if any descendent (node that depends on this)
+// has CBD set.
+func (t *ForcedCBDTransformer) hasCBDDescendent(g *Graph, v dag.Vertex) bool {
+        s, _ := g.Descendents(v)
+        if s == nil {
+                return true
+        }
+
+        for _, ov := range s.List() {
+                dn, ok := ov.(GraphNodeDestroyerCBD)
+                if !ok {
+                        continue
+                }
+
+                if dn.CreateBeforeDestroy() {
+                        // some descendent is CreateBeforeDestroy, so we need to follow suit
+                        log.Printf("[TRACE] ForcedCBDTransformer: %q has CBD descendent %q", dag.VertexName(v), dag.VertexName(ov))
+                        return true
+                }
+        }
+
+        return false
+}
+
 // CBDEdgeTransformer modifies the edges of CBD nodes that went through
 // the DestroyEdgeTransformer to have the right dependencies. There are
 // two real tasks here:
@@ -35,16 +118,25 @@ type GraphNodeDestroyerCBD interface {
 //      update to A. Example: adding a web server updates the load balancer
 //      before deleting the old web server.
 //
+// This transformer requires that a previous transformer has already forced
+// create_before_destroy on for nodes that are depended on by explicit CBD
+// nodes. This is the logic in ForcedCBDTransformer, though in practice we
+// will get here by recording the CBD-ness of each change in the plan during
+// the plan walk and then forcing the nodes into the appropriate setting during
+// DiffTransformer when building the apply graph.
 type CBDEdgeTransformer struct {
         // Module and State are only needed to look up dependencies in
         // any way possible. Either can be nil if not availabile.
-        Module *module.Tree
-        State  *State
+        Config *configs.Config
+        State  *states.State
+
+        // If configuration is present then Schemas is required in order to
+        // obtain schema information from providers and provisioners so we can
+        // properly resolve implicit dependencies.
+        Schemas *Schemas
 }
 
 func (t *CBDEdgeTransformer) Transform(g *Graph) error {
-        log.Printf("[TRACE] CBDEdgeTransformer: Beginning CBD transformation...")
-
         // Go through and reverse any destroy edges
         destroyMap := make(map[string][]dag.Vertex)
         for _, v := range g.Vertices() {
@@ -52,25 +144,13 @@ func (t *CBDEdgeTransformer) Transform(g *Graph) error {
                 if !ok {
                         continue
                 }
+                dern, ok := v.(GraphNodeDestroyer)
+                if !ok {
+                        continue
+                }
 
                 if !dn.CreateBeforeDestroy() {
-                        // If there are no CBD ancestors (dependent nodes), then we
-                        // do nothing here.
-                        if !t.hasCBDAncestor(g, v) {
-                                continue
-                        }
-
-                        // If this isn't naturally a CBD node, this means that an ancestor is
-                        // and we need to auto-upgrade this node to CBD. We do this because
-                        // a CBD node depending on non-CBD will result in cycles. To avoid this,
-                        // we always attempt to upgrade it.
-                        if err := dn.ModifyCreateBeforeDestroy(true); err != nil {
-                                return fmt.Errorf(
-                                        "%s: must have create before destroy enabled because "+
-                                                "a dependent resource has CBD enabled. However, when "+
-                                                "attempting to automatically do this, an error occurred: %s",
-                                        dag.VertexName(v), err)
-                        }
+                        continue
                 }
 
                 // Find the destroy edge. There should only be one.
@@ -86,7 +166,9 @@ func (t *CBDEdgeTransformer) Transform(g *Graph) error {
 
                         // Found it! Invert.
                         g.RemoveEdge(de)
-                        g.Connect(&DestroyEdge{S: de.Target(), T: de.Source()})
+                        applyNode := de.Source()
+                        destroyNode := de.Target()
+                        g.Connect(&DestroyEdge{S: destroyNode, T: applyNode})
                 }
 
                 // If the address has an index, we strip that. Our depMap creation
@@ -94,15 +176,11 @@ func (t *CBDEdgeTransformer) Transform(g *Graph) error {
                 // dependencies. One day when we limit dependencies more exactly
                 // this will have to change. We have a test case covering this
                 // (depNonCBDCountBoth) so it'll be caught.
-                addr := dn.DestroyAddr()
-                if addr.Index >= 0 {
-                        addr = addr.Copy() // Copy so that we don't modify any pointers
-                        addr.Index = -1
-                }
+                addr := dern.DestroyAddr()
+                key := addr.ContainingResource().String()
 
                 // Add this to the list of nodes that we need to fix up
                 // the edges for (step 2 above in the docs).
-                key := addr.String()
                 destroyMap[key] = append(destroyMap[key], v)
         }
 
@@ -151,13 +229,9 @@ func (t *CBDEdgeTransformer) Transform(g *Graph) error {
                 // dependencies. One day when we limit dependencies more exactly
                 // this will have to change. We have a test case covering this
                 // (depNonCBDCount) so it'll be caught.
-                if addr.Index >= 0 {
-                        addr = addr.Copy() // Copy so that we don't modify any pointers
-                        addr.Index = -1
-                }
+                key := addr.ContainingResource().String()
 
                 // If there is nothing this resource should depend on, ignore it
-                key := addr.String()
                 dns, ok := depMap[key]
                 if !ok {
                         continue
@@ -174,21 +248,21 @@ func (t *CBDEdgeTransformer) Transform(g *Graph) error {
         return nil
 }
 
-func (t *CBDEdgeTransformer) depMap(
-        destroyMap map[string][]dag.Vertex) (map[string][]dag.Vertex, error) {
+func (t *CBDEdgeTransformer) depMap(destroyMap map[string][]dag.Vertex) (map[string][]dag.Vertex, error) {
         // Build the graph of our config, this ensures that all resources
         // are present in the graph.
-        g, err := (&BasicGraphBuilder{
+        g, diags := (&BasicGraphBuilder{
                 Steps: []GraphTransformer{
-                        &FlatConfigTransformer{Module: t.Module},
-                        &AttachResourceConfigTransformer{Module: t.Module},
+                        &FlatConfigTransformer{Config: t.Config},
+                        &AttachResourceConfigTransformer{Config: t.Config},
                         &AttachStateTransformer{State: t.State},
+                        &AttachSchemaTransformer{Schemas: t.Schemas},
                         &ReferenceTransformer{},
                 },
                 Name: "CBDEdgeTransformer",
         }).Build(nil)
-        if err != nil {
-                return nil, err
+        if diags.HasErrors() {
+                return nil, diags.Err()
         }
 
         // Using this graph, build the list of destroy nodes that each resource
@@ -232,26 +306,3 @@ func (t *CBDEdgeTransformer) depMap(
 
         return depMap, nil
 }
-
-// hasCBDAncestor returns true if any ancestor (node that depends on this)
-// has CBD set.
-func (t *CBDEdgeTransformer) hasCBDAncestor(g *Graph, v dag.Vertex) bool {
-        s, _ := g.Ancestors(v)
-        if s == nil {
-                return true
-        }
-
-        for _, v := range s.List() {
-                dn, ok := v.(GraphNodeDestroyerCBD)
-                if !ok {
-                        continue
-                }
-
-                if dn.CreateBeforeDestroy() {
-                        // some ancestor is CreateBeforeDestroy, so we need to follow suit
-                        return true
-                }
-        }
-
-        return false
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_edge.go b/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_edge.go
index a06ff29..7fb415b 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_edge.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_edge.go
@@ -3,7 +3,10 @@ package terraform
 import (
         "log"
 
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -11,16 +14,16 @@ import (
 type GraphNodeDestroyer interface {
         dag.Vertex
 
-        // ResourceAddr is the address of the resource that is being
+        // DestroyAddr is the address of the resource that is being
         // destroyed by this node. If this returns nil, then this node
         // is not destroying anything.
-        DestroyAddr() *ResourceAddress
+        DestroyAddr() *addrs.AbsResourceInstance
 }
 
 // GraphNodeCreator must be implemented by nodes that create OR update resources.
 type GraphNodeCreator interface {
-        // ResourceAddr is the address of the resource being created or updated
-        CreateAddr() *ResourceAddress
+        // CreateAddr is the address of the resource being created or updated
+        CreateAddr() *addrs.AbsResourceInstance
 }
 
 // DestroyEdgeTransformer is a GraphTransformer that creates the proper
@@ -40,33 +43,37 @@ type GraphNodeCreator interface {
 type DestroyEdgeTransformer struct {
         // These are needed to properly build the graph of dependencies
         // to determine what a destroy node depends on. Any of these can be nil.
-        Module *module.Tree
-        State  *State
+        Config *configs.Config
+        State  *states.State
+
+        // If configuration is present then Schemas is required in order to
+        // obtain schema information from providers and provisioners in order
+        // to properly resolve implicit dependencies.
+        Schemas *Schemas
 }
 
 func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
-        log.Printf("[TRACE] DestroyEdgeTransformer: Beginning destroy edge transformation...")
-
         // Build a map of what is being destroyed (by address string) to
-        // the list of destroyers. In general there will only be one destroyer
-        // but to make it more robust we support multiple.
+        // the list of destroyers. Usually there will be at most one destroyer
+        // per node, but we allow multiple if present for completeness.
         destroyers := make(map[string][]GraphNodeDestroyer)
+        destroyerAddrs := make(map[string]addrs.AbsResourceInstance)
         for _, v := range g.Vertices() {
                 dn, ok := v.(GraphNodeDestroyer)
                 if !ok {
                         continue
                 }
 
-                addr := dn.DestroyAddr()
-                if addr == nil {
+                addrP := dn.DestroyAddr()
+                if addrP == nil {
                         continue
                 }
+                addr := *addrP
 
                 key := addr.String()
-                log.Printf(
-                        "[TRACE] DestroyEdgeTransformer: %s destroying %q",
-                        dag.VertexName(dn), key)
+                log.Printf("[TRACE] DestroyEdgeTransformer: %q (%T) destroys %s", dag.VertexName(dn), v, key)
                 destroyers[key] = append(destroyers[key], dn)
+                destroyerAddrs[key] = addr
         }
 
         // If we aren't destroying anything, there will be no edges to make
@@ -100,10 +107,20 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
                         a := v
 
                         log.Printf(
-                                "[TRACE] DestroyEdgeTransformer: connecting creator/destroyer: %s, %s",
+                                "[TRACE] DestroyEdgeTransformer: connecting creator %q with destroyer %q",
                                 dag.VertexName(a), dag.VertexName(a_d))
 
                         g.Connect(&DestroyEdge{S: a, T: a_d})
+
+                        // Attach the destroy node to the creator
+                        // There really shouldn't be more than one destroyer, but even if
+                        // there are, any of them will represent the correct
+                        // CreateBeforeDestroy status.
+                        if n, ok := cn.(GraphNodeAttachDestroyer); ok {
+                                if d, ok := d.(GraphNodeDestroyerCBD); ok {
+                                        n.AttachDestroyNode(d)
+                                }
+                        }
                 }
         }
 
@@ -120,20 +137,24 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
         }
         steps := []GraphTransformer{
                 // Add the local values
-                &LocalTransformer{Module: t.Module},
+                &LocalTransformer{Config: t.Config},
 
                 // Add outputs and metadata
-                &OutputTransformer{Module: t.Module},
-                &AttachResourceConfigTransformer{Module: t.Module},
+                &OutputTransformer{Config: t.Config},
+                &AttachResourceConfigTransformer{Config: t.Config},
                 &AttachStateTransformer{State: t.State},
 
-                TransformProviders(nil, providerFn, t.Module),
-
                 // Add all the variables. We can depend on resources through
                 // variables due to module parameters, and we need to properly
                 // determine that.
-                &RootVariableTransformer{Module: t.Module},
-                &ModuleVariableTransformer{Module: t.Module},
+                &RootVariableTransformer{Config: t.Config},
+                &ModuleVariableTransformer{Config: t.Config},
+
+                TransformProviders(nil, providerFn, t.Config),
+
+                // Must attach schemas before ReferenceTransformer so that we can
+                // analyze the configuration to find references.
+                &AttachSchemaTransformer{Schemas: t.Schemas},
 
                 &ReferenceTransformer{},
         }
@@ -146,37 +167,36 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
         //
         var tempG Graph
         var tempDestroyed []dag.Vertex
-        for d, _ := range destroyers {
-                // d is what is being destroyed. We parse the resource address
-                // which it came from it is a panic if this fails.
-                addr, err := ParseResourceAddress(d)
-                if err != nil {
-                        panic(err)
-                }
+        for d := range destroyers {
+                // d is the string key for the resource being destroyed. We actually
+                // want the address value, which we stashed earlier.
+                addr := destroyerAddrs[d]
 
                 // This part is a little bit weird but is the best way to
                 // find the dependencies we need to: build a graph and use the
                 // attach config and state transformers then ask for references.
-                abstract := &NodeAbstractResource{Addr: addr}
+                abstract := NewNodeAbstractResourceInstance(addr)
                 tempG.Add(abstract)
                 tempDestroyed = append(tempDestroyed, abstract)
 
                 // We also add the destroy version here since the destroy can
                 // depend on things that the creation doesn't (destroy provisioners).
-                destroy := &NodeDestroyResource{NodeAbstractResource: abstract}
+                destroy := &NodeDestroyResourceInstance{NodeAbstractResourceInstance: abstract}
                 tempG.Add(destroy)
                 tempDestroyed = append(tempDestroyed, destroy)
         }
 
         // Run the graph transforms so we have the information we need to
         // build references.
+        log.Printf("[TRACE] DestroyEdgeTransformer: constructing temporary graph for analysis of references, starting from:\n%s", tempG.StringWithNodeTypes())
         for _, s := range steps {
+                log.Printf("[TRACE] DestroyEdgeTransformer: running %T on temporary graph", s)
                 if err := s.Transform(&tempG); err != nil {
+                        log.Printf("[TRACE] DestroyEdgeTransformer: %T failed: %s", s, err)
                         return err
                 }
         }
-
-        log.Printf("[TRACE] DestroyEdgeTransformer: reference graph: %s", tempG.String())
+        log.Printf("[TRACE] DestroyEdgeTransformer: temporary reference graph:\n%s", tempG.String())
 
         // Go through all the nodes in the graph and determine what they
         // depend on.
@@ -207,16 +227,13 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
 
                 // Get the destroy node for this. In the example of our struct,
                 // we are currently at B and we're looking for B_d.
-                rn, ok := v.(GraphNodeResource)
+                rn, ok := v.(GraphNodeResourceInstance)
                 if !ok {
+                        log.Printf("[TRACE] DestroyEdgeTransformer: skipping %s, since it's not a resource", dag.VertexName(v))
                         continue
                 }
 
-                addr := rn.ResourceAddr()
-                if addr == nil {
-                        continue
-                }
-
+                addr := rn.ResourceInstanceAddr()
                 dns := destroyers[addr.String()]
 
                 // We have dependencies, check if any are being destroyed
@@ -231,16 +248,12 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
                 // to see if A_d exists.
                 var depDestroyers []dag.Vertex
                 for _, v := range refs {
-                        rn, ok := v.(GraphNodeResource)
+                        rn, ok := v.(GraphNodeResourceInstance)
                         if !ok {
                                 continue
                         }
 
-                        addr := rn.ResourceAddr()
-                        if addr == nil {
-                                continue
-                        }
-
+                        addr := rn.ResourceInstanceAddr()
                         key := addr.String()
                         if ds, ok := destroyers[key]; ok {
                                 for _, d := range ds {
@@ -257,6 +270,7 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
                 for _, a_d := range dns {
                         for _, b_d := range depDestroyers {
                                 if b_d != a_d {
+                                        log.Printf("[TRACE] DestroyEdgeTransformer: %q depends on %q", dag.VertexName(b_d), dag.VertexName(a_d))
                                         g.Connect(dag.BasicEdge(b_d, a_d))
                                 }
                         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_diff.go b/vendor/github.com/hashicorp/terraform/terraform/transform_diff.go
index ad46d3c..6fb915f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_diff.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_diff.go
@@ -4,83 +4,189 @@ import (
         "fmt"
         "log"
 
-        "github.com/hashicorp/terraform/config/module"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/plans"
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
-// DiffTransformer is a GraphTransformer that adds the elements of
-// the diff to the graph.
-//
-// This transform is used for example by the ApplyGraphBuilder to ensure
-// that only resources that are being modified are represented in the graph.
-//
-// Module and State is still required for the DiffTransformer for annotations
-// since the Diff doesn't contain all the information required to build the
-// complete graph (such as create-before-destroy information). The graph
-// is built based on the diff first, though, ensuring that only resources
-// that are being modified are present in the graph.
+// DiffTransformer is a GraphTransformer that adds graph nodes representing
+// each of the resource changes described in the given Changes object.
 type DiffTransformer struct {
-        Concrete ConcreteResourceNodeFunc
-
-        Diff   *Diff
-        Module *module.Tree
-        State  *State
+        Concrete ConcreteResourceInstanceNodeFunc
+        State    *states.State
+        Changes  *plans.Changes
 }
 
 func (t *DiffTransformer) Transform(g *Graph) error {
-        // If the diff is nil or empty (nil is empty) then do nothing
-        if t.Diff.Empty() {
+        if t.Changes == nil || len(t.Changes.Resources) == 0 {
+                // Nothing to do!
                 return nil
         }
 
         // Go through all the modules in the diff.
-        log.Printf("[TRACE] DiffTransformer: starting")
-        var nodes []dag.Vertex
-        for _, m := range t.Diff.Modules {
-                log.Printf("[TRACE] DiffTransformer: Module: %s", m)
-                // TODO: If this is a destroy diff then add a module destroy node
-
-                // Go through all the resources in this module.
-                for name, inst := range m.Resources {
-                        log.Printf("[TRACE] DiffTransformer: Resource %q: %#v", name, inst)
-
-                        // We have changes! This is a create or update operation.
-                        // First grab the address so we have a unique way to
-                        // reference this resource.
-                        addr, err := parseResourceAddressInternal(name)
-                        if err != nil {
-                                panic(fmt.Sprintf(
-                                        "Error parsing internal name, this is a bug: %q", name))
-                        }
+        log.Printf("[TRACE] DiffTransformer starting")
+
+        var diags tfdiags.Diagnostics
+        state := t.State
+        changes := t.Changes
+
+        // DiffTransformer creates resource _instance_ nodes. If there are any
+        // whole-resource nodes already in the graph, we must ensure that they
+        // get evaluated before any of the corresponding instances by creating
+        // dependency edges, so we'll do some prep work here to ensure we'll only
+        // create connections to nodes that existed before we started here.
+        resourceNodes := map[string][]GraphNodeResource{}
+        for _, node := range g.Vertices() {
+                rn, ok := node.(GraphNodeResource)
+                if !ok {
+                        continue
+                }
+                // We ignore any instances that _also_ implement
+                // GraphNodeResourceInstance, since in the unlikely event that they
+                // do exist we'd probably end up creating cycles by connecting them.
+                if _, ok := node.(GraphNodeResourceInstance); ok {
+                        continue
+                }
+
+                addr := rn.ResourceAddr().String()
+                resourceNodes[addr] = append(resourceNodes[addr], rn)
+        }
+
+        for _, rc := range changes.Resources {
+                addr := rc.Addr
+                dk := rc.DeposedKey
+
+                log.Printf("[TRACE] DiffTransformer: found %s change for %s %s", rc.Action, addr, dk)
+
+                // Depending on the action we'll need some different combinations of
+                // nodes, because destroying uses a special node type separate from
+                // other actions.
+                var update, delete, createBeforeDestroy bool
+                switch rc.Action {
+                case plans.NoOp:
+                        continue
+                case plans.Delete:
+                        delete = true
+                case plans.DeleteThenCreate, plans.CreateThenDelete:
+                        update = true
+                        delete = true
+                        createBeforeDestroy = (rc.Action == plans.CreateThenDelete)
+                default:
+                        update = true
+                }
+
+                if dk != states.NotDeposed && update {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Invalid planned change for deposed object",
+                                fmt.Sprintf("The plan contains a non-delete change for %s deposed object %s. The only valid action for a deposed object is to destroy it, so this is a bug in Terraform.", addr, dk),
+                        ))
+                        continue
+                }
 
-                        // Very important: add the module path for this resource to
-                        // the address. Remove "root" from it.
-                        addr.Path = m.Path[1:]
+                // If we're going to do a create_before_destroy Replace operation then
+                // we need to allocate a DeposedKey to use to retain the
+                // not-yet-destroyed prior object, so that the delete node can destroy
+                // _that_ rather than the newly-created node, which will be current
+                // by the time the delete node is visited.
+                if update && delete && createBeforeDestroy {
+                        // In this case, variable dk will be the _pre-assigned_ DeposedKey
+                        // that must be used if the update graph node deposes the current
+                        // instance, which will then align with the same key we pass
+                        // into the destroy node to ensure we destroy exactly the deposed
+                        // object we expect.
+                        if state != nil {
+                                ris := state.ResourceInstance(addr)
+                                if ris == nil {
+                                        // Should never happen, since we don't plan to replace an
+                                        // instance that doesn't exist yet.
+                                        diags = diags.Append(tfdiags.Sourceless(
+                                                tfdiags.Error,
+                                                "Invalid planned change",
+                                                fmt.Sprintf("The plan contains a replace change for %s, which doesn't exist yet. This is a bug in Terraform.", addr),
+                                        ))
+                                        continue
+                                }
+
+                                // Allocating a deposed key separately from using it can be racy
+                                // in general, but we assume here that nothing except the apply
+                                // node we instantiate below will actually make new deposed objects
+                                // in practice, and so the set of already-used keys will not change
+                                // between now and then.
+                                dk = ris.FindUnusedDeposedKey()
+                        } else {
+                                // If we have no state at all yet then we can use _any_
+                                // DeposedKey.
+                                dk = states.NewDeposedKey()
+                        }
+                }
 
-                        // If we're destroying, add the destroy node
-                        if inst.Destroy || inst.GetDestroyDeposed() {
-                                abstract := &NodeAbstractResource{Addr: addr}
-                                g.Add(&NodeDestroyResource{NodeAbstractResource: abstract})
+                if update {
+                        // All actions except destroying the node type chosen by t.Concrete
+                        abstract := NewNodeAbstractResourceInstance(addr)
+                        var node dag.Vertex = abstract
+                        if f := t.Concrete; f != nil {
+                                node = f(abstract)
                         }
 
-                        // If we have changes, then add the applyable version
-                        if len(inst.Attributes) > 0 {
-                                // Add the resource to the graph
-                                abstract := &NodeAbstractResource{Addr: addr}
-                                var node dag.Vertex = abstract
-                                if f := t.Concrete; f != nil {
-                                        node = f(abstract)
+                        if createBeforeDestroy {
+                                // We'll attach our pre-allocated DeposedKey to the node if
+                                // it supports that. NodeApplyableResourceInstance is the
+                                // specific concrete node type we are looking for here really,
+                                // since that's the only node type that might depose objects.
+                                if dn, ok := node.(GraphNodeDeposer); ok {
+                                        dn.SetPreallocatedDeposedKey(dk)
                                 }
+                                log.Printf("[TRACE] DiffTransformer: %s will be represented by %s, deposing prior object to %s", addr, dag.VertexName(node), dk)
+                        } else {
+                                log.Printf("[TRACE] DiffTransformer: %s will be represented by %s", addr, dag.VertexName(node))
+                        }
 
-                                nodes = append(nodes, node)
+                        g.Add(node)
+                        rsrcAddr := addr.ContainingResource().String()
+                        for _, rsrcNode := range resourceNodes[rsrcAddr] {
+                                g.Connect(dag.BasicEdge(node, rsrcNode))
+                        }
+                }
+
+                if delete {
+                        // Destroying always uses a destroy-specific node type, though
+                        // which one depends on whether we're destroying a current object
+                        // or a deposed object.
+                        var node GraphNodeResourceInstance
+                        abstract := NewNodeAbstractResourceInstance(addr)
+                        if dk == states.NotDeposed {
+                                node = &NodeDestroyResourceInstance{
+                                        NodeAbstractResourceInstance: abstract,
+                                        DeposedKey:                   dk,
+                                }
+                                node.(*NodeDestroyResourceInstance).ModifyCreateBeforeDestroy(createBeforeDestroy)
+                        } else {
+                                node = &NodeDestroyDeposedResourceInstanceObject{
+                                        NodeAbstractResourceInstance: abstract,
+                                        DeposedKey:                   dk,
+                                }
+                        }
+                        if dk == states.NotDeposed {
+                                log.Printf("[TRACE] DiffTransformer: %s will be represented for destruction by %s", addr, dag.VertexName(node))
+                        } else {
+                                log.Printf("[TRACE] DiffTransformer: %s deposed object %s will be represented for destruction by %s", addr, dk, dag.VertexName(node))
+                        }
+                        g.Add(node)
+                        rsrcAddr := addr.ContainingResource().String()
+                        for _, rsrcNode := range resourceNodes[rsrcAddr] {
+                                // We connect this edge "forwards" (even though destroy dependencies
+                                // are often inverted) because evaluating the resource node
+                                // after the destroy node could cause an unnecessary husk of
+                                // a resource state to be re-added.
+                                g.Connect(dag.BasicEdge(node, rsrcNode))
                         }
                 }
-        }
 
-        // Add all the nodes to the graph
-        for _, n := range nodes {
-                g.Add(n)
         }
 
-        return nil
+        log.Printf("[TRACE] DiffTransformer complete")
+
+        return diags.Err()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_import_provider.go b/vendor/github.com/hashicorp/terraform/terraform/transform_import_provider.go
index 3673771..c1945f0 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_import_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_import_provider.go
@@ -2,7 +2,10 @@ package terraform
 
 import (
         "fmt"
-        "strings"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ImportProviderValidateTransformer is a GraphTransformer that goes through
@@ -10,6 +13,8 @@ import (
 type ImportProviderValidateTransformer struct{}
 
 func (t *ImportProviderValidateTransformer) Transform(g *Graph) error {
+        var diags tfdiags.Diagnostics
+
         for _, v := range g.Vertices() {
                 // We only care about providers
                 pv, ok := v.(GraphNodeProvider)
@@ -24,15 +29,16 @@ func (t *ImportProviderValidateTransformer) Transform(g *Graph) error {
                 }
 
                 for _, ref := range rn.References() {
-                        if !strings.HasPrefix(ref, "var.") {
-                                return fmt.Errorf(
-                                        "Provider %q depends on non-var %q. Providers for import can currently\n"+
-                                                "only depend on variables or must be hardcoded. You can stop import\n"+
-                                                "from loading configurations by specifying `-config=\"\"`.",
-                                        pv.ProviderName(), ref)
+                        if _, ok := ref.Subject.(addrs.InputVariable); !ok {
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid provider dependency for import",
+                                        Detail:   fmt.Sprintf("The configuration for %s depends on %s. Providers used with import must either have literal configuration or refer only to input variables.", pv.ProviderAddr(), ref.Subject.String()),
+                                        Subject:  ref.SourceRange.ToHCL().Ptr(),
+                                })
                         }
                 }
         }
 
-        return nil
+        return diags.Err()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_import_state.go b/vendor/github.com/hashicorp/terraform/terraform/transform_import_state.go
index fcbff65..ab0ecae 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_import_state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_import_state.go
@@ -2,6 +2,10 @@ package terraform
 
 import (
         "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // ImportStateTransformer is a GraphTransformer that adds nodes to the
@@ -11,64 +15,68 @@ type ImportStateTransformer struct {
 }
 
 func (t *ImportStateTransformer) Transform(g *Graph) error {
-        nodes := make([]*graphNodeImportState, 0, len(t.Targets))
         for _, target := range t.Targets {
-                addr, err := ParseResourceAddress(target.Addr)
-                if err != nil {
-                        return fmt.Errorf(
-                                "failed to parse resource address '%s': %s",
-                                target.Addr, err)
+                // The ProviderAddr may not be supplied for non-aliased providers.
+                // This will be populated if the targets come from the cli, but tests
+                // may not specify implied provider addresses.
+                providerAddr := target.ProviderAddr
+                if providerAddr.ProviderConfig.Type == "" {
+                        providerAddr = target.Addr.Resource.Resource.DefaultProviderConfig().Absolute(target.Addr.Module)
                 }
 
-                nodes = append(nodes, &graphNodeImportState{
-                        Addr:         addr,
+                node := &graphNodeImportState{
+                        Addr:         target.Addr,
                         ID:           target.ID,
-                        ProviderName: target.Provider,
-                })
-        }
-
-        // Build the graph vertices
-        for _, n := range nodes {
-                g.Add(n)
+                        ProviderAddr: providerAddr,
+                }
+                g.Add(node)
         }
-
         return nil
 }
 
 type graphNodeImportState struct {
-        Addr             *ResourceAddress // Addr is the resource address to import to
-        ID               string           // ID is the ID to import as
-        ProviderName     string           // Provider string
-        ResolvedProvider string           // provider node address
+        Addr             addrs.AbsResourceInstance // Addr is the resource address to import into
+        ID               string                    // ID is the ID to import as
+        ProviderAddr     addrs.AbsProviderConfig   // Provider address given by the user, or implied by the resource type
+        ResolvedProvider addrs.AbsProviderConfig   // provider node address after resolution
 
-        states []*InstanceState
+        states []providers.ImportedResource
 }
 
+var (
+        _ GraphNodeSubPath           = (*graphNodeImportState)(nil)
+        _ GraphNodeEvalable          = (*graphNodeImportState)(nil)
+        _ GraphNodeProviderConsumer  = (*graphNodeImportState)(nil)
+        _ GraphNodeDynamicExpandable = (*graphNodeImportState)(nil)
+)
+
 func (n *graphNodeImportState) Name() string {
-        return fmt.Sprintf("%s (import id: %s)", n.Addr, n.ID)
+        return fmt.Sprintf("%s (import id %q)", n.Addr, n.ID)
 }
 
-func (n *graphNodeImportState) ProvidedBy() string {
-        return resourceProvider(n.Addr.Type, n.ProviderName)
+// GraphNodeProviderConsumer
+func (n *graphNodeImportState) ProvidedBy() (addrs.AbsProviderConfig, bool) {
+        // We assume that n.ProviderAddr has been properly populated here.
+        // It's the responsibility of the code creating a graphNodeImportState
+        // to populate this, possibly by calling DefaultProviderConfig() on the
+        // resource address to infer an implied provider from the resource type
+        // name.
+        return n.ProviderAddr, false
 }
 
-func (n *graphNodeImportState) SetProvider(p string) {
-        n.ResolvedProvider = p
+// GraphNodeProviderConsumer
+func (n *graphNodeImportState) SetProvider(addr addrs.AbsProviderConfig) {
+        n.ResolvedProvider = addr
 }
 
 // GraphNodeSubPath
-func (n *graphNodeImportState) Path() []string {
-        return normalizeModulePath(n.Addr.Path)
+func (n *graphNodeImportState) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // GraphNodeEvalable impl.
 func (n *graphNodeImportState) EvalTree() EvalNode {
-        var provider ResourceProvider
-        info := &InstanceInfo{
-                Id:         fmt.Sprintf("%s.%s", n.Addr.Type, n.Addr.Name),
-                ModulePath: n.Path(),
-                Type:       n.Addr.Type,
-        }
+        var provider providers.Interface
 
         // Reset our states
         n.states = nil
@@ -77,13 +85,13 @@ func (n *graphNodeImportState) EvalTree() EvalNode {
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
+                                Addr:   n.ResolvedProvider,
                                 Output: &provider,
                         },
                         &EvalImportState{
+                                Addr:     n.Addr.Resource,
                                 Provider: &provider,
-                                Info:     info,
-                                Id:       n.ID,
+                                ID:       n.ID,
                                 Output:   &n.states,
                         },
                 },
@@ -97,6 +105,8 @@ func (n *graphNodeImportState) EvalTree() EvalNode {
 // resources they don't depend on anything else and refreshes are isolated
 // so this is nearly a perfect use case for dynamic expand.
 func (n *graphNodeImportState) DynamicExpand(ctx EvalContext) (*Graph, error) {
+        var diags tfdiags.Diagnostics
+
         g := &Graph{Path: ctx.Path()}
 
         // nameCounter is used to de-dup names in the state.
@@ -105,11 +115,11 @@ func (n *graphNodeImportState) DynamicExpand(ctx EvalContext) (*Graph, error) {
         // Compile the list of addresses that we'll be inserting into the state.
         // We do this ahead of time so we can verify that we aren't importing
         // something that already exists.
-        addrs := make([]*ResourceAddress, len(n.states))
+        addrs := make([]addrs.AbsResourceInstance, len(n.states))
         for i, state := range n.states {
-                addr := *n.Addr
-                if t := state.Ephemeral.Type; t != "" {
-                        addr.Type = t
+                addr := n.Addr
+                if t := state.TypeName; t != "" {
+                        addr.Resource.Resource.Type = t
                 }
 
                 // Determine if we need to suffix the name to de-dup
@@ -117,36 +127,31 @@ func (n *graphNodeImportState) DynamicExpand(ctx EvalContext) (*Graph, error) {
                 count, ok := nameCounter[key]
                 if ok {
                         count++
-                        addr.Name += fmt.Sprintf("-%d", count)
+                        addr.Resource.Resource.Name += fmt.Sprintf("-%d", count)
                 }
                 nameCounter[key] = count
 
                 // Add it to our list
-                addrs[i] = &addr
+                addrs[i] = addr
         }
 
         // Verify that all the addresses are clear
-        state, lock := ctx.State()
-        lock.RLock()
-        defer lock.RUnlock()
-        filter := &StateFilter{State: state}
+        state := ctx.State()
         for _, addr := range addrs {
-                result, err := filter.Filter(addr.String())
-                if err != nil {
-                        return nil, fmt.Errorf("Error verifying address %s: %s", addr, err)
-                }
-
-                // Go through the filter results and it is an error if we find
-                // a matching InstanceState, meaning that we would have a collision.
-                for _, r := range result {
-                        if _, ok := r.Value.(*InstanceState); ok {
-                                return nil, fmt.Errorf(
-                                        "Can't import %s, would collide with an existing resource.\n\n"+
-                                                "Please remove or rename this resource before continuing.",
-                                        addr)
-                        }
+                existing := state.ResourceInstance(addr)
+                if existing != nil {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Resource already managed by Terraform",
+                                fmt.Sprintf("Terraform is already managing a remote object for %s. To import to this address you must first remove the existing object from the state.", addr),
+                        ))
+                        continue
                 }
         }
+        if diags.HasErrors() {
+                // Bail out early, then.
+                return nil, diags.Err()
+        }
 
         // For each of the states, we add a node to handle the refresh/add to state.
         // "n.states" is populated by our own EvalTree with the result of
@@ -154,10 +159,8 @@ func (n *graphNodeImportState) DynamicExpand(ctx EvalContext) (*Graph, error) {
         // is safe.
         for i, state := range n.states {
                 g.Add(&graphNodeImportStateSub{
-                        Target:           addrs[i],
-                        Path_:            n.Path(),
+                        TargetAddr:       addrs[i],
                         State:            state,
-                        ProviderName:     n.ProviderName,
                         ResolvedProvider: n.ResolvedProvider,
                 })
         }
@@ -169,79 +172,67 @@ func (n *graphNodeImportState) DynamicExpand(ctx EvalContext) (*Graph, error) {
         }
 
         // Done!
-        return g, nil
+        return g, diags.Err()
 }
 
 // graphNodeImportStateSub is the sub-node of graphNodeImportState
 // and is part of the subgraph. This node is responsible for refreshing
 // and adding a resource to the state once it is imported.
 type graphNodeImportStateSub struct {
-        Target           *ResourceAddress
-        State            *InstanceState
-        Path_            []string
-        ProviderName     string
-        ResolvedProvider string
+        TargetAddr       addrs.AbsResourceInstance
+        State            providers.ImportedResource
+        ResolvedProvider addrs.AbsProviderConfig
 }
 
+var (
+        _ GraphNodeSubPath  = (*graphNodeImportStateSub)(nil)
+        _ GraphNodeEvalable = (*graphNodeImportStateSub)(nil)
+)
+
 func (n *graphNodeImportStateSub) Name() string {
-        return fmt.Sprintf("import %s result: %s", n.Target, n.State.ID)
+        return fmt.Sprintf("import %s result", n.TargetAddr)
 }
 
-func (n *graphNodeImportStateSub) Path() []string {
-        return n.Path_
+func (n *graphNodeImportStateSub) Path() addrs.ModuleInstance {
+        return n.TargetAddr.Module
 }
 
 // GraphNodeEvalable impl.
 func (n *graphNodeImportStateSub) EvalTree() EvalNode {
         // If the Ephemeral type isn't set, then it is an error
-        if n.State.Ephemeral.Type == "" {
-                err := fmt.Errorf(
-                        "import of %s didn't set type for %s",
-                        n.Target.String(), n.State.ID)
+        if n.State.TypeName == "" {
+                err := fmt.Errorf("import of %s didn't set type", n.TargetAddr.String())
                 return &EvalReturnError{Error: &err}
         }
 
-        // DeepCopy so we're only modifying our local copy
-        state := n.State.DeepCopy()
+        state := n.State.AsInstanceObject()
 
-        // Build the resource info
-        info := &InstanceInfo{
-                Id:         fmt.Sprintf("%s.%s", n.Target.Type, n.Target.Name),
-                ModulePath: n.Path_,
-                Type:       n.State.Ephemeral.Type,
-        }
-
-        // Key is the resource key
-        key := &ResourceStateKey{
-                Name:  n.Target.Name,
-                Type:  info.Type,
-                Index: n.Target.Index,
-        }
-
-        // The eval sequence
-        var provider ResourceProvider
+        var provider providers.Interface
+        var providerSchema *ProviderSchema
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalGetProvider{
-                                Name:   n.ResolvedProvider,
+                                Addr:   n.ResolvedProvider,
                                 Output: &provider,
+                                Schema: &providerSchema,
                         },
                         &EvalRefresh{
-                                Provider: &provider,
-                                State:    &state,
-                                Info:     info,
-                                Output:   &state,
+                                Addr:           n.TargetAddr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                Provider:       &provider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
+                                Output:         &state,
                         },
                         &EvalImportStateVerify{
-                                Info:  info,
-                                Id:    n.State.ID,
+                                Addr:  n.TargetAddr.Resource,
                                 State: &state,
                         },
                         &EvalWriteState{
-                                Name:         key.String(),
-                                ResourceType: info.Type,
-                                Provider:     n.ResolvedProvider,
-                                State:        &state,
+                                Addr:           n.TargetAddr.Resource,
+                                ProviderAddr:   n.ResolvedProvider,
+                                ProviderSchema: &providerSchema,
+                                State:          &state,
                         },
                 },
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_local.go b/vendor/github.com/hashicorp/terraform/terraform/transform_local.go
index 95ecfc0..84eb26b 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_local.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_local.go
@@ -1,37 +1,45 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
 )
 
 // LocalTransformer is a GraphTransformer that adds all the local values
 // from the configuration to the graph.
 type LocalTransformer struct {
-        Module *module.Tree
+        Config *configs.Config
 }
 
 func (t *LocalTransformer) Transform(g *Graph) error {
-        return t.transformModule(g, t.Module)
+        return t.transformModule(g, t.Config)
 }
 
-func (t *LocalTransformer) transformModule(g *Graph, m *module.Tree) error {
-        if m == nil {
+func (t *LocalTransformer) transformModule(g *Graph, c *configs.Config) error {
+        if c == nil {
                 // Can't have any locals if there's no config
                 return nil
         }
 
-        for _, local := range m.Config().Locals {
+        // Our addressing system distinguishes between modules and module instances,
+        // but we're not yet ready to make that distinction here (since we don't
+        // support "count"/"for_each" on modules) and so we just do a naive
+        // transform of the module path into a module instance path, assuming that
+        // no keys are in use. This should be removed when "count" and "for_each"
+        // are implemented for modules.
+        path := c.Path.UnkeyedInstanceShim()
+
+        for _, local := range c.Module.Locals {
+                addr := path.LocalValue(local.Name)
                 node := &NodeLocal{
-                        PathValue: normalizeModulePath(m.Path()),
-                        Config:    local,
+                        Addr:   addr,
+                        Config: local,
                 }
-
                 g.Add(node)
         }
 
         // Also populate locals for child modules
-        for _, c := range m.Children() {
-                if err := t.transformModule(g, c); err != nil {
+        for _, cc := range c.Children {
+                if err := t.transformModule(g, cc); err != nil {
                         return err
                 }
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_module_variable.go b/vendor/github.com/hashicorp/terraform/terraform/transform_module_variable.go
index 467950b..a994bd4 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_module_variable.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_module_variable.go
@@ -1,46 +1,54 @@
 package terraform
 
 import (
-        "log"
+        "fmt"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
-        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs"
 )
 
 // ModuleVariableTransformer is a GraphTransformer that adds all the variables
 // in the configuration to the graph.
 //
-// This only adds variables that are referenced by other things in the graph.
-// If a module variable is not referenced, it won't be added to the graph.
+// Any "variable" block present in any non-root module is included here, even
+// if a particular variable is not referenced from anywhere.
+//
+// The transform will produce errors if a call to a module does not conform
+// to the expected set of arguments, but this transformer is not in a good
+// position to return errors and so the validate walk should include specific
+// steps for validating module blocks, separate from this transform.
 type ModuleVariableTransformer struct {
-        Module *module.Tree
-
-        DisablePrune bool // True if pruning unreferenced should be disabled
+        Config *configs.Config
 }
 
 func (t *ModuleVariableTransformer) Transform(g *Graph) error {
-        return t.transform(g, nil, t.Module)
+        return t.transform(g, nil, t.Config)
 }
 
-func (t *ModuleVariableTransformer) transform(g *Graph, parent, m *module.Tree) error {
-        // If no config, no variables
-        if m == nil {
+func (t *ModuleVariableTransformer) transform(g *Graph, parent, c *configs.Config) error {
+        // We can have no variables if we have no configuration.
+        if c == nil {
                 return nil
         }
 
-        // Transform all the children. This must be done BEFORE the transform
-        // above since child module variables can reference parent module variables.
-        for _, c := range m.Children() {
-                if err := t.transform(g, m, c); err != nil {
+        // Transform all the children first.
+        for _, cc := range c.Children {
+                if err := t.transform(g, c, cc); err != nil {
                         return err
                 }
         }
 
+        // If we're processing anything other than the root module then we'll
+        // add graph nodes for variables defined inside. (Variables for the root
+        // module are dealt with in RootVariableTransformer).
         // If we have a parent, we can determine if a module variable is being
         // used, so we transform this.
         if parent != nil {
-                if err := t.transformSingle(g, parent, m); err != nil {
+                if err := t.transformSingle(g, parent, c); err != nil {
                         return err
                 }
         }
@@ -48,71 +56,69 @@ func (t *ModuleVariableTransformer) transform(g *Graph, parent, m *module.Tree)
         return nil
 }
 
-func (t *ModuleVariableTransformer) transformSingle(g *Graph, parent, m *module.Tree) error {
-        // If we have no vars, we're done!
-        vars := m.Config().Variables
-        if len(vars) == 0 {
-                log.Printf("[TRACE] Module %#v has no variables, skipping.", m.Path())
-                return nil
+func (t *ModuleVariableTransformer) transformSingle(g *Graph, parent, c *configs.Config) error {
+
+        // Our addressing system distinguishes between modules and module instances,
+        // but we're not yet ready to make that distinction here (since we don't
+        // support "count"/"for_each" on modules) and so we just do a naive
+        // transform of the module path into a module instance path, assuming that
+        // no keys are in use. This should be removed when "count" and "for_each"
+        // are implemented for modules.
+        path := c.Path.UnkeyedInstanceShim()
+        _, call := path.Call()
+
+        // Find the call in the parent module configuration, so we can get the
+        // expressions given for each input variable at the call site.
+        callConfig, exists := parent.Module.ModuleCalls[call.Name]
+        if !exists {
+                // This should never happen, since it indicates an improperly-constructed
+                // configuration tree.
+                panic(fmt.Errorf("no module call block found for %s", path))
         }
 
-        // Look for usage of this module
-        var mod *config.Module
-        for _, modUse := range parent.Config().Modules {
-                if modUse.Name == m.Name() {
-                        mod = modUse
-                        break
-                }
+        // We need to construct a schema for the expected call arguments based on
+        // the configured variables in our config, which we can then use to
+        // decode the content of the call block.
+        schema := &hcl.BodySchema{}
+        for _, v := range c.Module.Variables {
+                schema.Attributes = append(schema.Attributes, hcl.AttributeSchema{
+                        Name:     v.Name,
+                        Required: v.Default == cty.NilVal,
+                })
         }
-        if mod == nil {
-                log.Printf("[INFO] Module %#v not used, not adding variables", m.Path())
-                return nil
+
+        content, contentDiags := callConfig.Config.Content(schema)
+        if contentDiags.HasErrors() {
+                // Validation code elsewhere should deal with any errors before we
+                // get in here, but we'll report them out here just in case, to
+                // avoid crashes.
+                var diags tfdiags.Diagnostics
+                diags = diags.Append(contentDiags)
+                return diags.Err()
         }
 
-        // Build the reference map so we can determine if we're referencing things.
-        refMap := NewReferenceMap(g.Vertices())
-
-        // Add all variables here
-        for _, v := range vars {
-                // Determine the value of the variable. If it isn't in the
-                // configuration then it was never set and that's not a problem.
-                var value *config.RawConfig
-                if raw, ok := mod.RawConfig.Raw[v.Name]; ok {
-                        var err error
-                        value, err = config.NewRawConfig(map[string]interface{}{
-                                v.Name: raw,
-                        })
-                        if err != nil {
-                                // This shouldn't happen because it is already in
-                                // a RawConfig above meaning it worked once before.
-                                panic(err)
+        for _, v := range c.Module.Variables {
+                var expr hcl.Expression
+                if attr := content.Attributes[v.Name]; attr != nil {
+                        expr = attr.Expr
+                } else {
+                        // No expression provided for this variable, so we'll make a
+                        // synthetic one using the variable's default value.
+                        expr = &hclsyntax.LiteralValueExpr{
+                                Val:      v.Default,
+                                SrcRange: v.DeclRange, // This is not exact, but close enough
                         }
                 }
 
-                // Build the node.
-                //
-                // NOTE: For now this is just an "applyable" variable. As we build
-                // new graph builders for the other operations I suspect we'll
-                // find a way to parameterize this, require new transforms, etc.
+                // For now we treat all module variables as "applyable", even though
+                // such nodes are valid to use on other walks too. We may specialize
+                // this in future if we find reasons to employ different behaviors
+                // in different scenarios.
                 node := &NodeApplyableModuleVariable{
-                        PathValue: normalizeModulePath(m.Path()),
-                        Config:    v,
-                        Value:     value,
-                        Module:    t.Module,
+                        Addr:   path.InputVariable(v.Name),
+                        Config: v,
+                        Expr:   expr,
                 }
-
-                if !t.DisablePrune {
-                        // If the node is not referenced by anything, then we don't need
-                        // to include it since it won't be used.
-                        if matches := refMap.ReferencedBy(node); len(matches) == 0 {
-                                log.Printf(
-                                        "[INFO] Not including %q in graph, nothing depends on it",
-                                        dag.VertexName(node))
-                                continue
-                        }
-                }
-
-                // Add it!
                 g.Add(node)
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_count.go b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_count.go
index b256a25..eec762e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_count.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_count.go
@@ -3,7 +3,9 @@ package terraform
 import (
         "log"
 
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
 )
 
 // OrphanResourceCountTransformer is a GraphTransformer that adds orphans
@@ -14,95 +16,106 @@ import (
 // This transform assumes that if an element in the state is within the count
 // bounds given, that it is not an orphan.
 type OrphanResourceCountTransformer struct {
-        Concrete ConcreteResourceNodeFunc
+        Concrete ConcreteResourceInstanceNodeFunc
 
-        Count int              // Actual count of the resource
-        Addr  *ResourceAddress // Addr of the resource to look for orphans
-        State *State           // Full global state
+        Count int               // Actual count of the resource, or -1 if count is not set at all
+        Addr  addrs.AbsResource // Addr of the resource to look for orphans
+        State *states.State     // Full global state
 }
 
 func (t *OrphanResourceCountTransformer) Transform(g *Graph) error {
-        log.Printf("[TRACE] OrphanResourceCount: Starting...")
+        rs := t.State.Resource(t.Addr)
+        if rs == nil {
+                return nil // Resource doesn't exist in state, so nothing to do!
+        }
 
-        // Grab the module in the state just for this resource address
-        ms := t.State.ModuleByPath(normalizeModulePath(t.Addr.Path))
-        if ms == nil {
-                // If no state, there can't be orphans
-                return nil
+        haveKeys := make(map[addrs.InstanceKey]struct{})
+        for key := range rs.Instances {
+                haveKeys[key] = struct{}{}
         }
 
-        orphanIndex := -1
-        if t.Count == 1 {
-                orphanIndex = 0
+        if t.Count < 0 {
+                return t.transformNoCount(haveKeys, g)
+        }
+        if t.Count == 0 {
+                return t.transformZeroCount(haveKeys, g)
         }
+        return t.transformCount(haveKeys, g)
+}
+
+func (t *OrphanResourceCountTransformer) transformCount(haveKeys map[addrs.InstanceKey]struct{}, g *Graph) error {
+        // Due to the logic in Transform, we only get in here if our count is
+        // at least one.
 
-        // Go through the orphans and add them all to the state
-        for key, _ := range ms.Resources {
-                // Build the address
-                addr, err := parseResourceAddressInternal(key)
-                if err != nil {
-                        return err
+        _, have0Key := haveKeys[addrs.IntKey(0)]
+
+        for key := range haveKeys {
+                if key == addrs.NoKey && !have0Key {
+                        // If we have no 0-key then we will accept a no-key instance
+                        // as an alias for it.
+                        continue
                 }
-                addr.Path = ms.Path[1:]
 
-                // Copy the address for comparison. If we aren't looking at
-                // the same resource, then just ignore it.
-                addrCopy := addr.Copy()
-                addrCopy.Index = -1
-                if !addrCopy.Equals(t.Addr) {
+                i, isInt := key.(addrs.IntKey)
+                if isInt && int(i) < t.Count {
                         continue
                 }
 
-                log.Printf("[TRACE] OrphanResourceCount: Checking: %s", addr)
+                abstract := NewNodeAbstractResourceInstance(t.Addr.Instance(key))
+                var node dag.Vertex = abstract
+                if f := t.Concrete; f != nil {
+                        node = f(abstract)
+                }
+                log.Printf("[TRACE] OrphanResourceCount(non-zero): adding %s as %T", t.Addr, node)
+                g.Add(node)
+        }
+
+        return nil
+}
 
-                idx := addr.Index
+func (t *OrphanResourceCountTransformer) transformZeroCount(haveKeys map[addrs.InstanceKey]struct{}, g *Graph) error {
+        // This case is easy: we need to orphan any keys we have at all.
 
-                // If we have zero and the index here is 0 or 1, then we
-                // change the index to a high number so that we treat it as
-                // an orphan.
-                if t.Count <= 0 && idx <= 0 {
-                        idx = t.Count + 1
+        for key := range haveKeys {
+                abstract := NewNodeAbstractResourceInstance(t.Addr.Instance(key))
+                var node dag.Vertex = abstract
+                if f := t.Concrete; f != nil {
+                        node = f(abstract)
                 }
+                log.Printf("[TRACE] OrphanResourceCount(zero): adding %s as %T", t.Addr, node)
+                g.Add(node)
+        }
 
-                // If we have a count greater than 0 and we're at the zero index,
-                // we do a special case check to see if our state also has a
-                // -1 index value. If so, this is an orphan because our rules are
-                // that if both a -1 and 0 are in the state, the 0 is destroyed.
-                if t.Count > 0 && idx == orphanIndex {
-                        // This is a piece of cleverness (beware), but its simple:
-                        // if orphanIndex is 0, then check -1, else check 0.
-                        checkIndex := (orphanIndex + 1) * -1
-
-                        key := &ResourceStateKey{
-                                Name:  addr.Name,
-                                Type:  addr.Type,
-                                Mode:  addr.Mode,
-                                Index: checkIndex,
-                        }
-
-                        if _, ok := ms.Resources[key.String()]; ok {
-                                // We have a -1 index, too. Make an arbitrarily high
-                                // index so that we always mark this as an orphan.
-                                log.Printf(
-                                        "[WARN] OrphanResourceCount: %q both -1 and 0 index found, orphaning %d",
-                                        addr, orphanIndex)
-                                idx = t.Count + 1
-                        }
-                }
+        return nil
+}
 
-                // If the index is within the count bounds, it is not an orphan
-                if idx < t.Count {
+func (t *OrphanResourceCountTransformer) transformNoCount(haveKeys map[addrs.InstanceKey]struct{}, g *Graph) error {
+        // Negative count indicates that count is not set at all, in which
+        // case we expect to have a single instance with no key set at all.
+        // However, we'll also accept an instance with key 0 set as an alias
+        // for it, in case the user has just deleted the "count" argument and
+        // so wants to keep the first instance in the set.
+
+        _, haveNoKey := haveKeys[addrs.NoKey]
+        _, have0Key := haveKeys[addrs.IntKey(0)]
+        keepKey := addrs.NoKey
+        if have0Key && !haveNoKey {
+                // If we don't have a no-key instance then we can use the 0-key instance
+                // instead.
+                keepKey = addrs.IntKey(0)
+        }
+
+        for key := range haveKeys {
+                if key == keepKey {
                         continue
                 }
 
-                // Build the abstract node and the concrete one
-                abstract := &NodeAbstractResource{Addr: addr}
+                abstract := NewNodeAbstractResourceInstance(t.Addr.Instance(key))
                 var node dag.Vertex = abstract
                 if f := t.Concrete; f != nil {
                         node = f(abstract)
                 }
-
-                // Add it to the graph
+                log.Printf("[TRACE] OrphanResourceCount(no-count): adding %s as %T", t.Addr, node)
                 g.Add(node)
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_output.go b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_output.go
index aea2bd0..c675409 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_output.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_output.go
@@ -3,16 +3,17 @@ package terraform
 import (
         "log"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/states"
 )
 
 // OrphanOutputTransformer finds the outputs that aren't present
 // in the given config that are in the state and adds them to the graph
 // for deletion.
 type OrphanOutputTransformer struct {
-        Module *module.Tree // Root module
-        State  *State       // State is the root state
+        Config *configs.Config // Root of config tree
+        State  *states.State   // State is the root state
 }
 
 func (t *OrphanOutputTransformer) Transform(g *Graph) error {
@@ -29,24 +30,30 @@ func (t *OrphanOutputTransformer) Transform(g *Graph) error {
         return nil
 }
 
-func (t *OrphanOutputTransformer) transform(g *Graph, ms *ModuleState) error {
+func (t *OrphanOutputTransformer) transform(g *Graph, ms *states.Module) error {
         if ms == nil {
                 return nil
         }
 
-        path := normalizeModulePath(ms.Path)
+        moduleAddr := ms.Addr
 
         // Get the config for this path, which is nil if the entire module has been
         // removed.
-        var c *config.Config
-        if m := t.Module.Child(path[1:]); m != nil {
-                c = m.Config()
+        var outputs map[string]*configs.Output
+        if c := t.Config.DescendentForInstance(moduleAddr); c != nil {
+                outputs = c.Module.Outputs
         }
 
-        // add all the orphaned outputs to the graph
-        for _, n := range ms.RemovedOutputs(c) {
-                g.Add(&NodeOutputOrphan{OutputName: n, PathValue: path})
+        // An output is "orphaned" if it's present in the state but not declared
+        // in the configuration.
+        for name := range ms.OutputValues {
+                if _, exists := outputs[name]; exists {
+                        continue
+                }
 
+                g.Add(&NodeOutputOrphan{
+                        Addr: addrs.OutputValue{Name: name}.Absolute(moduleAddr),
+                })
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_resource.go b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_resource.go
index e42d3c8..50df178 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_resource.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_resource.go
@@ -1,34 +1,43 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "log"
+
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
 )
 
-// OrphanResourceTransformer is a GraphTransformer that adds resource
-// orphans to the graph. A resource orphan is a resource that is
-// represented in the state but not in the configuration.
-//
-// This only adds orphans that have no representation at all in the
+// OrphanResourceInstanceTransformer is a GraphTransformer that adds orphaned
+// resource instances to the graph. An "orphan" is an instance that is present
+// in the state but belongs to a resource that is no longer present in the
 // configuration.
-type OrphanResourceTransformer struct {
-        Concrete ConcreteResourceNodeFunc
+//
+// This is not the transformer that deals with "count orphans" (instances that
+// are no longer covered by a resource's "count" or "for_each" setting); that's
+// handled instead by OrphanResourceCountTransformer.
+type OrphanResourceInstanceTransformer struct {
+        Concrete ConcreteResourceInstanceNodeFunc
 
         // State is the global state. We require the global state to
         // properly find module orphans at our path.
-        State *State
+        State *states.State
 
-        // Module is the root module. We'll look up the proper configuration
-        // using the graph path.
-        Module *module.Tree
+        // Config is the root node in the configuration tree. We'll look up
+        // the appropriate note in this tree using the path in each node.
+        Config *configs.Config
 }
 
-func (t *OrphanResourceTransformer) Transform(g *Graph) error {
+func (t *OrphanResourceInstanceTransformer) Transform(g *Graph) error {
         if t.State == nil {
                 // If the entire state is nil, there can't be any orphans
                 return nil
         }
+        if t.Config == nil {
+                // Should never happen: we can't be doing any Terraform operations
+                // without at least an empty configuration.
+                panic("OrphanResourceInstanceTransformer used without setting Config")
+        }
 
         // Go through the modules and for each module transform in order
         // to add the orphan.
@@ -41,38 +50,130 @@ func (t *OrphanResourceTransformer) Transform(g *Graph) error {
         return nil
 }
 
-func (t *OrphanResourceTransformer) transform(g *Graph, ms *ModuleState) error {
+func (t *OrphanResourceInstanceTransformer) transform(g *Graph, ms *states.Module) error {
         if ms == nil {
                 return nil
         }
 
-        // Get the configuration for this path. The configuration might be
+        moduleAddr := ms.Addr
+
+        // Get the configuration for this module. The configuration might be
         // nil if the module was removed from the configuration. This is okay,
         // this just means that every resource is an orphan.
-        var c *config.Config
-        if m := t.Module.Child(ms.Path[1:]); m != nil {
-                c = m.Config()
+        var m *configs.Module
+        if c := t.Config.DescendentForInstance(moduleAddr); c != nil {
+                m = c.Module
         }
 
-        // Go through the orphans and add them all to the state
-        for _, key := range ms.Orphans(c) {
-                // Build the abstract resource
-                addr, err := parseResourceAddressInternal(key)
-                if err != nil {
-                        return err
+        // An "orphan" is a resource that is in the state but not the configuration,
+        // so we'll walk the state resources and try to correlate each of them
+        // with a configuration block. Each orphan gets a node in the graph whose
+        // type is decided by t.Concrete.
+        //
+        // We don't handle orphans related to changes in the "count" and "for_each"
+        // pseudo-arguments here. They are handled by OrphanResourceCountTransformer.
+        for _, rs := range ms.Resources {
+                if m != nil {
+                        if r := m.ResourceByAddr(rs.Addr); r != nil {
+                                continue
+                        }
                 }
-                addr.Path = ms.Path[1:]
 
-                // Build the abstract node and the concrete one
-                abstract := &NodeAbstractResource{Addr: addr}
-                var node dag.Vertex = abstract
-                if f := t.Concrete; f != nil {
-                        node = f(abstract)
+                for key := range rs.Instances {
+                        addr := rs.Addr.Instance(key).Absolute(moduleAddr)
+                        abstract := NewNodeAbstractResourceInstance(addr)
+                        var node dag.Vertex = abstract
+                        if f := t.Concrete; f != nil {
+                                node = f(abstract)
+                        }
+                        log.Printf("[TRACE] OrphanResourceInstanceTransformer: adding single-instance orphan node for %s", addr)
+                        g.Add(node)
                 }
+        }
+
+        return nil
+}
+
+// OrphanResourceTransformer is a GraphTransformer that adds orphaned
+// resources to the graph. An "orphan" is a resource that is present in
+// the state but no longer present in the config.
+//
+// This is separate to OrphanResourceInstanceTransformer in that it deals with
+// whole resources, rather than individual instances of resources. Orphan
+// resource nodes are only used during apply to clean up leftover empty
+// resource state skeletons, after all of the instances inside have been
+// removed.
+//
+// This transformer will also create edges in the graph to any pre-existing
+// node that creates or destroys the entire orphaned resource or any of its
+// instances, to ensure that the "orphan-ness" of a resource is always dealt
+// with after all other aspects of it.
+type OrphanResourceTransformer struct {
+        Concrete ConcreteResourceNodeFunc
+
+        // State is the global state.
+        State *states.State
 
-                // Add it to the graph
-                g.Add(node)
+        // Config is the root node in the configuration tree.
+        Config *configs.Config
+}
+
+func (t *OrphanResourceTransformer) Transform(g *Graph) error {
+        if t.State == nil {
+                // If the entire state is nil, there can't be any orphans
+                return nil
+        }
+        if t.Config == nil {
+                // Should never happen: we can't be doing any Terraform operations
+                // without at least an empty configuration.
+                panic("OrphanResourceTransformer used without setting Config")
+        }
+
+        // We'll first collect up the existing nodes for each resource so we can
+        // create dependency edges for any new nodes we create.
+        deps := map[string][]dag.Vertex{}
+        for _, v := range g.Vertices() {
+                switch tv := v.(type) {
+                case GraphNodeResourceInstance:
+                        k := tv.ResourceInstanceAddr().ContainingResource().String()
+                        deps[k] = append(deps[k], v)
+                case GraphNodeResource:
+                        k := tv.ResourceAddr().String()
+                        deps[k] = append(deps[k], v)
+                case GraphNodeDestroyer:
+                        k := tv.DestroyAddr().ContainingResource().String()
+                        deps[k] = append(deps[k], v)
+                }
+        }
+
+        for _, ms := range t.State.Modules {
+                moduleAddr := ms.Addr
+
+                mc := t.Config.DescendentForInstance(moduleAddr) // might be nil if whole module has been removed
+
+                for _, rs := range ms.Resources {
+                        if mc != nil {
+                                if r := mc.Module.ResourceByAddr(rs.Addr); r != nil {
+                                        // It's in the config, so nothing to do for this one.
+                                        continue
+                                }
+                        }
+
+                        addr := rs.Addr.Absolute(moduleAddr)
+                        abstract := NewNodeAbstractResource(addr)
+                        var node dag.Vertex = abstract
+                        if f := t.Concrete; f != nil {
+                                node = f(abstract)
+                        }
+                        log.Printf("[TRACE] OrphanResourceTransformer: adding whole-resource orphan node for %s", addr)
+                        g.Add(node)
+                        for _, dn := range deps[addr.String()] {
+                                log.Printf("[TRACE] OrphanResourceTransformer: node %q depends on %q", dag.VertexName(node), dag.VertexName(dn))
+                                g.Connect(dag.BasicEdge(node, dn))
+                        }
+                }
         }
 
         return nil
+
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_output.go b/vendor/github.com/hashicorp/terraform/terraform/transform_output.go
index faa25e4..ed93cdb 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_output.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_output.go
@@ -3,7 +3,7 @@ package terraform
 import (
         "log"
 
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -14,42 +14,42 @@ import (
 // aren't changing since there is no downside: the state will be available
 // even if the dependent items aren't changing.
 type OutputTransformer struct {
-        Module *module.Tree
+        Config *configs.Config
 }
 
 func (t *OutputTransformer) Transform(g *Graph) error {
-        return t.transform(g, t.Module)
+        return t.transform(g, t.Config)
 }
 
-func (t *OutputTransformer) transform(g *Graph, m *module.Tree) error {
-        // If no config, no outputs
-        if m == nil {
+func (t *OutputTransformer) transform(g *Graph, c *configs.Config) error {
+        // If we have no config then there can be no outputs.
+        if c == nil {
                 return nil
         }
 
         // Transform all the children. We must do this first because
         // we can reference module outputs and they must show up in the
         // reference map.
-        for _, c := range m.Children() {
-                if err := t.transform(g, c); err != nil {
+        for _, cc := range c.Children {
+                if err := t.transform(g, cc); err != nil {
                         return err
                 }
         }
 
-        // If we have no outputs, we're done!
-        os := m.Config().Outputs
-        if len(os) == 0 {
-                return nil
-        }
+        // Our addressing system distinguishes between modules and module instances,
+        // but we're not yet ready to make that distinction here (since we don't
+        // support "count"/"for_each" on modules) and so we just do a naive
+        // transform of the module path into a module instance path, assuming that
+        // no keys are in use. This should be removed when "count" and "for_each"
+        // are implemented for modules.
+        path := c.Path.UnkeyedInstanceShim()
 
-        // Add all outputs here
-        for _, o := range os {
+        for _, o := range c.Module.Outputs {
+                addr := path.OutputValue(o.Name)
                 node := &NodeApplyableOutput{
-                        PathValue: normalizeModulePath(m.Path()),
-                        Config:    o,
+                        Addr:   addr,
+                        Config: o,
                 }
-
-                // Add it!
                 g.Add(node)
         }
 
@@ -71,8 +71,8 @@ func (t *DestroyOutputTransformer) Transform(g *Graph) error {
 
                 // create the destroy node for this output
                 node := &NodeDestroyableOutput{
-                        PathValue: output.PathValue,
-                        Config:    output.Config,
+                        Addr:   output.Addr,
+                        Config: output.Config,
                 }
 
                 log.Printf("[TRACE] creating %s", node.Name())
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_provider.go b/vendor/github.com/hashicorp/terraform/terraform/transform_provider.go
index c4772b4..6a4fb47 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_provider.go
@@ -1,22 +1,21 @@
 package terraform
 
 import (
-        "errors"
         "fmt"
         "log"
-        "strings"
 
-        "github.com/hashicorp/go-multierror"
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
         "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
-func TransformProviders(providers []string, concrete ConcreteProviderNodeFunc, mod *module.Tree) GraphTransformer {
+func TransformProviders(providers []string, concrete ConcreteProviderNodeFunc, config *configs.Config) GraphTransformer {
         return GraphTransformMulti(
                 // Add providers from the config
                 &ProviderConfigTransformer{
-                        Module:    mod,
+                        Config:    config,
                         Providers: providers,
                         Concrete:  concrete,
                 },
@@ -26,7 +25,9 @@ func TransformProviders(providers []string, concrete ConcreteProviderNodeFunc, m
                         Concrete:  concrete,
                 },
                 // Connect the providers
-                &ProviderTransformer{},
+                &ProviderTransformer{
+                        Config: config,
+                },
                 // Remove unused providers and proxies
                 &PruneProviderTransformer{},
                 // Connect provider to their parent provider nodes
@@ -36,10 +37,14 @@ func TransformProviders(providers []string, concrete ConcreteProviderNodeFunc, m
 
 // GraphNodeProvider is an interface that nodes that can be a provider
 // must implement.
-// ProviderName returns the name of the provider this satisfies.
+//
+// ProviderAddr returns the address of the provider configuration this
+// satisfies, which is relative to the path returned by method Path().
+//
 // Name returns the full name of the provider in the config.
 type GraphNodeProvider interface {
-        ProviderName() string
+        GraphNodeSubPath
+        ProviderAddr() addrs.AbsProviderConfig
         Name() string
 }
 
@@ -47,62 +52,132 @@ type GraphNodeProvider interface {
 // provider must implement. The CloseProviderName returned is the name of
 // the provider they satisfy.
 type GraphNodeCloseProvider interface {
-        CloseProviderName() string
+        GraphNodeSubPath
+        CloseProviderAddr() addrs.AbsProviderConfig
 }
 
 // GraphNodeProviderConsumer is an interface that nodes that require
-// a provider must implement. ProvidedBy must return the name of the provider
-// to use. This may be a provider by type, type.alias or a fully resolved
-// provider name
+// a provider must implement. ProvidedBy must return the address of the provider
+// to use, which will be resolved to a configuration either in the same module
+// or in an ancestor module, with the resulting absolute address passed to
+// SetProvider.
 type GraphNodeProviderConsumer interface {
-        ProvidedBy() string
+        // ProvidedBy returns the address of the provider configuration the node
+        // refers to. If the returned "exact" value is true, this address will
+        // be taken exactly. If "exact" is false, a provider configuration from
+        // an ancestor module may be selected instead.
+        ProvidedBy() (addr addrs.AbsProviderConfig, exact bool)
         // Set the resolved provider address for this resource.
-        SetProvider(string)
+        SetProvider(addrs.AbsProviderConfig)
 }
 
 // ProviderTransformer is a GraphTransformer that maps resources to
 // providers within the graph. This will error if there are any resources
 // that don't map to proper resources.
-type ProviderTransformer struct{}
+type ProviderTransformer struct {
+        Config *configs.Config
+}
 
 func (t *ProviderTransformer) Transform(g *Graph) error {
-        // Go through the other nodes and match them to providers they need
-        var err error
-        m := providerVertexMap(g)
+        // We need to find a provider configuration address for each resource
+        // either directly represented by a node or referenced by a node in
+        // the graph, and then create graph edges from provider to provider user
+        // so that the providers will get initialized first.
+
+        var diags tfdiags.Diagnostics
+
+        // To start, we'll collect the _requested_ provider addresses for each
+        // node, which we'll then resolve (handling provider inheritence, etc) in
+        // the next step.
+        // Our "requested" map is from graph vertices to string representations of
+        // provider config addresses (for deduping) to requests.
+        type ProviderRequest struct {
+                Addr  addrs.AbsProviderConfig
+                Exact bool // If true, inheritence from parent modules is not attempted
+        }
+        requested := map[dag.Vertex]map[string]ProviderRequest{}
+        needConfigured := map[string]addrs.AbsProviderConfig{}
         for _, v := range g.Vertices() {
+
+                // Does the vertex _directly_ use a provider?
                 if pv, ok := v.(GraphNodeProviderConsumer); ok {
-                        p := pv.ProvidedBy()
+                        requested[v] = make(map[string]ProviderRequest)
 
-                        key := providerMapKey(p, pv)
+                        p, exact := pv.ProvidedBy()
+                        if exact {
+                                log.Printf("[TRACE] ProviderTransformer: %s is provided by %s exactly", dag.VertexName(v), p)
+                        } else {
+                                log.Printf("[TRACE] ProviderTransformer: %s is provided by %s or inherited equivalent", dag.VertexName(v), p)
+                        }
+
+                        requested[v][p.String()] = ProviderRequest{
+                                Addr:  p,
+                                Exact: exact,
+                        }
+
+                        // Direct references need the provider configured as well as initialized
+                        needConfigured[p.String()] = p
+                }
+        }
+
+        // Now we'll go through all the requested addresses we just collected and
+        // figure out which _actual_ config address each belongs to, after resolving
+        // for provider inheritance and passing.
+        m := providerVertexMap(g)
+        for v, reqs := range requested {
+                for key, req := range reqs {
+                        p := req.Addr
                         target := m[key]
 
-                        sp, ok := pv.(GraphNodeSubPath)
+                        _, ok := v.(GraphNodeSubPath)
                         if !ok && target == nil {
-                                // no target, and no path to walk up
-                                err = multierror.Append(err, fmt.Errorf(
-                                        "%s: provider %s couldn't be found",
-                                        dag.VertexName(v), p))
-                                break
+                                // No target and no path to traverse up from
+                                diags = diags.Append(fmt.Errorf("%s: provider %s couldn't be found", dag.VertexName(v), p))
+                                continue
+                        }
+
+                        if target != nil {
+                                log.Printf("[TRACE] ProviderTransformer: exact match for %s serving %s", p, dag.VertexName(v))
                         }
 
-                        // if we don't have a provider at this level, walk up the path looking for one
-                        for i := 1; target == nil; i++ {
-                                path := normalizeModulePath(sp.Path())
-                                if len(path) < i {
-                                        break
+                        // if we don't have a provider at this level, walk up the path looking for one,
+                        // unless we were told to be exact.
+                        if target == nil && !req.Exact {
+                                for pp, ok := p.Inherited(); ok; pp, ok = pp.Inherited() {
+                                        key := pp.String()
+                                        target = m[key]
+                                        if target != nil {
+                                                log.Printf("[TRACE] ProviderTransformer: %s uses inherited configuration %s", dag.VertexName(v), pp)
+                                                break
+                                        }
+                                        log.Printf("[TRACE] ProviderTransformer: looking for %s to serve %s", pp, dag.VertexName(v))
                                 }
+                        }
 
-                                key = ResolveProviderName(p, path[:len(path)-i])
-                                target = m[key]
-                                if target != nil {
-                                        break
+                        // If this provider doesn't need to be configured then we can just
+                        // stub it out with an init-only provider node, which will just
+                        // start up the provider and fetch its schema.
+                        if _, exists := needConfigured[key]; target == nil && !exists {
+                                stubAddr := p.ProviderConfig.Absolute(addrs.RootModuleInstance)
+                                stub := &NodeEvalableProvider{
+                                        &NodeAbstractProvider{
+                                                Addr: stubAddr,
+                                        },
                                 }
+                                m[stubAddr.String()] = stub
+                                log.Printf("[TRACE] ProviderTransformer: creating init-only node for %s", stubAddr)
+                                target = stub
+                                g.Add(target)
                         }
 
                         if target == nil {
-                                err = multierror.Append(err, fmt.Errorf(
-                                        "%s: configuration for %s is not present; a provider configuration block is required for all operations",
-                                        dag.VertexName(v), p,
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Provider configuration not present",
+                                        fmt.Sprintf(
+                                                "To work with %s its original provider configuration at %s is required, but it has been removed. This occurs when a provider configuration is removed while objects created by that provider still exist in the state. Re-add the provider configuration to destroy %s, after which you can remove the provider configuration again.",
+                                                dag.VertexName(v), p, dag.VertexName(v),
+                                        ),
                                 ))
                                 break
                         }
@@ -111,16 +186,18 @@ func (t *ProviderTransformer) Transform(g *Graph) error {
                         if p, ok := target.(*graphNodeProxyProvider); ok {
                                 g.Remove(p)
                                 target = p.Target()
-                                key = target.(GraphNodeProvider).Name()
+                                key = target.(GraphNodeProvider).ProviderAddr().String()
                         }
 
-                        log.Printf("[DEBUG] resource %s using provider %s", dag.VertexName(pv), key)
-                        pv.SetProvider(key)
+                        log.Printf("[DEBUG] ProviderTransformer: %q (%T) needs %s", dag.VertexName(v), v, dag.VertexName(target))
+                        if pv, ok := v.(GraphNodeProviderConsumer); ok {
+                                pv.SetProvider(target.ProviderAddr())
+                        }
                         g.Connect(dag.BasicEdge(v, target))
                 }
         }
 
-        return err
+        return diags.Err()
 }
 
 // CloseProviderTransformer is a GraphTransformer that adds nodes to the
@@ -136,15 +213,16 @@ func (t *CloseProviderTransformer) Transform(g *Graph) error {
 
         for _, v := range pm {
                 p := v.(GraphNodeProvider)
+                key := p.ProviderAddr().String()
 
                 // get the close provider of this type if we alread created it
-                closer := cpm[p.Name()]
+                closer := cpm[key]
 
                 if closer == nil {
                         // create a closer for this provider type
-                        closer = &graphNodeCloseProvider{ProviderNameValue: p.Name()}
+                        closer = &graphNodeCloseProvider{Addr: p.ProviderAddr()}
                         g.Add(closer)
-                        cpm[p.Name()] = closer
+                        cpm[key] = closer
                 }
 
                 // Close node depends on the provider itself
@@ -164,10 +242,20 @@ func (t *CloseProviderTransformer) Transform(g *Graph) error {
         return err
 }
 
-// MissingProviderTransformer is a GraphTransformer that adds nodes for all
-// required providers into the graph. Specifically, it creates provider
-// configuration nodes for all the providers that we support. These are pruned
-// later during an optimization pass.
+// MissingProviderTransformer is a GraphTransformer that adds to the graph
+// a node for each default provider configuration that is referenced by another
+// node but not already present in the graph.
+//
+// These "default" nodes are always added to the root module, regardless of
+// where they are requested. This is important because our inheritance
+// resolution behavior in ProviderTransformer will then treat these as a
+// last-ditch fallback after walking up the tree, rather than preferring them
+// as it would if they were placed in the same module as the requester.
+//
+// This transformer may create extra nodes that are not needed in practice,
+// due to overriding provider configurations in child modules.
+// PruneProviderTransformer can then remove these once ProviderTransformer
+// has resolved all of the inheritence, etc.
 type MissingProviderTransformer struct {
         // Providers is the list of providers we support.
         Providers []string
@@ -192,34 +280,40 @@ func (t *MissingProviderTransformer) Transform(g *Graph) error {
                         continue
                 }
 
-                p := pv.ProvidedBy()
-                // this may be the resolved provider from the state, so we need to get
-                // the base provider name.
-                parts := strings.SplitAfter(p, "provider.")
-                p = parts[len(parts)-1]
+                // For our work here we actually care only about the provider type and
+                // we plan to place all default providers in the root module, and so
+                // it's safe for us to rely on ProvidedBy here rather than waiting for
+                // the later proper resolution of provider inheritance done by
+                // ProviderTransformer.
+                p, _ := pv.ProvidedBy()
+                if p.ProviderConfig.Alias != "" {
+                        // We do not create default aliased configurations.
+                        log.Println("[TRACE] MissingProviderTransformer: skipping implication of aliased config", p)
+                        continue
+                }
 
-                key := ResolveProviderName(p, nil)
+                // We're going to create an implicit _default_ configuration for the
+                // referenced provider type in the _root_ module, ignoring all other
+                // aspects of the resource's declared provider address.
+                defaultAddr := addrs.RootModuleInstance.ProviderConfigDefault(p.ProviderConfig.Type)
+                key := defaultAddr.String()
                 provider := m[key]
 
-                // we already have it
                 if provider != nil {
+                        // There's already an explicit default configuration for this
+                        // provider type in the root module, so we have nothing to do.
                         continue
                 }
 
-                // we don't implicitly create aliased providers
-                if strings.Contains(p, ".") {
-                        log.Println("[DEBUG] not adding missing provider alias:", p)
-                        continue
-                }
-
-                log.Println("[DEBUG] adding missing provider:", p)
+                log.Printf("[DEBUG] adding implicit provider configuration %s, implied first by %s", defaultAddr, dag.VertexName(v))
 
-                // create the misisng top-level provider
+                // create the missing top-level provider
                 provider = t.Concrete(&NodeAbstractProvider{
-                        NameValue: p,
-                }).(dag.Vertex)
+                        Addr: defaultAddr,
+                }).(GraphNodeProvider)
 
-                m[key] = g.Add(provider)
+                g.Add(provider)
+                m[key] = provider
         }
 
         return err
@@ -237,26 +331,26 @@ func (t *ParentProviderTransformer) Transform(g *Graph) error {
         for _, v := range g.Vertices() {
                 // Only care about providers
                 pn, ok := v.(GraphNodeProvider)
-                if !ok || pn.ProviderName() == "" {
+                if !ok {
                         continue
                 }
 
-                // Also require a subpath, if there is no subpath then we
-                // can't have a parent.
-                if pn, ok := v.(GraphNodeSubPath); ok {
-                        if len(normalizeModulePath(pn.Path())) <= 1 {
-                                continue
-                        }
+                // Also require non-empty path, since otherwise we're in the root
+                // module and so cannot have a parent.
+                if len(pn.Path()) <= 1 {
+                        continue
                 }
 
                 // this provider may be disabled, but we can only get it's name from
                 // the ProviderName string
-                name := ResolveProviderName(strings.SplitN(pn.ProviderName(), " ", 2)[0], nil)
-                parent := pm[name]
-                if parent != nil {
-                        g.Connect(dag.BasicEdge(v, parent))
+                addr := pn.ProviderAddr()
+                parentAddr, ok := addr.Inherited()
+                if ok {
+                        parent := pm[parentAddr.String()]
+                        if parent != nil {
+                                g.Connect(dag.BasicEdge(v, parent))
+                        }
                 }
-
         }
         return nil
 }
@@ -270,20 +364,20 @@ type PruneProviderTransformer struct{}
 func (t *PruneProviderTransformer) Transform(g *Graph) error {
         for _, v := range g.Vertices() {
                 // We only care about providers
-                pn, ok := v.(GraphNodeProvider)
-                if !ok || pn.ProviderName() == "" {
+                _, ok := v.(GraphNodeProvider)
+                if !ok {
                         continue
                 }
 
                 // ProxyProviders will have up edges, but we're now done with them in the graph
                 if _, ok := v.(*graphNodeProxyProvider); ok {
-                        log.Printf("[DEBUG] pruning proxy provider %s", dag.VertexName(v))
+                        log.Printf("[DEBUG] pruning proxy %s", dag.VertexName(v))
                         g.Remove(v)
                 }
 
                 // Remove providers with no dependencies.
                 if g.UpEdges(v).Len() == 0 {
-                        log.Printf("[DEBUG] pruning unused provider %s", dag.VertexName(v))
+                        log.Printf("[DEBUG] pruning unused %s", dag.VertexName(v))
                         g.Remove(v)
                 }
         }
@@ -291,40 +385,24 @@ func (t *PruneProviderTransformer) Transform(g *Graph) error {
         return nil
 }
 
-// providerMapKey is a helper that gives us the key to use for the
-// maps returned by things such as providerVertexMap.
-func providerMapKey(k string, v dag.Vertex) string {
-        if strings.Contains(k, "provider.") {
-                // this is already resolved
-                return k
-        }
-
-        // we create a dummy provider to
-        var path []string
-        if sp, ok := v.(GraphNodeSubPath); ok {
-                path = normalizeModulePath(sp.Path())
-        }
-        return ResolveProviderName(k, path)
-}
-
-func providerVertexMap(g *Graph) map[string]dag.Vertex {
-        m := make(map[string]dag.Vertex)
+func providerVertexMap(g *Graph) map[string]GraphNodeProvider {
+        m := make(map[string]GraphNodeProvider)
         for _, v := range g.Vertices() {
                 if pv, ok := v.(GraphNodeProvider); ok {
-                        // TODO:  The Name may have meta info, like " (disabled)"
-                        name := strings.SplitN(pv.Name(), " ", 2)[0]
-                        m[name] = v
+                        addr := pv.ProviderAddr()
+                        m[addr.String()] = pv
                 }
         }
 
         return m
 }
 
-func closeProviderVertexMap(g *Graph) map[string]dag.Vertex {
-        m := make(map[string]dag.Vertex)
+func closeProviderVertexMap(g *Graph) map[string]GraphNodeCloseProvider {
+        m := make(map[string]GraphNodeCloseProvider)
         for _, v := range g.Vertices() {
                 if pv, ok := v.(GraphNodeCloseProvider); ok {
-                        m[pv.CloseProviderName()] = v
+                        addr := pv.CloseProviderAddr()
+                        m[addr.String()] = pv
                 }
         }
 
@@ -332,16 +410,25 @@ func closeProviderVertexMap(g *Graph) map[string]dag.Vertex {
 }
 
 type graphNodeCloseProvider struct {
-        ProviderNameValue string
+        Addr addrs.AbsProviderConfig
 }
 
+var (
+        _ GraphNodeCloseProvider = (*graphNodeCloseProvider)(nil)
+)
+
 func (n *graphNodeCloseProvider) Name() string {
-        return n.ProviderNameValue + " (close)"
+        return n.Addr.String() + " (close)"
+}
+
+// GraphNodeSubPath impl.
+func (n *graphNodeCloseProvider) Path() addrs.ModuleInstance {
+        return n.Addr.Module
 }
 
 // GraphNodeEvalable impl.
 func (n *graphNodeCloseProvider) EvalTree() EvalNode {
-        return CloseProviderEvalTree(n.ProviderNameValue)
+        return CloseProviderEvalTree(n.Addr)
 }
 
 // GraphNodeDependable impl.
@@ -349,8 +436,8 @@ func (n *graphNodeCloseProvider) DependableName() []string {
         return []string{n.Name()}
 }
 
-func (n *graphNodeCloseProvider) CloseProviderName() string {
-        return n.ProviderNameValue
+func (n *graphNodeCloseProvider) CloseProviderAddr() addrs.AbsProviderConfig {
+        return n.Addr
 }
 
 // GraphNodeDotter impl.
@@ -380,17 +467,24 @@ func (n *graphNodeCloseProvider) RemoveIfNotTargeted() bool {
 // configurations, and are removed after all the resources have been connected
 // to their providers.
 type graphNodeProxyProvider struct {
-        nameValue string
-        path      []string
-        target    GraphNodeProvider
+        addr   addrs.AbsProviderConfig
+        target GraphNodeProvider
+}
+
+var (
+        _ GraphNodeProvider = (*graphNodeProxyProvider)(nil)
+)
+
+func (n *graphNodeProxyProvider) ProviderAddr() addrs.AbsProviderConfig {
+        return n.addr
 }
 
-func (n *graphNodeProxyProvider) ProviderName() string {
-        return n.Target().ProviderName()
+func (n *graphNodeProxyProvider) Path() addrs.ModuleInstance {
+        return n.addr.Module
 }
 
 func (n *graphNodeProxyProvider) Name() string {
-        return ResolveProviderName(n.nameValue, n.path)
+        return n.addr.String() + " (proxy)"
 }
 
 // find the concrete provider instance
@@ -415,26 +509,21 @@ type ProviderConfigTransformer struct {
         // record providers that can be overriden with a proxy
         proxiable map[string]bool
 
-        // Module is the module to add resources from.
-        Module *module.Tree
+        // Config is the root node of the configuration tree to add providers from.
+        Config *configs.Config
 }
 
 func (t *ProviderConfigTransformer) Transform(g *Graph) error {
-        // If no module is given, we don't do anything
-        if t.Module == nil {
+        // If no configuration is given, we don't do anything
+        if t.Config == nil {
                 return nil
         }
 
-        // If the module isn't loaded, that is simply an error
-        if !t.Module.Loaded() {
-                return errors.New("module must be loaded for ProviderConfigTransformer")
-        }
-
         t.providers = make(map[string]GraphNodeProvider)
         t.proxiable = make(map[string]bool)
 
         // Start the transformation process
-        if err := t.transform(g, t.Module); err != nil {
+        if err := t.transform(g, t.Config); err != nil {
                 return err
         }
 
@@ -442,95 +531,126 @@ func (t *ProviderConfigTransformer) Transform(g *Graph) error {
         return t.attachProviderConfigs(g)
 }
 
-func (t *ProviderConfigTransformer) transform(g *Graph, m *module.Tree) error {
+func (t *ProviderConfigTransformer) transform(g *Graph, c *configs.Config) error {
         // If no config, do nothing
-        if m == nil {
+        if c == nil {
                 return nil
         }
 
         // Add our resources
-        if err := t.transformSingle(g, m); err != nil {
+        if err := t.transformSingle(g, c); err != nil {
                 return err
         }
 
         // Transform all the children.
-        for _, c := range m.Children() {
-                if err := t.transform(g, c); err != nil {
+        for _, cc := range c.Children {
+                if err := t.transform(g, cc); err != nil {
                         return err
                 }
         }
         return nil
 }
 
-func (t *ProviderConfigTransformer) transformSingle(g *Graph, m *module.Tree) error {
-        log.Printf("[TRACE] ProviderConfigTransformer: Starting for path: %v", m.Path())
-
-        // Get the configuration for this module
-        conf := m.Config()
-
-        // Build the path we're at
-        path := m.Path()
-        if len(path) > 0 {
-                path = append([]string{RootModuleName}, path...)
+func (t *ProviderConfigTransformer) transformSingle(g *Graph, c *configs.Config) error {
+        // Get the module associated with this configuration tree node
+        mod := c.Module
+        staticPath := c.Path
+
+        // We actually need a dynamic module path here, but we've not yet updated
+        // our graph builders enough to support expansion of module calls with
+        // "count" and "for_each" set, so for now we'll shim this by converting to
+        // a dynamic path with no keys. At the time of writing this is the only
+        // possible kind of dynamic path anyway.
+        path := make(addrs.ModuleInstance, len(staticPath))
+        for i, name := range staticPath {
+                path[i] = addrs.ModuleInstanceStep{
+                        Name: name,
+                }
         }
 
         // add all providers from the configuration
-        for _, p := range conf.ProviderConfigs {
-                name := p.Name
-                if p.Alias != "" {
-                        name += "." + p.Alias
-                }
+        for _, p := range mod.ProviderConfigs {
+                relAddr := p.Addr()
+                addr := relAddr.Absolute(path)
 
-                v := t.Concrete(&NodeAbstractProvider{
-                        NameValue: name,
-                        PathValue: path,
-                })
+                abstract := &NodeAbstractProvider{
+                        Addr: addr,
+                }
+                var v dag.Vertex
+                if t.Concrete != nil {
+                        v = t.Concrete(abstract)
+                } else {
+                        v = abstract
+                }
 
                 // Add it to the graph
                 g.Add(v)
-                fullName := ResolveProviderName(name, path)
-                t.providers[fullName] = v.(GraphNodeProvider)
-                t.proxiable[fullName] = len(p.RawConfig.RawMap()) == 0
+                key := addr.String()
+                t.providers[key] = v.(GraphNodeProvider)
+
+                // A provider configuration is "proxyable" if its configuration is
+                // entirely empty. This means it's standing in for a provider
+                // configuration that must be passed in from the parent module.
+                // We decide this by evaluating the config with an empty schema;
+                // if this succeeds, then we know there's nothing in the body.
+                _, diags := p.Config.Content(&hcl.BodySchema{})
+                t.proxiable[key] = !diags.HasErrors()
         }
 
         // Now replace the provider nodes with proxy nodes if a provider was being
         // passed in, and create implicit proxies if there was no config. Any extra
         // proxies will be removed in the prune step.
-        return t.addProxyProviders(g, m)
+        return t.addProxyProviders(g, c)
 }
 
-func (t *ProviderConfigTransformer) addProxyProviders(g *Graph, m *module.Tree) error {
-        path := m.Path()
+func (t *ProviderConfigTransformer) addProxyProviders(g *Graph, c *configs.Config) error {
+        path := c.Path
 
         // can't add proxies at the root
         if len(path) == 0 {
                 return nil
         }
 
-        parentPath := path[:len(path)-1]
-        parent := t.Module.Child(parentPath)
+        parentPath, callAddr := path.Call()
+        parent := c.Parent
         if parent == nil {
                 return nil
         }
 
-        var parentCfg *config.Module
-        for _, mod := range parent.Config().Modules {
-                if mod.Name == m.Name() {
+        callName := callAddr.Name
+        var parentCfg *configs.ModuleCall
+        for name, mod := range parent.Module.ModuleCalls {
+                if name == callName {
                         parentCfg = mod
                         break
                 }
         }
 
+        // We currently don't support count/for_each for modules and so we must
+        // shim our path and parentPath into module instances here so that the
+        // rest of Terraform can behave as if we do. This shimming should be
+        // removed later as part of implementing count/for_each for modules.
+        instPath := make(addrs.ModuleInstance, len(path))
+        for i, name := range path {
+                instPath[i] = addrs.ModuleInstanceStep{Name: name}
+        }
+        parentInstPath := make(addrs.ModuleInstance, len(parentPath))
+        for i, name := range parentPath {
+                parentInstPath[i] = addrs.ModuleInstanceStep{Name: name}
+        }
+
         if parentCfg == nil {
                 // this can't really happen during normal execution.
-                return fmt.Errorf("parent module config not found for %s", m.Name())
+                return fmt.Errorf("parent module config not found for %s", c.Path.String())
         }
 
         // Go through all the providers the parent is passing in, and add proxies to
         // the parent provider nodes.
-        for name, parentName := range parentCfg.Providers {
-                fullName := ResolveProviderName(name, path)
-                fullParentName := ResolveProviderName(parentName, parentPath)
+        for _, pair := range parentCfg.Providers {
+                fullAddr := pair.InChild.Addr().Absolute(instPath)
+                fullParentAddr := pair.InParent.Addr().Absolute(parentInstPath)
+                fullName := fullAddr.String()
+                fullParentName := fullParentAddr.String()
 
                 parentProvider := t.providers[fullParentName]
 
@@ -539,9 +659,8 @@ func (t *ProviderConfigTransformer) addProxyProviders(g *Graph, m *module.Tree)
                 }
 
                 proxy := &graphNodeProxyProvider{
-                        nameValue: name,
-                        path:      path,
-                        target:    parentProvider,
+                        addr:   fullAddr,
+                        target: parentProvider,
                 }
 
                 concreteProvider := t.providers[fullName]
@@ -553,8 +672,8 @@ func (t *ProviderConfigTransformer) addProxyProviders(g *Graph, m *module.Tree)
                         continue
                 }
 
-                // aliased providers can't be implicitly passed in
-                if strings.Contains(name, ".") {
+                // aliased configurations can't be implicitly passed in
+                if fullAddr.ProviderConfig.Alias != "" {
                         continue
                 }
 
@@ -575,27 +694,19 @@ func (t *ProviderConfigTransformer) attachProviderConfigs(g *Graph) error {
                 }
 
                 // Determine what we're looking for
-                path := normalizeModulePath(apn.Path())[1:]
-                name := apn.ProviderName()
-                log.Printf("[TRACE] Attach provider request: %#v %s", path, name)
+                addr := apn.ProviderAddr()
 
                 // Get the configuration.
-                tree := t.Module.Child(path)
-                if tree == nil {
+                mc := t.Config.DescendentForInstance(addr.Module)
+                if mc == nil {
+                        log.Printf("[TRACE] ProviderConfigTransformer: no configuration available for %s", addr.String())
                         continue
                 }
 
                 // Go through the provider configs to find the matching config
-                for _, p := range tree.Config().ProviderConfigs {
-                        // Build the name, which is "name.alias" if an alias exists
-                        current := p.Name
-                        if p.Alias != "" {
-                                current += "." + p.Alias
-                        }
-
-                        // If the configs match then attach!
-                        if current == name {
-                                log.Printf("[TRACE] Attaching provider config: %#v", p)
+                for _, p := range mc.Module.ProviderConfigs {
+                        if p.Name == addr.ProviderConfig.Type && p.Alias == addr.ProviderConfig.Alias {
+                                log.Printf("[TRACE] ProviderConfigTransformer: attaching to %q provider configuration from %s", dag.VertexName(v), p.DeclRange)
                                 apn.AttachProvider(p)
                                 break
                         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_provisioner.go b/vendor/github.com/hashicorp/terraform/terraform/transform_provisioner.go
index f49d824..fe4cf0e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_provisioner.go
@@ -2,6 +2,9 @@ package terraform
 
 import (
         "fmt"
+        "log"
+
+        "github.com/hashicorp/terraform/addrs"
 
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/terraform/dag"
@@ -22,8 +25,8 @@ type GraphNodeCloseProvisioner interface {
 }
 
 // GraphNodeProvisionerConsumer is an interface that nodes that require
-// a provisioner must implement. ProvisionedBy must return the name of the
-// provisioner to use.
+// a provisioner must implement. ProvisionedBy must return the names of the
+// provisioners to use.
 type GraphNodeProvisionerConsumer interface {
         ProvisionedBy() []string
 }
@@ -48,6 +51,7 @@ func (t *ProvisionerTransformer) Transform(g *Graph) error {
                                         continue
                                 }
 
+                                log.Printf("[TRACE] ProvisionerTransformer: %s is provisioned by %s (%q)", dag.VertexName(v), key, dag.VertexName(m[key]))
                                 g.Connect(dag.BasicEdge(v, m[key]))
                         }
                 }
@@ -83,12 +87,9 @@ func (t *MissingProvisionerTransformer) Transform(g *Graph) error {
 
                 // If this node has a subpath, then we use that as a prefix
                 // into our map to check for an existing provider.
-                var path []string
+                path := addrs.RootModuleInstance
                 if sp, ok := pv.(GraphNodeSubPath); ok {
-                        raw := normalizeModulePath(sp.Path())
-                        if len(raw) > len(rootModulePath) {
-                                path = raw
-                        }
+                        path = sp.Path()
                 }
 
                 for _, p := range pv.ProvisionedBy() {
@@ -101,7 +102,7 @@ func (t *MissingProvisionerTransformer) Transform(g *Graph) error {
                         }
 
                         if _, ok := supported[p]; !ok {
-                                // If we don't support the provisioner type, skip it.
+                                // If we don't support the provisioner type, we skip it.
                                 // Validation later will catch this as an error.
                                 continue
                         }
@@ -114,6 +115,7 @@ func (t *MissingProvisionerTransformer) Transform(g *Graph) error {
 
                         // Add the missing provisioner node to the graph
                         m[key] = g.Add(newV)
+                        log.Printf("[TRACE] MissingProviderTransformer: added implicit provisioner %s, first implied by %s", key, dag.VertexName(v))
                 }
         }
 
@@ -156,10 +158,7 @@ func (t *CloseProvisionerTransformer) Transform(g *Graph) error {
 func provisionerMapKey(k string, v dag.Vertex) string {
         pathPrefix := ""
         if sp, ok := v.(GraphNodeSubPath); ok {
-                raw := normalizeModulePath(sp.Path())
-                if len(raw) > len(rootModulePath) {
-                        pathPrefix = modulePrefixStr(raw) + "."
-                }
+                pathPrefix = sp.Path().String() + "."
         }
 
         return pathPrefix + k
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_reference.go b/vendor/github.com/hashicorp/terraform/terraform/transform_reference.go
index be8c7f9..23bc8cd 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_reference.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_reference.go
@@ -3,8 +3,12 @@ package terraform
 import (
         "fmt"
         "log"
-        "strings"
 
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/lang"
+
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/dag"
 )
@@ -17,35 +21,46 @@ import (
 // be referenced and other methods of referencing may still be possible (such
 // as by path!)
 type GraphNodeReferenceable interface {
-        // ReferenceableName is the name by which this can be referenced.
-        // This can be either just the type, or include the field. Example:
-        // "aws_instance.bar" or "aws_instance.bar.id".
-        ReferenceableName() []string
+        GraphNodeSubPath
+
+        // ReferenceableAddrs returns a list of addresses through which this can be
+        // referenced.
+        ReferenceableAddrs() []addrs.Referenceable
 }
 
 // GraphNodeReferencer must be implemented by nodes that reference other
 // Terraform items and therefore depend on them.
 type GraphNodeReferencer interface {
-        // References are the list of things that this node references. This
-        // can include fields or just the type, just like GraphNodeReferenceable
-        // above.
-        References() []string
+        GraphNodeSubPath
+
+        // References returns a list of references made by this node, which
+        // include both a referenced address and source location information for
+        // the reference.
+        References() []*addrs.Reference
 }
 
-// GraphNodeReferenceGlobal is an interface that can optionally be
-// implemented. If ReferenceGlobal returns true, then the References()
-// and ReferenceableName() must be _fully qualified_ with "module.foo.bar"
-// etc.
+// GraphNodeReferenceOutside is an interface that can optionally be implemented.
+// A node that implements it can specify that its own referenceable addresses
+// and/or the addresses it references are in a different module than the
+// node itself.
+//
+// Any referenceable addresses returned by ReferenceableAddrs are interpreted
+// relative to the returned selfPath.
 //
-// This allows a node to reference and be referenced by a specific name
-// that may cross module boundaries. This can be very dangerous so use
-// this wisely.
+// Any references returned by References are interpreted relative to the
+// returned referencePath.
 //
-// The primary use case for this is module boundaries (variables coming in).
-type GraphNodeReferenceGlobal interface {
-        // Set to true to signal that references and name are fully
-        // qualified. See the above docs for more information.
-        ReferenceGlobal() bool
+// It is valid but not required for either of these paths to match what is
+// returned by method Path, though if both match the main Path then there
+// is no reason to implement this method.
+//
+// The primary use-case for this is the nodes representing module input
+// variables, since their expressions are resolved in terms of their calling
+// module, but they are still referenced from their own module.
+type GraphNodeReferenceOutside interface {
+        // ReferenceOutside returns a path in which any references from this node
+        // are resolved.
+        ReferenceOutside() (selfPath, referencePath addrs.ModuleInstance)
 }
 
 // ReferenceTransformer is a GraphTransformer that connects all the
@@ -158,75 +173,91 @@ func (t *PruneUnusedValuesTransformer) Transform(g *Graph) error {
 // ReferenceMap is a structure that can be used to efficiently check
 // for references on a graph.
 type ReferenceMap struct {
-        // m is the mapping of referenceable name to list of verticies that
-        // implement that name. This is built on initialization.
-        references   map[string][]dag.Vertex
-        referencedBy map[string][]dag.Vertex
+        // vertices is a map from internal reference keys (as produced by the
+        // mapKey method) to one or more vertices that are identified by each key.
+        //
+        // A particular reference key might actually identify multiple vertices,
+        // e.g. in situations where one object is contained inside another.
+        vertices map[string][]dag.Vertex
+
+        // edges is a map whose keys are a subset of the internal reference keys
+        // from "vertices", and whose values are the nodes that refer to each
+        // key. The values in this map are the referrers, while values in
+        // "verticies" are the referents. The keys in both cases are referents.
+        edges map[string][]dag.Vertex
 }
 
-// References returns the list of vertices that this vertex
-// references along with any missing references.
-func (m *ReferenceMap) References(v dag.Vertex) ([]dag.Vertex, []string) {
+// References returns the set of vertices that the given vertex refers to,
+// and any referenced addresses that do not have corresponding vertices.
+func (m *ReferenceMap) References(v dag.Vertex) ([]dag.Vertex, []addrs.Referenceable) {
         rn, ok := v.(GraphNodeReferencer)
         if !ok {
                 return nil, nil
         }
+        if _, ok := v.(GraphNodeSubPath); !ok {
+                return nil, nil
+        }
 
         var matches []dag.Vertex
-        var missing []string
-        prefix := m.prefix(v)
-
-        for _, ns := range rn.References() {
-                found := false
-                for _, n := range strings.Split(ns, "/") {
-                        n = prefix + n
-                        parents, ok := m.references[n]
-                        if !ok {
-                                continue
+        var missing []addrs.Referenceable
+
+        for _, ref := range rn.References() {
+                subject := ref.Subject
+
+                key := m.referenceMapKey(v, subject)
+                if _, exists := m.vertices[key]; !exists {
+                        // If what we were looking for was a ResourceInstance then we
+                        // might be in a resource-oriented graph rather than an
+                        // instance-oriented graph, and so we'll see if we have the
+                        // resource itself instead.
+                        switch ri := subject.(type) {
+                        case addrs.ResourceInstance:
+                                subject = ri.ContainingResource()
+                        case addrs.ResourceInstancePhase:
+                                subject = ri.ContainingResource()
                         }
+                        key = m.referenceMapKey(v, subject)
+                }
 
-                        // Mark that we found a match
-                        found = true
-
-                        for _, p := range parents {
-                                // don't include self-references
-                                if p == v {
-                                        continue
-                                }
-                                matches = append(matches, p)
+                vertices := m.vertices[key]
+                for _, rv := range vertices {
+                        // don't include self-references
+                        if rv == v {
+                                continue
                         }
-
-                        break
+                        matches = append(matches, rv)
                 }
-
-                if !found {
-                        missing = append(missing, ns)
+                if len(vertices) == 0 {
+                        missing = append(missing, ref.Subject)
                 }
         }
 
         return matches, missing
 }
 
-// ReferencedBy returns the list of vertices that reference the
-// vertex passed in.
-func (m *ReferenceMap) ReferencedBy(v dag.Vertex) []dag.Vertex {
+// Referrers returns the set of vertices that refer to the given vertex.
+func (m *ReferenceMap) Referrers(v dag.Vertex) []dag.Vertex {
         rn, ok := v.(GraphNodeReferenceable)
         if !ok {
                 return nil
         }
+        sp, ok := v.(GraphNodeSubPath)
+        if !ok {
+                return nil
+        }
 
         var matches []dag.Vertex
-        prefix := m.prefix(v)
-        for _, n := range rn.ReferenceableName() {
-                n = prefix + n
-                children, ok := m.referencedBy[n]
+        for _, addr := range rn.ReferenceableAddrs() {
+                key := m.mapKey(sp.Path(), addr)
+                referrers, ok := m.edges[key]
                 if !ok {
                         continue
                 }
 
-                // Make sure this isn't a self reference, which isn't included
+                // If the referrer set includes our own given vertex then we skip,
+                // since we don't want to return self-references.
                 selfRef := false
-                for _, p := range children {
+                for _, p := range referrers {
                         if p == v {
                                 selfRef = true
                                 break
@@ -236,28 +267,77 @@ func (m *ReferenceMap) ReferencedBy(v dag.Vertex) []dag.Vertex {
                         continue
                 }
 
-                matches = append(matches, children...)
+                matches = append(matches, referrers...)
         }
 
         return matches
 }
 
-func (m *ReferenceMap) prefix(v dag.Vertex) string {
-        // If the node is stating it is already fully qualified then
-        // we don't have to create the prefix!
-        if gn, ok := v.(GraphNodeReferenceGlobal); ok && gn.ReferenceGlobal() {
-                return ""
+func (m *ReferenceMap) mapKey(path addrs.ModuleInstance, addr addrs.Referenceable) string {
+        return fmt.Sprintf("%s|%s", path.String(), addr.String())
+}
+
+// vertexReferenceablePath returns the path in which the given vertex can be
+// referenced. This is the path that its results from ReferenceableAddrs
+// are considered to be relative to.
+//
+// Only GraphNodeSubPath implementations can be referenced, so this method will
+// panic if the given vertex does not implement that interface.
+func (m *ReferenceMap) vertexReferenceablePath(v dag.Vertex) addrs.ModuleInstance {
+        sp, ok := v.(GraphNodeSubPath)
+        if !ok {
+                // Only nodes with paths can participate in a reference map.
+                panic(fmt.Errorf("vertexMapKey on vertex type %T which doesn't implement GraphNodeSubPath", sp))
         }
 
-        // Create the prefix based on the path
-        var prefix string
-        if pn, ok := v.(GraphNodeSubPath); ok {
-                if path := normalizeModulePath(pn.Path()); len(path) > 1 {
-                        prefix = modulePrefixStr(path) + "."
-                }
+        if outside, ok := v.(GraphNodeReferenceOutside); ok {
+                // Vertex is referenced from a different module than where it was
+                // declared.
+                path, _ := outside.ReferenceOutside()
+                return path
+        }
+
+        // Vertex is referenced from the same module as where it was declared.
+        return sp.Path()
+}
+
+// vertexReferencePath returns the path in which references _from_ the given
+// vertex must be interpreted.
+//
+// Only GraphNodeSubPath implementations can have references, so this method
+// will panic if the given vertex does not implement that interface.
+func vertexReferencePath(referrer dag.Vertex) addrs.ModuleInstance {
+        sp, ok := referrer.(GraphNodeSubPath)
+        if !ok {
+                // Only nodes with paths can participate in a reference map.
+                panic(fmt.Errorf("vertexReferencePath on vertex type %T which doesn't implement GraphNodeSubPath", sp))
+        }
+
+        var path addrs.ModuleInstance
+        if outside, ok := referrer.(GraphNodeReferenceOutside); ok {
+                // Vertex makes references to objects in a different module than where
+                // it was declared.
+                _, path = outside.ReferenceOutside()
+                return path
         }
 
-        return prefix
+        // Vertex makes references to objects in the same module as where it
+        // was declared.
+        return sp.Path()
+}
+
+// referenceMapKey produces keys for the "edges" map. "referrer" is the vertex
+// that the reference is from, and "addr" is the address of the object being
+// referenced.
+//
+// The result is an opaque string that includes both the address of the given
+// object and the address of the module instance that object belongs to.
+//
+// Only GraphNodeSubPath implementations can be referrers, so this method will
+// panic if the given vertex does not implement that interface.
+func (m *ReferenceMap) referenceMapKey(referrer dag.Vertex, addr addrs.Referenceable) string {
+        path := vertexReferencePath(referrer)
+        return m.mapKey(path, addr)
 }
 
 // NewReferenceMap is used to create a new reference map for the
@@ -266,83 +346,82 @@ func NewReferenceMap(vs []dag.Vertex) *ReferenceMap {
         var m ReferenceMap
 
         // Build the lookup table
-        refMap := make(map[string][]dag.Vertex)
+        vertices := make(map[string][]dag.Vertex)
         for _, v := range vs {
+                _, ok := v.(GraphNodeSubPath)
+                if !ok {
+                        // Only nodes with paths can participate in a reference map.
+                        continue
+                }
+
                 // We're only looking for referenceable nodes
                 rn, ok := v.(GraphNodeReferenceable)
                 if !ok {
                         continue
                 }
 
+                path := m.vertexReferenceablePath(v)
+
                 // Go through and cache them
-                prefix := m.prefix(v)
-                for _, n := range rn.ReferenceableName() {
-                        n = prefix + n
-                        refMap[n] = append(refMap[n], v)
+                for _, addr := range rn.ReferenceableAddrs() {
+                        key := m.mapKey(path, addr)
+                        vertices[key] = append(vertices[key], v)
                 }
 
-                // If there is a path, it is always referenceable by that. For
-                // example, if this is a referenceable thing at path []string{"foo"},
-                // then it can be referenced at "module.foo"
-                if pn, ok := v.(GraphNodeSubPath); ok {
-                        for _, p := range ReferenceModulePath(pn.Path()) {
-                                refMap[p] = append(refMap[p], v)
-                        }
+                // Any node can be referenced by the address of the module it belongs
+                // to or any of that module's ancestors.
+                for _, addr := range path.Ancestors()[1:] {
+                        // Can be referenced either as the specific call instance (with
+                        // an instance key) or as the bare module call itself (the "module"
+                        // block in the parent module that created the instance).
+                        callPath, call := addr.Call()
+                        callInstPath, callInst := addr.CallInstance()
+                        callKey := m.mapKey(callPath, call)
+                        callInstKey := m.mapKey(callInstPath, callInst)
+                        vertices[callKey] = append(vertices[callKey], v)
+                        vertices[callInstKey] = append(vertices[callInstKey], v)
                 }
         }
 
         // Build the lookup table for referenced by
-        refByMap := make(map[string][]dag.Vertex)
+        edges := make(map[string][]dag.Vertex)
         for _, v := range vs {
-                // We're only looking for referenceable nodes
+                _, ok := v.(GraphNodeSubPath)
+                if !ok {
+                        // Only nodes with paths can participate in a reference map.
+                        continue
+                }
+
                 rn, ok := v.(GraphNodeReferencer)
                 if !ok {
+                        // We're only looking for referenceable nodes
                         continue
                 }
 
                 // Go through and cache them
-                prefix := m.prefix(v)
-                for _, n := range rn.References() {
-                        n = prefix + n
-                        refByMap[n] = append(refByMap[n], v)
+                for _, ref := range rn.References() {
+                        if ref.Subject == nil {
+                                // Should never happen
+                                panic(fmt.Sprintf("%T.References returned reference with nil subject", rn))
+                        }
+                        key := m.referenceMapKey(v, ref.Subject)
+                        edges[key] = append(edges[key], v)
                 }
         }
 
-        m.references = refMap
-        m.referencedBy = refByMap
+        m.vertices = vertices
+        m.edges = edges
         return &m
 }
 
-// Returns the reference name for a module path. The path "foo" would return
-// "module.foo". If this is a deeply nested module, it will be every parent
-// as well. For example: ["foo", "bar"] would return both "module.foo" and
-// "module.foo.module.bar"
-func ReferenceModulePath(p []string) []string {
-        p = normalizeModulePath(p)
-        if len(p) == 1 {
-                // Root, no name
-                return nil
-        }
-
-        result := make([]string, 0, len(p)-1)
-        for i := len(p); i > 1; i-- {
-                result = append(result, modulePrefixStr(p[:i]))
-        }
-
-        return result
-}
-
 // ReferencesFromConfig returns the references that a configuration has
 // based on the interpolated variables in a configuration.
-func ReferencesFromConfig(c *config.RawConfig) []string {
-        var result []string
-        for _, v := range c.Variables {
-                if r := ReferenceFromInterpolatedVar(v); len(r) > 0 {
-                        result = append(result, r...)
-                }
+func ReferencesFromConfig(body hcl.Body, schema *configschema.Block) []*addrs.Reference {
+        if body == nil {
+                return nil
         }
-
-        return result
+        refs, _ := lang.ReferencesInBlock(body, schema)
+        return refs
 }
 
 // ReferenceFromInterpolatedVar returns the reference from this variable,
@@ -378,18 +457,31 @@ func ReferenceFromInterpolatedVar(v config.InterpolatedVariable) []string {
         }
 }
 
-func modulePrefixStr(p []string) string {
-        // strip "root"
-        if len(p) > 0 && p[0] == rootModulePath[0] {
-                p = p[1:]
-        }
-
-        parts := make([]string, 0, len(p)*2)
-        for _, p := range p {
-                parts = append(parts, "module", p)
+// appendResourceDestroyReferences identifies resource and resource instance
+// references in the given slice and appends to it the "destroy-phase"
+// equivalents of those references, returning the result.
+//
+// This can be used in the References implementation for a node which must also
+// depend on the destruction of anything it references.
+func appendResourceDestroyReferences(refs []*addrs.Reference) []*addrs.Reference {
+        given := refs
+        for _, ref := range given {
+                switch tr := ref.Subject.(type) {
+                case addrs.Resource:
+                        newRef := *ref // shallow copy
+                        newRef.Subject = tr.Phase(addrs.ResourceInstancePhaseDestroy)
+                        refs = append(refs, &newRef)
+                case addrs.ResourceInstance:
+                        newRef := *ref // shallow copy
+                        newRef.Subject = tr.Phase(addrs.ResourceInstancePhaseDestroy)
+                        refs = append(refs, &newRef)
+                }
         }
+        return refs
+}
 
-        return strings.Join(parts, ".")
+func modulePrefixStr(p addrs.ModuleInstance) string {
+        return p.String()
 }
 
 func modulePrefixList(result []string, prefix string) []string {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_removed_modules.go b/vendor/github.com/hashicorp/terraform/terraform/transform_removed_modules.go
index 2e05edb..ee71387 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_removed_modules.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_removed_modules.go
@@ -3,14 +3,15 @@ package terraform
 import (
         "log"
 
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/states"
 )
 
-// RemoveModuleTransformer implements GraphTransformer to add nodes indicating
+// RemovedModuleTransformer implements GraphTransformer to add nodes indicating
 // when a module was removed from the configuration.
 type RemovedModuleTransformer struct {
-        Module *module.Tree // root module
-        State  *State
+        Config *configs.Config // root node in the config tree
+        State  *states.State
 }
 
 func (t *RemovedModuleTransformer) Transform(g *Graph) error {
@@ -20,13 +21,13 @@ func (t *RemovedModuleTransformer) Transform(g *Graph) error {
         }
 
         for _, m := range t.State.Modules {
-                c := t.Module.Child(m.Path[1:])
-                if c != nil {
+                cc := t.Config.DescendentForInstance(m.Addr)
+                if cc != nil {
                         continue
                 }
 
-                log.Printf("[DEBUG] module %s no longer in config\n", modulePrefixStr(m.Path))
-                g.Add(&NodeModuleRemoved{PathValue: m.Path})
+                log.Printf("[DEBUG] %s is no longer in configuration\n", m.Addr)
+                g.Add(&NodeModuleRemoved{Addr: m.Addr})
         }
         return nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go b/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go
index e528b37..1123790 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go
@@ -1,8 +1,8 @@
 package terraform
 
 import (
-        "fmt"
-
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -11,41 +11,44 @@ import (
 //
 // This assumes that the count is already interpolated.
 type ResourceCountTransformer struct {
-        Concrete ConcreteResourceNodeFunc
+        Concrete ConcreteResourceInstanceNodeFunc
+        Schema   *configschema.Block
 
+        // Count is either the number of indexed instances to create, or -1 to
+        // indicate that count is not set at all and thus a no-key instance should
+        // be created.
         Count int
-        Addr  *ResourceAddress
+        Addr  addrs.AbsResource
 }
 
 func (t *ResourceCountTransformer) Transform(g *Graph) error {
-        // Don't allow the count to be negative
         if t.Count < 0 {
-                return fmt.Errorf("negative count: %d", t.Count)
+                // Negative count indicates that count is not set at all.
+                addr := t.Addr.Instance(addrs.NoKey)
+
+                abstract := NewNodeAbstractResourceInstance(addr)
+                abstract.Schema = t.Schema
+                var node dag.Vertex = abstract
+                if f := t.Concrete; f != nil {
+                        node = f(abstract)
+                }
+
+                g.Add(node)
+                return nil
         }
 
         // For each count, build and add the node
         for i := 0; i < t.Count; i++ {
-                // Set the index. If our count is 1 we special case it so that
-                // we handle the "resource.0" and "resource" boundary properly.
-                index := i
-                if t.Count == 1 {
-                        index = -1
-                }
+                key := addrs.IntKey(i)
+                addr := t.Addr.Instance(key)
 
-                // Build the resource address
-                addr := t.Addr.Copy()
-                addr.Index = index
-
-                // Build the abstract node and the concrete one
-                abstract := &NodeAbstractResource{
-                        Addr: addr,
-                }
+                abstract := NewNodeAbstractResourceInstance(addr)
+                abstract.Schema = t.Schema
                 var node dag.Vertex = abstract
                 if f := t.Concrete; f != nil {
                         node = f(abstract)
                 }
 
-                // Add it to the graph
                 g.Add(node)
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_state.go b/vendor/github.com/hashicorp/terraform/terraform/transform_state.go
index 471cd74..0b52347 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_state.go
@@ -1,10 +1,9 @@
 package terraform
 
 import (
-        "fmt"
         "log"
 
-        "github.com/hashicorp/terraform/dag"
+        "github.com/hashicorp/terraform/states"
 )
 
 // StateTransformer is a GraphTransformer that adds the elements of
@@ -13,53 +12,63 @@ import (
 // This transform is used for example by the DestroyPlanGraphBuilder to ensure
 // that only resources that are in the state are represented in the graph.
 type StateTransformer struct {
-        Concrete ConcreteResourceNodeFunc
+        // ConcreteCurrent and ConcreteDeposed are used to specialize the abstract
+        // resource instance nodes that this transformer will create.
+        //
+        // If either of these is nil, the objects of that type will be skipped and
+        // not added to the graph at all. It doesn't make sense to use this
+        // transformer without setting at least one of these, since that would
+        // skip everything and thus be a no-op.
+        ConcreteCurrent ConcreteResourceInstanceNodeFunc
+        ConcreteDeposed ConcreteResourceInstanceDeposedNodeFunc
 
-        State *State
+        State *states.State
 }
 
 func (t *StateTransformer) Transform(g *Graph) error {
-        // If the state is nil or empty (nil is empty) then do nothing
-        if t.State.Empty() {
+        if !t.State.HasResources() {
+                log.Printf("[TRACE] StateTransformer: state is empty, so nothing to do")
                 return nil
         }
 
-        // Go through all the modules in the diff.
-        log.Printf("[TRACE] StateTransformer: starting")
-        var nodes []dag.Vertex
+        switch {
+        case t.ConcreteCurrent != nil && t.ConcreteDeposed != nil:
+                log.Printf("[TRACE] StateTransformer: creating nodes for both current and deposed instance objects")
+        case t.ConcreteCurrent != nil:
+                log.Printf("[TRACE] StateTransformer: creating nodes for current instance objects only")
+        case t.ConcreteDeposed != nil:
+                log.Printf("[TRACE] StateTransformer: creating nodes for deposed instance objects only")
+        default:
+                log.Printf("[TRACE] StateTransformer: pointless no-op call, creating no nodes at all")
+        }
+
         for _, ms := range t.State.Modules {
-                log.Printf("[TRACE] StateTransformer: Module: %v", ms.Path)
+                moduleAddr := ms.Addr
 
-                // Go through all the resources in this module.
-                for name, rs := range ms.Resources {
-                        log.Printf("[TRACE] StateTransformer: Resource %q: %#v", name, rs)
+                for _, rs := range ms.Resources {
+                        resourceAddr := rs.Addr.Absolute(moduleAddr)
 
-                        // Add the resource to the graph
-                        addr, err := parseResourceAddressInternal(name)
-                        if err != nil {
-                                panic(fmt.Sprintf(
-                                        "Error parsing internal name, this is a bug: %q", name))
-                        }
+                        for key, is := range rs.Instances {
+                                addr := resourceAddr.Instance(key)
 
-                        // Very important: add the module path for this resource to
-                        // the address. Remove "root" from it.
-                        addr.Path = ms.Path[1:]
+                                if obj := is.Current; obj != nil && t.ConcreteCurrent != nil {
+                                        abstract := NewNodeAbstractResourceInstance(addr)
+                                        node := t.ConcreteCurrent(abstract)
+                                        g.Add(node)
+                                        log.Printf("[TRACE] StateTransformer: added %T for %s current object", node, addr)
+                                }
 
-                        // Add the resource to the graph
-                        abstract := &NodeAbstractResource{Addr: addr}
-                        var node dag.Vertex = abstract
-                        if f := t.Concrete; f != nil {
-                                node = f(abstract)
+                                if t.ConcreteDeposed != nil {
+                                        for dk := range is.Deposed {
+                                                abstract := NewNodeAbstractResourceInstance(addr)
+                                                node := t.ConcreteDeposed(abstract, dk)
+                                                g.Add(node)
+                                                log.Printf("[TRACE] StateTransformer: added %T for %s deposed object %s", node, addr, dk)
+                                        }
+                                }
                         }
-
-                        nodes = append(nodes, node)
                 }
         }
 
-        // Add all the nodes to the graph
-        for _, n := range nodes {
-                g.Add(n)
-        }
-
         return nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go b/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go
index af6defe..d25274e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go
@@ -3,6 +3,7 @@ package terraform
 import (
         "log"
 
+        "github.com/hashicorp/terraform/addrs"
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -12,7 +13,7 @@ import (
 // provided will contain every target provided, and each implementing graph
 // node must filter this list to targets considered relevant.
 type GraphNodeTargetable interface {
-        SetTargets([]ResourceAddress)
+        SetTargets([]addrs.Targetable)
 }
 
 // GraphNodeTargetDownstream is an interface for graph nodes that need to
@@ -35,11 +36,7 @@ type GraphNodeTargetDownstream interface {
 // their dependencies.
 type TargetsTransformer struct {
         // List of targeted resource names specified by the user
-        Targets []string
-
-        // List of parsed targets, provided by callers like ResourceCountTransform
-        // that already have the targets parsed
-        ParsedTargets []ResourceAddress
+        Targets []addrs.Targetable
 
         // If set, the index portions of resource addresses will be ignored
         // for comparison. This is used when transforming a graph where
@@ -53,17 +50,8 @@ type TargetsTransformer struct {
 }
 
 func (t *TargetsTransformer) Transform(g *Graph) error {
-        if len(t.Targets) > 0 && len(t.ParsedTargets) == 0 {
-                addrs, err := t.parseTargetAddresses()
-                if err != nil {
-                        return err
-                }
-
-                t.ParsedTargets = addrs
-        }
-
-        if len(t.ParsedTargets) > 0 {
-                targetedNodes, err := t.selectTargetedNodes(g, t.ParsedTargets)
+        if len(t.Targets) > 0 {
+                targetedNodes, err := t.selectTargetedNodes(g, t.Targets)
                 if err != nil {
                         return err
                 }
@@ -88,24 +76,10 @@ func (t *TargetsTransformer) Transform(g *Graph) error {
         return nil
 }
 
-func (t *TargetsTransformer) parseTargetAddresses() ([]ResourceAddress, error) {
-        addrs := make([]ResourceAddress, len(t.Targets))
-        for i, target := range t.Targets {
-                ta, err := ParseResourceAddress(target)
-                if err != nil {
-                        return nil, err
-                }
-                addrs[i] = *ta
-        }
-
-        return addrs, nil
-}
-
-// Returns the list of targeted nodes. A targeted node is either addressed
-// directly, or is an Ancestor of a targeted node. Destroy mode keeps
-// Descendents instead of Ancestors.
-func (t *TargetsTransformer) selectTargetedNodes(
-        g *Graph, addrs []ResourceAddress) (*dag.Set, error) {
+// Returns a set of targeted nodes. A targeted node is either addressed
+// directly, address indirectly via its container, or it's a dependency of a
+// targeted node. Destroy mode keeps dependents instead of dependencies.
+func (t *TargetsTransformer) selectTargetedNodes(g *Graph, addrs []addrs.Targetable) (*dag.Set, error) {
         targetedNodes := new(dag.Set)
 
         vertices := g.Vertices()
@@ -154,6 +128,12 @@ func (t *TargetsTransformer) addDependencies(targetedNodes *dag.Set, g *Graph) (
                 vertices := queue
                 queue = nil // ready to append for next iteration if neccessary
                 for _, v := range vertices {
+                        // providers don't cause transitive dependencies, so don't target
+                        // downstream from them.
+                        if _, ok := v.(GraphNodeProvider); ok {
+                                continue
+                        }
+
                         dependers := g.UpEdges(v)
                         if dependers == nil {
                                 // indicates that there are no up edges for this node, so
@@ -240,21 +220,34 @@ func filterPartialOutputs(v interface{}, targetedNodes *dag.Set, g *Graph) bool
         return true
 }
 
-func (t *TargetsTransformer) nodeIsTarget(
-        v dag.Vertex, addrs []ResourceAddress) bool {
-        r, ok := v.(GraphNodeResource)
+func (t *TargetsTransformer) nodeIsTarget(v dag.Vertex, targets []addrs.Targetable) bool {
+        var vertexAddr addrs.Targetable
+        switch r := v.(type) {
+        case GraphNodeResourceInstance:
+                vertexAddr = r.ResourceInstanceAddr()
+        case GraphNodeResource:
+                vertexAddr = r.ResourceAddr()
+        default:
+                // Only resource and resource instance nodes can be targeted.
+                return false
+        }
+        _, ok := v.(GraphNodeResource)
         if !ok {
                 return false
         }
 
-        addr := r.ResourceAddr()
-        for _, targetAddr := range addrs {
+        for _, targetAddr := range targets {
                 if t.IgnoreIndices {
-                        // targetAddr is not a pointer, so we can safely mutate it without
-                        // interfering with references elsewhere.
-                        targetAddr.Index = -1
+                        // If we're ignoring indices then we'll convert any resource instance
+                        // addresses into resource addresses. We don't need to convert
+                        // vertexAddr because instance addresses are contained within
+                        // their associated resources, and so .TargetContains will take
+                        // care of this for us.
+                        if instance, isInstance := targetAddr.(addrs.AbsResourceInstance); isInstance {
+                                targetAddr = instance.ContainingResource()
+                        }
                 }
-                if targetAddr.Contains(addr) {
+                if targetAddr.TargetContains(vertexAddr) {
                         return true
                 }
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_variable.go b/vendor/github.com/hashicorp/terraform/terraform/transform_variable.go
index b31e2c7..05daa51 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_variable.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_variable.go
@@ -1,7 +1,8 @@
 package terraform
 
 import (
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs"
 )
 
 // RootVariableTransformer is a GraphTransformer that adds all the root
@@ -11,28 +12,27 @@ import (
 // graph since downstream things that depend on them must be able to
 // reach them.
 type RootVariableTransformer struct {
-        Module *module.Tree
+        Config *configs.Config
 }
 
 func (t *RootVariableTransformer) Transform(g *Graph) error {
-        // If no config, no variables
-        if t.Module == nil {
+        // We can have no variables if we have no config.
+        if t.Config == nil {
                 return nil
         }
 
-        // If we have no vars, we're done!
-        vars := t.Module.Config().Variables
-        if len(vars) == 0 {
-                return nil
-        }
+        // We're only considering root module variables here, since child
+        // module variables are handled by ModuleVariableTransformer.
+        vars := t.Config.Module.Variables
 
         // Add all variables here
         for _, v := range vars {
                 node := &NodeRootVariable{
+                        Addr: addrs.InputVariable{
+                                Name: v.Name,
+                        },
                         Config: v,
                 }
-
-                // Add it!
                 g.Add(node)
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/ui_input.go b/vendor/github.com/hashicorp/terraform/terraform/ui_input.go
index 7c87459..f6790d9 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/ui_input.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/ui_input.go
@@ -1,10 +1,12 @@
 package terraform
 
+import "context"
+
 // UIInput is the interface that must be implemented to ask for input
 // from this user. This should forward the request to wherever the user
 // inputs things to ask for values.
 type UIInput interface {
-        Input(*InputOpts) (string, error)
+        Input(context.Context, *InputOpts) (string, error)
 }
 
 // InputOpts are options for asking for input.
diff --git a/vendor/github.com/hashicorp/terraform/terraform/ui_input_mock.go b/vendor/github.com/hashicorp/terraform/terraform/ui_input_mock.go
index e3a07ef..e2d9c38 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/ui_input_mock.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/ui_input_mock.go
@@ -1,5 +1,7 @@
 package terraform
 
+import "context"
+
 // MockUIInput is an implementation of UIInput that can be used for tests.
 type MockUIInput struct {
         InputCalled       bool
@@ -10,7 +12,7 @@ type MockUIInput struct {
         InputFn           func(*InputOpts) (string, error)
 }
 
-func (i *MockUIInput) Input(opts *InputOpts) (string, error) {
+func (i *MockUIInput) Input(ctx context.Context, opts *InputOpts) (string, error) {
         i.InputCalled = true
         i.InputOpts = opts
         if i.InputFn != nil {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/ui_input_prefix.go b/vendor/github.com/hashicorp/terraform/terraform/ui_input_prefix.go
index 2207d1d..b5d32b1 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/ui_input_prefix.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/ui_input_prefix.go
@@ -1,6 +1,7 @@
 package terraform
 
 import (
+        "context"
         "fmt"
 )
 
@@ -12,8 +13,8 @@ type PrefixUIInput struct {
         UIInput     UIInput
 }
 
-func (i *PrefixUIInput) Input(opts *InputOpts) (string, error) {
+func (i *PrefixUIInput) Input(ctx context.Context, opts *InputOpts) (string, error) {
         opts.Id = fmt.Sprintf("%s.%s", i.IdPrefix, opts.Id)
         opts.Query = fmt.Sprintf("%s%s", i.QueryPrefix, opts.Query)
-        return i.UIInput.Input(opts)
+        return i.UIInput.Input(ctx, opts)
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/ui_output_provisioner.go b/vendor/github.com/hashicorp/terraform/terraform/ui_output_provisioner.go
index 878a031..fff964f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/ui_output_provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/ui_output_provisioner.go
@@ -1,15 +1,19 @@
 package terraform
 
+import (
+        "github.com/hashicorp/terraform/addrs"
+)
+
 // ProvisionerUIOutput is an implementation of UIOutput that calls a hook
 // for the output so that the hooks can handle it.
 type ProvisionerUIOutput struct {
-        Info  *InstanceInfo
-        Type  string
-        Hooks []Hook
+        InstanceAddr    addrs.AbsResourceInstance
+        ProvisionerType string
+        Hooks           []Hook
 }
 
 func (o *ProvisionerUIOutput) Output(msg string) {
         for _, h := range o.Hooks {
-                h.ProvisionOutput(o.Info, o.Type, msg)
+                h.ProvisionOutput(o.InstanceAddr, o.ProvisionerType, msg)
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/valuesourcetype_string.go b/vendor/github.com/hashicorp/terraform/terraform/valuesourcetype_string.go
new file mode 100644
index 0000000..627593d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/valuesourcetype_string.go
@@ -0,0 +1,59 @@
+// Code generated by "stringer -type ValueSourceType"; DO NOT EDIT.
+
+package terraform
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[ValueFromUnknown-0]
+        _ = x[ValueFromConfig-67]
+        _ = x[ValueFromAutoFile-70]
+        _ = x[ValueFromNamedFile-78]
+        _ = x[ValueFromCLIArg-65]
+        _ = x[ValueFromEnvVar-69]
+        _ = x[ValueFromInput-73]
+        _ = x[ValueFromPlan-80]
+        _ = x[ValueFromCaller-83]
+}
+
+const (
+        _ValueSourceType_name_0 = "ValueFromUnknown"
+        _ValueSourceType_name_1 = "ValueFromCLIArg"
+        _ValueSourceType_name_2 = "ValueFromConfig"
+        _ValueSourceType_name_3 = "ValueFromEnvVarValueFromAutoFile"
+        _ValueSourceType_name_4 = "ValueFromInput"
+        _ValueSourceType_name_5 = "ValueFromNamedFile"
+        _ValueSourceType_name_6 = "ValueFromPlan"
+        _ValueSourceType_name_7 = "ValueFromCaller"
+)
+
+var (
+        _ValueSourceType_index_3 = [...]uint8{0, 15, 32}
+)
+
+func (i ValueSourceType) String() string {
+        switch {
+        case i == 0:
+                return _ValueSourceType_name_0
+        case i == 65:
+                return _ValueSourceType_name_1
+        case i == 67:
+                return _ValueSourceType_name_2
+        case 69 <= i && i <= 70:
+                i -= 69
+                return _ValueSourceType_name_3[_ValueSourceType_index_3[i]:_ValueSourceType_index_3[i+1]]
+        case i == 73:
+                return _ValueSourceType_name_4
+        case i == 78:
+                return _ValueSourceType_name_5
+        case i == 80:
+                return _ValueSourceType_name_6
+        case i == 83:
+                return _ValueSourceType_name_7
+        default:
+                return "ValueSourceType(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/variables.go b/vendor/github.com/hashicorp/terraform/terraform/variables.go
index 300f2ad..75531b2 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/variables.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/variables.go
@@ -2,165 +2,312 @@ package terraform
 
 import (
         "fmt"
-        "os"
-        "strings"
 
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
-        "github.com/hashicorp/terraform/helper/hilmapstructure"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/tfdiags"
+)
+
+// InputValue represents a value for a variable in the root module, provided
+// as part of the definition of an operation.
+type InputValue struct {
+        Value      cty.Value
+        SourceType ValueSourceType
+
+        // SourceRange provides source location information for values whose
+        // SourceType is either ValueFromConfig or ValueFromFile. It is not
+        // populated for other source types, and so should not be used.
+        SourceRange tfdiags.SourceRange
+}
+
+// ValueSourceType describes what broad category of source location provided
+// a particular value.
+type ValueSourceType rune
+
+const (
+        // ValueFromUnknown is the zero value of ValueSourceType and is not valid.
+        ValueFromUnknown ValueSourceType = 0
+
+        // ValueFromConfig indicates that a value came from a .tf or .tf.json file,
+        // e.g. the default value defined for a variable.
+        ValueFromConfig ValueSourceType = 'C'
+
+        // ValueFromAutoFile indicates that a value came from a "values file", like
+        // a .tfvars file, that was implicitly loaded by naming convention.
+        ValueFromAutoFile ValueSourceType = 'F'
+
+        // ValueFromNamedFile indicates that a value came from a named "values file",
+        // like a .tfvars file, that was passed explicitly on the command line (e.g.
+        // -var-file=foo.tfvars).
+        ValueFromNamedFile ValueSourceType = 'N'
+
+        // ValueFromCLIArg indicates that the value was provided directly in
+        // a CLI argument. The name of this argument is not recorded and so it must
+        // be inferred from context.
+        ValueFromCLIArg ValueSourceType = 'A'
+
+        // ValueFromEnvVar indicates that the value was provided via an environment
+        // variable. The name of the variable is not recorded and so it must be
+        // inferred from context.
+        ValueFromEnvVar ValueSourceType = 'E'
+
+        // ValueFromInput indicates that the value was provided at an interactive
+        // input prompt.
+        ValueFromInput ValueSourceType = 'I'
+
+        // ValueFromPlan indicates that the value was retrieved from a stored plan.
+        ValueFromPlan ValueSourceType = 'P'
+
+        // ValueFromCaller indicates that the value was explicitly overridden by
+        // a caller to Context.SetVariable after the context was constructed.
+        ValueFromCaller ValueSourceType = 'S'
 )
 
-// Variables returns the fully loaded set of variables to use with
-// ContextOpts and NewContext, loading any additional variables from
-// the environment or any other sources.
+func (v *InputValue) GoString() string {
+        if (v.SourceRange != tfdiags.SourceRange{}) {
+                return fmt.Sprintf("&terraform.InputValue{Value: %#v, SourceType: %#v, SourceRange: %#v}", v.Value, v.SourceType, v.SourceRange)
+        } else {
+                return fmt.Sprintf("&terraform.InputValue{Value: %#v, SourceType: %#v}", v.Value, v.SourceType)
+        }
+}
+
+func (v ValueSourceType) GoString() string {
+        return fmt.Sprintf("terraform.%s", v)
+}
+
+//go:generate stringer -type ValueSourceType
+
+// InputValues is a map of InputValue instances.
+type InputValues map[string]*InputValue
+
+// InputValuesFromCaller turns the given map of naked values into an
+// InputValues that attributes each value to "a caller", using the source
+// type ValueFromCaller. This is primarily useful for testing purposes.
 //
-// The given module tree doesn't need to be loaded.
-func Variables(
-        m *module.Tree,
-        override map[string]interface{}) (map[string]interface{}, error) {
-        result := make(map[string]interface{})
-
-        // Variables are loaded in the following sequence. Each additional step
-        // will override conflicting variable keys from prior steps:
-        //
-        //   * Take default values from config
-        //   * Take values from TF_VAR_x env vars
-        //   * Take values specified in the "override" param which is usually
-        //     from -var, -var-file, etc.
-        //
-
-        // First load from the config
-        for _, v := range m.Config().Variables {
-                // If the var has no default, ignore
-                if v.Default == nil {
-                        continue
+// This should not be used as a general way to convert map[string]cty.Value
+// into InputValues, since in most real cases we want to set a suitable
+// other SourceType and possibly SourceRange value.
+func InputValuesFromCaller(vals map[string]cty.Value) InputValues {
+        ret := make(InputValues, len(vals))
+        for k, v := range vals {
+                ret[k] = &InputValue{
+                        Value:      v,
+                        SourceType: ValueFromCaller,
                 }
+        }
+        return ret
+}
 
-                // If the type isn't a string, we use it as-is since it is a rich type
-                if v.Type() != config.VariableTypeString {
-                        result[v.Name] = v.Default
-                        continue
+// Override merges the given value maps with the receiver, overriding any
+// conflicting keys so that the latest definition wins.
+func (vv InputValues) Override(others ...InputValues) InputValues {
+        // FIXME: This should check to see if any of the values are maps and
+        // merge them if so, in order to preserve the behavior from prior to
+        // Terraform 0.12.
+        ret := make(InputValues)
+        for k, v := range vv {
+                ret[k] = v
+        }
+        for _, other := range others {
+                for k, v := range other {
+                        ret[k] = v
                 }
+        }
+        return ret
+}
 
-                // v.Default has already been parsed as HCL but it may be an int type
-                switch typedDefault := v.Default.(type) {
-                case string:
-                        if typedDefault == "" {
-                                continue
-                        }
-                        result[v.Name] = typedDefault
-                case int, int64:
-                        result[v.Name] = fmt.Sprintf("%d", typedDefault)
-                case float32, float64:
-                        result[v.Name] = fmt.Sprintf("%f", typedDefault)
-                case bool:
-                        result[v.Name] = fmt.Sprintf("%t", typedDefault)
-                default:
-                        panic(fmt.Sprintf(
-                                "Unknown default var type: %T\n\n"+
-                                        "THIS IS A BUG. Please report it.",
-                                v.Default))
-                }
+// JustValues returns a map that just includes the values, discarding the
+// source information.
+func (vv InputValues) JustValues() map[string]cty.Value {
+        ret := make(map[string]cty.Value, len(vv))
+        for k, v := range vv {
+                ret[k] = v.Value
         }
+        return ret
+}
 
-        // Load from env vars
-        for _, v := range os.Environ() {
-                if !strings.HasPrefix(v, VarEnvPrefix) {
+// DefaultVariableValues returns an InputValues map representing the default
+// values specified for variables in the given configuration map.
+func DefaultVariableValues(configs map[string]*configs.Variable) InputValues {
+        ret := make(InputValues)
+        for k, c := range configs {
+                if c.Default == cty.NilVal {
                         continue
                 }
+                ret[k] = &InputValue{
+                        Value:       c.Default,
+                        SourceType:  ValueFromConfig,
+                        SourceRange: tfdiags.SourceRangeFromHCL(c.DeclRange),
+                }
+        }
+        return ret
+}
 
-                // Strip off the prefix and get the value after the first "="
-                idx := strings.Index(v, "=")
-                k := v[len(VarEnvPrefix):idx]
-                v = v[idx+1:]
-
-                // Override the configuration-default values. Note that *not* finding the variable
-                // in configuration is OK, as we don't want to preclude people from having multiple
-                // sets of TF_VAR_whatever in their environment even if it is a little weird.
-                for _, schema := range m.Config().Variables {
-                        if schema.Name != k {
-                                continue
-                        }
-
-                        varType := schema.Type()
-                        varVal, err := parseVariableAsHCL(k, v, varType)
-                        if err != nil {
-                                return nil, err
-                        }
+// SameValues returns true if the given InputValues has the same values as
+// the receiever, disregarding the source types and source ranges.
+//
+// Values are compared using the cty "RawEquals" method, which means that
+// unknown values can be considered equal to one another if they are of the
+// same type.
+func (vv InputValues) SameValues(other InputValues) bool {
+        if len(vv) != len(other) {
+                return false
+        }
 
-                        switch varType {
-                        case config.VariableTypeMap:
-                                if err := varSetMap(result, k, varVal); err != nil {
-                                        return nil, err
-                                }
-                        default:
-                                result[k] = varVal
-                        }
+        for k, v := range vv {
+                ov, exists := other[k]
+                if !exists {
+                        return false
+                }
+                if !v.Value.RawEquals(ov.Value) {
+                        return false
                 }
         }
 
-        // Load from overrides
-        for k, v := range override {
-                for _, schema := range m.Config().Variables {
-                        if schema.Name != k {
-                                continue
-                        }
+        return true
+}
 
-                        switch schema.Type() {
-                        case config.VariableTypeList:
-                                result[k] = v
-                        case config.VariableTypeMap:
-                                if err := varSetMap(result, k, v); err != nil {
-                                        return nil, err
-                                }
-                        case config.VariableTypeString:
-                                // Convert to a string and set. We don't catch any errors
-                                // here because the validation step later should catch
-                                // any type errors.
-                                var strVal string
-                                if err := hilmapstructure.WeakDecode(v, &strVal); err == nil {
-                                        result[k] = strVal
-                                } else {
-                                        result[k] = v
-                                }
-                        default:
-                                panic(fmt.Sprintf(
-                                        "Unhandled var type: %T\n\n"+
-                                                "THIS IS A BUG. Please report it.",
-                                        schema.Type()))
-                        }
+// HasValues returns true if the reciever has the same values as in the given
+// map, disregarding the source types and source ranges.
+//
+// Values are compared using the cty "RawEquals" method, which means that
+// unknown values can be considered equal to one another if they are of the
+// same type.
+func (vv InputValues) HasValues(vals map[string]cty.Value) bool {
+        if len(vv) != len(vals) {
+                return false
+        }
+
+        for k, v := range vv {
+                oVal, exists := vals[k]
+                if !exists {
+                        return false
+                }
+                if !v.Value.RawEquals(oVal) {
+                        return false
                 }
         }
 
-        return result, nil
+        return true
 }
 
-// varSetMap sets or merges the map in "v" with the key "k" in the
-// "current" set of variables. This is just a private function to remove
-// duplicate logic in Variables
-func varSetMap(current map[string]interface{}, k string, v interface{}) error {
-        existing, ok := current[k]
-        if !ok {
-                current[k] = v
-                return nil
+// Identical returns true if the given InputValues has the same values,
+// source types, and source ranges as the receiver.
+//
+// Values are compared using the cty "RawEquals" method, which means that
+// unknown values can be considered equal to one another if they are of the
+// same type.
+//
+// This method is primarily for testing. For most practical purposes, it's
+// better to use SameValues or HasValues.
+func (vv InputValues) Identical(other InputValues) bool {
+        if len(vv) != len(other) {
+                return false
         }
 
-        existingMap, ok := existing.(map[string]interface{})
-        if !ok {
-                panic(fmt.Sprintf("%q is not a map, this is a bug in Terraform.", k))
+        for k, v := range vv {
+                ov, exists := other[k]
+                if !exists {
+                        return false
+                }
+                if !v.Value.RawEquals(ov.Value) {
+                        return false
+                }
+                if v.SourceType != ov.SourceType {
+                        return false
+                }
+                if v.SourceRange != ov.SourceRange {
+                        return false
+                }
         }
 
-        switch typedV := v.(type) {
-        case []map[string]interface{}:
-                for newKey, newVal := range typedV[0] {
-                        existingMap[newKey] = newVal
+        return true
+}
+
+// checkInputVariables ensures that variable values supplied at the UI conform
+// to their corresponding declarations in configuration.
+//
+// The set of values is considered valid only if the returned diagnostics
+// does not contain errors. A valid set of values may still produce warnings,
+// which should be returned to the user.
+func checkInputVariables(vcs map[string]*configs.Variable, vs InputValues) tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
+        for name, vc := range vcs {
+                val, isSet := vs[name]
+                if !isSet {
+                        // Always an error, since the caller should already have included
+                        // default values from the configuration in the values map.
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Unassigned variable",
+                                fmt.Sprintf("The input variable %q has not been assigned a value. This is a bug in Terraform; please report it in a GitHub issue.", name),
+                        ))
+                        continue
                 }
-        case map[string]interface{}:
-                for newKey, newVal := range typedV {
-                        existingMap[newKey] = newVal
+
+                wantType := vc.Type
+
+                // A given value is valid if it can convert to the desired type.
+                _, err := convert.Convert(val.Value, wantType)
+                if err != nil {
+                        switch val.SourceType {
+                        case ValueFromConfig, ValueFromAutoFile, ValueFromNamedFile:
+                                // We have source location information for these.
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid value for input variable",
+                                        Detail:   fmt.Sprintf("The given value is not valid for variable %q: %s.", name, err),
+                                        Subject:  val.SourceRange.ToHCL().Ptr(),
+                                })
+                        case ValueFromEnvVar:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid value for input variable",
+                                        fmt.Sprintf("The environment variable TF_VAR_%s does not contain a valid value for variable %q: %s.", name, name, err),
+                                ))
+                        case ValueFromCLIArg:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid value for input variable",
+                                        fmt.Sprintf("The argument -var=\"%s=...\" does not contain a valid value for variable %q: %s.", name, name, err),
+                                ))
+                        case ValueFromInput:
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid value for input variable",
+                                        fmt.Sprintf("The value entered for variable %q is not valid: %s.", name, err),
+                                ))
+                        default:
+                                // The above gets us good coverage for the situations users
+                                // are likely to encounter with their own inputs. The other
+                                // cases are generally implementation bugs, so we'll just
+                                // use a generic error for these.
+                                diags = diags.Append(tfdiags.Sourceless(
+                                        tfdiags.Error,
+                                        "Invalid value for input variable",
+                                        fmt.Sprintf("The value provided for variable %q is not valid: %s.", name, err),
+                                ))
+                        }
                 }
-        default:
-                return fmt.Errorf("variable %q should be type map, got %s", k, hclTypeName(v))
         }
-        return nil
+
+        // Check for any variables that are assigned without being configured.
+        // This is always an implementation error in the caller, because we
+        // expect undefined variables to be caught during context construction
+        // where there is better context to report it well.
+        for name := range vs {
+                if _, defined := vcs[name]; !defined {
+                        diags = diags.Append(tfdiags.Sourceless(
+                                tfdiags.Error,
+                                "Value assigned to undeclared variable",
+                                fmt.Sprintf("A value was assigned to an undeclared input variable %q.", name),
+                        ))
+                }
+        }
+
+        return diags
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/version_required.go b/vendor/github.com/hashicorp/terraform/terraform/version_required.go
index 1f43045..61423c2 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/version_required.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/version_required.go
@@ -3,69 +3,60 @@ package terraform
 import (
         "fmt"
 
-        "github.com/hashicorp/go-version"
-        "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/terraform/tfdiags"
+
+        "github.com/hashicorp/terraform/configs"
 
         tfversion "github.com/hashicorp/terraform/version"
 )
 
-// CheckRequiredVersion verifies that any version requirements specified by
-// the configuration are met.
-//
-// This checks the root module as well as any additional version requirements
-// from child modules.
+// CheckCoreVersionRequirements visits each of the modules in the given
+// configuration tree and verifies that any given Core version constraints
+// match with the version of Terraform Core that is being used.
 //
-// This is tested in context_test.go.
-func CheckRequiredVersion(m *module.Tree) error {
-        // Check any children
-        for _, c := range m.Children() {
-                if err := CheckRequiredVersion(c); err != nil {
-                        return err
-                }
-        }
-
-        var tf *config.Terraform
-        if c := m.Config(); c != nil {
-                tf = c.Terraform
-        }
-
-        // If there is no Terraform config or the required version isn't set,
-        // we move on.
-        if tf == nil || tf.RequiredVersion == "" {
+// The returned diagnostics will contain errors if any constraints do not match.
+// The returned diagnostics might also return warnings, which should be
+// displayed to the user.
+func CheckCoreVersionRequirements(config *configs.Config) tfdiags.Diagnostics {
+        if config == nil {
                 return nil
         }
 
-        // Path for errors
-        module := "root"
-        if path := normalizeModulePath(m.Path()); len(path) > 1 {
-                module = modulePrefixStr(path)
-        }
-
-        // Check this version requirement of this module
-        cs, err := version.NewConstraint(tf.RequiredVersion)
-        if err != nil {
-                return fmt.Errorf(
-                        "%s: terraform.required_version %q syntax error: %s",
-                        module,
-                        tf.RequiredVersion, err)
+        var diags tfdiags.Diagnostics
+        module := config.Module
+
+        for _, constraint := range module.CoreVersionConstraints {
+                if !constraint.Required.Check(tfversion.SemVer) {
+                        switch {
+                        case len(config.Path) == 0:
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Unsupported Terraform Core version",
+                                        Detail: fmt.Sprintf(
+                                                "This configuration does not support Terraform version %s. To proceed, either choose another supported Terraform version or update this version constraint. Version constraints are normally set for good reason, so updating the constraint may lead to other errors or unexpected behavior.",
+                                                tfversion.String(),
+                                        ),
+                                        Subject: &constraint.DeclRange,
+                                })
+                        default:
+                                diags = diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Unsupported Terraform Core version",
+                                        Detail: fmt.Sprintf(
+                                                "Module %s (from %s) does not support Terraform version %s. To proceed, either choose another supported Terraform version or update this version constraint. Version constraints are normally set for good reason, so updating the constraint may lead to other errors or unexpected behavior.",
+                                                config.Path, config.SourceAddr, tfversion.String(),
+                                        ),
+                                        Subject: &constraint.DeclRange,
+                                })
+                        }
+                }
         }
 
-        if !cs.Check(tfversion.SemVer) {
-                return fmt.Errorf(
-                        "The currently running version of Terraform doesn't meet the\n"+
-                                "version requirements explicitly specified by the configuration.\n"+
-                                "Please use the required version or update the configuration.\n"+
-                                "Note that version requirements are usually set for a reason, so\n"+
-                                "we recommend verifying with whoever set the version requirements\n"+
-                                "prior to making any manual changes.\n\n"+
-                                "  Module: %s\n"+
-                                "  Required version: %s\n"+
-                                "  Current version: %s",
-                        module,
-                        tf.RequiredVersion,
-                        tfversion.SemVer)
+        for _, c := range config.Children {
+                childDiags := CheckCoreVersionRequirements(c)
+                diags = diags.Append(childDiags)
         }
 
-        return nil
+        return diags
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/walkoperation_string.go b/vendor/github.com/hashicorp/terraform/terraform/walkoperation_string.go
index 4cfc528..0666aa5 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/walkoperation_string.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/walkoperation_string.go
@@ -4,9 +4,24 @@ package terraform
 
 import "strconv"
 
-const _walkOperation_name = "walkInvalidwalkInputwalkApplywalkPlanwalkPlanDestroywalkRefreshwalkValidatewalkDestroywalkImport"
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[walkInvalid-0]
+        _ = x[walkApply-1]
+        _ = x[walkPlan-2]
+        _ = x[walkPlanDestroy-3]
+        _ = x[walkRefresh-4]
+        _ = x[walkValidate-5]
+        _ = x[walkDestroy-6]
+        _ = x[walkImport-7]
+        _ = x[walkEval-8]
+}
+
+const _walkOperation_name = "walkInvalidwalkApplywalkPlanwalkPlanDestroywalkRefreshwalkValidatewalkDestroywalkImportwalkEval"
 
-var _walkOperation_index = [...]uint8{0, 11, 20, 29, 37, 52, 63, 75, 86, 96}
+var _walkOperation_index = [...]uint8{0, 11, 20, 28, 43, 54, 66, 77, 87, 95}
 
 func (i walkOperation) String() string {
         if i >= walkOperation(len(_walkOperation_index)-1) {
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/config_traversals.go b/vendor/github.com/hashicorp/terraform/tfdiags/config_traversals.go
new file mode 100644
index 0000000..8e41f46
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/config_traversals.go
@@ -0,0 +1,68 @@
+package tfdiags
+
+import (
+        "bytes"
+        "fmt"
+        "strconv"
+
+        "github.com/zclconf/go-cty/cty"
+)
+
+// FormatCtyPath is a helper function to produce a user-friendly string
+// representation of a cty.Path. The result uses a syntax similar to the
+// HCL expression language in the hope of it being familiar to users.
+func FormatCtyPath(path cty.Path) string {
+        var buf bytes.Buffer
+        for _, step := range path {
+                switch ts := step.(type) {
+                case cty.GetAttrStep:
+                        fmt.Fprintf(&buf, ".%s", ts.Name)
+                case cty.IndexStep:
+                        buf.WriteByte('[')
+                        key := ts.Key
+                        keyTy := key.Type()
+                        switch {
+                        case key.IsNull():
+                                buf.WriteString("null")
+                        case !key.IsKnown():
+                                buf.WriteString("(not yet known)")
+                        case keyTy == cty.Number:
+                                bf := key.AsBigFloat()
+                                buf.WriteString(bf.Text('g', -1))
+                        case keyTy == cty.String:
+                                buf.WriteString(strconv.Quote(key.AsString()))
+                        default:
+                                buf.WriteString("...")
+                        }
+                        buf.WriteByte(']')
+                }
+        }
+        return buf.String()
+}
+
+// FormatError is a helper function to produce a user-friendly string
+// representation of certain special error types that we might want to
+// include in diagnostic messages.
+//
+// This currently has special behavior only for cty.PathError, where a
+// non-empty path is rendered in a HCL-like syntax as context.
+func FormatError(err error) string {
+        perr, ok := err.(cty.PathError)
+        if !ok || len(perr.Path) == 0 {
+                return err.Error()
+        }
+
+        return fmt.Sprintf("%s: %s", FormatCtyPath(perr.Path), perr.Error())
+}
+
+// FormatErrorPrefixed is like FormatError except that it presents any path
+// information after the given prefix string, which is assumed to contain
+// an HCL syntax representation of the value that errors are relative to.
+func FormatErrorPrefixed(err error, prefix string) string {
+        perr, ok := err.(cty.PathError)
+        if !ok || len(perr.Path) == 0 {
+                return fmt.Sprintf("%s: %s", prefix, err.Error())
+        }
+
+        return fmt.Sprintf("%s%s: %s", prefix, FormatCtyPath(perr.Path), perr.Error())
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/contextual.go b/vendor/github.com/hashicorp/terraform/tfdiags/contextual.go
new file mode 100644
index 0000000..25b2140
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/contextual.go
@@ -0,0 +1,372 @@
+package tfdiags
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+// The "contextual" family of diagnostics are designed to allow separating
+// the detection of a problem from placing that problem in context. For
+// example, some code that is validating an object extracted from configuration
+// may not have access to the configuration that generated it, but can still
+// report problems within that object which the caller can then place in
+// context by calling IsConfigBody on the returned diagnostics.
+//
+// When contextual diagnostics are used, the documentation for a method must
+// be very explicit about what context is implied for any diagnostics returned,
+// to help ensure the expected result.
+
+// contextualFromConfig is an interface type implemented by diagnostic types
+// that can elaborate themselves when given information about the configuration
+// body they are embedded in.
+//
+// Usually this entails extracting source location information in order to
+// populate the "Subject" range.
+type contextualFromConfigBody interface {
+        ElaborateFromConfigBody(hcl.Body) Diagnostic
+}
+
+// InConfigBody returns a copy of the receiver with any config-contextual
+// diagnostics elaborated in the context of the given body.
+func (d Diagnostics) InConfigBody(body hcl.Body) Diagnostics {
+        if len(d) == 0 {
+                return nil
+        }
+
+        ret := make(Diagnostics, len(d))
+        for i, srcDiag := range d {
+                if cd, isCD := srcDiag.(contextualFromConfigBody); isCD {
+                        ret[i] = cd.ElaborateFromConfigBody(body)
+                } else {
+                        ret[i] = srcDiag
+                }
+        }
+
+        return ret
+}
+
+// AttributeValue returns a diagnostic about an attribute value in an implied current
+// configuration context. This should be returned only from functions whose
+// interface specifies a clear configuration context that this will be
+// resolved in.
+//
+// The given path is relative to the implied configuration context. To describe
+// a top-level attribute, it should be a single-element cty.Path with a
+// cty.GetAttrStep. It's assumed that the path is returning into a structure
+// that would be produced by our conventions in the configschema package; it
+// may return unexpected results for structures that can't be represented by
+// configschema.
+//
+// Since mapping attribute paths back onto configuration is an imprecise
+// operation (e.g. dynamic block generation may cause the same block to be
+// evaluated multiple times) the diagnostic detail should include the attribute
+// name and other context required to help the user understand what is being
+// referenced in case the identified source range is not unique.
+//
+// The returned attribute will not have source location information until
+// context is applied to the containing diagnostics using diags.InConfigBody.
+// After context is applied, the source location is the value assigned to the
+// named attribute, or the containing body's "missing item range" if no
+// value is present.
+func AttributeValue(severity Severity, summary, detail string, attrPath cty.Path) Diagnostic {
+        return &attributeDiagnostic{
+                diagnosticBase: diagnosticBase{
+                        severity: severity,
+                        summary:  summary,
+                        detail:   detail,
+                },
+                attrPath: attrPath,
+        }
+}
+
+// GetAttribute extracts an attribute cty.Path from a diagnostic if it contains
+// one. Normally this is not accessed directly, and instead the config body is
+// added to the Diagnostic to create a more complete message for the user. In
+// some cases however, we may want to know just the name of the attribute that
+// generated the Diagnostic message.
+// This returns a nil cty.Path if it does not exist in the Diagnostic.
+func GetAttribute(d Diagnostic) cty.Path {
+        if d, ok := d.(*attributeDiagnostic); ok {
+                return d.attrPath
+        }
+        return nil
+}
+
+type attributeDiagnostic struct {
+        diagnosticBase
+        attrPath cty.Path
+        subject  *SourceRange // populated only after ElaborateFromConfigBody
+}
+
+// ElaborateFromConfigBody finds the most accurate possible source location
+// for a diagnostic's attribute path within the given body.
+//
+// Backing out from a path back to a source location is not always entirely
+// possible because we lose some information in the decoding process, so
+// if an exact position cannot be found then the returned diagnostic will
+// refer to a position somewhere within the containing body, which is assumed
+// to be better than no location at all.
+//
+// If possible it is generally better to report an error at a layer where
+// source location information is still available, for more accuracy. This
+// is not always possible due to system architecture, so this serves as a
+// "best effort" fallback behavior for such situations.
+func (d *attributeDiagnostic) ElaborateFromConfigBody(body hcl.Body) Diagnostic {
+        if len(d.attrPath) < 1 {
+                // Should never happen, but we'll allow it rather than crashing.
+                return d
+        }
+
+        if d.subject != nil {
+                // Don't modify an already-elaborated diagnostic.
+                return d
+        }
+
+        ret := *d
+
+        // This function will often end up re-decoding values that were already
+        // decoded by an earlier step. This is non-ideal but is architecturally
+        // more convenient than arranging for source location information to be
+        // propagated to every place in Terraform, and this happens only in the
+        // presence of errors where performance isn't a concern.
+
+        traverse := d.attrPath[:]
+        final := d.attrPath[len(d.attrPath)-1]
+
+        // Index should never be the first step
+        // as indexing of top blocks (such as resources & data sources)
+        // is handled elsewhere
+        if _, isIdxStep := traverse[0].(cty.IndexStep); isIdxStep {
+                subject := SourceRangeFromHCL(body.MissingItemRange())
+                ret.subject = &subject
+                return &ret
+        }
+
+        // Process index separately
+        idxStep, hasIdx := final.(cty.IndexStep)
+        if hasIdx {
+                final = d.attrPath[len(d.attrPath)-2]
+                traverse = d.attrPath[:len(d.attrPath)-1]
+        }
+
+        // If we have more than one step after removing index
+        // then we'll first try to traverse to a child body
+        // corresponding to the requested path.
+        if len(traverse) > 1 {
+                body = traversePathSteps(traverse, body)
+        }
+
+        // Default is to indicate a missing item in the deepest body we reached
+        // while traversing.
+        subject := SourceRangeFromHCL(body.MissingItemRange())
+        ret.subject = &subject
+
+        // Once we get here, "final" should be a GetAttr step that maps to an
+        // attribute in our current body.
+        finalStep, isAttr := final.(cty.GetAttrStep)
+        if !isAttr {
+                return &ret
+        }
+
+        content, _, contentDiags := body.PartialContent(&hcl.BodySchema{
+                Attributes: []hcl.AttributeSchema{
+                        {
+                                Name:     finalStep.Name,
+                                Required: true,
+                        },
+                },
+        })
+        if contentDiags.HasErrors() {
+                return &ret
+        }
+
+        if attr, ok := content.Attributes[finalStep.Name]; ok {
+                hclRange := attr.Expr.Range()
+                if hasIdx {
+                        // Try to be more precise by finding index range
+                        hclRange = hclRangeFromIndexStepAndAttribute(idxStep, attr)
+                }
+                subject = SourceRangeFromHCL(hclRange)
+                ret.subject = &subject
+        }
+
+        return &ret
+}
+
+func traversePathSteps(traverse []cty.PathStep, body hcl.Body) hcl.Body {
+        for i := 0; i < len(traverse); i++ {
+                step := traverse[i]
+
+                switch tStep := step.(type) {
+                case cty.GetAttrStep:
+
+                        var next cty.PathStep
+                        if i < (len(traverse) - 1) {
+                                next = traverse[i+1]
+                        }
+
+                        // Will be indexing into our result here?
+                        var indexType cty.Type
+                        var indexVal cty.Value
+                        if nextIndex, ok := next.(cty.IndexStep); ok {
+                                indexVal = nextIndex.Key
+                                indexType = indexVal.Type()
+                                i++ // skip over the index on subsequent iterations
+                        }
+
+                        var blockLabelNames []string
+                        if indexType == cty.String {
+                                // Map traversal means we expect one label for the key.
+                                blockLabelNames = []string{"key"}
+                        }
+
+                        // For intermediate steps we expect to be referring to a child
+                        // block, so we'll attempt decoding under that assumption.
+                        content, _, contentDiags := body.PartialContent(&hcl.BodySchema{
+                                Blocks: []hcl.BlockHeaderSchema{
+                                        {
+                                                Type:       tStep.Name,
+                                                LabelNames: blockLabelNames,
+                                        },
+                                },
+                        })
+                        if contentDiags.HasErrors() {
+                                return body
+                        }
+                        filtered := make([]*hcl.Block, 0, len(content.Blocks))
+                        for _, block := range content.Blocks {
+                                if block.Type == tStep.Name {
+                                        filtered = append(filtered, block)
+                                }
+                        }
+                        if len(filtered) == 0 {
+                                // Step doesn't refer to a block
+                                continue
+                        }
+
+                        switch indexType {
+                        case cty.NilType: // no index at all
+                                if len(filtered) != 1 {
+                                        return body
+                                }
+                                body = filtered[0].Body
+                        case cty.Number:
+                                var idx int
+                                err := gocty.FromCtyValue(indexVal, &idx)
+                                if err != nil || idx >= len(filtered) {
+                                        return body
+                                }
+                                body = filtered[idx].Body
+                        case cty.String:
+                                key := indexVal.AsString()
+                                var block *hcl.Block
+                                for _, candidate := range filtered {
+                                        if candidate.Labels[0] == key {
+                                                block = candidate
+                                                break
+                                        }
+                                }
+                                if block == nil {
+                                        // No block with this key, so we'll just indicate a
+                                        // missing item in the containing block.
+                                        return body
+                                }
+                                body = block.Body
+                        default:
+                                // Should never happen, because only string and numeric indices
+                                // are supported by cty collections.
+                                return body
+                        }
+
+                default:
+                        // For any other kind of step, we'll just return our current body
+                        // as the subject and accept that this is a little inaccurate.
+                        return body
+                }
+        }
+        return body
+}
+
+func hclRangeFromIndexStepAndAttribute(idxStep cty.IndexStep, attr *hcl.Attribute) hcl.Range {
+        switch idxStep.Key.Type() {
+        case cty.Number:
+                var idx int
+                err := gocty.FromCtyValue(idxStep.Key, &idx)
+                items, diags := hcl.ExprList(attr.Expr)
+                if diags.HasErrors() {
+                        return attr.Expr.Range()
+                }
+                if err != nil || idx >= len(items) {
+                        return attr.NameRange
+                }
+                return items[idx].Range()
+        case cty.String:
+                pairs, diags := hcl.ExprMap(attr.Expr)
+                if diags.HasErrors() {
+                        return attr.Expr.Range()
+                }
+                stepKey := idxStep.Key.AsString()
+                for _, kvPair := range pairs {
+                        key, err := kvPair.Key.Value(nil)
+                        if err != nil {
+                                return attr.Expr.Range()
+                        }
+                        if key.AsString() == stepKey {
+                                startRng := kvPair.Value.StartRange()
+                                return startRng
+                        }
+                }
+                return attr.NameRange
+        }
+        return attr.Expr.Range()
+}
+
+func (d *attributeDiagnostic) Source() Source {
+        return Source{
+                Subject: d.subject,
+        }
+}
+
+// WholeContainingBody returns a diagnostic about the body that is an implied
+// current configuration context. This should be returned only from
+// functions whose interface specifies a clear configuration context that this
+// will be resolved in.
+//
+// The returned attribute will not have source location information until
+// context is applied to the containing diagnostics using diags.InConfigBody.
+// After context is applied, the source location is currently the missing item
+// range of the body. In future, this may change to some other suitable
+// part of the containing body.
+func WholeContainingBody(severity Severity, summary, detail string) Diagnostic {
+        return &wholeBodyDiagnostic{
+                diagnosticBase: diagnosticBase{
+                        severity: severity,
+                        summary:  summary,
+                        detail:   detail,
+                },
+        }
+}
+
+type wholeBodyDiagnostic struct {
+        diagnosticBase
+        subject *SourceRange // populated only after ElaborateFromConfigBody
+}
+
+func (d *wholeBodyDiagnostic) ElaborateFromConfigBody(body hcl.Body) Diagnostic {
+        if d.subject != nil {
+                // Don't modify an already-elaborated diagnostic.
+                return d
+        }
+
+        ret := *d
+        rng := SourceRangeFromHCL(body.MissingItemRange())
+        ret.subject = &rng
+        return &ret
+}
+
+func (d *wholeBodyDiagnostic) Source() Source {
+        return Source{
+                Subject: d.subject,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic.go b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic.go
index 2c23f76..c91ba9a 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic.go
@@ -1,9 +1,18 @@
 package tfdiags
 
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
 type Diagnostic interface {
         Severity() Severity
         Description() Description
         Source() Source
+
+        // FromExpr returns the expression-related context for the diagnostic, if
+        // available. Returns nil if the diagnostic is not related to an
+        // expression evaluation.
+        FromExpr() *FromExpr
 }
 
 type Severity rune
@@ -24,3 +33,8 @@ type Source struct {
         Subject *SourceRange
         Context *SourceRange
 }
+
+type FromExpr struct {
+        Expression  hcl.Expression
+        EvalContext *hcl.EvalContext
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic_base.go b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic_base.go
new file mode 100644
index 0000000..50bf9d8
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic_base.go
@@ -0,0 +1,31 @@
+package tfdiags
+
+// diagnosticBase can be embedded in other diagnostic structs to get
+// default implementations of Severity and Description. This type also
+// has default implementations of Source and FromExpr that return no source
+// location or expression-related information, so embedders should generally
+// override those method to return more useful results where possible.
+type diagnosticBase struct {
+        severity Severity
+        summary  string
+        detail   string
+}
+
+func (d diagnosticBase) Severity() Severity {
+        return d.severity
+}
+
+func (d diagnosticBase) Description() Description {
+        return Description{
+                Summary: d.summary,
+                Detail:  d.detail,
+        }
+}
+
+func (d diagnosticBase) Source() Source {
+        return Source{}
+}
+
+func (d diagnosticBase) FromExpr() *FromExpr {
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/diagnostics.go b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostics.go
index 667ba80..465b230 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/diagnostics.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostics.go
@@ -3,6 +3,9 @@ package tfdiags
 import (
         "bytes"
         "fmt"
+        "path/filepath"
+        "sort"
+        "strings"
 
         "github.com/hashicorp/errwrap"
         multierror "github.com/hashicorp/go-multierror"
@@ -54,6 +57,8 @@ func (diags Diagnostics) Append(new ...interface{}) Diagnostics {
                         diags = append(diags, ti...) // flatten
                 case diagnosticsAsError:
                         diags = diags.Append(ti.Diagnostics) // unwrap
+                case NonFatalError:
+                        diags = diags.Append(ti.Diagnostics) // unwrap
                 case hcl.Diagnostics:
                         for _, hclDiag := range ti {
                                 diags = append(diags, hclDiagnostic{hclDiag})
@@ -136,6 +141,54 @@ func (diags Diagnostics) Err() error {
         return diagnosticsAsError{diags}
 }
 
+// ErrWithWarnings is similar to Err except that it will also return a non-nil
+// error if the receiver contains only warnings.
+//
+// In the warnings-only situation, the result is guaranteed to be of dynamic
+// type NonFatalError, allowing diagnostics-aware callers to type-assert
+// and unwrap it, treating it as non-fatal.
+//
+// This should be used only in contexts where the caller is able to recognize
+// and handle NonFatalError. For normal callers that expect a lack of errors
+// to be signaled by nil, use just Diagnostics.Err.
+func (diags Diagnostics) ErrWithWarnings() error {
+        if len(diags) == 0 {
+                return nil
+        }
+        if diags.HasErrors() {
+                return diags.Err()
+        }
+        return NonFatalError{diags}
+}
+
+// NonFatalErr is similar to Err except that it always returns either nil
+// (if there are no diagnostics at all) or NonFatalError.
+//
+// This allows diagnostics to be returned over an error return channel while
+// being explicit that the diagnostics should not halt processing.
+//
+// This should be used only in contexts where the caller is able to recognize
+// and handle NonFatalError. For normal callers that expect a lack of errors
+// to be signaled by nil, use just Diagnostics.Err.
+func (diags Diagnostics) NonFatalErr() error {
+        if len(diags) == 0 {
+                return nil
+        }
+        return NonFatalError{diags}
+}
+
+// Sort applies an ordering to the diagnostics in the receiver in-place.
+//
+// The ordering is: warnings before errors, sourceless before sourced,
+// short source paths before long source paths, and then ordering by
+// position within each file.
+//
+// Diagnostics that do not differ by any of these sortable characteristics
+// will remain in the same relative order after this method returns.
+func (diags Diagnostics) Sort() {
+        sort.Stable(sortDiagnostics(diags))
+}
+
 type diagnosticsAsError struct {
         Diagnostics
 }
@@ -179,3 +232,99 @@ func (dae diagnosticsAsError) WrappedErrors() []error {
         }
         return errs
 }
+
+// NonFatalError is a special error type, returned by
+// Diagnostics.ErrWithWarnings and Diagnostics.NonFatalErr,
+// that indicates that the wrapped diagnostics should be treated as non-fatal.
+// Callers can conditionally type-assert an error to this type in order to
+// detect the non-fatal scenario and handle it in a different way.
+type NonFatalError struct {
+        Diagnostics
+}
+
+func (woe NonFatalError) Error() string {
+        diags := woe.Diagnostics
+        switch {
+        case len(diags) == 0:
+                // should never happen, since we don't create this wrapper if
+                // there are no diagnostics in the list.
+                return "no errors or warnings"
+        case len(diags) == 1:
+                desc := diags[0].Description()
+                if desc.Detail == "" {
+                        return desc.Summary
+                }
+                return fmt.Sprintf("%s: %s", desc.Summary, desc.Detail)
+        default:
+                var ret bytes.Buffer
+                if diags.HasErrors() {
+                        fmt.Fprintf(&ret, "%d problems:\n", len(diags))
+                } else {
+                        fmt.Fprintf(&ret, "%d warnings:\n", len(diags))
+                }
+                for _, diag := range woe.Diagnostics {
+                        desc := diag.Description()
+                        if desc.Detail == "" {
+                                fmt.Fprintf(&ret, "\n- %s", desc.Summary)
+                        } else {
+                                fmt.Fprintf(&ret, "\n- %s: %s", desc.Summary, desc.Detail)
+                        }
+                }
+                return ret.String()
+        }
+}
+
+// sortDiagnostics is an implementation of sort.Interface
+type sortDiagnostics []Diagnostic
+
+var _ sort.Interface = sortDiagnostics(nil)
+
+func (sd sortDiagnostics) Len() int {
+        return len(sd)
+}
+
+func (sd sortDiagnostics) Less(i, j int) bool {
+        iD, jD := sd[i], sd[j]
+        iSev, jSev := iD.Severity(), jD.Severity()
+        iSrc, jSrc := iD.Source(), jD.Source()
+
+        switch {
+
+        case iSev != jSev:
+                return iSev == Warning
+
+        case (iSrc.Subject == nil) != (jSrc.Subject == nil):
+                return iSrc.Subject == nil
+
+        case iSrc.Subject != nil && *iSrc.Subject != *jSrc.Subject:
+                iSubj := iSrc.Subject
+                jSubj := jSrc.Subject
+                switch {
+                case iSubj.Filename != jSubj.Filename:
+                        // Path with fewer segments goes first if they are different lengths
+                        sep := string(filepath.Separator)
+                        iCount := strings.Count(iSubj.Filename, sep)
+                        jCount := strings.Count(jSubj.Filename, sep)
+                        if iCount != jCount {
+                                return iCount < jCount
+                        }
+                        return iSubj.Filename < jSubj.Filename
+                case iSubj.Start.Byte != jSubj.Start.Byte:
+                        return iSubj.Start.Byte < jSubj.Start.Byte
+                case iSubj.End.Byte != jSubj.End.Byte:
+                        return iSubj.End.Byte < jSubj.End.Byte
+                }
+                fallthrough
+
+        default:
+                // The remaining properties do not have a defined ordering, so
+                // we'll leave it unspecified. Since we use sort.Stable in
+                // the caller of this, the ordering of remaining items will
+                // be preserved.
+                return false
+        }
+}
+
+func (sd sortDiagnostics) Swap(i, j int) {
+        sd[i], sd[j] = sd[j], sd[i]
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/error.go b/vendor/github.com/hashicorp/terraform/tfdiags/error.go
index 35edc30..13f7a71 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/error.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/error.go
@@ -13,7 +13,7 @@ func (e nativeError) Severity() Severity {
 
 func (e nativeError) Description() Description {
         return Description{
-                Summary: e.err.Error(),
+                Summary: FormatError(e.err),
         }
 }
 
@@ -21,3 +21,8 @@ func (e nativeError) Source() Source {
         // No source information available for a native error
         return Source{}
 }
+
+func (e nativeError) FromExpr() *FromExpr {
+        // Native errors are not expression-related
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/hcl.go b/vendor/github.com/hashicorp/terraform/tfdiags/hcl.go
index 24851f4..f9aec41 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/hcl.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/hcl.go
@@ -40,6 +40,16 @@ func (d hclDiagnostic) Source() Source {
         return ret
 }
 
+func (d hclDiagnostic) FromExpr() *FromExpr {
+        if d.diag.Expression == nil || d.diag.EvalContext == nil {
+                return nil
+        }
+        return &FromExpr{
+                Expression:  d.diag.Expression,
+                EvalContext: d.diag.EvalContext,
+        }
+}
+
 // SourceRangeFromHCL constructs a SourceRange from the corresponding range
 // type within the HCL package.
 func SourceRangeFromHCL(hclRange hcl.Range) SourceRange {
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/rpc_friendly.go b/vendor/github.com/hashicorp/terraform/tfdiags/rpc_friendly.go
index 6cc95cc..485063b 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/rpc_friendly.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/rpc_friendly.go
@@ -48,6 +48,12 @@ func (d *rpcFriendlyDiag) Source() Source {
         }
 }
 
+func (d rpcFriendlyDiag) FromExpr() *FromExpr {
+        // RPC-friendly diagnostics cannot preserve expression information because
+        // expressions themselves are not RPC-friendly.
+        return nil
+}
+
 func init() {
         gob.Register((*rpcFriendlyDiag)(nil))
 }
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/severity_string.go b/vendor/github.com/hashicorp/terraform/tfdiags/severity_string.go
index 0b1249b..78a7210 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/severity_string.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/severity_string.go
@@ -4,6 +4,14 @@ package tfdiags
 
 import "strconv"
 
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[Error-69]
+        _ = x[Warning-87]
+}
+
 const (
         _Severity_name_0 = "Error"
         _Severity_name_1 = "Warning"
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/simple_warning.go b/vendor/github.com/hashicorp/terraform/tfdiags/simple_warning.go
index fb3ac98..b0f1ecd 100644
--- a/vendor/github.com/hashicorp/terraform/tfdiags/simple_warning.go
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/simple_warning.go
@@ -20,6 +20,11 @@ func (e simpleWarning) Description() Description {
 }
 
 func (e simpleWarning) Source() Source {
-        // No source information available for a native error
+        // No source information available for a simple warning
         return Source{}
 }
+
+func (e simpleWarning) FromExpr() *FromExpr {
+        // Simple warnings are not expression-related
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/sourceless.go b/vendor/github.com/hashicorp/terraform/tfdiags/sourceless.go
new file mode 100644
index 0000000..eaa2737
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/sourceless.go
@@ -0,0 +1,13 @@
+package tfdiags
+
+// Sourceless creates and returns a diagnostic with no source location
+// information. This is generally used for operational-type errors that are
+// caused by or relate to the environment where Terraform is running rather
+// than to the provided configuration.
+func Sourceless(severity Severity, summary, detail string) Diagnostic {
+        return diagnosticBase{
+                severity: severity,
+                summary:  summary,
+                detail:   detail,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/version/version.go b/vendor/github.com/hashicorp/terraform/version/version.go
index b21b297..30d7284 100644
--- a/vendor/github.com/hashicorp/terraform/version/version.go
+++ b/vendor/github.com/hashicorp/terraform/version/version.go
@@ -11,17 +11,21 @@ import (
 )
 
 // The main version number that is being run at the moment.
-var Version = "0.11.12"
+var Version = "0.12.0"
 
 // A pre-release marker for the version. If this is "" (empty string)
 // then it means that it is a final release. Otherwise, this is a pre-release
 // such as "dev" (in development), "beta", "rc1", etc.
-var Prerelease = "dev"
+var Prerelease = ""
 
 // SemVer is an instance of version.Version. This has the secondary
 // benefit of verifying during tests and init time that our version is a
 // proper semantic version, which should always be the case.
-var SemVer = version.Must(version.NewVersion(Version))
+var SemVer *version.Version
+
+func init() {
+        SemVer = version.Must(version.NewVersion(Version))
+}
 
 // Header is the header name used to send the current terraform version
 // in http requests.
diff --git a/vendor/github.com/hashicorp/yamux/session.go b/vendor/github.com/hashicorp/yamux/session.go
index e179818..32ba02e 100644
--- a/vendor/github.com/hashicorp/yamux/session.go
+++ b/vendor/github.com/hashicorp/yamux/session.go
@@ -123,6 +123,12 @@ func (s *Session) IsClosed() bool {
         }
 }
 
+// CloseChan returns a read-only channel which is closed as
+// soon as the session is closed.
+func (s *Session) CloseChan() <-chan struct{} {
+        return s.shutdownCh
+}
+
 // NumStreams returns the number of currently open streams
 func (s *Session) NumStreams() int {
         s.streamLock.Lock()
@@ -303,8 +309,10 @@ func (s *Session) keepalive() {
                 case <-time.After(s.config.KeepAliveInterval):
                         _, err := s.Ping()
                         if err != nil {
-                                s.logger.Printf("[ERR] yamux: keepalive failed: %v", err)
-                                s.exitErr(ErrKeepAliveTimeout)
+                                if err != ErrSessionShutdown {
+                                        s.logger.Printf("[ERR] yamux: keepalive failed: %v", err)
+                                        s.exitErr(ErrKeepAliveTimeout)
+                                }
                                 return
                         }
                 case <-s.shutdownCh:
@@ -323,8 +331,17 @@ func (s *Session) waitForSend(hdr header, body io.Reader) error {
 // potential shutdown. Since there's the expectation that sends can happen
 // in a timely manner, we enforce the connection write timeout here.
 func (s *Session) waitForSendErr(hdr header, body io.Reader, errCh chan error) error {
-        timer := time.NewTimer(s.config.ConnectionWriteTimeout)
-        defer timer.Stop()
+        t := timerPool.Get()
+        timer := t.(*time.Timer)
+        timer.Reset(s.config.ConnectionWriteTimeout)
+        defer func() {
+                timer.Stop()
+                select {
+                case <-timer.C:
+                default:
+                }
+                timerPool.Put(t)
+        }()
 
         ready := sendReady{Hdr: hdr, Body: body, Err: errCh}
         select {
@@ -349,8 +366,17 @@ func (s *Session) waitForSendErr(hdr header, body io.Reader, errCh chan error) e
 // the send happens right here, we enforce the connection write timeout if we
 // can't queue the header to be sent.
 func (s *Session) sendNoWait(hdr header) error {
-        timer := time.NewTimer(s.config.ConnectionWriteTimeout)
-        defer timer.Stop()
+        t := timerPool.Get()
+        timer := t.(*time.Timer)
+        timer.Reset(s.config.ConnectionWriteTimeout)
+        defer func() {
+                timer.Stop()
+                select {
+                case <-timer.C:
+                default:
+                }
+                timerPool.Put(t)
+        }()
 
         select {
         case s.sendCh <- sendReady{Hdr: hdr}:
@@ -408,11 +434,20 @@ func (s *Session) recv() {
         }
 }
 
+// Ensure that the index of the handler (typeData/typeWindowUpdate/etc) matches the message type
+var (
+        handlers = []func(*Session, header) error{
+                typeData:         (*Session).handleStreamMessage,
+                typeWindowUpdate: (*Session).handleStreamMessage,
+                typePing:         (*Session).handlePing,
+                typeGoAway:       (*Session).handleGoAway,
+        }
+)
+
 // recvLoop continues to receive data until a fatal error is encountered
 func (s *Session) recvLoop() error {
         defer close(s.recvDoneCh)
         hdr := header(make([]byte, headerSize))
-        var handler func(header) error
         for {
                 // Read the header
                 if _, err := io.ReadFull(s.bufRead, hdr); err != nil {
@@ -428,22 +463,12 @@ func (s *Session) recvLoop() error {
                         return ErrInvalidVersion
                 }
 
-                // Switch on the type
-                switch hdr.MsgType() {
-                case typeData:
-                        handler = s.handleStreamMessage
-                case typeWindowUpdate:
-                        handler = s.handleStreamMessage
-                case typeGoAway:
-                        handler = s.handleGoAway
-                case typePing:
-                        handler = s.handlePing
-                default:
+                mt := hdr.MsgType()
+                if mt < typeData || mt > typeGoAway {
                         return ErrInvalidMsgType
                 }
 
-                // Invoke the handler
-                if err := handler(hdr); err != nil {
+                if err := handlers[mt](s, hdr); err != nil {
                         return err
                 }
         }
diff --git a/vendor/github.com/hashicorp/yamux/stream.go b/vendor/github.com/hashicorp/yamux/stream.go
index d216e28..aa23919 100644
--- a/vendor/github.com/hashicorp/yamux/stream.go
+++ b/vendor/github.com/hashicorp/yamux/stream.go
@@ -47,8 +47,8 @@ type Stream struct {
         recvNotifyCh chan struct{}
         sendNotifyCh chan struct{}
 
-        readDeadline  time.Time
-        writeDeadline time.Time
+        readDeadline  atomic.Value // time.Time
+        writeDeadline atomic.Value // time.Time
 }
 
 // newStream is used to construct a new stream within
@@ -67,6 +67,8 @@ func newStream(session *Session, id uint32, state streamState) *Stream {
                 recvNotifyCh: make(chan struct{}, 1),
                 sendNotifyCh: make(chan struct{}, 1),
         }
+        s.readDeadline.Store(time.Time{})
+        s.writeDeadline.Store(time.Time{})
         return s
 }
 
@@ -122,8 +124,9 @@ START:
 WAIT:
         var timeout <-chan time.Time
         var timer *time.Timer
-        if !s.readDeadline.IsZero() {
-                delay := s.readDeadline.Sub(time.Now())
+        readDeadline := s.readDeadline.Load().(time.Time)
+        if !readDeadline.IsZero() {
+                delay := readDeadline.Sub(time.Now())
                 timer = time.NewTimer(delay)
                 timeout = timer.C
         }
@@ -188,7 +191,7 @@ START:
 
         // Send the header
         s.sendHdr.encode(typeData, flags, s.id, max)
-        if err := s.session.waitForSendErr(s.sendHdr, body, s.sendErr); err != nil {
+        if err = s.session.waitForSendErr(s.sendHdr, body, s.sendErr); err != nil {
                 return 0, err
         }
 
@@ -200,8 +203,9 @@ START:
 
 WAIT:
         var timeout <-chan time.Time
-        if !s.writeDeadline.IsZero() {
-                delay := s.writeDeadline.Sub(time.Now())
+        writeDeadline := s.writeDeadline.Load().(time.Time)
+        if !writeDeadline.IsZero() {
+                delay := writeDeadline.Sub(time.Now())
                 timeout = time.After(delay)
         }
         select {
@@ -238,18 +242,25 @@ func (s *Stream) sendWindowUpdate() error {
 
         // Determine the delta update
         max := s.session.config.MaxStreamWindowSize
-        delta := max - atomic.LoadUint32(&s.recvWindow)
+        var bufLen uint32
+        s.recvLock.Lock()
+        if s.recvBuf != nil {
+                bufLen = uint32(s.recvBuf.Len())
+        }
+        delta := (max - bufLen) - s.recvWindow
 
         // Determine the flags if any
         flags := s.sendFlags()
 
         // Check if we can omit the update
         if delta < (max/2) && flags == 0 {
+                s.recvLock.Unlock()
                 return nil
         }
 
         // Update our window
-        atomic.AddUint32(&s.recvWindow, delta)
+        s.recvWindow += delta
+        s.recvLock.Unlock()
 
         // Send the header
         s.controlHdr.encode(typeWindowUpdate, flags, s.id, delta)
@@ -392,16 +403,18 @@ func (s *Stream) readData(hdr header, flags uint16, conn io.Reader) error {
         if length == 0 {
                 return nil
         }
-        if remain := atomic.LoadUint32(&s.recvWindow); length > remain {
-                s.session.logger.Printf("[ERR] yamux: receive window exceeded (stream: %d, remain: %d, recv: %d)", s.id, remain, length)
-                return ErrRecvWindowExceeded
-        }
 
         // Wrap in a limited reader
         conn = &io.LimitedReader{R: conn, N: int64(length)}
 
         // Copy into buffer
         s.recvLock.Lock()
+
+        if length > s.recvWindow {
+                s.session.logger.Printf("[ERR] yamux: receive window exceeded (stream: %d, remain: %d, recv: %d)", s.id, s.recvWindow, length)
+                return ErrRecvWindowExceeded
+        }
+
         if s.recvBuf == nil {
                 // Allocate the receive buffer just-in-time to fit the full data frame.
                 // This way we can read in the whole packet without further allocations.
@@ -414,7 +427,7 @@ func (s *Stream) readData(hdr header, flags uint16, conn io.Reader) error {
         }
 
         // Decrement the receive window
-        atomic.AddUint32(&s.recvWindow, ^uint32(length-1))
+        s.recvWindow -= length
         s.recvLock.Unlock()
 
         // Unblock any readers
@@ -435,13 +448,13 @@ func (s *Stream) SetDeadline(t time.Time) error {
 
 // SetReadDeadline sets the deadline for future Read calls.
 func (s *Stream) SetReadDeadline(t time.Time) error {
-        s.readDeadline = t
+        s.readDeadline.Store(t)
         return nil
 }
 
 // SetWriteDeadline sets the deadline for future Write calls
 func (s *Stream) SetWriteDeadline(t time.Time) error {
-        s.writeDeadline = t
+        s.writeDeadline.Store(t)
         return nil
 }
 
diff --git a/vendor/github.com/hashicorp/yamux/util.go b/vendor/github.com/hashicorp/yamux/util.go
index 5fe45af..8a73e92 100644
--- a/vendor/github.com/hashicorp/yamux/util.go
+++ b/vendor/github.com/hashicorp/yamux/util.go
@@ -1,5 +1,20 @@
 package yamux
 
+import (
+        "sync"
+        "time"
+)
+
+var (
+        timerPool = &sync.Pool{
+                New: func() interface{} {
+                        timer := time.NewTimer(time.Hour * 1e6)
+                        timer.Stop()
+                        return timer
+                },
+        }
+)
+
 // asyncSendErr is used to try an async send of an error
 func asyncSendErr(ch chan error, err error) {
         if ch == nil {